diff --git a/.env.example b/.env.example
index c741ba39c6..60b5074e6e 100644
--- a/.env.example
+++ b/.env.example
@@ -84,10 +84,14 @@ PORT=20128
 # API_HOST=0.0.0.0
 # DASHBOARD_PORT=20128
 
+# Connection backpressure: cap concurrent in-flight chat connections (503 + Retry-After when full).
+# Used by: src/sse/utils/backpressure.ts — disabled when unset/0.
+# OMNI_MAX_CONCURRENT_CONNECTIONS=0
+
 # Port for the real-time WebSocket live monitoring server.
 # Used by: src/server/ws/liveServer.ts, src/app/api/v1/ws/route.ts
-# Default: 20129
-# LIVE_WS_PORT=20129
+# Default: 20132
+# LIVE_WS_PORT=20132
 
 # Bind address for the live WebSocket server.
 # Default: 127.0.0.1 (loopback only). Set to 0.0.0.0 to expose on LAN —
@@ -112,16 +116,14 @@ PORT=20128
 
 # Public URL for the live dashboard WebSocket (client-side, browser only).
 # Set this when fronting the WS server with a reverse proxy or Cloudflare Tunnel.
-# The browser will connect to this URL instead of ws://hostname:20129.
-# The /live-ws path is already proxied from the main app (port 20128) to the
-# live WS server (port 20129) by scripts/dev/standalone-server-ws.mjs.
-# Used by: src/hooks/useLiveDashboard.ts
+# The browser will connect to this URL instead of ws://hostname:20132.
+# The path portion of this URL (e.g. ws://localhost:20132/live-ws -> /live-ws) is also used by the dev proxy
+# (scripts/dev/standalone-server-ws.mjs) and the handshake response to route
+# WebSocket upgrades. Default path: /live-ws.
+# Used by: src/hooks/useLiveDashboard.ts, src/app/api/v1/ws/route.ts,
+# scripts/dev/standalone-server-ws.mjs, and scripts/start-ws-server.mjs.
 # Example: NEXT_PUBLIC_LIVE_WS_PUBLIC_URL=wss://ws.my-ai.com/live-ws
-# NEXT_PUBLIC_LIVE_WS_PUBLIC_URL=
-
-# Disable the standalone live WebSocket helper used by scripts/start-ws-server.mjs.
-# Used by: scripts/start-ws-server.mjs (CI/embedded harness toggle).
-# OMNIROUTE_DISABLE_LIVE_WS=0
+# NEXT_PUBLIC_LIVE_WS_PUBLIC_URL=ws://localhost:20132/live-ws
 
 # Enable the real-time dashboard WebSocket server.
 # Used by: src/server/ws/liveServer.ts, scripts/start-ws-server.mjs
@@ -174,6 +176,12 @@ OMNIROUTE_USE_TURBOPACK=1
 # hints in production logs.
 # OMNIROUTE_PROXY_FETCH_DEBUG=true
 
+# Set to any non-empty value to emit `[omniroute completion]` diagnostics from
+# the CLI shell-completion cache paths (read/refresh/write) in
+# bin/cli/commands/completion.mjs. Off by default — these caches fail silently
+# so a missing/corrupt cache never breaks tab-completion.
+# OMNIROUTE_DEBUG_COMPLETION=1
+
 # Docker production port mappings (docker-compose.prod.yml only).
 # These set the HOST-side published ports. Container ports use PORT/API_PORT.
 # PROD_DASHBOARD_PORT=20130
@@ -191,9 +199,9 @@ OMNIROUTE_USE_TURBOPACK=1
 # the machine name by bash/zsh. The .env loader cannot override it (first-wins
 # semantics). Use OMNIROUTE_SERVER_HOST instead for `omniroute serve`.
 # See: https://github.com/diegosouzapw/OmniRoute/issues/6194
-#HOST=0.0.0.0
-#HOSTNAME=127.0.0.1
-#OMNIROUTE_SERVER_HOST=0.0.0.0
+# HOST=0.0.0.0
+# HOSTNAME=127.0.0.1
+# OMNIROUTE_SERVER_HOST=0.0.0.0
 
 # Environment mode — affects Next.js behavior, logging verbosity, and caching.
 # Values: production | development  |  Default: production
@@ -205,6 +213,17 @@ NODE_ENV=production
 # gives the correct fix instructions (podman unshare chown vs sudo chown).
 CONTAINER_HOST=docker
 
+# Container runtime override for skill sandboxing.
+# Used by: src/lib/skills/sandbox.ts + src/lib/skills/containerProvider.ts
+# Values: auto | docker | apple | wsl | orbstack | podman
+# - auto:    OS-aware auto-detect (apple/orbstack on macOS, wsl on Windows, podman on Linux)
+# - apple:   Apple Container (native OCI on macOS 26+)
+# - wsl:     WSL Container CLI (wslc.exe on Windows)
+# - orbstack: OrbStack (high-perf Linux VM + docker shim on macOS)
+# - podman:  Podman (rootless, daemonless)
+# - docker:  Docker (default fallback)
+SKILLS_SANDBOX_RUNTIME=auto
+
 # ═══════════════════════════════════════════════════════════════════════════════
 # 4. SECURITY & AUTHENTICATION
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -966,7 +985,7 @@ GITHUB_OAUTH_CLIENT_ID=Iv1.b507a08c87ecfe98
 # Used by: open-sse/executors/base.ts — buildHeaders() dynamic lookup.
 # Update these when providers release new CLI versions to avoid blocks.
 
-CLAUDE_USER_AGENT="claude-cli/2.1.195 (external, cli)"
+CLAUDE_USER_AGENT="claude-cli/2.1.207 (external, cli)"
 
 # Disable the deterministic tool-name cloak applied on both Anthropic-bound paths
 # (executors/base.ts native OAuth + executors/cliproxyapi.ts CLIProxyAPI) —
@@ -975,7 +994,7 @@ CLAUDE_USER_AGENT="claude-cli/2.1.195 (external, cli)"
 # stream with a misleading 400 out-of-extra-usage placeholder. Set to true to
 # forward the original names verbatim (debugging only).
 # CLAUDE_DISABLE_TOOL_NAME_CLOAK=false
-CODEX_USER_AGENT="codex-cli/0.142.0 (Windows 10.0.26200; x64)"
+CODEX_USER_AGENT="codex-cli/0.144.1 (Windows 10.0.26200; x64)"
 GITHUB_USER_AGENT="GitHubCopilotChat/0.54.0"
 ANTIGRAVITY_USER_AGENT="antigravity/2.0.1 linux/arm64 google-api-nodejs-client/10.3.0"
 KIRO_USER_AGENT="AWS-SDK-JS/3.0.0 kiro-ide/1.0.0"
@@ -996,7 +1015,7 @@ CURSOR_USER_AGENT="Cursor/3.4"
 
 # Override Codex client version sent in headers independently of the
 # CODEX_USER_AGENT string. Used by: open-sse/config/codexClient.ts.
-# CODEX_CLIENT_VERSION=0.142.0
+# CODEX_CLIENT_VERSION=0.144.1
 
 # Kill-switch to strip non-standard `codex.*` SSE events (e.g. codex.rate_limits)
 # from the Codex Responses stream. These frames break the OpenAI SDK's
@@ -1512,6 +1531,11 @@ APP_LOG_TO_FILE=true
 # Timeout for fast-fail health checks (ms).  Default: 2000
 # PROXY_FAST_FAIL_TIMEOUT_MS=2000
 
+# Time window (hours) for calculating the average latency of candidate proxies
+# in the latency-optimized pool strategy.  Default: 3
+# Used by: src/lib/db/proxies.ts
+# PROXY_LATENCY_WINDOW_HOURS=3
+
 # Health check result cache TTL (ms).  Default: 30000 (30s)
 # PROXY_HEALTH_CACHE_TTL_MS=30000
 
@@ -1630,10 +1654,19 @@ APP_LOG_TO_FILE=true
 # Used by: open-sse/utils/cursorImages.ts.
 # CURSOR_IMAGE_FETCH_TIMEOUT_MS=15000
 
-# Cursor state DB path override (for cursor version detection).
+# Cursor state DB path override (for IDE cursor version detection).
 # Used by: open-sse/utils/cursorVersionDetector.ts. Default: probed automatically.
 # CURSOR_STATE_DB_PATH=
 
+# Cursor Agent CLI build id for AgentService/Run impersonation (YYYY.MM.DD-<hash>).
+# Used by: open-sse/utils/cursorAgentCliVersion.ts. Default: detect local install, else pin.
+# CURSOR_AGENT_CLI_VERSION=2026.07.08-0c04a8a
+
+# Cursor Agent CLI data directory override (versions live under <dir>/versions/).
+# Used by: open-sse/utils/cursorAgentCliVersion.ts. Default: ~/.local/share/cursor-agent (unix)
+# or %LOCALAPPDATA%\cursor-agent (win32). Official agent CLI also honors this var.
+# CURSOR_DATA_DIR=
+
 # Direct Cursor bearer token used by scripts/ad-hoc/cursor-tap.cjs (developer tooling).
 # CURSOR_TOKEN=
 
@@ -1815,6 +1848,15 @@ APP_LOG_TO_FILE=true
 # SKILLS_SANDBOX_NETWORK_ENABLED=0
 # SKILLS_ALLOWED_SANDBOX_IMAGES=
 
+# Container runtime used by the skill sandbox. Accepted values:
+#   auto     — pick the best installed runtime per host OS (default)
+#   docker   — Docker Engine / Docker Desktop
+#   apple    — Apple Container (macOS native, micro-VM)
+#   wsl      — WSL Container (Windows native via wslc.exe)
+#   orbstack — OrbStack (high-perf Linux VM + docker shim on macOS)
+#   podman   — Podman (rootless, daemonless)
+# SKILLS_SANDBOX_RUNTIME=auto
+
 # ═══════════════════════════════════════════════════════════════════════════════
 # 25. TEST & E2E
 # ═══════════════════════════════════════════════════════════════════════════════
@@ -1860,7 +1902,7 @@ APP_LOG_TO_FILE=true
 # OMNIROUTE_TRANSLATION_API_URL=
 # Bearer token for the translation backend (NEVER commit a real key here).
 # OMNIROUTE_TRANSLATION_API_KEY=
-# Model id, e.g. gpt-4o-mini or cx/gpt-5.4-mini.
+# Model id, e.g. gpt-4o-mini or cx/gpt-5.6-sol.
 # OMNIROUTE_TRANSLATION_MODEL=gpt-4o-mini
 # Per-request timeout in milliseconds (default 60000).
 # OMNIROUTE_TRANSLATION_TIMEOUT_MS=60000
@@ -2068,3 +2110,24 @@ QUOTA_STORE_DRIVER=sqlite              # sqlite | redis
 # BIFROST_API_KEY=
 # BIFROST_STREAMING_ENABLED=true
 # BIFROST_TIMEOUT_MS=30000
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Account rotation config (operator-managed; consumed by open-sse/services/rotationConfig.ts)
+# Lets a supervising front-end mirror its rotation rules onto the backend's account-fallback
+# engine. All optional; defaults preserve the historical behavior.
+# ─────────────────────────────────────────────────────────────────────────────
+# OMNIROUTE_ROTATION_ENABLED=true
+# OMNIROUTE_ROTATION_RATE_LIMIT_RESET_SECONDS=0
+# OMNIROUTE_ROTATION_DISABLE_TAG_WITHOUT_RESET=true
+# OMNIROUTE_ROTATE_ON_429=true
+# OMNIROUTE_ROTATE_429_THRESHOLD=1
+# OMNIROUTE_ROTATE_429_WINDOW_SECONDS=120
+# OMNIROUTE_ROTATE_ON_500=true
+# OMNIROUTE_ROTATE_500_THRESHOLD=1
+# OMNIROUTE_ROTATE_500_WINDOW_SECONDS=120
+# OMNIROUTE_ROTATE_ON_502=true
+# OMNIROUTE_ROTATE_502_THRESHOLD=1
+# OMNIROUTE_ROTATE_502_WINDOW_SECONDS=120
+# OMNIROUTE_ROTATE_ON_400=false
+# OMNIROUTE_ROTATE_400_THRESHOLD=1
+# OMNIROUTE_ROTATE_400_WINDOW_SECONDS=120
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 706b6c22f9..2cdbc4dbd3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,12 +38,17 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.CI_NODE_VERSION }}
       - id: classify
         env:
           EVENT_NAME: ${{ github.event_name }}
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
+          # Single source of truth: scripts/quality/classify-pr-changes.mjs
+          # (unit-tested). Push/dispatch always enable every lane.
           if [ "$EVENT_NAME" != "pull_request" ]; then
             {
               echo "code=true"
@@ -54,51 +59,18 @@ jobs:
             exit 0
           fi
 
-          code=false
-          docs=false
-          i18n=false
-          workflow=false
-
           git diff --name-only "$BASE_SHA" "$HEAD_SHA" > changed-files.txt
-
-          while IFS= read -r file; do
-            case "$file" in
-              .github/workflows/*|.zizmor.yml)
-                workflow=true
-                code=true
-                ;;
-              docs/*|*.md)
-                docs=true
-                ;;
-              src/i18n/*|src/i18n/messages/*|scripts/i18n/*|config/i18n.json)
-                i18n=true
-                code=true
-                ;;
-              src/*|open-sse/*|bin/*|electron/*|tests/*|scripts/*|package.json|package-lock.json|tsconfig*.json|next.config.*|vitest*.config.*|playwright.config.*)
-                code=true
-                ;;
-              db/*|config/*)
-                code=true
-                ;;
-              *)
-                code=true
-                ;;
-            esac
-          done < changed-files.txt
-
-          {
-            echo "code=$code"
-            echo "docs=$docs"
-            echo "i18n=$i18n"
-            echo "workflow=$workflow"
-          } >> "$GITHUB_OUTPUT"
+          node scripts/quality/classify-pr-changes.mjs changed-files.txt >> "$GITHUB_OUTPUT"
 
   lint:
     name: Lint
     runs-on: ubuntu-latest
+    needs: changes
     # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
     # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
-    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
+    # Path filter: pure docs / pure message-catalog PRs skip the code lint bag + typecheck.
+    # Existence reason of this job is code regression; docs/i18n have dedicated jobs.
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
     env:
       # tsx gates below (known-symbols, route-guard-membership) import modules that
       # open SQLite on load; provide DB env so a fresh CI DB initializes cleanly.
@@ -116,7 +88,27 @@ jobs:
       - uses: ./.github/actions/npm-ci-retry
       - run: npm run check:node-runtime
       - run: npm run audit:deps
-      - run: npm run lint
+      - name: Restore ESLint file cache
+        uses: actions/cache@v6
+        with:
+          path: |
+            .eslintcache
+            .eslintcache-complexity
+          key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
+          restore-keys: |
+            eslint-${{ runner.os }}-
+      # Single ESLint inventory (JSON) — quality-gate reuses the artifact instead of
+      # a second cold full-tree pass for eslintWarnings ratchet counts.
+      - name: ESLint (JSON report)
+        run: npm run lint:json
+      - name: Upload ESLint results
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: eslint-results
+          path: .artifacts/eslint-results.json
+          if-no-files-found: warn
+          retention-days: 7
       - run: npm run check:cycles
       - run: npm run check:route-validation:t06
       - run: npm run check:any-budget:t11
@@ -137,16 +129,16 @@ jobs:
       # check:docs-sync is run by the docs-sync-strict job (via check:docs-all) and the
       # husky pre-commit hook; the standalone copy here was redundant (ROI dedup).
       - run: npm run typecheck:core
-      # typecheck:noimplicit:core is a forward-looking gate (noImplicitAny).
-      # Run informationally for now — many pre-existing call sites still need
-      # explicit annotations; track in a dedicated follow-up.
-      - run: npm run typecheck:noimplicit:core
-        continue-on-error: true
+      # typecheck:noimplicit:core dropped from this job (2026-07 optimize):
+      # it was advisory (continue-on-error) and largely subsumed by the blocking
+      # check:type-coverage ratchet in quality-gate. Local: npm run typecheck:noimplicit:core.
 
   quality-gate:
     name: Quality Ratchet
     runs-on: ubuntu-latest
-    needs: test-coverage
+    # needs lint so eslint-results artifact is available (same inventory as the
+    # blocking lint step). Allow lint failure so other ratchets still run.
+    needs: [changes, test-coverage, lint]
     # Run even when test-coverage was SKIPPED/FAILED (e.g. a single flaky Coverage
     # Shard breaks the shard→coverage→ratchet chain). The DETERMINISTIC ratchets
     # (eslint / complexity / cognitive-complexity / duplication / codeql) do NOT need
@@ -155,7 +147,8 @@ jobs:
     # release PR #4854, where the drift cascade only surfaced post-merge in #5029).
     # The coverage.* metrics degrade gracefully: the download is continue-on-error and
     # the ratchet runs with --allow-missing, so absent coverage is skipped, not failed.
-    if: ${{ !cancelled() && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
+    # Path filter: code-only — pure docs/i18n PRs have nothing for these ratchets to guard.
+    if: ${{ !cancelled() && (github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true' && (needs.lint.result == 'success' || needs.lint.result == 'failure'))) }}
     # security-events: read lets the CodeQL ratchet read open code-scanning alerts
     # via `gh api .../code-scanning/alerts`. contents: read keeps checkout working.
     permissions:
@@ -170,6 +163,15 @@ jobs:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
       - uses: ./.github/actions/npm-ci-retry
+      - name: Restore ESLint file cache
+        uses: actions/cache@v6
+        with:
+          path: |
+            .eslintcache
+            .eslintcache-complexity
+          key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
+          restore-keys: |
+            eslint-${{ runner.os }}-
       # Coverage mergeada (coverage-summary.json) p/ o ratchet de cobertura.
       # continue-on-error: o artifact pode não existir se a job test-coverage foi
       # SKIPPED (shard flaky). Nesse caso collect-metrics pula coverage.* (ausente sem
@@ -180,6 +182,13 @@ jobs:
         with:
           name: coverage-report
           path: coverage/
+      # Prefer lint job's ESLint JSON (one inventory, two consumers).
+      - name: Download ESLint results
+        continue-on-error: true
+        uses: actions/download-artifact@v8
+        with:
+          name: eslint-results
+          path: .artifacts/
       - run: npm run quality:collect
       # Catraca: falha se qualquer métrica regredir vs quality-baseline.json (commitado).
       # Hoje: contagem de warnings do ESLint. Fase 4 estende com cobertura (lida do
@@ -201,15 +210,13 @@ jobs:
       # para não pesar no caminho crítico do lint.
       - name: Duplication ratchet
         run: npm run check:duplication
-      - name: Complexity ratchet
-        run: npm run check:complexity
-      # Fase 7 INT: dead-code, cognitive-complexity, type-coverage promovidos de
-      # advisory (quality-extended) para BLOQUEANTES aqui. Os 3 leem seus baseline
-      # de quality-baseline.json e saem 1 em regressão.
+      # Complexity + cognitive: one ESLint walk, two independent baselines (by ruleId).
+      - name: Complexity + cognitive ratchets
+        run: npm run check:complexity-ratchets
+      # Fase 7 INT: dead-code, type-coverage promovidos de advisory (quality-extended)
+      # para BLOQUEANTES aqui. cognitive-complexity is folded into the step above.
       - name: Dead-code ratchet (knip)
         run: npm run check:dead-code
-      - name: Cognitive complexity ratchet (sonarjs)
-        run: npm run check:cognitive-complexity
       - name: Type coverage ratchet
         run: npm run check:type-coverage
       - name: Compression budget ratchet (F2.4 / N4)
@@ -247,9 +254,11 @@ jobs:
   quality-extended:
     name: Quality Gates (Extended)
     runs-on: ubuntu-latest
+    needs: changes
     # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
     # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
-    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
+    # Path filter: code-only (scanners/ratchets target production surface).
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
     steps:
       # fetch-depth: 0 — the OpenAPI breaking-change gate (oasdiff) reads the base
       # spec via `git show <base_ref>:docs/openapi.yaml`; a shallow clone
@@ -357,9 +366,11 @@ jobs:
   docs-sync-strict:
     name: Docs Sync (Strict)
     runs-on: ubuntu-latest
+    needs: changes
     # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
     # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
-    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
+    # Run when docs OR code change: API/route code can break doc/OpenAPI contract gates.
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && (needs.changes.outputs.docs == 'true' || needs.changes.outputs.code == 'true')) }}
     steps:
       - uses: actions/checkout@v7
         with:
@@ -379,19 +390,20 @@ jobs:
         run: npm run check:openapi-coverage
       - name: OpenAPI security-tier consistency (advisory)
         run: npm run check:openapi-security-tiers
-      - name: OpenAPI spec paths resolve to real routes (anti-hallucination)
-        run: npm run check:openapi-routes
-      - name: Doc /api refs resolve to real routes (anti-hallucination)
-        run: npm run check:docs-symbols
+      # One FS inventory of src/app/api for both anti-hallucination directions.
+      - name: API docs refs (openapi + prose → routes)
+        run: npm run check:api-docs-refs
       - name: i18n translation drift (warn)
         run: node scripts/i18n/check-translation-drift.mjs --warn
 
   docs-lint:
     name: Docs Lint (prose — advisory)
     runs-on: ubuntu-latest
+    needs: changes
     # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
     # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
-    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
+    # Prose/markdown only — skip when the PR has no doc surface.
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.docs == 'true') }}
     # Advisory (warning-first): prose/markdown style must not block merges while the
     # existing doc corpus is brought up to style. Promote to blocking once it converges.
     continue-on-error: true
@@ -418,9 +430,11 @@ jobs:
   i18n-ui-coverage:
     name: i18n UI Coverage
     runs-on: ubuntu-latest
+    needs: changes
     # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
     # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
-    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
+    # UI keys move with dashboard code OR message catalogs.
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && (needs.changes.outputs.i18n == 'true' || needs.changes.outputs.code == 'true')) }}
     steps:
       - uses: actions/checkout@v7
         with:
@@ -440,9 +454,11 @@ jobs:
   i18n:
     name: i18n Validation (all languages)
     runs-on: ubuntu-latest
+    needs: changes
     # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam
     # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados).
-    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
+    # Message-catalog / i18n-tooling only — pure code without i18n surface skips this lane.
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.i18n == 'true') }}
     continue-on-error: true
     steps:
       - uses: actions/checkout@v7
@@ -961,7 +977,7 @@ jobs:
       - uses: ./.github/actions/npm-ci-retry
       - run: npm run check:node-runtime
       - name: Cache Playwright browsers
-        uses: actions/cache@v6.1.0
+        uses: actions/cache@v6
         with:
           path: ~/.cache/ms-playwright
           key: playwright-chromium-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d0d262dfe9..e47f93b3f6 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -22,10 +22,10 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: javascript-typescript
           queries: security-extended
-      - uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           category: "/language:javascript-typescript"
diff --git a/.github/workflows/electron-release.yml b/.github/workflows/electron-release.yml
index b225342a4e..b86cd50f69 100644
--- a/.github/workflows/electron-release.yml
+++ b/.github/workflows/electron-release.yml
@@ -201,6 +201,12 @@ jobs:
               [ -f "$file" ] && cp "$file" "../../release-assets/OmniRoute.exe" && break
             done
           fi
+          # electron-updater manifests (latest.yml / latest-mac.yml / latest-linux.yml)
+          # must be published alongside the installers, or autoUpdater fails with
+          # "Cannot find latest.yml in the latest release artifacts" (#6766).
+          for file in latest*.yml; do
+            [ -f "$file" ] && cp "$file" ../../release-assets/
+          done
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v7
@@ -263,6 +269,7 @@ jobs:
             release-assets/*.AppImage
             release-assets/*.deb
             release-assets/*.blockmap
+            release-assets/*.yml
             release-assets/*.source.tar.gz
             release-assets/*.source.zip
         env:
diff --git a/.github/workflows/nightly-release-green.yml b/.github/workflows/nightly-release-green.yml
index 81c599a7a9..0ba8e9301d 100644
--- a/.github/workflows/nightly-release-green.yml
+++ b/.github/workflows/nightly-release-green.yml
@@ -97,7 +97,12 @@ jobs:
           set +e
           # --hermetic: scrub live-test trigger vars (self-hosted runner may carry
           # operator env; hosted ignores the unknown flag before #6300 lands).
-          node scripts/quality/validate-release-green.mjs --json --with-build --hermetic \
+          # --full-ci: ALSO run every static gate from ci.yml's gate jobs (lint,
+          # quality-gate, quality-extended, docs-sync-strict, pr-test-policy). PRs into
+          # release/** only get the fast-gates, so these accrue silently and explode in
+          # layers on the release PR (v3.8.46: 11 static base-reds leaked). Running them
+          # nightly opens the tracking issue the moment one lands, not at release time.
+          node scripts/quality/validate-release-green.mjs --json --with-build --hermetic --full-ci \
             1> release-green.json 2> release-green.log
           echo "exit=$?" >> "$GITHUB_OUTPUT"
           echo "------- report -------"
@@ -137,7 +142,7 @@ jobs:
 
       - name: Upload report artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: release-green-report
           path: |
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index f5c0aa9967..f6cdbe4d98 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -21,9 +21,73 @@ env:
   CI_NODE_VERSION: "24"
 
 jobs:
+  # Same classifier as ci.yml (scripts/quality/classify-pr-changes.mjs) so PR→release
+  # path filters share existence reasons: code / docs / i18n / workflow.
+  changes:
+    name: Change Classification
+    runs-on: ubuntu-latest
+    outputs:
+      code: ${{ steps.classify.outputs.code }}
+      docs: ${{ steps.classify.outputs.docs }}
+      i18n: ${{ steps.classify.outputs.i18n }}
+      workflow: ${{ steps.classify.outputs.workflow }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.CI_NODE_VERSION }}
+      - id: classify
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          if [ "$EVENT_NAME" != "pull_request" ]; then
+            {
+              echo "code=true"
+              echo "docs=true"
+              echo "i18n=true"
+              echo "workflow=true"
+            } >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          git diff --name-only "$BASE_SHA" "$HEAD_SHA" > changed-files.txt
+          node scripts/quality/classify-pr-changes.mjs changed-files.txt >> "$GITHUB_OUTPUT"
+
+  # Docs/OpenAPI contract gates only — existence reason is doc accuracy + route refs.
+  # Split out of fast-gates so pure-docs PRs skip typecheck/unit while still validating docs.
+  docs-gates:
+    name: Docs Gates (fast-path)
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && (needs.changes.outputs.docs == 'true' || needs.changes.outputs.code == 'true')) }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.CI_NODE_VERSION }}
+          cache: npm
+      - run: npm ci
+      # One walk of src/app/api for openapi-routes + docs-symbols (both still fail independently).
+      - run: npm run check:api-docs-refs
+      - name: Docs accuracy (fabricated-docs + i18n mirrors, strict)
+        run: npm run check:docs-all
+
   fast-gates:
     name: Fast Quality Gates
-    runs-on: ubuntu-latest
+    needs: changes
+    # Code surface only — pure docs/i18n PRs skip this bag (docs-gates covers docs).
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
+    # Dynamic runner (same rule as ci.yml): use the self-hosted VPS pool only when the
+    # release captain has USE_VPS_RUNNER=true AND this is not a fork PR (own-origin
+    # branches only — a fork PR must never execute on the LAN runner). Var unset/false
+    # or a fork PR falls back to ubuntu-latest, so this is inert until the flag flips.
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     # tsx gates (known-symbols, route-guard-membership) import modules that open
     # SQLite on load; provide DB env so a fresh CI DB initializes cleanly.
     env:
@@ -40,12 +104,18 @@ jobs:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
       - run: npm ci
+      - name: Restore ESLint file cache
+        uses: actions/cache@v6
+        with:
+          path: |
+            .eslintcache
+            .eslintcache-complexity
+          key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
+          restore-keys: |
+            eslint-${{ runner.os }}-
       - run: npm run check:provider-consistency
       - run: npm run check:fetch-targets
-      - run: npm run check:openapi-routes
-      - run: npm run check:docs-symbols
-      - name: Docs accuracy (fabricated-docs + i18n mirrors, strict)
-        run: npm run check:docs-all
+      # docs-all / openapi-routes / docs-symbols live in docs-gates (path-filtered).
       - run: npm run check:deps
       - run: npm run check:file-size
       - run: npm run check:error-helper
@@ -68,25 +138,21 @@ jobs:
       # leaking into the npm tarball (v3.8.36: 6 ops bin/*.sh) per-PR instead of only on
       # the release PR's heavy Package Artifact job.
       - run: npm run check:pack-policy
-      # Complexity + cognitive-complexity ratchets on the fast-path (PR→release) so
-      # cycle drift is rebaselined PER-PR instead of cascading onto the release PR's
-      # Quality Ratchet (v3.8.36: +30 complexity / +15 cognitive surfaced only post-merge).
-      - run: npm run check:complexity
-      - run: npm run check:cognitive-complexity
+      # Complexity + cognitive-complexity: ONE ESLint walk (both baselines still
+      # enforced separately by ruleId). Avoids two cold tree walks on fast-path.
+      - run: npm run check:complexity-ratchets
       - name: Typecheck (core)
         run: npm run typecheck:core
       # TIA: build the impact map at runtime (gitignored, ~21MB) and run only the
-      # unit tests impacted by this PR's changed files. Fail-safe runs the FULL
-      # unit suite on hub/unmapped changes — TIA accelerates, never replaces, the net.
+      # unit tests impacted by this PR's changed files. On hub/unmapped changes the
+      # selector returns __RUN_ALL__ — full-suite authority is the parallel
+      # `fast-unit` 4-shard job (test:unit:ci:shard; was 2-shard, #6781), NOT an
+      # unsharded re-run here. Stacking unsharded test:unit:ci on top of fast-unit
+      # doubled wall time (~16 min extra on ubuntu-latest) without extra coverage.
       #
-      # BLOCKING (flipped 2026-06-17). The pre-existing release unit test-debt that kept
-      # this advisory was cleared: #4030 (16 Zod/registry reds, lossless restore) and
-      # #4063 (the last red — the LiveWS boot test — root-caused as a real event-loop
-      # stall in the WS sidecar, fixed + relocated to the integration suite). A full
-      # ci.yml run on release/v3.8.28 then showed all 8 unit shards green, so PR->release
-      # now blocks on unit-test regressions in the impacted set (typecheck:core already
-      # blocked above). Fail-safe still runs the FULL unit suite on hub/unmapped changes.
-      - name: Impacted unit tests (TIA, fail-safe full; blocking)
+      # BLOCKING for the *impacted subset* (flipped 2026-06-17). Fail-safe full
+      # coverage remains required via `Unit Tests fast-path` (fast-unit).
+      - name: Impacted unit tests (TIA subset; blocking)
         env:
           GITHUB_BASE_REF: ${{ github.base_ref }}
         run: |
@@ -100,15 +166,39 @@ jobs:
           # which must not happen on a blocking gate. DATA_DIR isolation keeps the parallel
           # run race-free regardless of concurrency.
           if echo "$SEL" | grep -q "__RUN_ALL__"; then
-            echo "Fail-safe: running FULL unit suite (CI concurrency)"; npm run test:unit:ci; exit $?
+            echo "Fail-safe: __RUN_ALL__ — deferring FULL unit suite to fast-unit (4-shard)."
+            echo "Not re-running unsharded test:unit:ci here (duplicate of fast-unit coverage)."
+            exit 0
           fi
           echo "Running impacted tests:"; echo "$SEL"
           mapfile -t FILES <<< "$SEL"
-          node --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 "${FILES[@]}"
+          # Loader parity with test:unit:ci:shard (#6787): tests/unit/dashboard/** runs
+          # under `--import tsx` (CJS transform — required for ESM-only deep imports like
+          # @lobehub/icons/es/* reached via lobeProviderIcons.ts); everything else under
+          # `--import tsx/esm`. A single tsx/esm invocation false-reds every dashboard
+          # module-shape test the impact map selects ("Unexpected token 'export'").
+          DASH=(); REST=()
+          for f in "${FILES[@]}"; do
+            case "$f" in
+              tests/unit/dashboard/*) DASH+=("$f") ;;
+              *) REST+=("$f") ;;
+            esac
+          done
+          RC=0
+          if [ ${#REST[@]} -gt 0 ]; then
+            node --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 "${REST[@]}" || RC=$?
+          fi
+          if [ ${#DASH[@]} -gt 0 ]; then
+            node --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 "${DASH[@]}" || RC=$?
+          fi
+          exit $RC
 
   fast-vitest:
     name: Vitest (fast-path)
-    runs-on: ubuntu-latest
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
+    # Dynamic runner — see fast-gates (own-origin + flag; fork/unset → ubuntu-latest).
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     env:
       JWT_SECRET: ci-lint-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-lint-api-key-secret-long
@@ -125,12 +215,19 @@ jobs:
       - run: npm run test:vitest
 
   fast-unit:
-    name: Unit Tests fast-path (${{ matrix.shard }}/2)
-    runs-on: ubuntu-latest
+    name: Unit Tests fast-path (${{ matrix.shard }}/4)
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
+    # Dynamic runner — see fast-gates (own-origin + flag; fork/unset → ubuntu-latest).
+    # This is the heaviest fast-path job; 4-way sharding (was 2, #6781) halves the
+    # critical path again (~8.5min → ~4.5min on ubuntu-latest; ~2min on the 8-slot
+    # runner box). Node's native --test-shard=N/total takes any denominator — only
+    # this matrix and the TEST_SHARD env below encode the shard count.
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }}
     strategy:
       fail-fast: false
       matrix:
-        shard: [1, 2]
+        shard: [1, 2, 3, 4]
     env:
       JWT_SECRET: ci-lint-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-lint-api-key-secret-long
@@ -149,7 +246,7 @@ jobs:
       # silenciosamente não rodavam no fast path) e o setupPolyfill não era importado.
       - run: npm run test:unit:ci:shard
         env:
-          TEST_SHARD: ${{ matrix.shard }}/2
+          TEST_SHARD: ${{ matrix.shard }}/4
 
   # ── Pacote 4 (plano mestre testes+CI, aprovado 2026-07-04) ─────────────────────────
   # No-new-warnings por PR via ESLint bulk suppressions nativo (>=9.24). O baseline
@@ -165,6 +262,8 @@ jobs:
   # contribuidor NUNCA é bloqueado nem cobrado).
   lint-guard:
     name: No new ESLint warnings
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }}
     runs-on: ubuntu-latest
     continue-on-error: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true }}
     steps:
@@ -176,8 +275,18 @@ jobs:
           node-version: ${{ env.CI_NODE_VERSION }}
           cache: npm
       - run: npm ci
+      - name: Restore ESLint file cache
+        uses: actions/cache@v6
+        with:
+          path: |
+            .eslintcache
+            .eslintcache-complexity
+          key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
+          restore-keys: |
+            eslint-${{ runner.os }}-
       - name: ESLint (baseline congelado — warning novo = vermelho)
-        run: npx eslint . --suppressions-location config/quality/eslint-suppressions.json --max-warnings 0
+        # lint:json writes the report; --max-warnings 0 keeps no-new-warnings policy.
+        run: npm run lint:json -- --max-warnings 0
 
   # Merge-integrity: pega no PR os dois vazamentos crônicos de merge que hoje só
   # explodem na release-PR. (1) CHANGELOG-eat — o auto-resolve do merge come
@@ -192,6 +301,8 @@ jobs:
   # nunca é bloqueado.
   merge-integrity:
     name: Merge integrity (changelog + generated skills)
+    # Always on non-draft PRs — CHANGELOG/skills can break on docs-only merges too.
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     continue-on-error: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true }}
     env:
diff --git a/.gitignore b/.gitignore
index b2261dfff7..67d69b3d5d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -233,3 +233,12 @@ omniroute.md
 # mise configuration
 mise.toml
 _artifacts/
+.claude-flow/
+
+# ESLint file cache (npm run lint --cache / complexity ratchets)
+.eslintcache
+.eslintcache-complexity
+
+
+# CI/local quality artifacts (eslint-results.json, etc.)
+.artifacts/
diff --git a/.husky/pre-push b/.husky/pre-push
index 32b08fb504..6ac944236b 100755
--- a/.husky/pre-push
+++ b/.husky/pre-push
@@ -1,7 +1,9 @@
 #!/usr/bin/env sh
-# .husky/pre-push — fast deterministic gates (<10s total)
-# Intentionally excludes test:unit (slow; covered by CI pre-push remote run).
-# Activated: 2026-06-13 (6A.12 — replaced commented-out test:unit stub)
+# .husky/pre-push — intentionally light.
+# any-budget + tracked-artifacts already run on pre-commit; re-running them on
+# every push only doubles local wall time for the same existence reason (CI still
+# enforces both). Keep this hook as a PATH/npm sanity check + reminder.
+# Intentionally excludes test:unit / typecheck (slow; covered by CI).
 
 if ! command -v npm >/dev/null 2>&1; then
   echo "⚠️  npm not found in PATH — skipping pre-push hooks"
@@ -9,4 +11,5 @@ if ! command -v npm >/dev/null 2>&1; then
   exit 0
 fi
 
-npm run check:any-budget:t11 && npm run check:tracked-artifacts
+# No-op success: real local gates live in pre-commit; CI owns the rest.
+exit 0
diff --git a/.prettierignore b/.prettierignore
index b2256c1219..a0e473264e 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -1,2 +1,5 @@
 # Long reference tables are manually aligned; formatting the whole file causes noisy diffs.
 docs/reference/ENVIRONMENT.md
+
+# Dense auto-generated free-tier budget rows (one object per line) — prettier multi-line expand blows past file-size cap 800.
+open-sse/config/freeModelCatalog.data.ts
diff --git a/.vscode/settings.json b/.vscode/settings.json
index 261dc258aa..2f303c5a82 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -48,11 +48,19 @@
       "**/.build",
       "**/dist",
       "**/coverage",
-      "**/.worktrees"
+      "**/.worktrees",
+      "**/.claude/worktrees",
+      "**/electron",
+      "**/_references",
+      "**/_mono_repo",
+      "**/_tasks"
     ]
   },
 
   // Para esconder os diretórios gerados da árvore do Explorer, descomente:
+  // (MANTIDO comentado — o dono precisa ver _references/_mono_repo/_tasks na árvore.
+  //  A performance é resolvida por watcherExclude + search.exclude + tsserver, sem
+  //  precisar escondê-los do Explorer.)
   // "files.exclude": {
   //   "**/.worktrees": true,
   //   "**/coverage": true,
diff --git a/@omniroute/opencode-plugin/package.json b/@omniroute/opencode-plugin/package.json
index 491de78c16..717c101001 100644
--- a/@omniroute/opencode-plugin/package.json
+++ b/@omniroute/opencode-plugin/package.json
@@ -23,7 +23,7 @@
   "scripts": {
     "build": "tsup",
     "clean": "rm -rf dist",
-    "test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts",
+    "test": "node --import tsx/esm --test tests/scaffold.test.ts tests/auth.test.ts tests/options-schema.test.ts tests/multi-instance.test.ts tests/fetch-interceptor.test.ts tests/provider.test.ts tests/gemini-sanitize.test.ts tests/combos.test.ts tests/config-shim.test.ts tests/features.test.ts tests/usable-combo.test.ts tests/disk-snapshot-perms.test.ts tests/fork-features.test.ts tests/auto-combo-context.test.ts tests/provider-id-routing.test.ts",
     "prepublishOnly": "npm run clean && npm run build && npm test"
   },
   "keywords": [
diff --git a/@omniroute/opencode-plugin/src/index.ts b/@omniroute/opencode-plugin/src/index.ts
index d69383b087..cb154fb513 100644
--- a/@omniroute/opencode-plugin/src/index.ts
+++ b/@omniroute/opencode-plugin/src/index.ts
@@ -238,9 +238,26 @@ function trimLeadingDashes(value: string): string {
  */
 export function resolveOmniRoutePluginOptions(
   opts?: OmniRoutePluginOptions
-): Required<Pick<OmniRoutePluginOptions, "providerId" | "displayName" | "modelCacheTtl">> &
-  Pick<OmniRoutePluginOptions, "baseURL" | "features"> {
+): Required<
+  Pick<OmniRoutePluginOptions, "providerId" | "displayName" | "modelCacheTtl">
+> & {
+  /**
+   * #6859: the UNPREFIXED provider id ("omniroute", "omniroute-preprod", …).
+   * `providerId` above is auto-prefixed with "opencode-" ONLY to satisfy OC
+   * 1.17.8+'s native-adapter gate ({openai, anthropic, opencode*}) — that
+   * prefixed value is OC-internal and must be used ONLY for AuthHook.provider
+   * and provider-registration keys (the OC config-hook top-level
+   * `provider.<id>` block). `omnirouteProviderId` MUST be used everywhere an
+   * identifier reaches or represents something OmniRoute's own server parses
+   * (model `id` prefix, `ModelV2.providerID`, combo catalog keys in the
+   * dynamic provider hook) — OmniRoute's `parseModel()` has no alias for
+   * "opencode-<x>", so a prefixed id there is unrecoverable and credential
+   * lookup fails with "No credentials for opencode-<x>".
+   */
+  omnirouteProviderId: string;
+} & Pick<OmniRoutePluginOptions, "baseURL" | "features"> {
   const rawProviderId = opts?.providerId ?? OMNIROUTE_PROVIDER_KEY;
+  const omnirouteProviderId = trimLeadingOpencodePrefix(rawProviderId);
   // OC 1.17.8+ native-adapter gate rejects providerID not in
   // {openai, anthropic, opencode*}. Silently prefix so existing
   // configs (providerId: "omniroute") keep working.
@@ -258,6 +275,7 @@ export function resolveOmniRoutePluginOptions(
       : DEFAULT_MODEL_CACHE_TTL_MS;
   return {
     providerId,
+    omnirouteProviderId,
     displayName,
     modelCacheTtl,
     baseURL: opts?.baseURL,
@@ -265,6 +283,18 @@ export function resolveOmniRoutePluginOptions(
   };
 }
 
+/**
+ * Strip a leading "opencode-" prefix (added only for the OC native-adapter
+ * gate — see `resolveOmniRoutePluginOptions`) so the returned id is safe to
+ * embed in anything OmniRoute's own server parses. A user-supplied
+ * `providerId: "opencode-omniroute"` (already prefixed) resolves to the same
+ * unprefixed "omniroute" as the default, matching `providerId`'s own
+ * idempotent-prefix handling above.
+ */
+function trimLeadingOpencodePrefix(rawProviderId: string): string {
+  return rawProviderId.startsWith("opencode-") ? rawProviderId.slice("opencode-".length) : rawProviderId;
+}
+
 /**
  * Strict parse of raw plugin options (as received from opencode.json or a
  * direct factory call) into the validated `OmniRoutePluginOptions` shape.
@@ -2661,7 +2691,8 @@ export function createOmniRouteProviderHook(
         if (canonicalDedup.has(entry.id)) continue;
         if (usable && !isUsableRawModelId(entry.id, usable, rawEnrichment)) continue;
         const model = mapRawModelToModelV2(entry, {
-          providerId: resolved.providerId,
+          // #6859: server-facing id — NOT the OC-gate-prefixed `resolved.providerId`.
+          providerId: resolved.omnirouteProviderId,
           baseURL,
           apiFormat: resolved.features?.apiFormat,
         });
@@ -2826,7 +2857,8 @@ export function createOmniRouteProviderHook(
           const mapped = mapComboToModelV2(
             combo,
             memberEntries,
-            resolved.providerId,
+            // #6859: server-facing id — NOT the OC-gate-prefixed `resolved.providerId`.
+            resolved.omnirouteProviderId,
             baseURL,
             features.apiFormat
           );
@@ -2845,7 +2877,8 @@ export function createOmniRouteProviderHook(
             }
           }
 
-          const comboKey = buildComboKey(combo, usedComboKeys, resolved.providerId);
+          // #6859: server-facing key — NOT the OC-gate-prefixed `resolved.providerId`.
+          const comboKey = buildComboKey(combo, usedComboKeys, resolved.omnirouteProviderId);
 
           // Collision policy: combos win. Warn ONCE per (cacheKey, comboKey)
           // when overwriting a same-key raw model so the operator can spot
@@ -2947,7 +2980,8 @@ export function createOmniRouteProviderHook(
             },
             status: "active",
             release_date: "",
-            providerID: resolved.providerId,
+            // #6859: server-facing id — NOT the OC-gate-prefixed `resolved.providerId`.
+            providerID: resolved.omnirouteProviderId,
             options: {},
             headers: {},
           };
diff --git a/@omniroute/opencode-plugin/tests/combos.test.ts b/@omniroute/opencode-plugin/tests/combos.test.ts
index 04102c0055..ff209a9a67 100644
--- a/@omniroute/opencode-plugin/tests/combos.test.ts
+++ b/@omniroute/opencode-plugin/tests/combos.test.ts
@@ -447,14 +447,14 @@ test("models() returns combo entries merged into the map", async () => {
 
   // 3 raw models + 1 combo = 4 entries
   assert.equal(Object.keys(out).length, 4);
-  assert.ok(out["opencode-omniroute/claude-primary"]);
-  assert.ok(out["opencode-omniroute/claude-secondary"]);
-  assert.ok(out["opencode-omniroute/gemini-3-flash"]);
-  assert.ok(out["opencode-omniroute/claude-tier"]);
+  assert.ok(out["omniroute/claude-primary"]);
+  assert.ok(out["omniroute/claude-secondary"]);
+  assert.ok(out["omniroute/gemini-3-flash"]);
+  assert.ok(out["omniroute/claude-tier"]);
 
-  const combo = out["opencode-omniroute/claude-tier"];
+  const combo = out["omniroute/claude-tier"];
   assert.equal(combo.name, "Claude Tier");
-  assert.equal(combo.providerID, "opencode-omniroute");
+  assert.equal(combo.providerID, "omniroute");
   // LCD over claude-primary (200k, reasoning) + claude-secondary (100k, no reasoning)
   assert.equal(combo.limit.context, 100_000);
   assert.equal(combo.capabilities.reasoning, false);
@@ -478,11 +478,11 @@ test("models(): combo with unknown member ids degrades to all-false LCD posture"
     { fetcher: modelsFetcher, combosFetcher }
   );
   const out = await hook.models!({} as never, { auth: apiAuth("sk-z") as never });
-  assert.ok(out["opencode-omniroute/phantom-combo"]);
+  assert.ok(out["omniroute/phantom-combo"]);
   // With zero resolvable members, LCD = all-false (defensive posture).
-  assert.equal(out["opencode-omniroute/phantom-combo"].capabilities.toolcall, false);
-  assert.equal(out["opencode-omniroute/phantom-combo"].capabilities.reasoning, false);
-  assert.equal(out["opencode-omniroute/phantom-combo"].limit.context, 0);
+  assert.equal(out["omniroute/phantom-combo"].capabilities.toolcall, false);
+  assert.equal(out["omniroute/phantom-combo"].capabilities.reasoning, false);
+  assert.equal(out["omniroute/phantom-combo"].limit.context, 0);
 });
 
 test("models(): hidden combos are excluded from the map", async () => {
@@ -505,8 +505,8 @@ test("models(): hidden combos are excluded from the map", async () => {
     { fetcher: modelsFetcher, combosFetcher }
   );
   const out = await hook.models!({} as never, { auth: apiAuth("sk-z") as never });
-  assert.ok(out["opencode-omniroute/visible"]);
-  assert.ok(!out["opencode-omniroute/hidden"], "hidden combo must be omitted");
+  assert.ok(out["omniroute/visible"]);
+  assert.ok(!out["omniroute/hidden"], "hidden combo must be omitted");
 });
 
 test("models(): combo name exactly matches raw model id → raw deleted, raw deleted, no warn", async () => {
@@ -530,8 +530,8 @@ test("models(): combo name exactly matches raw model id → raw deleted, raw del
   });
 
   // Raw model replaced by combo of the same key; combo now lives at the bare slug.
-  assert.ok(out["opencode-omniroute/claude-primary"], "combo surfaces under prefixed key");
-  assert.equal(out["opencode-omniroute/claude-primary"].name, "claude-primary");
+  assert.ok(out["omniroute/claude-primary"], "combo surfaces under prefixed key");
+  assert.equal(out["omniroute/claude-primary"].name, "claude-primary");
 
   // No collision warning fires — dedup makes keys disjoint.
   const collisionWarns = warnings.filter((w) => {
@@ -565,8 +565,8 @@ test("models(): two combos with same slug → second gets disambiguator suffix",
 
   const out = await hook.models!({} as never, { auth: apiAuth("sk-z") as never });
   // First combo gets the bare slug; second gets disambiguated.
-  assert.ok(out["opencode-omniroute/claude"], "first combo at prefixed slug");
-  assert.ok(out["opencode-omniroute/claude-uuid"], "second combo disambiguated by id prefix");
+  assert.ok(out["omniroute/claude"], "first combo at prefixed slug");
+  assert.ok(out["omniroute/claude-uuid"], "second combo disambiguated by id prefix");
 });
 
 test("models(): combos fetch fails → falls back to models-only, warn emitted, no throw", async () => {
@@ -583,8 +583,8 @@ test("models(): combos fetch fails → falls back to models-only, warn emitted,
 
   // Catalog includes the models but NOT any combo entries.
   assert.equal(Object.keys(out).length, 2);
-  assert.ok(out["opencode-omniroute/claude-primary"]);
-  assert.ok(out["opencode-omniroute/claude-secondary"]);
+  assert.ok(out["omniroute/claude-primary"]);
+  assert.ok(out["omniroute/claude-secondary"]);
 
   // Soft-fail warning surfaced.
   const softFail = warnings.find((w) => {
@@ -609,7 +609,7 @@ test("models(): combos cached + reused within TTL (one combo fetch per TTL windo
   const second = await hook.models!({} as never, { auth: apiAuth("sk-z") as never });
   assert.equal(combosFetcher.callCount(), 1, "combos fetched only once within TTL");
   assert.equal(modelsFetcher.callCount(), 1, "models fetched only once within TTL");
-  assert.ok(second["opencode-omniroute/claude-tier"]);
+  assert.ok(second["omniroute/claude-tier"]);
 });
 
 test("models(): combos refetched after TTL expiry (same key as models)", async () => {
@@ -701,7 +701,7 @@ test("models(): nested combo-ref context is the min of nested + raw members", as
     { fetcher: modelsFetcher, combosFetcher }
   );
   const out = await hook.models!({} as never, { auth: apiAuth("sk-z") as never });
-  const masterLight = out["opencode-omniroute/master-light"];
+  const masterLight = out["omniroute/master-light"];
   assert.ok(masterLight, "MASTER-LIGHT entry must exist");
   assert.equal(
     masterLight.limit.context,
diff --git a/@omniroute/opencode-plugin/tests/features.test.ts b/@omniroute/opencode-plugin/tests/features.test.ts
index 73ee37a72b..929a097390 100644
--- a/@omniroute/opencode-plugin/tests/features.test.ts
+++ b/@omniroute/opencode-plugin/tests/features.test.ts
@@ -376,7 +376,8 @@ test("provider hook: enrichment fetcher called when features.enrichment !== fals
   );
   const out = await hook.models!({} as never, { auth: apiAuth("sk") as never });
   assert.equal(called, 1, "enrichment fetcher called once");
-  const m = out["opencode-omniroute/claude-sonnet-4-6"];
+  // #6859: dynamic-hook catalog keys use the unprefixed omnirouteProviderId.
+  const m = out["omniroute/claude-sonnet-4-6"];
   assert.equal(m.name, "Claude Sonnet 4.6", "enrichment name overlay applied");
   assert.equal(m.cost.input, 3, "enrichment pricing applied");
   assert.equal(m.cost.output, 15);
@@ -402,7 +403,7 @@ test("provider hook: enrichment fetcher NOT called when features.enrichment:fals
   const out = await hook.models!({} as never, { auth: apiAuth("sk") as never });
   assert.equal(called, 0, "enrichment fetcher NOT called when gated off");
   assert.equal(
-    out["opencode-omniroute/claude-sonnet-4-6"].name,
+    out["omniroute/claude-sonnet-4-6"].name,
     "claude-sonnet-4-6",
     "raw id preserved"
   );
@@ -463,7 +464,7 @@ test("provider hook: compression metadata fetcher called when opted in", async (
   );
   const out = await hook.models!({} as never, { auth: apiAuth("sk") as never });
   assert.equal(called, 1, "compression metadata fetcher called");
-  const combo = out["opencode-omniroute/claude-primary"];
+  const combo = out["omniroute/claude-primary"];
   assert.ok(combo, "combo entry present");
   assert.match(
     combo.name,
diff --git a/@omniroute/opencode-plugin/tests/provider-id-routing.test.ts b/@omniroute/opencode-plugin/tests/provider-id-routing.test.ts
new file mode 100644
index 0000000000..eb01aac703
--- /dev/null
+++ b/@omniroute/opencode-plugin/tests/provider-id-routing.test.ts
@@ -0,0 +1,99 @@
+/**
+ * Regression test for #6859.
+ *
+ * `resolveOmniRoutePluginOptions()` auto-prefixes `providerId` with
+ * `"opencode-"` (commit 75b52e286) so OpenCode 1.17.8+'s native-adapter gate
+ * accepts it as an OC-registered provider id. That prefixed value must stay
+ * OC-internal (AuthHook.provider / provider registration keys) — it must
+ * NEVER leak into the identifiers OmniRoute's own server parses to resolve
+ * credentials (`mapRawModelToModelV2`'s `id`/`providerID`,
+ * `mapComboToModelV2`'s `providerID`, and the dynamic-hook catalog keys).
+ *
+ * OmniRoute's server-side `parseModel()` (open-sse/services/model.ts) splits
+ * a dispatched model string on `/` to recover the provider name and look up
+ * credentials. If the plugin embeds the OC-gate-prefixed id in that string,
+ * the server looks up credentials for a provider named "opencode-omniroute"
+ * (which never exists in `src/shared/constants/providers.ts`) instead of
+ * "omniroute" — producing the exact "No credentials for opencode-omniroute" /
+ * "No active credentials for provider: opencode-omniroute" errors reported
+ * in #6859.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import {
+  createOmniRouteProviderHook,
+  mapRawModelToModelV2,
+  resolveOmniRoutePluginOptions,
+} from "../src/index.js";
+
+/**
+ * Minimal stand-in for OmniRoute's own `parseModel()` (open-sse/services/
+ * model.ts), which splits a dispatched `<providerID>/<modelID>` string on the
+ * FIRST "/" to recover the provider name used for credential lookup. Kept
+ * local (rather than cross-importing the real module) so this package's
+ * self-contained test suite (`cd @omniroute/opencode-plugin && npm test`)
+ * doesn't depend on the root repo's `@/*` path-alias resolution.
+ */
+function splitProviderFromDispatchedModel(modelStr: string): string {
+  const idx = modelStr.indexOf("/");
+  return idx === -1 ? modelStr : modelStr.slice(0, idx);
+}
+
+const apiAuth = (key: string) => ({ type: "api" as const, key });
+
+test("#6859: server-facing model id/providerID must resolve to the unprefixed provider name", () => {
+  const resolved = resolveOmniRoutePluginOptions();
+
+  // The OC-gate-compatible id stays prefixed — it is legitimate for
+  // AuthHook.provider / provider registration.
+  assert.equal(resolved.providerId, "opencode-omniroute");
+
+  // A second, unprefixed id must be exposed for anything that reaches
+  // OmniRoute's own server (model id prefix, ModelV2.providerID, combo keys).
+  assert.equal(
+    resolved.omnirouteProviderId,
+    "omniroute",
+    "resolveOmniRoutePluginOptions() must expose an unprefixed omnirouteProviderId"
+  );
+
+  // A bare raw /v1/models entry (no existing "/" in its id — the common
+  // case for OmniRoute's catalog) mapped with the server-facing id.
+  const model = mapRawModelToModelV2(
+    { id: "claude-opus-4-7" },
+    { providerId: resolved.omnirouteProviderId, baseURL: "http://localhost:20128" }
+  );
+
+  assert.equal(model.providerID, "omniroute");
+  assert.equal(model.id, "omniroute/claude-opus-4-7");
+
+  // OpenCode dispatches back to OmniRoute using `providerID/modelKey`
+  // (matches the issue's own repro: `-m opencode-omniroute/oc/big-pickle`).
+  const dispatchedModelString = `${model.providerID}/claude-opus-4-7`;
+  const parsedProvider = splitProviderFromDispatchedModel(dispatchedModelString);
+
+  assert.equal(
+    parsedProvider,
+    "omniroute",
+    `server-side provider split resolved '${parsedProvider}', expected 'omniroute' — ` +
+      `credentials lookup would fail for an OC-gate-prefixed provider id`
+  );
+});
+
+test("#6859: createOmniRouteProviderHook end-to-end — catalog keys/providerID never carry the OC-gate prefix", async () => {
+  const hook = createOmniRouteProviderHook(
+    { baseURL: "https://or.example.com/v1" },
+    {
+      fetcher: async () => [{ id: "claude-opus-4-7" }],
+      combosFetcher: async () => [],
+    }
+  );
+  const out = await hook.models!({} as never, { auth: apiAuth("sk-test") as never });
+  const model = out["omniroute/claude-opus-4-7"];
+  assert.ok(model, "catalog keyed under the unprefixed provider name");
+  assert.equal(model.providerID, "omniroute");
+  assert.ok(
+    !model.providerID.startsWith("opencode-"),
+    "the OC-gate prefix must never leak into ModelV2.providerID"
+  );
+});
diff --git a/@omniroute/opencode-plugin/tests/provider.test.ts b/@omniroute/opencode-plugin/tests/provider.test.ts
index e4849205ac..20012ddb12 100644
--- a/@omniroute/opencode-plugin/tests/provider.test.ts
+++ b/@omniroute/opencode-plugin/tests/provider.test.ts
@@ -101,7 +101,10 @@ test("models: extracts apiKey from ctx.auth (type=api) and calls fetcher with it
   assert.equal(fetcher.callCount(), 1);
   assert.deepEqual(fetcher.callsBy()[0], ["https://or.example.com/v1", "sk-abc"]);
   assert.equal(Object.keys(out).length, 3);
-  assert.ok(out["opencode-omniroute/claude-primary"]);
+  // #6859: dynamic-hook catalog keys use the unprefixed omnirouteProviderId
+  // ("omniroute"), not the OC-gate-prefixed hook.id ("opencode-omniroute") —
+  // that prefix must never leak into anything OmniRoute's server parses.
+  assert.ok(out["omniroute/claude-primary"]);
 });
 
 test("models: returns {} when ctx.auth is null/undefined/wrong-type/empty-key", async () => {
@@ -152,13 +155,17 @@ test("models: maps a sample /v1/models entry to ModelV2 (sanity)", async () => {
     { fetcher, combosFetcher: async () => [] }
   );
   const out = await hook.models!({} as never, { auth: apiAuth("sk-abc") as never });
-  const claude = out["opencode-omniroute/claude-primary"];
+  // #6859: dynamic-hook catalog keys/ids/providerID use the unprefixed
+  // omnirouteProviderId ("omniroute") — the OC-gate prefix ("opencode-")
+  // must stay OC-internal (hook.id / AuthHook.provider) and never leak into
+  // anything OmniRoute's own server parses for credential lookup.
+  const claude = out["omniroute/claude-primary"];
   assert.ok(claude, "claude-primary present");
   // `mapRawModelToModelV2` stamps the provider prefix on the id so OC's
   // static-catalog reader resolves `(providerID, modelID)` from the key.
-  assert.equal(claude.id, "opencode-omniroute/claude-primary");
+  assert.equal(claude.id, "omniroute/claude-primary");
   assert.equal(claude.name, "claude-primary");
-  assert.equal(claude.providerID, "opencode-omniroute");
+  assert.equal(claude.providerID, "omniroute");
   assert.equal(claude.api.id, "openai-compatible");
   assert.equal(claude.api.url, "https://or.example.com/v1");
   assert.equal(claude.api.npm, "@ai-sdk/openai-compatible");
diff --git a/AGENTS.md b/AGENTS.md
index 00ef4b2547..42209a90d0 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -3,12 +3,12 @@
 ## Project
 
 Unified AI proxy/router — route any LLM through one endpoint. Multi-provider support
-with **237 provider entries** (OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Fireworks,
+with **250 provider entries** (OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Fireworks,
 Cohere, NVIDIA, Cerebras, Pollinations, Puter, Cloudflare AI, HuggingFace, DeepInfra,
 SambaNova, Meta Llama API, Moonshot AI, AI21 Labs, Databricks, Snowflake, and many more)
 with **MCP Server** (94 tools), **A2A v0.3 Protocol**, and **Electron desktop app**.
 
-> **Live counts (v3.8.43)**: providers 237 · MCP tools 94 · MCP scopes 30 · A2A skills 6 ·
+> **Live counts (v3.8.47)**: providers 250 · MCP tools 94 · MCP scopes 30 · A2A skills 6 ·
 > open-sse services 134 · routing strategies 17 · auto-combo scoring factors 12 ·
 > DB modules 95 · DB migrations 110 · base tables 17 · search providers 11 ·
 > i18n locales 42. **Refresh with `npm run check:docs-all`.**
@@ -539,7 +539,7 @@ For any non-trivial change, read the matching deep-dive first:
 | Repo navigation                            | [`docs/architecture/REPOSITORY_MAP.md`](docs/architecture/REPOSITORY_MAP.md)                                    |
 | Architecture                               | [`docs/architecture/ARCHITECTURE.md`](docs/architecture/ARCHITECTURE.md)                                        |
 | Engineering reference                      | [`docs/architecture/CODEBASE_DOCUMENTATION.md`](docs/architecture/CODEBASE_DOCUMENTATION.md)                    |
-| Auto-Combo (12-factor, 17 strategies)      | [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md)                                                      |
+| Auto-Combo (12-factor, 18 strategies)      | [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md)                                                      |
 | Resilience (3 layers)                      | [`docs/architecture/RESILIENCE_GUIDE.md`](docs/architecture/RESILIENCE_GUIDE.md)                                |
 | Skills                                     | [`docs/frameworks/SKILLS.md`](docs/frameworks/SKILLS.md)                                                        |
 | Memory                                     | [`docs/frameworks/MEMORY.md`](docs/frameworks/MEMORY.md)                                                        |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index bc306bc1a0..51ab532369 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,328 @@
 
 ---
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -3213,6 +3535,7 @@ And thank you to the OmniRoute community for the bug reports, reproductions, and
 
 ### Fixed
 
+- **usage:** use xAI's exact provider-reported cost when present instead of always estimating from token counts. (thanks @ryanngit)
 - **memory:** the `recent` retrieval strategy no longer drops recent memories whose
   text doesn't overlap the current prompt. It was internally mapped to the `exact`
   path, which relevance-filtered by the forwarded prompt (`score > 0`), so
diff --git a/CLAUDE.md b/CLAUDE.md
index 324729d317..65100f4fc4 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -35,7 +35,7 @@ For full test matrix, see `CONTRIBUTING.md` → "Running Tests". For deep archit
 
 ## Project at a Glance
 
-**OmniRoute** — unified AI proxy/router. One endpoint, 237 LLM providers, auto-fallback.
+**OmniRoute** — unified AI proxy/router. One endpoint, 250 LLM providers, auto-fallback.
 
 | Layer         | Location                | Purpose                                                                                                                                                |
 | ------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
@@ -72,7 +72,7 @@ Client → /v1/chat/completions (Next.js route)
 
 API routes follow a consistent pattern: `Route → CORS preflight → Zod body validation → Optional auth (extractApiKey/isValidApiKey) → API key policy enforcement → Handler delegation (open-sse)`. No global Next.js middleware — interception is route-specific.
 
-**Combo routing** (`open-sse/services/combo.ts`): 18 strategies (priority, weighted, fill-first, round-robin, P2C, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline). Each target calls `handleSingleModel()` which wraps `handleChatCore()` with per-target error handling and circuit breaker checks. The `fusion` strategy is the exception: it fans out to a panel of models in parallel, then a judge model synthesizes one final answer (`open-sse/services/fusion.ts`). See `docs/routing/AUTO-COMBO.md` for the 12-factor Auto-Combo scoring + the full strategy table and `docs/architecture/RESILIENCE_GUIDE.md` for the 3 resilience layers.
+**Combo routing** (`open-sse/services/combo.ts`): 18 strategies (priority, weighted, fill-first, round-robin, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline). Each target calls `handleSingleModel()` which wraps `handleChatCore()` with per-target error handling and circuit breaker checks. The `fusion` strategy is the exception: it fans out to a panel of models in parallel, then a judge model synthesizes one final answer (`open-sse/services/fusion.ts`). See `docs/routing/AUTO-COMBO.md` for the 12-factor Auto-Combo scoring + the full strategy table and `docs/architecture/RESILIENCE_GUIDE.md` for the 3 resilience layers.
 
 ---
 
@@ -428,8 +428,10 @@ git push -u origin feat/your-feature
 
 **Husky hooks**:
 
-- **pre-commit**: lint-staged + `check-docs-sync` + `check:any-budget:t11`
-- **pre-push**: fast deterministic gates (`check:any-budget:t11` + `check:tracked-artifacts`); intentionally excludes `test:unit` (slow — covered by the CI `test-unit` job). Activated 2026-06-13 (Quality Gates Fase 6A.12).
+- **pre-commit**: lint-staged + `check-docs-sync` + `check:any-budget:t11` + `check:tracked-artifacts`
+- **pre-push**: intentionally light (PATH/npm sanity only). `any-budget` + `tracked-artifacts`
+  already run on pre-commit; re-running them on every push was pure double-pay. CI still
+  enforces both. (Was Fase 6A.12 full pre-push gate; folded into pre-commit in #6716.)
 
 ### Worktree isolation (MANDATORY for every development task)
 
@@ -540,7 +542,7 @@ the stale-enforcement added in Fase 6A.3.
 18. Every bug fix must be validated before shipping: a failing-then-passing unit/integration test (TDD) OR a documented live test on the production VPS (192.168.0.15). A fix without either is not merged. See Testing → "Bug fix / issue triage protocol" for the full decision tree.
 19. Never develop on the shared main checkout. Every development task runs in its own git worktree on its own dedicated branch, and you MUST confirm the base branch with the operator (e.g. via `AskUserQuestion`) before creating the worktree/branch — never assume `main` or the currently checked-out branch. A `git checkout` in the shared checkout silently destroys other sessions' uncommitted work. Tear down only the worktrees/branches you created (by name, never `fix/*`/`feat/*` wildcards), leave other sessions' worktrees untouched, and end on the branch you started on (the active `release/vX.Y.Z`, never `main`). See Git Workflow → "Worktree isolation".
 20. PII redaction/sanitization is **opt-in — never on by default**. OmniRoute proxies for self-hosted/local LLMs where the operator owns the data, so mutating request/response payloads by default would silently corrupt legitimate traffic. The two data-mutating PII feature flags **MUST** keep `defaultValue: "false"` in `src/shared/constants/featureFlagDefinitions.ts`: `PII_REDACTION_ENABLED` (request-side) and `PII_RESPONSE_SANITIZATION` (response + streaming). All three application points — `src/lib/guardrails/piiMasker.ts` (request guardrail), `src/lib/piiSanitizer.ts` (response), `src/lib/streamingPiiTransform.ts` (SSE) — are gated on these flags; with both off the `pii-masker` guardrail still runs but never mutates payloads (data passes through untouched). Flipping either default to `"true"` requires explicit operator approval. The regression guard is `tests/unit/pii-opt-in-default.test.ts` (asserts both definition defaults + behavioral pass-through). Opt-in is per-operator via env or the settings/DB override (`src/lib/db/featureFlags.ts`), never a silent default. See `docs/security/GUARDRAILS.md`.
-21. **Release-freeze — the FROZEN release branch belongs to the release captain; development does NOT stop (parallel-cycle model, 2026-07-04).** `/generate-release` opens a marker issue labeled `release-freeze` at the start of reconciliation (Phase 0a), **immediately cuts the next cycle's branch `release/vX+1` from the frozen tip (Phase 0a.0b — bump + living release PR + re-home of open PRs)**, and closes the freeze once the release PR squash-merges to `main`. Before merging **any** PR, every campaign workflow (`/review-issues`, `/review-prs`, `/implement-features`, `/green-prs`, `/port-upstream-*`) **MUST** check `gh issue list --repo diegosouzapw/OmniRoute --label release-freeze --state open` — if a freeze is active: **NEVER merge into the frozen `release/vX.Y.Z` named in the freeze title**; instead resolve the ACTIVE development branch (the **highest** `release/v*` by semver — normally `release/vX+1`, announced in a freeze-issue comment) and **retarget the PR there** (`gh pr edit <N> --base release/vX+1`, then VERIFY with `gh pr view <N> --json baseRefName` — the edit fails silently) and merge normally. **HOLD only when the highest release/v\* branch IS the frozen one** (the short window before 0a.0b completes, or a pre-parallel-cycle release) — in that case leave the PR ready and open, tell the operator, and resume when the next branch appears or the freeze lifts. The just-shipped fixes reach `release/vX+1` via the Phase 5 sync-back (`scripts/release/sync-next-cycle.mjs`); do not try to sync mid-release. This is a **coordination signal, not a permission lock**: the release captain and the campaign sessions share the `diegosouzapw` identity, so a GitHub branch-protection lock cannot distinguish them — only this honored marker prevents the mid-release commit races that forced full CHANGELOG re-reconciliation in v3.8.40/v3.8.41 (a parallel campaign advanced `release/vX.Y.Z` by 34 commits mid-run). The release captain's own reconciliation/cycle-open pushes are exempt — they _are_ the release. Fixes that must land during a freeze (a homologation finding) follow the post-merge read-only rule: land on `main` first via `fix/release-vX.Y.Z-*`. **⛔ ONLY `/generate-release` may raise a release-freeze, and ONLY at its Phase 0a (start of generating a new version) — lifted at Phase 12c after the squash-merge to `main`.** No campaign, session, or agent may open a `release-freeze` marker at any other time — a freeze is **never** a mid-development coordination tool. If a session ever believes a freeze is genuinely, unavoidably necessary outside the `/generate-release` flow, it **MUST first ask the operator (`diegosouzapw`) in chat, explicitly alert "estou criando um freeze" and get an explicit yes** — never open, extend, or re-open a `release-freeze` autonomously. Conversely, do **not** close/lift an active `/generate-release` freeze to unblock campaign merges: it protects the captain's single clean CI run and auto-lifts at Phase 12c — closing it early re-triggers the exact commit race it prevents. Verify a freeze is legitimate before acting on it: an open `release-freeze` whose title/body references an **OPEN** release PR (`gh pr view <N> --json state`) is the authorized captain freeze — hold, don't touch.
+21. **Release-freeze — the FROZEN release branch belongs to the release captain; development does NOT stop (parallel-cycle model, 2026-07-04).** `/generate-release` opens a marker issue labeled `release-freeze` at the start of reconciliation (Phase 0a), **immediately cuts the next cycle's branch `release/vX+1` from the frozen tip (Phase 0a.0b — bump + living release PR + re-home of open PRs)**, and closes the freeze once the release PR squash-merges to `main`. Before merging **any** PR, every campaign workflow (`/review-prs`, `/review-group-prs`, `/merge-prs`, `/triage-fix-bugs`, `/implement-fix-bugs`, `/triage-features`, `/implement-features`, `/green-prs`, `/port-upstream-*`) **MUST** check `gh issue list --repo diegosouzapw/OmniRoute --label release-freeze --state open` — if a freeze is active: **NEVER merge into the frozen `release/vX.Y.Z` named in the freeze title**; instead resolve the ACTIVE development branch (the **highest** `release/v*` by semver — normally `release/vX+1`, announced in a freeze-issue comment) and **retarget the PR there** (`gh pr edit <N> --base release/vX+1`, then VERIFY with `gh pr view <N> --json baseRefName` — the edit fails silently) and merge normally. **HOLD only when the highest release/v\* branch IS the frozen one** (the short window before 0a.0b completes, or a pre-parallel-cycle release) — in that case leave the PR ready and open, tell the operator, and resume when the next branch appears or the freeze lifts. The just-shipped fixes reach `release/vX+1` via the Phase 5 sync-back (`scripts/release/sync-next-cycle.mjs`); do not try to sync mid-release. This is a **coordination signal, not a permission lock**: the release captain and the campaign sessions share the `diegosouzapw` identity, so a GitHub branch-protection lock cannot distinguish them — only this honored marker prevents the mid-release commit races that forced full CHANGELOG re-reconciliation in v3.8.40/v3.8.41 (a parallel campaign advanced `release/vX.Y.Z` by 34 commits mid-run). The release captain's own reconciliation/cycle-open pushes are exempt — they _are_ the release. Fixes that must land during a freeze (a homologation finding) follow the post-merge read-only rule: land on `main` first via `fix/release-vX.Y.Z-*`. **⛔ ONLY `/generate-release` may raise a release-freeze, and ONLY at its Phase 0a (start of generating a new version) — lifted at Phase 12c after the squash-merge to `main`.** No campaign, session, or agent may open a `release-freeze` marker at any other time — a freeze is **never** a mid-development coordination tool. If a session ever believes a freeze is genuinely, unavoidably necessary outside the `/generate-release` flow, it **MUST first ask the operator (`diegosouzapw`) in chat, explicitly alert "estou criando um freeze" and get an explicit yes** — never open, extend, or re-open a `release-freeze` autonomously. Conversely, do **not** close/lift an active `/generate-release` freeze to unblock campaign merges: it protects the captain's single clean CI run and auto-lifts at Phase 12c — closing it early re-triggers the exact commit race it prevents. Verify a freeze is legitimate before acting on it: an open `release-freeze` whose title/body references an **OPEN** release PR (`gh pr view <N> --json state`) is the authorized captain freeze — hold, don't touch.
 22. **Cross-session safety — this repo is worked by MANY parallel sessions/agents at once; never step on another's in-flight work.** Two absolute bans, both recurring incidents (this rule exists because they keep happening):
     - **(a) Never `git stash` / `git stash pop` — ANYWHERE in this repo, including inside an isolated worktree, and including inside any subagent you dispatch.** `git stash` operates on the **shared repository object store**, not the per-worktree working tree — so a stash pushed or popped in one session can silently clobber or resurrect another parallel session's uncommitted changes. This is not hypothetical: 2026-07-02 a `#5923` quotaCache change leaked into the unrelated `#2296` worktree via a global `stash pop`, and the same class reincided through a **subagent**. To compare working changes against a base ref **without** stashing, use `git show <ref>:<path>` or `git diff <ref> -- <path>`; to confirm a typecheck/lint error is pre-existing on the base, inspect the base ref directly (`git show origin/release/vX.Y.Z:<path>`) — never stash your tree away to "get it clean". **Put this ban verbatim in the prompt of every subagent that touches git** (agents don't inherit this file's context — the recurrence was a subagent).
     - **(b) Never merge, push, rebase, or force-push a PR / branch / worktree that another session is actively working.** An open PR whose head is a live fix worktree in `.claude/worktrees/` you did **not** create (e.g. `fix-5852`/`fix-5923` carrying fresh commits, even when they share your `diegosouzapw` identity), or any branch another session owns, is **off-limits — HOLD**, and let the owning session merge it. **Before** merging or pushing to any PR you did not create _this_ session, run `git worktree list` to check for a matching in-flight worktree and re-check `gh pr view <N> --json state,headRefOid`. Only the owning session merges its own in-flight PR; mid-flight merges race the owner and re-trigger the exact commit/CHANGELOG races Rule #19 and Rule #21 guard against. (Reinforces Rule #19.)
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 6c3b4acb02..389b79d534 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -341,7 +341,7 @@ Write unit tests in `tests/unit/` covering at minimum:
 - [ ] Error responses route through `buildErrorBody()` / `sanitizeErrorMessage()` — no raw stack traces in response bodies (see [`docs/security/ERROR_SANITIZATION.md`](./docs/security/ERROR_SANITIZATION.md))
 - [ ] Shell commands (`exec` / `spawn`) pass runtime values via `env`, not via string interpolation
 - [ ] All inputs validated with Zod schemas
-- [ ] CHANGELOG updated (if user-facing change)
+- [ ] Changelog **fragment** added under `changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md` for user-facing changes (see [`changelog.d/README.md`](./changelog.d/README.md)) — do **not** edit `CHANGELOG.md` directly; fragments are aggregated at release time and never conflict between PRs
 - [ ] Documentation updated (if applicable)
 - [ ] No new CodeQL / Secret-Scanning alerts opened, or each one dismissed with technical justification referencing the relevant `docs/security/` doc
 - [ ] Routes that spawn child processes (`/api/mcp/`, `/api/cli-tools/runtime/`) classified as `isLocalOnlyPath()` in `src/server/authz/routeGuard.ts` — see [Hard Rule #15](docs/security/ROUTE_GUARD_TIERS.md)
diff --git a/Dockerfile b/Dockerfile
index 81df902f13..e57cef96da 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -55,9 +55,16 @@ ENV NPM_CONFIG_LEGACY_PEER_DEPS=true
 # are reproducible.
 RUN test -f package-lock.json \
   || (echo "package-lock.json is required for reproducible Docker builds" >&2 && exit 1)
+# `npm rebuild <pkg>` re-runs the package's own install script, so under npm 11 +
+# `--ignore-scripts` on the parent `npm ci` it depends on npm's script-allowlist
+# machinery correctly re-enabling that one package's script. Some self-hosted build
+# environments (e.g. Dokploy) hit a broken/incomplete better-sqlite3 native binding
+# from that indirection. Invoking `node-gyp rebuild` directly inside the package
+# directory bypasses npm's script-running layer entirely and is deterministic
+# regardless of npm version or ignore-scripts allowlist behavior.
 RUN --mount=type=cache,id=npm-cache,target=/root/.npm \
   npm ci --no-audit --no-fund --legacy-peer-deps --ignore-scripts \
-  && npm rebuild better-sqlite3 \
+  && (cd node_modules/better-sqlite3 && npx --yes node-gyp rebuild) \
   && node -e "require('better-sqlite3')(':memory:').close()"
 
 # Build with Turbopack (stable in Next 16, the repo default). The v3.8.27-era
diff --git a/README.md b/README.md
index 605901d698..0ccfa90a47 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@
 
 # 🚀 OmniRoute — The Free AI Gateway
 
-### Never stop coding. Connect every AI tool to **237 providers** — **90+ free** — through one endpoint.
+### Never stop coding. Connect every AI tool to **250 providers** — **90+ free** — through one endpoint.
 
 **Plug Claude Code, Codex, Cursor, Cline, Copilot & Antigravity into FREE Claude / GPT / Gemini. Auto-fallback.**
 <br/>
@@ -21,16 +21,21 @@
 
 <h3>
 
-⭐ Star the repo if OMNIROUTE helped you save money and make your work easier. [![Stars](https://img.shields.io/github/stars/diegosouzapw/OmniRoute?style=social)](https://github.com/diegosouzapw/OmniRoute)
+⭐ Star the repo if OMNIROUTE helped you save money and make your work easier.
+
 </h3>
 
+[![Stars](https://img.shields.io/github/stars/diegosouzapw/OmniRoute?style=social)](https://github.com/diegosouzapw/OmniRoute)
 <a href="https://trendshift.io/repositories/23589" target="_blank"><img src="https://trendshift.io/api/badge/repositories/23589" alt="diegosouzapw%2FOmniRoute | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a>
+[![Star History Rank](https://api.star-history.com/badge?repo=diegosouzapw/OmniRoute&theme=dark)](https://www.star-history.com/diegosouzapw/omniroute)
 
-[![237 AI Providers](https://img.shields.io/badge/237-AI_Providers-6C5CE7?style=for-the-badge)](#-237-ai-providers--90-free)
-[![90+ Free](https://img.shields.io/badge/90%2B-Free_Tiers-00B894?style=for-the-badge)](#-237-ai-providers--90-free)
+</br>
+
+[![250 AI Providers](https://img.shields.io/badge/250-AI_Providers-6C5CE7?style=for-the-badge)](#-250-ai-providers--90-free)
+[![90+ Free](https://img.shields.io/badge/90%2B-Free_Tiers-00B894?style=for-the-badge)](#-250-ai-providers--90-free)
 [![1.6B Free Tokens/mo](https://img.shields.io/badge/1.6B-Free_Tokens%2Fmo-00B894?style=for-the-badge)](docs/reference/FREE_TIERS.md)
 [![Token Savings](https://img.shields.io/badge/up_to_95%25-Token_Savings-E17055?style=for-the-badge)](#%EF%B8%8F-save-1595-tokens--automatically)
-[![17 Strategies](https://img.shields.io/badge/17-Routing_Strategies-0984E3?style=for-the-badge)](#-combos--the-flagship)
+[![18 Strategies](https://img.shields.io/badge/18-Routing_Strategies-0984E3?style=for-the-badge)](#-combos--the-flagship)
 [![$0 to start](https://img.shields.io/badge/%240-To_Start-FDCB6E?style=for-the-badge&logoColor=black)](#-quick-start)
 
 <br/>
@@ -56,7 +61,7 @@
 ![Docker Pulls](https://img.shields.io/docker/pulls/diegosouzapw/omniroute?label=docker%20pulls&logo=docker&color=2496ED)
 ![Electron Downloads](https://img.shields.io/github/downloads/diegosouzapw/omniroute/total?style=flat&label=electron%20downloads&logo=electron&color=47848F)
 
-[**🚀 Quick Start**](#-quick-start) • [**🎯 Combos**](#-combos--the-flagship) • [**🌐 Providers**](#-237-ai-providers--90-free) • [**🔌 CLI & MCP**](#-full-cli--a2a--mcp) • [**🗜️ Compression**](#%EF%B8%8F-save-1595-tokens--automatically) • [**🌍 Website**](https://omniroute.online)
+[**🚀 Quick Start**](#-quick-start) • [**🎯 Combos**](#-combos--the-flagship) • [**🌐 Providers**](#-250-ai-providers--90-free) • [**🔌 CLI & MCP**](#-full-cli--a2a--mcp) • [**🗜️ Compression**](#%EF%B8%8F-save-1595-tokens--automatically) • [**🌍 Website**](https://omniroute.online)
 
 [💥 The Promise](#-the-promise) • [🤔 Why](#-why-omniroute) • [🏆 What Sets Apart](#-what-sets-omniroute-apart) • [🤖 Compatible CLIs](#-compatible-clis--coding-agents) • [🖥️ Where It Runs](#%EF%B8%8F-where-omniroute-runs--anywhere) • [🔒 Private](#-private--local-first) • [🎬 In Action](#-omniroute-in-action) • [📚 Explore More](#-explore-more) • [📧 Support](#-support--community)
 
@@ -144,18 +149,18 @@
 
 </div>
 
-> One endpoint. **237 providers.** Never stop building — and let OmniRoute pick the cheapest one that works.
+> One endpoint. **250 providers.** Never stop building — and let OmniRoute pick the cheapest one that works.
 
 <table>
   <tr>
-    <td width="33%" valign="top"><b>🚫 Never hit limits</b><br/><sub>Auto-fallback across 237 providers in milliseconds. Quota out? Next provider takes over — zero downtime.</sub></td>
+    <td width="33%" valign="top"><b>🚫 Never hit limits</b><br/><sub>Auto-fallback across 250 providers in milliseconds. Quota out? Next provider takes over — zero downtime.</sub></td>
     <td width="33%" valign="top"><b>💸 Save up to 95% tokens</b><br/><sub>RTK + Caveman stacked compression cuts 15–95% of eligible tokens (~89% avg on tool-heavy sessions).</sub></td>
     <td width="33%" valign="top"><b>🆓 $0 to start</b><br/><sub>90+ providers with a free tier, 11 free <i>forever</i> (Kiro, Qoder, Pollinations, LongCat…). No card needed.</sub></td>
   </tr>
   <tr>
     <td width="33%" valign="top"><b>🔌 Every tool works</b><br/><sub>24+ coding agents — Claude Code, Codex, Cursor, Cline, Copilot, Antigravity — through one config.</sub></td>
     <td width="33%" valign="top"><b>🧩 One endpoint</b><br/><sub>OpenAI ↔ Claude ↔ Gemini ↔ Responses API translation. Point any tool at <code>/v1</code> and it just works.</sub></td>
-    <td width="33%" valign="top"><b>🛡️ Production-grade</b><br/><sub>Circuit breakers, TLS stealth, MCP (95 tools), A2A, memory, guardrails, evals. 21,000+ tests.</sub></td>
+    <td width="33%" valign="top"><b>🛡️ Production-grade</b><br/><sub>Circuit breakers, TLS stealth, MCP (94 tools), A2A, memory, guardrails, evals. 21,000+ tests.</sub></td>
   </tr>
 </table>
 
@@ -189,7 +194,7 @@
                           ▼
 ┌──────────────────────────────────────────────────────────┐
 │                  OmniRoute — Smart Router                  │
-│  RTK + Caveman compression · 17 routing strategies         │
+│  RTK + Caveman compression · 18 routing strategies         │
 │  Circuit breakers · TLS stealth · MCP · A2A · Guardrails   │
 └─────────────────────────┬──────────────────────────────────┘
         ┌─────────────┬────┴────────┬─────────────┐
@@ -227,9 +232,9 @@ No combo to create. Set your model to `auto` (or a variant) and OmniRoute builds
 
 ##
 
-### 🔀 Or build your own — 17 routing strategies
+### 🔀 Or build your own — 18 routing strategies
 
-All **17** strategies — mix & match per combo step:
+All **18** strategies — mix & match per combo step:
 
 | #   | Strategy            | What it does                                                     |
 | --- | ------------------- | ---------------------------------------------------------------- |
@@ -248,10 +253,11 @@ All **17** strategies — mix & match per combo step:
 | 13  | `context-relay`     | Hand off context across targets for long conversations 🧠        |
 | 14  | `context-optimized` | Pick the best fit for the current context size                   |
 | 15  | `lkgp`              | Last-Known-Good Path — sticky to the last successful target      |
-| 16  | `auto`              | 9-factor live scoring across every connection 🤖                 |
+| 16  | `auto`              | 12-factor live scoring across every connection 🤖                |
 | 17  | `fusion`            | Fan out to a panel of models + a judge synthesizes one answer 🧬 |
+| 18  | `pipeline`          | Chain steps — each target's output feeds the next one 🔗         |
 
-<sub>The Auto-Combo engine scores every candidate on **9 factors** (health, quota, cost, latency, success rate, freshness…) — see [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md).</sub>
+<sub>The Auto-Combo engine scores every candidate on **12 factors** (health, quota, cost, latency, success rate, freshness…) — see [`docs/routing/AUTO-COMBO.md`](docs/routing/AUTO-COMBO.md).</sub>
 
 ##
 
@@ -308,11 +314,11 @@ Result: 4 layers of fallback = zero downtime
 
 | Feature                                | OmniRoute                                                           | Other routers |
 | -------------------------------------- | ------------------------------------------------------------------- | ------------- |
-| 🌐 Providers                           | **237**                                                             | 20–100        |
+| 🌐 Providers                           | **250**                                                             | 20–100        |
 | 🆓 Free providers                      | **90+ (11 free forever)**                                           | 1–5           |
-| 🔀 Routing strategies                  | **17** (priority, weighted, cost-optimized, context-relay, fusion…) | 1–3           |
+| 🔀 Routing strategies                  | **18** (priority, weighted, cost-optimized, context-relay, fusion…) | 1–3           |
 | 🗜️ Token compression                   | **RTK + Caveman stacked (15–95%)**                                  | None / 20–40% |
-| 🧰 Built-in MCP server                 | **95 tools, 3 transports, 30 scopes**                               | Rare          |
+| 🧰 Built-in MCP server                 | **94 tools, 3 transports, 30 scopes**                               | Rare          |
 | 🤝 A2A agent protocol                  | **6 skills, JSON-RPC 2.0**                                          | None          |
 | 🧠 Memory (FTS5 + vector)              | **Yes**                                                             | Rare          |
 | 🛡️ Guardrails (PII, injection, vision) | **Yes**                                                             | Rare          |
@@ -331,23 +337,23 @@ Result: 4 layers of fallback = zero downtime
 
 </div>
 
-> Recent highlights from **v3.8.20 → v3.8.45**. Full history in [`CHANGELOG.md`](CHANGELOG.md).
+> Recent highlights from **v3.8.20 → v3.8.47**. Full history in [`CHANGELOG.md`](CHANGELOG.md).
 
 - **🗜️ Compression hardening** — a default-on **inflation guard** (discard the stacked result and send the verbatim original whenever compression would _grow_ the prompt), completed **Caveman rule packs** for German / French / Japanese (dedup + ultra) plus a new **Chinese (文言 / wényán) input pack** with zh-vs-ja auto-detection, and **RTK filters for Gradle & .NET (`dotnet`)** build output. → [Compression](docs/compression/COMPRESSION_ENGINES.md)
 - **💸 Honest flat-rate cost** — subscription / coding-plan providers (ChatGPT Web, grok-web, the Minimax / Kimi / GLM / Alibaba Coding plans, Xiaomi MiMo…) now read **$0** in cost analytics instead of an inflated per-token estimate, while budget / quota / routing keep estimating unchanged. → [API Reference](docs/reference/API_REFERENCE.md)
 - **⚖️ Quota-Share routing** — a dedicated combo strategy that spreads load across accounts by _available quota_: Deficit-Round-Robin scheduling, per-connection `max_concurrent` with cooldown-wait queueing, multi-window usage buckets (5h / 7d / per-model), per-(key, model) caps, session stickiness for prompt-cache integrity (now with a per-combo / global disable toggle), and proactive saturation from upstream token-usage headers. → [Resilience Guide](docs/architecture/RESILIENCE_GUIDE.md)
 - **🤖 One-command CLI/agent setup** — a dedicated `setup-*` command configures each coding tool to route through OmniRoute (Claude Code, Codex, Cline, Continue, Cursor, Roo Code, Kilo Code, Crush, Goose, Qwen Code, Aider, OpenCode); `omniroute launch` / `omniroute launch-codex` are zero-config launchers. → [CLI Integrations](docs/guides/CLI-INTEGRATIONS.md)
 - **🛰️ Remote mode** — drive a remote OmniRoute from any machine with scoped access tokens (`omniroute connect` / `omniroute contexts` / `omniroute tokens`), plus an `omniroute login antigravity` helper that runs Google "native/desktop" OAuth on your own machine and pastes a credential blob into a remote/VPS install (where the loopback redirect is unreachable). → [Remote Mode](docs/guides/REMOTE-MODE.md)
-- **🧭 Smarter auto-routing** — OpenRouter-style `auto/<category>:<tier>` combos (e.g. `auto/coding:fast`, `auto/reasoning:pro`), a **Fusion** strategy (fan out to a panel of models in parallel, then synthesize via a judge), **task-aware routing** (best-fit connection per task type), per-request `X-Route-Model` override, live Arena-ELO + models.dev model intelligence, per-step account allowlists, provider-wildcard combo steps, nested combo-ref execution, sticky weighted selection, `web_search`-aware routing, and **per-request Auto-Combo controls** (`X-OmniRoute-Mode` mode-preset override + `X-OmniRoute-Budget` hard USD cost ceiling, scoped to a single request). → [Auto-Combo](docs/routing/AUTO-COMBO.md)
-- **🗜️ Pluggable compression** — an async pipeline of **10 composable engines** with Compression Studios, an LLMLingua-2 ONNX engine and a heuristic/SLM two-tier **Ultra**, RTK, delegated Anthropic Context Editing, **Output Styles** (output-axis steering: terse-prose / less-code / terse-CJK), an **adaptive context-budget dial** (escalate only as far as needed to fit the context window), per-request `x-omniroute-compression` control, an opt-in offline eval harness, one-click **Headroom** proxy lifecycle management from the dashboard (Docker sidecar supported), a synthetic **compression playground** (Play lanes + A/B Compare with USD-capped fidelity verdicts), an opt-in **per-step fidelity gate** that rejects a lossy engine before it degrades the prompt, a **best-of-N candidate encoder** (GCF vs TOON — keep whichever is shorter, with an A/B bytes/token table in the studio), **CCR ranged/grep/stats retrieval** (pull an exact byte/line slice or summary of a stored block instead of re-expanding it), a unified panel with named profiles + an active-profile selector, an opt-in **per-engine pipeline circuit-breaker**, an opt-in **LLM-tier engine** (a model pass for higher-ratio semantic compression), a **read-lifecycle engine** that collapses superseded file reads, **usage-observed prefix freeze**, a graduated **CCR retrieval-feedback ramp**, a `preserveSystemPrompt` mode enum, and a **drag-reorder pipeline editor** in the studio. → [Compression](docs/compression/COMPRESSION_ENGINES.md)
+- **🧭 Smarter auto-routing** — OpenRouter-style `auto/<category>:<tier>` combos (e.g. `auto/coding:fast`, `auto/reasoning:pro`), a **Fusion** strategy (fan out to a panel of models in parallel, then synthesize via a judge), **task-aware routing** (best-fit connection per task type), per-request `X-Route-Model` override, live Arena-ELO + models.dev model intelligence, per-step account allowlists, provider-wildcard combo steps, nested combo-ref execution, sticky weighted selection, `web_search`-aware routing (now with **per-model web-search/web-fetch interception rules**), native **xAI Grok `/v1/responses`** routing, and **per-request Auto-Combo controls** (`X-OmniRoute-Mode` mode-preset override + `X-OmniRoute-Budget` hard USD cost ceiling, scoped to a single request). Embeddings-only and rerank-only models (JinaAI, OpenRouter custom, reranker models…) no longer disappear from the combo builder's model picker. → [Auto-Combo](docs/routing/AUTO-COMBO.md)
+- **🗜️ Pluggable compression** — an async pipeline of **10 composable engines** with Compression Studios, an LLMLingua-2 ONNX engine and a heuristic/SLM two-tier **Ultra**, RTK, delegated Anthropic Context Editing, **Output Styles** (output-axis steering: terse-prose / less-code / terse-CJK), an **adaptive context-budget dial** (escalate only as far as needed to fit the context window), per-request `x-omniroute-compression` control, an opt-in offline eval harness, one-click **Headroom** proxy lifecycle management from the dashboard (Docker sidecar supported), a synthetic **compression playground** (Play lanes + A/B Compare with USD-capped fidelity verdicts), an opt-in **per-step fidelity gate** that rejects a lossy engine before it degrades the prompt, a **best-of-N candidate encoder** (GCF vs TOON — keep whichever is shorter, with an A/B bytes/token table in the studio), the vendored **GCF codec updated to spec v3.2** (nested flattening — deeply-nested payloads go from ~3% to ~32% compression vs JSON), a new **omniglyph** engine (context-as-image, ~10× fewer tokens on the converted block), **CCR ranged/grep/stats retrieval** (pull an exact byte/line slice or summary of a stored block instead of re-expanding it), a unified panel with named profiles + an active-profile selector, an opt-in **per-engine pipeline circuit-breaker**, an opt-in **LLM-tier engine** (a model pass for higher-ratio semantic compression), a **read-lifecycle engine** that collapses superseded file reads, **usage-observed prefix freeze**, a graduated **CCR retrieval-feedback ramp**, a `preserveSystemPrompt` mode enum, and a **drag-reorder pipeline editor** in the studio. → [Compression](docs/compression/COMPRESSION_ENGINES.md)
 - **🕵️ Transparent MITM decrypt (TPROXY)** — capture & translate traffic from CLIs that ignore proxy env vars, with a per-SNI certificate authority and a trust-store installer. → [MITM/TPROXY](docs/security/MITM-TPROXY-DECRYPT.md)
 - **💸 Cost telemetry everywhere** — `X-OmniRoute-*` cost/usage headers on every endpoint (including media), a non-token cost engine, a cache-HIT `X-OmniRoute-Cost-Saved` header, and per-key USD spend quotas. → [API Reference](docs/reference/API_REFERENCE.md)
 - **🧠 Memory you control** — opt-in int8 vector quantization (Qdrant + sqlite-vec), opt-in **typed memory decay** (aged low-value memories fade on a per-type schedule), memory off by default, and a per-request `x-omniroute-no-memory` header. → [Memory](docs/frameworks/MEMORY.md)
 - **🛡️ Security** — a prompt-injection guard across every LLM route (backed by a red-team suite), plus a free DuckDuckGo last-resort web search. → [Guardrails](docs/security/GUARDRAILS.md)
 - **🖼️ New endpoints** — `/v1/ocr` (Mistral OCR) and `/v1/audio/translations` (Whisper-style audio translation) round out the media API surface. → [API Reference](docs/reference/API_REFERENCE.md)
-- **🌍 Deployment & ops** — reverse-proxy `basePath` deployment (`OMNIROUTE_BASE_PATH`, e.g. serving OmniRoute under `/omniroute/`), browser-language auto-detect on first visit, per-API-key device/connection tracking (IP+UA fingerprint, masked, in-memory only), root-less MITM cert trust for user-namespaced containers (`OMNIROUTE_NO_SUDO`), and server-side configured-only / available-only filters on the Free Provider Rankings page. → [Environment](docs/reference/ENVIRONMENT.md)
-- **🤝 More providers & agents** — Cursor Cloud Agent (a 4th cloud agent), CodeBuddy CN (`copilot.tencent.com`), a Google Flow video-generation provider, new gateways **DGrid** and **Pioneer AI** (Fastino Labs), inbound **xAI Grok** translators plus **Grok Build (xAI)** with an OAuth import-token flow, GPT-4 / GPT-4o-mini on the GitHub Copilot provider, multi-model **Factory Droid**, **ZenMux Free** (session-cookie free tier), **Alibaba DashScope** text-to-video (`wan2.7-t2v`), a refreshed 237-provider catalog (OrcaRouter, Wafer AI, OpenAdapter, dit.ai, TokenRouter, …), Vertex AI media generation (speech/transcription/music/video), a first-class **Ollama** local-provider card, the **SenseNova** free Token Plan (chat + text-to-image), one-click account import from CLIProxyAPI (`~/.cli-proxy-api/`), **Claude Sonnet 5** wired end-to-end, a new provider wave (**Kenari**, **SumoPod**, **X5Lab**, **Charm Hyper**, **Nube.sh**, **b.ai**, **Qiniu**, **ModelScope**, **Augment/Auggie CLI**, **ClinePass**, NVIDIA NIM image generation), Codex account import from a raw ChatGPT access token, the **Requesty** gateway (BYOK, ~200 free req/day), **Yuanbao (web)** as a cookie-session provider (DeepSeek V3/R1 + Hunyuan), the **Zed** hosted LLM aggregator (OAuth), **Claude 5 Sonnet** on the Claude Web provider, Kiro **adaptive-thinking reasoning** surfaced as `reasoning_content`, and **bulk API-key add for Cloudflare Workers AI**. → [Providers](docs/reference/PROVIDER_REFERENCE.md)
-- **⚡ Local performance & infra** — a one-click local Redis launcher (`omniroute redis up`, plus a dashboard Redis panel), one-click **Cloudflare Workers** and **Deno Deploy** relay deployers wired into the proxy pool, a relay-backend selector (`OMNIROUTE_RELAY_BACKEND=ts|bifrost|auto`) so `/v1/relay` stays the stable surface while choosing the fastest backend internally, **Bifrost** (Go AI-gateway) and **Mux** (agent-orchestration daemon) promoted to first-class embedded/supervised services alongside 9Router/CLIProxyAPI, and **Webshare** added as a paid fourth source in the free-proxy provider framework. → [Embedded Services](docs/frameworks/EMBEDDED-SERVICES.md)
+- **🌍 Deployment & ops** — reverse-proxy `basePath` deployment (`OMNIROUTE_BASE_PATH`, e.g. serving OmniRoute under `/omniroute/`), browser-language auto-detect on first visit, per-API-key device/connection tracking (IP+UA fingerprint, masked, in-memory only), root-less MITM cert trust for user-namespaced containers (`OMNIROUTE_NO_SUDO`), server-side configured-only / available-only filters on the Free Provider Rankings page, and **Traditional Chinese (zh-TW)** localization for the frontend + CLI. → [Environment](docs/reference/ENVIRONMENT.md)
+- **🤝 More providers & agents** — Cursor Cloud Agent (a 4th cloud agent), CodeBuddy CN (`copilot.tencent.com`), a Google Flow video-generation provider, new gateways **DGrid** and **Pioneer AI** (Fastino Labs), inbound **xAI Grok** translators plus **Grok Build (xAI)** with an OAuth import-token flow, GPT-4 / GPT-4o-mini on the GitHub Copilot provider, multi-model **Factory Droid**, **ZenMux Free** (session-cookie free tier), **Alibaba DashScope** text-to-video (`wan2.7-t2v`), a refreshed 250-provider catalog (OrcaRouter, Wafer AI, OpenAdapter, dit.ai, TokenRouter, …), Vertex AI media generation (speech/transcription/music/video), a first-class **Ollama** local-provider card, the **SenseNova** free Token Plan (chat + text-to-image), one-click account import from CLIProxyAPI (`~/.cli-proxy-api/`), **Claude Sonnet 5** wired end-to-end, a new provider wave (**Kenari**, **SumoPod**, **X5Lab**, **Charm Hyper**, **Nube.sh**, **b.ai**, **Qiniu**, **ModelScope**, **Augment/Auggie CLI**, **ClinePass**, NVIDIA NIM image generation), Codex account import from a raw ChatGPT access token, the **Requesty** gateway (BYOK, ~200 free req/day), **Yuanbao (web)** as a cookie-session provider (DeepSeek V3/R1 + Hunyuan), the **Zed** hosted LLM aggregator (OAuth), **Claude 5 Sonnet** on the Claude Web provider, Kiro **adaptive-thinking reasoning** surfaced as `reasoning_content`, **bulk API-key add for Cloudflare Workers AI**, and **OpenVecta** (AI inference gateway). → [Providers](docs/reference/PROVIDER_REFERENCE.md)
+- **⚡ Local performance & infra** — a one-click local Redis launcher (`omniroute redis up`, plus a dashboard Redis panel), one-click **Cloudflare Workers** and **Deno Deploy** relay deployers wired into the proxy pool, a relay-backend selector (`OMNIROUTE_RELAY_BACKEND=ts|bifrost|auto`) so `/v1/relay` stays the stable surface while choosing the fastest backend internally, **Bifrost** (Go AI-gateway) and **Mux** (agent-orchestration daemon) promoted to first-class embedded/supervised services alongside 9Router/CLIProxyAPI, **Webshare** added as a paid fourth source in the free-proxy provider framework, and **shorthand proxy formats + protocol header mode** for bulk proxy import. → [Embedded Services](docs/frameworks/EMBEDDED-SERVICES.md)
 
 <br/>
 
@@ -389,11 +395,11 @@ Result: 4 layers of fallback = zero downtime
 
 <div align="center">
 
-# 🌐 237 AI Providers — 90+ Free
+# 🌐 250 AI Providers — 90+ Free
 
 </div>
 
-> The most complete catalog of any open-source router: **237 providers**, **90+ with a free tier**, **11 free forever**.
+> The most complete catalog of any open-source router: **250 providers**, **90+ with a free tier**, **11 free forever**.
 
 <div align="center">
 
@@ -538,7 +544,7 @@ Expose OmniRoute over **MCP** or **A2A** and any capable agent gets the keys to
 | Protocol           | Endpoint                                        | Use it for                                             |
 | ------------------ | ----------------------------------------------- | ------------------------------------------------------ |
 | 🧰 **MCP (stdio)** | `omniroute --mcp`                               | Plug into Claude Desktop, Cursor, any MCP client       |
-| 🌊 **MCP (HTTP)**  | `http://localhost:20128/api/mcp/stream`         | Remote MCP — **95 tools**, 30 scopes, full audit trail |
+| 🌊 **MCP (HTTP)**  | `http://localhost:20128/api/mcp/stream`         | Remote MCP — **94 tools**, 30 scopes, full audit trail |
 | 📡 **MCP (SSE)**   | `http://localhost:20128/api/mcp/sse`            | Streaming MCP transport                                |
 | 🤝 **A2A**         | `http://localhost:20128/.well-known/agent.json` | Agent-to-agent, **JSON-RPC 2.0** + SSE, 6 skills       |
 
@@ -568,7 +574,7 @@ Engines run in pipeline order; each is independently toggleable and configurable
 | 1   | **Session-Dedup** | Drops content repeated across turns (content-addressed, cross-turn) |
 | 2   | **CCR**           | Archives large blocks behind retrieve markers, fetched on demand    |
 | 3   | **RTK**           | Smart tool-result filtering, dedup & truncation (command-aware)     |
-| 4   | **Headroom**      | Lossless tabular compaction of homogeneous JSON arrays (~30%+)      |
+| 4   | **Headroom**      | Lossless tabular compaction of homogeneous JSON arrays, flat or nested (~30%), via a vendored **GCF** codec (spec v3.2) |
 | 5   | **Relevance**     | Extractive sentence scoring against the last user query             |
 | 6   | **Caveman**       | Rule-based prose compression (~65–75% on output)                    |
 | 7   | **LLMLingua-2**   | ML semantic pruning via MobileBERT ONNX — code-safe, async          |
@@ -875,9 +881,9 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 
 <br/>
 
-**Routing:** 17 strategies · task-aware smart routing · thinking budget controls · wildcard routing · system prompt injection.
+**Routing:** 18 strategies · task-aware smart routing · thinking budget controls · wildcard routing · system prompt injection.
 **Compatibility:** OpenAI ↔ Claude ↔ Gemini ↔ Responses API · auto OAuth refresh (PKCE, 8 providers) · multi-account round-robin · Batch + Files API · live OpenAPI 3.0.
-**Protocols:** MCP (95 tools, 3 transports, 30 scopes) · A2A (JSON-RPC 2.0, SSE, 6 skills) · ACP · cloud agents (Codex, Cursor, Devin, Jules).
+**Protocols:** MCP (94 tools, 3 transports, 30 scopes) · A2A (JSON-RPC 2.0, SSE, 6 skills) · ACP · cloud agents (Codex, Cursor, Devin, Jules).
 **Plugins:** custom plugin marketplace (system-configured registry URL with SSRF-guarded fetch) · install / enable / disable · Notion + Obsidian knowledge-base integrations (WebDAV file server, vault search, note CRUD).
 **Embedded services:** one-click install & lifecycle management of local sidecar services (CLIProxy, NineRouter).
 **Quality & Ops:** built-in **Evals** (golden-set: exact/contains/regex/custom) · guardrails (PII, injection, vision) · health dashboard · p50/p95/p99 telemetry · webhooks · compliance audit.
@@ -901,7 +907,7 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 **Will I be charged by OmniRoute?** No — it's free, open-source software on your machine. You only pay paid providers directly. OmniRoute has no billing system.
 **Are FREE providers really unlimited?** Mostly — Qoder, Pollinations, LongCat, and Cloudflare are free with no per-account credit cap. Kiro is free too but capped at ~50 credits/month per account. Stack multiple free providers in a combo and auto-fallback keeps you serving for $0.
 **Will compression hurt quality?** No — it only compresses the **input**; code, URLs, JSON are always protected.
-**Does it work where AI is blocked?** Yes — 3-level proxy + 1proxy marketplace reach all 237 providers.
+**Does it work where AI is blocked?** Yes — 3-level proxy + 1proxy marketplace reach all 250 providers.
 
 📖 [User Guide](docs/guides/USER_GUIDE.md) · [API Reference](docs/reference/API_REFERENCE.md) · [Environment Config](docs/reference/ENVIRONMENT.md)
 
@@ -1022,7 +1028,7 @@ Compression: aggressive (~50%) → double your free quota · Cost: $0/mo
 | [Compression Rules Format](docs/compression/COMPRESSION_RULES_FORMAT.md)     | JSON rule-pack schemas for Caveman and RTK filters                            |
 | [Compression Language Packs](docs/compression/COMPRESSION_LANGUAGE_PACKS.md) | Language detection and Caveman rule-pack authoring                            |
 | [Resilience Guide](docs/architecture/RESILIENCE_GUIDE.md)                    | Circuit breakers, cooldowns, queue, anti-thundering herd, TLS spoofing        |
-| [Auto-Combo Engine](docs/routing/AUTO-COMBO.md)                              | 9-factor scoring, mode packs, self-healing                                    |
+| [Auto-Combo Engine](docs/routing/AUTO-COMBO.md)                              | 12-factor scoring, mode packs, self-healing                                    |
 | [Proxy Guide](docs/ops/PROXY_GUIDE.md)                                       | 3-level proxy system, 1proxy marketplace, registry CRUD                       |
 | [Free Tiers](docs/reference/FREE_TIERS.md)                                   | 25+ free API providers consolidated directory                                 |
 | [Features Gallery](docs/guides/FEATURES.md)                                  | Visual dashboard tour with screenshots                                        |
@@ -1150,14 +1156,13 @@ gh release create v3.8.2 --title "v3.8.2" --generate-notes
 
 ## 📊 Stars
 
-<a href="https://www.star-history.com/?repos=diegosouzapw%2Fomniroute&type=date&legend=top-left">
+<a href="https://www.star-history.com/?repos=diegosouzapw%2FOmniRoute&type=date&legend=top-left">
  <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=diegosouzapw/omniroute&type=date&theme=dark&legend=top-left" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=diegosouzapw/omniroute&type=date&legend=top-left" />
-   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=diegosouzapw/omniroute&type=date&legend=top-left" />
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=diegosouzapw/OmniRoute&type=date&theme=dark&legend=top-left&sealed_token=XP_ycEjv7s31p1edvhsMOXry51OWYsUjDRWjflSG7jQKRpO9hPGg7i_EHvwhI6QtrARTMH-YGjJhi8sumRYflEJD0DPlH_MMHjizhBYCX8fbHFrHEiNvVA" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=diegosouzapw/OmniRoute&type=date&legend=top-left&sealed_token=XP_ycEjv7s31p1edvhsMOXry51OWYsUjDRWjflSG7jQKRpO9hPGg7i_EHvwhI6QtrARTMH-YGjJhi8sumRYflEJD0DPlH_MMHjizhBYCX8fbHFrHEiNvVA" />
+   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=diegosouzapw/OmniRoute&type=date&legend=top-left&sealed_token=XP_ycEjv7s31p1edvhsMOXry51OWYsUjDRWjflSG7jQKRpO9hPGg7i_EHvwhI6QtrARTMH-YGjJhi8sumRYflEJD0DPlH_MMHjizhBYCX8fbHFrHEiNvVA" />
  </picture>
 </a>
-</div>
 
 <br/>
 
@@ -1211,7 +1216,7 @@ OmniRoute stands on the shoulders of giants. It started as a fork of **[9router]
 | Project                                                                                        |    ⭐ | How it inspired OmniRoute                                                                                                                                                                                      |
 | ---------------------------------------------------------------------------------------------- | ----: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **[TOON](https://github.com/toon-format/toon)** · toon-format                                  | 24.7k | Token-Oriented Object Notation — its columnar, header-plus-rows model shaped our tabular compaction stage.                                                                                                     |
-| **[GCF – Graph Compact Format](https://github.com/blackwell-systems/gcf)** · Blackwell Systems |    14 | Schema-aware "JSON for LLMs" notation — co-inspired our lossless homogeneous-array compaction with `[N rows]` markers.                                                                                         |
+| **[GCF – Graph Compact Format](https://github.com/blackwell-systems/gcf)** · Blackwell Systems |    14 | First inspired our tabular compaction stage; now its zero-dependency, lossless generic-profile encoder is **vendored directly** as the Headroom codec (MIT, SPDX-marked), current with GCF spec v3.2. |
 | **[token-optimizer-mcp](https://github.com/ooples/token-optimizer-mcp)** · ooples              |   421 | Brotli/SQLite cache + per-session context-delta — inspired our `session-dedup` engine.                                                                                                                         |
 | **[token-savior](https://github.com/Mibayy/token-savior)** · Mibayy                            |  1.0k | Bash-output compaction + MCP profiles — inspired our compression bail-out discipline and MCP tool-manifest reduction.                                                                                          |
 | **[token-saver](https://github.com/ppgranger/token-saver)** · ppgranger                        |   110 | Content-aware, per-file-type output compression with failure-aware bail-out — validated our per-type dispatch and minimum-gain skip.                                                                           |
@@ -1255,6 +1260,12 @@ OmniRoute stands on the shoulders of giants. It started as a fork of **[9router]
 | ------------------------------------------------------------------------------------------- | --: | ------------------------------------------------------------------------------------------------------------------------------------------------ |
 | **[awesome-secure-defaults](https://github.com/tldrsec/awesome-secure-defaults)** · tldrsec | 708 | A curated list of secure-by-default libraries that guides our security choices (Helmet.js, DOMPurify, ssrf-req-filter, safe-regex, Google Tink). |
 
+### 🧭 Complementary tools
+
+| Project                                                                       | How it composes with OmniRoute                                                                                                                                                                             |
+| ----------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **[CodeWebChat](https://github.com/robertpiosik/CodeWebChat)** · robertpiosik | Editor-side companion — VS Code + browser extension that autofills 15+ chatbot web UIs with editor context. Owns the free-web-UI rail alongside OmniRoute's API rail; can point its API mode at OmniRoute. |
+
 ## ❤️ Support
 
 OmniRoute is free and open source, built and maintained in the open. If it saves you time or money, consider supporting development:
diff --git a/bin/cli/commands/completion.mjs b/bin/cli/commands/completion.mjs
index d1d02d944c..3fbbfe9258 100644
--- a/bin/cli/commands/completion.mjs
+++ b/bin/cli/commands/completion.mjs
@@ -15,7 +15,11 @@ function readCache() {
   try {
     const raw = JSON.parse(readFileSync(cachePath(), "utf8"));
     if (raw && typeof raw.ts === "number" && Date.now() - raw.ts < CACHE_TTL_MS) return raw;
-  } catch {}
+  } catch (err) {
+    if (process.env.OMNIROUTE_DEBUG_COMPLETION) {
+      console.error("[omniroute completion] readCache failed:", err?.message ?? err);
+    }
+  }
   return null;
 }
 
@@ -41,12 +45,20 @@ async function refreshCache(opts = {}) {
       const j = await mr.value.json();
       models = (Array.isArray(j) ? j : j.data || []).map((m) => m.id).filter(Boolean);
     }
-  } catch {}
+  } catch (err) {
+    if (process.env.OMNIROUTE_DEBUG_COMPLETION) {
+      console.error("[omniroute completion] refreshCache failed:", err?.message ?? err);
+    }
+  }
   const data = { combos, providers, models, ts: Date.now() };
   try {
     mkdirSync(dirname(cachePath()), { recursive: true });
     writeFileSync(cachePath(), JSON.stringify(data));
-  } catch {}
+  } catch (err) {
+    if (process.env.OMNIROUTE_DEBUG_COMPLETION) {
+      console.error("[omniroute completion] writeCache failed:", err?.message ?? err);
+    }
+  }
   return data;
 }
 
diff --git a/bin/cli/commands/compression.mjs b/bin/cli/commands/compression.mjs
index 95bb6f6c18..6992497f69 100644
--- a/bin/cli/commands/compression.mjs
+++ b/bin/cli/commands/compression.mjs
@@ -24,7 +24,7 @@ async function restCompressionStatus() {
   const combosBody = combosRes.ok ? await combosRes.json() : { combos: [] };
   const analytics = analyticsRes && analyticsRes.ok ? await analyticsRes.json() : null;
   return {
-    engine: settings.engine ?? null,
+    strategy: settings.defaultMode || "standard",
     settings,
     combos: combosBody.combos ?? combosBody,
     analytics,
@@ -33,7 +33,10 @@ async function restCompressionStatus() {
 
 async function restCompressionConfigure(config) {
   const body = { ...config };
-  if (body.engine) body.engine = normalizeEngine(body.engine);
+  if (body.strategy) {
+    body.defaultMode = body.strategy === "caveman" ? "standard" : normalizeEngine(body.strategy);
+    delete body.strategy;
+  }
   const res = await apiFetch("/api/settings/compression", { method: "PUT", body });
   if (!res.ok) {
     process.stderr.write(`Error: ${res.status}\n`);
@@ -43,9 +46,10 @@ async function restCompressionConfigure(config) {
 }
 
 async function restSetEngine(name) {
+  const normalized = normalizeEngine(name);
   const res = await apiFetch("/api/settings/compression", {
     method: "PUT",
-    body: { engine: normalizeEngine(name) },
+    body: { defaultMode: normalized === "caveman" ? "standard" : normalized },
   });
   if (!res.ok) {
     process.stderr.write(`Error: ${res.status}\n`);
@@ -103,7 +107,11 @@ export async function runCompressionStatus(opts, cmd) {
 
 export async function runCompressionConfigure(opts, cmd) {
   const config = {};
-  if (opts.engine) config.engine = opts.engine;
+  // #6571 — both the MCP tool schema (compressionConfigureInput) and
+  // handleCompressionConfigure expect `strategy`, not `engine`; a non-strict
+  // MCP schema silently strips an unrecognized `engine` key on the primary
+  // (MCP-mounted) path, so this must be `strategy` on both paths.
+  if (opts.engine) config.strategy = normalizeEngine(opts.engine);
   if (opts.cavemanAggressiveness !== undefined)
     config.caveman = { aggressiveness: opts.cavemanAggressiveness };
   if (opts.rtkBudget !== undefined) config.rtk = { tokenBudget: opts.rtkBudget };
@@ -163,7 +171,7 @@ export function registerCompression(program) {
   engine.command("set <name>").action(runCompressionEngineSet);
   engine.command("get").action(async (opts, cmd) => {
     const data = await mcpCall("omniroute_compression_status", {}, restCompressionStatus);
-    process.stdout.write(`${data.engine ?? "(default)"}\n`);
+    process.stdout.write(`${data.strategy ?? "(default)"}\n`);
   });
 
   const combos = cmp.command("combos").description(t("compression.combos.description"));
diff --git a/bin/cli/commands/health.mjs b/bin/cli/commands/health.mjs
index f9289e170a..d61a3e9c39 100644
--- a/bin/cli/commands/health.mjs
+++ b/bin/cli/commands/health.mjs
@@ -48,7 +48,11 @@ export async function runHealthCommand(opts = {}) {
   }
 
   try {
-    const res = await apiFetch("/api/health", { retry: false, timeout: 5000, acceptNotOk: true });
+    const res = await apiFetch("/api/monitoring/health", {
+      retry: false,
+      timeout: 5000,
+      acceptNotOk: true,
+    });
     if (!res.ok) {
       console.error(t("common.error", { message: `HTTP ${res.status}` }));
       return 1;
@@ -66,29 +70,22 @@ export async function runHealthCommand(opts = {}) {
     if (health.uptime) console.log(t("health.uptime", { uptime: health.uptime }));
     if (health.version) console.log(`  Version: ${health.version}`);
 
-    if (health.requests !== undefined) {
-      console.log(t("health.requests", { count: health.requests }));
+    if (health.activeConnections !== undefined) {
+      console.log(t("health.requests", { count: health.activeConnections }));
     }
 
-    if (health.breakers && opts.verbose) {
+    if (health.circuitBreakers && opts.verbose) {
       console.log("\n  \x1b[1mCircuit Breakers\x1b[0m");
-      for (const [name, status] of Object.entries(health.breakers)) {
-        const state =
-          status.state === "closed" ? "\x1b[32m● closed\x1b[0m" : "\x1b[33m○ open\x1b[0m";
-        console.log(`    ${name.padEnd(20)} ${state}`);
-      }
+      const { open = 0, halfOpen = 0, closed = 0 } = health.circuitBreakers;
+      console.log(`    \x1b[32m● closed\x1b[0m     ${closed}`);
+      console.log(`    \x1b[33m○ half-open\x1b[0m  ${halfOpen}`);
+      console.log(`    \x1b[31m○ open\x1b[0m       ${open}`);
     }
 
-    if (health.cache && opts.verbose) {
-      console.log("\n  \x1b[1mCache\x1b[0m");
-      console.log(`    Semantic hits:   ${health.cache.semanticHits || 0}`);
-      console.log(`    Signature hits:  ${health.cache.signatureHits || 0}`);
-    }
-
-    if (opts.verbose && health.memory) {
+    if (opts.verbose && health.memoryUsage) {
       console.log("\n  \x1b[1mMemory\x1b[0m");
-      console.log(`    RSS:        ${health.memory.rss || "N/A"}`);
-      console.log(`    Heap used:  ${health.memory.heapUsed || "N/A"}`);
+      console.log(`    RSS:        ${health.memoryUsage.rss || "N/A"}`);
+      console.log(`    Heap used:  ${health.memoryUsage.heapUsed || "N/A"}`);
     }
 
     return 0;
@@ -100,13 +97,17 @@ export async function runHealthCommand(opts = {}) {
 
 export async function runHealthComponentsCommand(opts = {}) {
   try {
-    const res = await apiFetch("/api/health", { retry: false, timeout: 5000, acceptNotOk: true });
+    const res = await apiFetch("/api/monitoring/health", {
+      retry: false,
+      timeout: 5000,
+      acceptNotOk: true,
+    });
     if (!res.ok) {
       console.error(`HTTP ${res.status}`);
       return 1;
     }
     const health = await res.json();
-    const components = health.components || health.breakers || {};
+    const components = health.components || health.circuitBreakers || {};
     for (const [name, info] of Object.entries(components)) {
       const status =
         typeof info === "object" ? info.state || info.status || "unknown" : String(info);
diff --git a/bin/cli/commands/serve.mjs b/bin/cli/commands/serve.mjs
index ab9d793ca3..b7abd7beeb 100644
--- a/bin/cli/commands/serve.mjs
+++ b/bin/cli/commands/serve.mjs
@@ -351,11 +351,35 @@ async function runWithSupervisor(
       if (up) {
         if (useTray) await maybeStartTray(dashboardPort, apiPort, supervisor);
         onReady(dashboardPort, apiPort, noOpen, startedAt);
+      } else {
+        reportReadinessTimeout(dashboardPort, supervisor);
       }
     });
   }
 }
 
+// #6321: waitForServer resolving `false` used to fall through silently — the CLI
+// printed the banner + "⏳ Starting server..." and then produced ZERO further
+// output forever, even though the child process may well have crashed or be
+// stuck (issue reports show the server sometimes actually comes up later, or is
+// reachable directly while the CLI still looks hung). Surface a clear diagnostic
+// plus whatever stdout/stderr the child buffered instead of going silent.
+export function reportReadinessTimeout(dashboardPort, supervisor) {
+  console.error(
+    `\n\x1b[33m⚠ Server did not respond within 60s.\x1b[0m It may still be starting, or may` +
+      ` have failed silently.`
+  );
+  console.error(`  Try:  curl -I http://localhost:${dashboardPort}/api/monitoring/health`);
+  console.error(`  Or:   rerun with \x1b[36m--log\x1b[0m to see live server output.\n`);
+
+  const recentLog = supervisor?.getRecentLog?.() ?? [];
+  if (recentLog.length) {
+    console.error("--- Recent server output ---");
+    recentLog.forEach((l) => console.error(l));
+    console.error("--- End recent output ---\n");
+  }
+}
+
 let _killTray = null;
 function killTrayIfActive() {
   if (_killTray) {
diff --git a/bin/cli/locales/zh-TW.json b/bin/cli/locales/zh-TW.json
new file mode 100644
index 0000000000..41a8974219
--- /dev/null
+++ b/bin/cli/locales/zh-TW.json
@@ -0,0 +1,1262 @@
+{
+  "common": {
+    "error": "錯誤：{message}",
+    "serverOffline": "OmniRoute 伺服器已離線。請啟動：omniroute serve",
+    "authRequired": "需要認證。請設定 OMNIROUTE_API_KEY 或執行：omniroute setup",
+    "rateLimited": "請求超出限制。請在 {seconds}s 後重試。",
+    "timeout": "請求在 {ms}ms 後超時。",
+    "success": "完成。",
+    "yes": "是",
+    "no": "否",
+    "confirm": "確定嗎？（是/否）",
+    "dryRun": "【模擬】將執行：{action}",
+    "cancelled": "已取消。",
+    "jsonOpt": "以 JSON 格式輸出",
+    "yesOpt": "跳過確認"
+  },
+  "program": {
+    "description": "OmniRoute — 具有自動故障轉移的智慧 AI 路由器",
+    "version": "列印版本並退出",
+    "output": "輸出格式（table, json, jsonl, csv）",
+    "quiet": "禁止非必要輸出",
+    "no_color": "停用彩色輸出",
+    "timeout": "HTTP 請求超時（毫秒）",
+    "api_key": "OmniRoute 伺服器的 API 金鑰",
+    "base_url": "OmniRoute 伺服器的基礎 URL",
+    "context": "此命令使用的伺服器上下文/配置檔案",
+    "lang": "設定 CLI 顯示語言（覆蓋 OMNIROUTE_LANG）"
+  },
+  "setup": {
+    "title": "OmniRoute 設定",
+    "passwordPrompt": "管理員密碼",
+    "providerPrompt": "預設提供商（留空跳過）",
+    "done": "設定完成",
+    "passwordSet": "管理員密碼已配置",
+    "providerSet": "提供商已配置：{name}",
+    "testingProvider": "正在測試提供商連線：{name}",
+    "testPassed": "提供商測試通過",
+    "testFailed": "提供商測試失敗：{error}",
+    "loginEnabled": "登入：已啟用（密碼已更新）",
+    "loginDisabled": "登入：已停用",
+    "providerInfo": "提供商：{info}"
+  },
+  "doctor": {
+    "title": "OmniRoute 診斷",
+    "dbOk": "資料庫：正常（{path}）",
+    "dbMissing": "資料庫：未初始化 — 執行 omniroute setup",
+    "portOk": "埠 {port}：可用",
+    "portConflict": "埠 {port}：已被其他程序佔用",
+    "encryptionOk": "加密金鑰：已配置",
+    "encryptionMissing": "加密金鑰缺失 — 執行 omniroute setup",
+    "allGood": "所有檢查通過。",
+    "warnings": "{count} 個警告 — 見上文。"
+  },
+  "providers": {
+    "title": "提供商",
+    "noProviders": "未配置提供商。執行：omniroute setup",
+    "testing": "正在測試 {name}...",
+    "available": "{count} 個提供商可用",
+    "connected": "已連線",
+    "disconnected": "未連線",
+    "validationFailed": "驗證失敗：{error}",
+    "metrics": {
+      "description": "顯示提供商效能指標（延遲、成功率、成本）",
+      "provider": "按提供商 ID 篩選",
+      "connection_id": "按連線 ID 篩選",
+      "period": "時間範圍：1h|6h|24h|7d|30d（預設：24h）",
+      "metric": "關注特定指標欄位",
+      "sort": "按欄位排序（降序）",
+      "limit": "最大行數（預設：50）",
+      "watch": "每 5 秒重新整理（即時模式）",
+      "compare": "逗號分隔的提供商 ID，並排比較"
+    },
+    "metric_single": {
+      "description": "獲取特定連線的單個指標值"
+    },
+    "rotate": {
+      "description": "輪換提供商連線的上游 API 金鑰",
+      "newKeyOpt": "新 API 金鑰值（避免使用：優先使用 --from-env）",
+      "fromEnvOpt": "從環境變數 VAR 讀取新金鑰",
+      "oauthOpt": "改為觸發 OAuth 重新認證流程",
+      "skipTestOpt": "跳過輪換後的連通性測試",
+      "dryRunOpt": "預覽將要更改的內容而不寫入",
+      "confirmPrompt": "替換連線 \"{name}\" ({id}) 的 API 金鑰？[y/N] ",
+      "dryRunResult": "【模擬】將輪換 \"{name}\" ({id}) 的金鑰。未做任何更改。",
+      "oauthHint": "OAuth 連線 — 執行：omniroute oauth {provider}",
+      "envVarEmpty": "環境變數 {var} 未設定或為空。",
+      "success": "已為 \"{name}\" 輪換金鑰。執行 providers test {id} 驗證。",
+      "testPassed": "輪換後測試通過。",
+      "testFailed": "輪換後測試失敗：{error}"
+    },
+    "status": {
+      "description": "顯示所有提供商連線的金鑰健康狀態（期限、過期、冷卻）",
+      "providerOpt": "按提供商名稱篩選",
+      "header": "ID         提供商       名稱                     過期狀態  測試狀態  冷卻至",
+      "noData": "沒有可用的提供商連線資料。",
+      "requiresServer": "providers status 需要 OmniRoute 伺服器正在執行。"
+    }
+  },
+  "keys": {
+    "title": "API 金鑰",
+    "addDescription": "為提供商新增或更新 API 金鑰",
+    "listDescription": "列出所有已配置的 API 金鑰",
+    "removeDescription": "移除提供商的 API 金鑰",
+    "regenerateDescription": "重新生成 OmniRoute API 金鑰",
+    "revokeDescription": "撤銷 OmniRoute API 金鑰",
+    "revealDescription": "顯示未掩碼的 API 金鑰值",
+    "usageDescription": "顯示 API 金鑰的最近使用情況",
+    "usageLimitOpt": "最近請求數",
+    "rotateDescription": "生成新金鑰並使舊金鑰失效",
+    "graceOpt": "舊金鑰失效前的寬限期（毫秒）",
+    "stdinOpt": "從標準輸入讀取 API 金鑰而不是引數",
+    "added": "已為 {provider} 新增金鑰。",
+    "removed": "金鑰已移除。",
+    "listed": "{count} 個金鑰。",
+    "noKeys": "未配置金鑰。",
+    "noUsage": "未找到使用資料。",
+    "confirmRemove": "移除金鑰 {id}？",
+    "confirmRegenerate": "重新生成金鑰 {id}？",
+    "confirmRevoke": "撤銷金鑰 {id}？",
+    "confirmRotate": "輪換金鑰 {id}？（舊金鑰將在寬限期後失效）",
+    "regenerated": "已重新生成。新金鑰：{key}",
+    "revoked": "金鑰 {id} 已撤銷。",
+    "rotated": "金鑰 {id} 已輪換。新金鑰 ID：{newId}",
+    "revealWarning": "⚠ 這將顯示完整的未掩碼金鑰。請確保您的螢幕不被人看到。",
+    "providerRequired": "需要提供商。",
+    "keyRequired": "需要 API 金鑰。",
+    "stdinEmpty": "未通過標準輸入提供 API 金鑰。",
+    "unknownProvider": "未知提供商：{provider}",
+    "policy": {
+      "title": "金鑰策略",
+      "showDescription": "顯示金鑰的速率/成本策略",
+      "setDescription": "設定金鑰的速率/成本策略",
+      "rateLimitOpt": "每分鐘最大請求數",
+      "maxCostOpt": "每日最大成本（美元）",
+      "allowedModelsOpt": "逗號分隔的允許模型列表",
+      "nothingToSet": "未提供策略欄位。使用 --rate-limit、--max-cost 或 --allowed-models。",
+      "updated": "策略已更新。"
+    },
+    "expiration": {
+      "title": "金鑰過期",
+      "listDescription": "列出即將過期的金鑰",
+      "daysOpt": "顯示 N 天內過期的金鑰",
+      "none": "{days} 天內沒有金鑰過期。",
+      "listTitle": "{days} 天內過期的金鑰："
+    }
+  },
+  "stream": {
+    "description": "使用 SSE 檢查模式流式傳輸聊天響應",
+    "file": "從檔案讀取提示",
+    "stdin": "從標準輸入讀取提示",
+    "model": "模型 ID（預設：auto）",
+    "system": "系統提示",
+    "combo": "強制指定組合名稱",
+    "max_tokens": "響應最大令牌數",
+    "responses_api": "使用 /v1/responses 而不是 /v1/chat/completions",
+    "raw": "列印接收到的原始 SSE 行",
+    "debug": "在 stderr 中列印每塊的時間資訊",
+    "save": "將所有 SSE 事件儲存到 .jsonl 檔案",
+    "error": {
+      "empty_prompt": "錯誤：需要提供提示（位置引數、--file 或 --stdin）"
+    }
+  },
+  "usage": {
+    "description": "使用分析、預算、配額和日誌",
+    "analytics": {
+      "description": "顯示彙總使用分析",
+      "period": "時間範圍：1d|7d|30d|90d|ytd|all（預設：30d）",
+      "provider": "按提供商 ID 篩選"
+    },
+    "budget": {
+      "description": "管理成本預算",
+      "set": {
+        "scope": "預算範圍（預設：全域性）",
+        "period": "預算週期：daily|weekly|monthly（預設：monthly）"
+      }
+    },
+    "quota": {
+      "description": "顯示提供商配額使用情況",
+      "provider": "按提供商 ID 篩選",
+      "check": "顯示新請求是否有可用配額"
+    },
+    "logs": {
+      "description": "顯示請求呼叫日誌",
+      "limit": "返回的日誌條目數（預設：100）",
+      "search": "篩選日誌的搜尋查詢",
+      "since": "返回自此時間戳以來的日誌",
+      "follow": "持續跟蹤新的日誌條目",
+      "api_key": "按 API 金鑰篩選日誌"
+    },
+    "utilization": {
+      "description": "顯示 API 金鑰利用率指標",
+      "api_key": "按 API 金鑰篩選"
+    },
+    "history": {
+      "description": "顯示請求歷史",
+      "limit": "歷史條目數（預設：100）"
+    },
+    "proxy_logs": {
+      "description": "顯示代理級請求日誌",
+      "limit": "代理日誌條目數（預設：100）"
+    }
+  },
+  "cost": {
+    "description": "按提供商、模型、組合或 API 金鑰顯示成本報告",
+    "period": "時間範圍：1d|7d|30d|90d|ytd|all（預設：30d）",
+    "since": "開始日期（ISO 格式，例如 2026-01-01）— 覆蓋 --period",
+    "until": "結束日期（ISO 格式）",
+    "group_by": "按以下方式分組：provider|model|api-key|combo|day（預設：provider）",
+    "api_key_filter": "按特定 API 金鑰篩選",
+    "limit": "顯示的最大行數（預設：100）"
+  },
+  "simulate": {
+    "description": "模擬路由（空執行）— 顯示將選擇哪些提供商而不呼叫上游",
+    "file": "從 JSON 檔案載入完整請求體",
+    "model": "模型 ID（預設：auto）",
+    "combo": "強制指定組合名稱",
+    "reasoning": "推理努力級別（low|medium|high）",
+    "thinking": "擴充套件思維令牌預算",
+    "explain": "在 stderr 中列印回退樹和成本範圍",
+    "noCombo": "未找到匹配的組合。使用以下命令配置：omniroute combo create"
+  },
+  "chat": {
+    "description": "向 OmniRoute 傳送一次性聊天提示",
+    "file": "從檔案讀取提示",
+    "stdin": "從標準輸入讀取提示",
+    "system": "系統提示",
+    "model": "模型 ID（預設：auto）",
+    "max_tokens": "響應最大令牌數",
+    "temperature": "取樣溫度（0–2）",
+    "top_p": "Top-p 核取樣",
+    "reasoning_effort": "推理努力級別（low|medium|high）",
+    "thinking_budget": "擴充套件思維令牌預算",
+    "combo": "強制指定組合名稱",
+    "responses_api": "使用 /v1/responses 而不是 /v1/chat/completions",
+    "stream": "增量流式傳輸響應",
+    "no_history": "不儲存到 ~/.omniroute/cli-history.jsonl",
+    "error": {
+      "empty_prompt": "錯誤：需要提供提示（位置引數、--file 或 --stdin）"
+    }
+  },
+  "serve": {
+    "description": "啟動 OmniRoute 伺服器（預設操作）",
+    "starting": "正在啟動 OmniRoute 伺服器（埠 {port}）...",
+    "ready": "就緒地址：http://localhost:{port}",
+    "stopping": "正在停止伺服器（PID {pid}）...",
+    "stopped": "伺服器已停止。",
+    "notRunning": "伺服器未在執行。",
+    "port": "監聽埠（預設：20128）",
+    "no_open": "不自動開啟瀏覽器",
+    "daemon": "以後臺守護程序方式執行伺服器",
+    "log": "內聯顯示伺服器日誌",
+    "no_recovery": "停用崩潰自動重啟（除錯模式）",
+    "max_restarts": "30 秒內的最大崩潰重啟次數（預設：2）",
+    "tray": "顯示系統托盤圖示（僅桌面，選擇加入）",
+    "no_tray": "停用系統托盤圖示"
+  },
+  "backup": {
+    "title": "備份",
+    "description": "建立 OmniRoute 資料備份",
+    "creating": "正在建立備份...",
+    "done": "備份已儲存至 {path}",
+    "noFiles": "沒有可備份的檔案（資料庫未初始化）",
+    "failed": "備份失敗：{error}",
+    "restoring": "正在從 {path} 恢復...",
+    "restored": "恢復完成。",
+    "restoreDescription": "從備份恢復",
+    "listTitle": "可用備份",
+    "noBackups": "未找到備份。",
+    "notFound": "未找到備份：{name}",
+    "confirmRestore": "用 {ts} 的備份覆蓋當前資料？",
+    "createDescription": "建立 OmniRoute 資料備份",
+    "nameOpt": "自定義備份名稱",
+    "cloudOpt": "將備份上傳到雲端儲存",
+    "encryptOpt": "使用 AES-256-GCM 加密備份",
+    "keyFileOpt": "包含加密密碼的檔案路徑",
+    "excludeOpt": "排除匹配模式的檔案（可重複）",
+    "retentionOpt": "僅保留最近 N 個備份",
+    "passphrasePrompt": "加密密碼：",
+    "noPassphrase": "加密備份需要密碼。",
+    "cloudFailed": "警告：雲上傳失敗。本地備份已儲存。",
+    "cloudUploaded": "雲備份已上傳：{url}",
+    "auto": {
+      "title": "備份計劃",
+      "enableDescription": "啟用定時自動備份",
+      "disableDescription": "停用定時自動備份",
+      "statusDescription": "顯示當前備份計劃狀態",
+      "cronOpt": "計劃 cron 表示式（預設：每天凌晨 3 點）",
+      "enabled": "已啟用自動備份（cron：{cron}）。",
+      "hint": "  計劃由 omniroute serve 啟動時讀取。",
+      "disabled": "已停用自動備份。",
+      "notConfigured": "未配置備份計劃。"
+    }
+  },
+  "health": {
+    "description": "檢查伺服器健康狀態和元件狀態",
+    "noServer": "伺服器未執行。啟動：omniroute serve",
+    "title": "健康狀態",
+    "status": "狀態：{status}",
+    "uptime": "執行時間：{uptime}",
+    "requests": "請求數（24h）：{count}",
+    "cost": "成本（24h）："
+  },
+  "quota": {
+    "description": "顯示提供商配額使用情況",
+    "noServer": "伺服器未執行。啟動：omniroute serve",
+    "noData": "沒有可用的配額資訊。"
+  },
+  "cache": {
+    "description": "管理響應快取",
+    "noServer": "伺服器未執行。啟動：omniroute serve",
+    "cleared": "快取已清除。",
+    "clearFailed": "清除快取失敗。"
+  },
+  "redis": {
+    "description": "一鍵啟動本地 Redis 容器（Podman 或 Docker），用於 OmniRoute 快取和配額跟蹤"
+  },
+  "test": {
+    "description": "測試提供商連線",
+    "noServer": "伺服器未執行。啟動：omniroute serve",
+    "testing": "正在測試 {provider} / {model}...",
+    "passed": "連線成功！",
+    "failed": "連線失敗：{error}",
+    "allProvidersOpt": "測試所有已配置的提供商",
+    "latencyOpt": "顯示延遲測量值（平均/最小/最大 毫秒）",
+    "repeatOpt": "重複測試 N 次並彙總結果",
+    "compareOpt": "逗號分隔的要比較的模型（例如 gpt-4o,claude-3-5-sonnet）",
+    "saveOpt": "將結果儲存到 JSON 檔案",
+    "saved": "結果已儲存至 {path}",
+    "compareTitle": "模型比較",
+    "compareMinTwo": "--compare 需要至少兩個模型（逗號分隔）",
+    "noProviders": "未配置提供商。新增：omniroute keys add"
+  },
+  "update": {
+    "checking": "正在檢查更新...",
+    "upToDate": "已是最新版本（{version}）。",
+    "available": "有可用更新：{current} → {latest}",
+    "installing": "正在安裝 {latest}...",
+    "done": "已更新至 {latest}。重啟伺服器以生效。"
+  },
+  "mcp": {
+    "title": "MCP 伺服器",
+    "running": "MCP 伺服器正在執行（{transport}）",
+    "stopped": "MCP 伺服器已停止。",
+    "restarted": "MCP 伺服器已重啟。",
+    "call": {
+      "description": "直接呼叫 MCP 工具",
+      "args": "JSON 引數物件（內聯）",
+      "args_file": "JSON 引數檔案路徑",
+      "stream": "使用流式端點（/api/mcp/stream）",
+      "scope": "所需作用域（可重複，例如 read:health）"
+    },
+    "scopes": {
+      "description": "列出可用的 MCP 作用域",
+      "tool": "顯示特定工具所需的作用域"
+    },
+    "tools": {
+      "description": "檢查 MCP 工具",
+      "list": {
+        "description": "列出所有 MCP 工具",
+        "scope": "按作用域篩選"
+      },
+      "info": {
+        "description": "顯示 MCP 工具的後設資料"
+      },
+      "schema": {
+        "description": "顯示 MCP 工具的輸入/輸出 JSON 模式",
+        "io": "模式型別：input|output（預設：input）"
+      }
+    },
+    "audit": {
+      "description": "MCP 審計日誌（audit --source mcp 的別名）"
+    }
+  },
+  "a2a": {
+    "skills": {
+      "description": "從代理卡片列出可用的 A2A 技能"
+    },
+    "invoke": {
+      "description": "呼叫 A2A 技能並返回任務 ID",
+      "input": "JSON 輸入物件",
+      "input_file": "JSON 輸入檔案路徑",
+      "wait": "等待任務完成後返回",
+      "timeout": "等待完成的超時時間（毫秒，預設：60000）"
+    },
+    "tasks": {
+      "description": "管理 A2A 任務",
+      "list": {
+        "status": "按狀態篩選",
+        "skill": "按技能 ID 篩選"
+      },
+      "watch": {
+        "description": "輪詢任務狀態直至完成"
+      },
+      "stream": {
+        "description": "通過 SSE 流式傳輸任務執行事件"
+      },
+      "logs": {
+        "description": "顯示任務訊息和產物"
+      }
+    }
+  },
+  "policy": {
+    "description": "管理 OmniRoute 授權策略",
+    "list": {
+      "description": "列出策略",
+      "kind": "按型別篩選（allow|deny|rate-limit|cost-cap）",
+      "scope": "按作用域篩選（global|api-key|provider）"
+    },
+    "get": {
+      "description": "按 ID 獲取策略詳情"
+    },
+    "create": {
+      "description": "從 JSON 檔案建立策略",
+      "file": "策略 JSON 檔案路徑"
+    },
+    "update": {
+      "description": "從 JSON 檔案更新策略",
+      "file": "策略 JSON 檔案路徑"
+    },
+    "delete": {
+      "description": "按 ID 刪除策略",
+      "yes": "跳過確認提示"
+    },
+    "evaluate": {
+      "description": "空執行策略評估（退出碼 0=允許，4=拒絕）",
+      "api_key": "要評估的 API 金鑰",
+      "action": "要檢查的操作（例如 chat, embed, admin）",
+      "resource": "資源路徑或識別符號",
+      "context": "作為 JSON 物件的額外上下文"
+    },
+    "export": {
+      "description": "將所有策略匯出到 JSON 檔案"
+    },
+    "import": {
+      "description": "從 JSON 檔案匯入策略",
+      "overwrite": "覆蓋具有相同 ID 的現有策略"
+    }
+  },
+  "compression": {
+    "description": "配置和檢查 OmniRoute 壓縮管道",
+    "status": {
+      "description": "顯示當前壓縮狀態和設定"
+    },
+    "configure": {
+      "description": "配置壓縮設定",
+      "engine": "壓縮引擎（caveman|rtk|hybrid|none）",
+      "caveman_agg": "Caveman 激程序度 0.0–1.0",
+      "rtk_budget": "RTK 令牌預算",
+      "language_pack": "要啟用的語言包"
+    },
+    "engine": {
+      "description": "獲取或設定活動壓縮引擎"
+    },
+    "combos": {
+      "description": "管理壓縮組合統計"
+    },
+    "rules": {
+      "description": "管理壓縮規則",
+      "add": {
+        "pattern": "要匹配的模式（正則或 field:pattern）",
+        "action": "操作：drop|shrink|replace"
+      }
+    },
+    "language_packs": {
+      "description": "列出可用的壓縮語言包"
+    },
+    "preview": {
+      "description": "預覽壓縮對請求的效果",
+      "file": "請求 JSON 檔案路徑"
+    }
+  },
+  "tunnel": {
+    "title": "隧道",
+    "listDescription": "列出活動隧道",
+    "createDescription": "建立隧道",
+    "created": "隧道已建立：{url}",
+    "stopped": "隧道已停止。",
+    "confirmStop": "停止隧道 {id}？",
+    "stopDescription": "停止隧道",
+    "statusDescription": "顯示隧道的詳細狀態",
+    "logsDescription": "顯示隧道日誌",
+    "infoDescription": "顯示隧道的配置詳情",
+    "rotateDescription": "生成新的隧道 URL",
+    "tailOpt": "顯示的日誌行數",
+    "typeRequired": "需要隧道型別。",
+    "noLogs": "沒有可用日誌。",
+    "notAvailable": "隧道資訊不可用。",
+    "noTunnels": "沒有活動隧道。",
+    "infoTitle": "隧道資訊：{type}",
+    "rotated": "隧道 URL 已輪換：{url}",
+    "confirmRotate": "輪換隧道 {type}？（將生成新 URL）"
+  },
+  "stop": {
+    "description": "停止 OmniRoute 伺服器",
+    "stopping": "正在停止伺服器（PID {pid}）...",
+    "stopped": "伺服器已停止。",
+    "notRunning": "沒有伺服器在執行。",
+    "portFallback": "未找到 PID 檔案，嘗試通過埠停止..."
+  },
+  "restart": {
+    "description": "重啟 OmniRoute 伺服器",
+    "restarting": "正在重啟 OmniRoute 伺服器..."
+  },
+  "dashboard": {
+    "description": "在瀏覽器中開啟 OmniRoute 儀表盤",
+    "opening": "正在開啟儀表盤：{url}",
+    "urlOnly": "僅列印儀表盤 URL，不開啟瀏覽器",
+    "tui": "開啟互動式 TUI 儀表盤（終端 UI，7 個標籤頁）"
+  },
+  "models": {
+    "description": "列出可用模型（需要伺服器）",
+    "search": "按 ID、名稱、提供商或描述篩選模型",
+    "noServer": "伺服器未執行。啟動：omniroute serve",
+    "noModels": "未找到模型。"
+  },
+  "audit": {
+    "description": "訪問合規和 MCP 審計日誌",
+    "source": "日誌來源：all|compliance|mcp（預設：all）",
+    "since": "返回自此時間戳以來的條目（ISO 8601）",
+    "until": "返回直至此時間戳的條目（ISO 8601）",
+    "tail": {
+      "description": "顯示最近的審計日誌條目",
+      "follow": "持續跟蹤新條目（2 秒輪詢）",
+      "limit": "顯示的最大條目數（預設：100）"
+    },
+    "search": {
+      "description": "按關鍵詞搜尋審計日誌條目",
+      "limit": "最大結果數（預設：200）",
+      "actor": "按參與者 ID 篩選",
+      "action": "按操作名稱篩選"
+    },
+    "export": {
+      "description": "將審計日誌匯出到檔案",
+      "format": "輸出格式：jsonl|csv（預設：jsonl）"
+    },
+    "stats": {
+      "description": "顯示審計日誌統計",
+      "period": "時間範圍：1d|7d|30d（預設：7d）"
+    },
+    "get": {
+      "description": "按 ID 獲取單個審計日誌條目"
+    }
+  },
+  "skills": {
+    "description": "管理 OmniRoute 技能（沙箱、內建、自定義、混合、skillssh）",
+    "list": {
+      "description": "列出已安裝的技能",
+      "type": "按型別篩選（sandbox|custom|builtin|hybrid|skillssh）",
+      "enabled": "僅顯示已啟用的技能",
+      "disabled": "僅顯示已停用的技能",
+      "api_key": "按 API 金鑰篩選"
+    },
+    "get": {
+      "description": "按 ID 獲取技能詳情"
+    },
+    "install": {
+      "description": "從檔案或 URL 安裝技能",
+      "from_file": "技能 JSON 定義檔案路徑",
+      "from_url": "遠端技能定義的 URL",
+      "type": "技能型別（sandbox|custom|hybrid）",
+      "enable": "安裝後啟用技能"
+    },
+    "enable": {
+      "description": "按 ID 啟用技能"
+    },
+    "disable": {
+      "description": "按 ID 停用技能",
+      "yes": "跳過確認提示"
+    },
+    "delete": {
+      "description": "按 ID 刪除技能",
+      "yes": "跳過確認提示"
+    },
+    "execute": {
+      "description": "按 ID 執行技能",
+      "input": "JSON 輸入物件",
+      "input_file": "JSON 輸入檔案路徑",
+      "timeout": "執行超時時間（毫秒，預設：30000）"
+    },
+    "executions": {
+      "description": "列出技能執行歷史",
+      "skill": "按技能 ID 篩選",
+      "limit": "最大結果數（預設：50）",
+      "status": "按狀態篩選（running|completed|failed）"
+    },
+    "skillssh": {
+      "description": "管理通過 SSH 安裝的技能"
+    },
+    "marketplace": {
+      "description": "瀏覽和安裝市場中的技能"
+    },
+    "mp": {
+      "search": {
+        "description": "搜尋市場包",
+        "category": "按類別篩選",
+        "tag": "按標籤篩選",
+        "limit": "最大結果數（預設：30）",
+        "sort": "排序方式：downloads|rating|recent"
+      },
+      "info": {
+        "description": "顯示包詳情和說明文件"
+      },
+      "install": {
+        "description": "安裝市場包",
+        "version": "包版本（預設：latest）",
+        "enable": "安裝後啟用",
+        "yes": "跳過確認提示"
+      },
+      "categories": {
+        "description": "列出市場類別"
+      },
+      "featured": {
+        "description": "顯示推薦市場包"
+      }
+    }
+  },
+  "memory": {
+    "description": "管理 OmniRoute 對話記憶（FTS5 + 向量）",
+    "search": {
+      "description": "按語義查詢搜尋記憶條目",
+      "type": "按記憶型別篩選（user|feedback|project|reference）",
+      "limit": "最大結果數（預設：20）",
+      "api_key": "按 API 金鑰篩選",
+      "token_budget": "限制結果中的總令牌數"
+    },
+    "add": {
+      "description": "新增新的記憶條目",
+      "content": "記憶文本內容",
+      "file": "從檔案讀取內容",
+      "type": "記憶型別（預設：user）",
+      "metadata": "JSON 後設資料物件",
+      "api_key": "關聯到 API 金鑰"
+    },
+    "clear": {
+      "description": "刪除匹配篩選條件的記憶條目",
+      "type": "按型別篩選",
+      "older": "刪除早於指定時長的條目（30d, 6m, 1y）",
+      "api_key": "按 API 金鑰篩選",
+      "yes": "跳過確認提示"
+    },
+    "list": {
+      "description": "列出記憶條目（不按搜尋排名）",
+      "type": "按型別篩選",
+      "limit": "最大結果數（預設：100）",
+      "api_key": "按 API 金鑰篩選"
+    },
+    "get": {
+      "description": "按 ID 獲取單個記憶條目"
+    },
+    "delete": {
+      "description": "按 ID 刪除記憶條目",
+      "yes": "跳過確認提示"
+    },
+    "health": {
+      "description": "顯示記憶子系統健康狀態（FTS5 + Qdrant）"
+    }
+  },
+  "oauth": {
+    "description": "管理 OAuth 提供商連線",
+    "providers": {
+      "description": "列出支援 OAuth 的提供商及其流程型別"
+    },
+    "start": {
+      "description": "為提供商啟動 OAuth 授權流程",
+      "provider": "提供商 ID（gemini, copilot, cursor, ...）",
+      "no_browser": "僅列印 URL — 不開啟瀏覽器",
+      "import_system": "從本地系統配置自動匯入憑據",
+      "social": "社交登入提供商（google|github）— kiro 需要",
+      "timeout": "等待授權超時時間（毫秒，預設：300000）"
+    },
+    "status": {
+      "description": "列出活動的 OAuth 連線",
+      "provider": "按提供商 ID 篩選"
+    },
+    "revoke": {
+      "description": "撤銷 OAuth 連線",
+      "provider": "要撤銷的提供商 ID",
+      "connection_id": "按 ID 撤銷特定連線",
+      "yes": "跳過確認提示"
+    }
+  },
+  "cloud": {
+    "description": "管理雲 AI 代理任務（codex, devin, jules）",
+    "agents": {
+      "description": "列出可用的雲代理"
+    },
+    "agent": {
+      "description": "管理 {agent} 雲代理任務",
+      "auth": {
+        "description": "通過 OAuth 授權 {agent}"
+      }
+    },
+    "task": {
+      "description": "管理雲代理任務",
+      "create": {
+        "description": "建立新的代理任務",
+        "title": "任務標題（預設為提示的前 80 個字元）",
+        "prompt": "任務提示文本",
+        "prompt_file": "從檔案讀取提示",
+        "repo": "要克隆的任務倉庫 URL",
+        "branch": "要使用的分支名稱",
+        "metadata": "JSON 後設資料物件"
+      },
+      "list": {
+        "description": "列出代理任務",
+        "status": "按狀態篩選（running|completed|failed|cancelled）",
+        "limit": "最大結果數（預設：50）"
+      },
+      "get": {
+        "description": "按 ID 獲取任務詳情"
+      },
+      "status": {
+        "description": "列印任務狀態（running|completed|failed|cancelled）"
+      },
+      "cancel": {
+        "description": "取消執行中的任務",
+        "yes": "跳過確認提示"
+      },
+      "approve": {
+        "description": "批准代理計劃開始執行"
+      },
+      "message": {
+        "description": "向執行中的任務傳送訊息"
+      }
+    },
+    "sources": {
+      "description": "列出任務產生的原始檔"
+    }
+  },
+  "eval": {
+    "description": "管理評估套件和執行",
+    "suites": {
+      "description": "管理評估套件",
+      "list": {
+        "description": "列出評估套件"
+      },
+      "get": {
+        "description": "按 ID 獲取評估套件詳情"
+      },
+      "create": {
+        "description": "從 JSON 檔案建立評估套件",
+        "file": "套件定義 JSON 檔案路徑"
+      }
+    },
+    "run": {
+      "description": "為套件啟動評估執行",
+      "model": "要評估的模型 ID（預設：auto）",
+      "combo": "強制指定組合名稱",
+      "concurrency": "併發樣本數（預設：4）",
+      "tag": "標記此次執行以便後續篩選",
+      "watch": "觀察執行進度直至完成"
+    },
+    "list": {
+      "description": "列出評估執行",
+      "suite": "按套件 ID 篩選",
+      "status": "按狀態篩選",
+      "since": "返回自此時間戳以來的執行",
+      "limit": "最大結果數（預設：50）"
+    },
+    "get": {
+      "description": "按 ID 獲取評估執行詳情"
+    },
+    "results": {
+      "description": "顯示評估執行的樣本結果",
+      "failed": "僅顯示失敗的樣本"
+    },
+    "cancel": {
+      "description": "取消正在執行的評估",
+      "yes": "跳過確認提示"
+    },
+    "scorecard": {
+      "description": "顯示已完成評估執行的記分卡"
+    }
+  },
+  "webhooks": {
+    "description": "管理 OmniRoute Webhook",
+    "events": {
+      "description": "列出所有可用的 Webhook 事件型別"
+    },
+    "list": {
+      "description": "列出已配置的 Webhook"
+    },
+    "get": {
+      "description": "按 ID 獲取 Webhook 詳情"
+    },
+    "add": {
+      "description": "註冊新的 Webhook",
+      "url": "目標 URL",
+      "events": "逗號分隔的事件型別列表",
+      "secret": "HMAC 簽名金鑰",
+      "header": "額外的標頭（key=value 格式，可重複）",
+      "no_enabled": "以停用狀態建立 Webhook"
+    },
+    "update": {
+      "description": "更新現有 Webhook",
+      "enabled": "設定啟用狀態（true|false）"
+    },
+    "remove": {
+      "description": "刪除 Webhook",
+      "yes": "跳過確認提示"
+    },
+    "test": {
+      "description": "向 Webhook 傳送測試事件",
+      "event": "要模擬的事件型別（預設：request.completed）"
+    }
+  },
+  "files": {
+    "description": "管理檔案（上傳、列出、獲取、下載、刪除）",
+    "list": {
+      "purpose": "按用途篩選",
+      "limit": "最大結果數"
+    },
+    "get": {
+      "description": "獲取檔案後設資料"
+    },
+    "upload": {
+      "description": "上傳檔案",
+      "purpose": "檔案用途（batch, assistants, fine-tune）"
+    },
+    "content": {
+      "description": "下載檔案內容",
+      "out": "儲存到路徑（預設：stdout）"
+    },
+    "delete": {
+      "yes": "跳過確認"
+    }
+  },
+  "batches": {
+    "description": "管理相容 OpenAI 的批次作業",
+    "list": {
+      "status": "按狀態篩選",
+      "limit": "最大結果數"
+    },
+    "create": {
+      "description": "建立批次作業",
+      "inputFile": "輸入檔案 ID",
+      "endpoint": "目標端點",
+      "window": "完成視窗",
+      "metadata": "新增後設資料 key=value"
+    },
+    "submit": {
+      "description": "上傳 JSONL 檔案並建立批次作業",
+      "jsonl": "JSONL 檔案路徑",
+      "endpoint": "目標端點",
+      "wait": "等待完成"
+    },
+    "cancel": {
+      "yes": "跳過確認"
+    },
+    "wait": {
+      "timeout": "超時時間（毫秒）"
+    },
+    "output": {
+      "out": "將輸出儲存到路徑"
+    },
+    "errors": {
+      "out": "將錯誤儲存到路徑"
+    }
+  },
+  "translator": {
+    "description": "在 LLM 格式之間轉換請求體",
+    "detect": {
+      "description": "檢測請求體格式"
+    },
+    "translate": {
+      "description": "將請求體從一種格式轉換為另一種格式"
+    },
+    "send": {
+      "description": "轉換併發送到上游"
+    },
+    "stream": {
+      "description": "流式轉換請求體"
+    },
+    "from": "源格式（openai|anthropic|gemini|cohere）",
+    "to": "目標格式（openai|anthropic|gemini|cohere）",
+    "file": "請求體 JSON 檔案路徑",
+    "out": "將輸出儲存到檔案",
+    "model": "覆蓋模型",
+    "history": {
+      "limit": "最大結果數"
+    }
+  },
+  "pricing": {
+    "description": "管理模型定價資料",
+    "sync": {
+      "description": "從上游同步價格",
+      "provider": "按提供商篩選",
+      "force": "強制重新同步"
+    },
+    "list": {
+      "provider": "按提供商篩選",
+      "model": "按模型篩選",
+      "limit": "最大結果數"
+    },
+    "defaults": {
+      "description": "管理預設定價",
+      "input": "每 1M 令牌的輸入成本（美元）",
+      "output": "每 1M 令牌的輸出成本（美元）",
+      "cacheRead": "每 1M 令牌的快取讀取成本（美元）",
+      "cacheWrite": "每 1M 令牌的快取寫入成本（美元）"
+    },
+    "diff": {
+      "description": "顯示與上游價格的差異",
+      "model": "按模型篩選"
+    }
+  },
+  "resilience": {
+    "description": "檢查和管理彈性機制",
+    "status": {
+      "provider": "按提供商篩選"
+    },
+    "breakers": {
+      "provider": "按提供商篩選"
+    },
+    "cooldowns": {
+      "provider": "按提供商篩選",
+      "connectionId": "按連線 ID 篩選"
+    },
+    "lockouts": {
+      "provider": "按提供商篩選",
+      "model": "按模型篩選"
+    },
+    "reset": {
+      "description": "重置斷路器/冷卻狀態",
+      "provider": "要重置的提供商",
+      "connectionId": "要重置的連線 ID",
+      "model": "要重置鎖定狀態的模型",
+      "allCooldowns": "重置提供商的所有冷卻",
+      "yes": "跳過確認"
+    },
+    "profile": {
+      "description": "管理彈性配置檔案",
+      "name": "配置檔名稱"
+    },
+    "config": {
+      "description": "管理彈性配置",
+      "threshold": "失敗閾值",
+      "resetTimeout": "重置超時（毫秒）",
+      "baseCooldown": "基礎冷卻時間（毫秒）"
+    }
+  },
+  "nodes": {
+    "description": "管理提供商節點（端點）",
+    "list": {
+      "provider": "按提供商篩選",
+      "enabled": "僅顯示已啟用的節點"
+    },
+    "add": {
+      "provider": "提供商名稱",
+      "baseUrl": "節點的基礎 URL",
+      "name": "節點名稱",
+      "weight": "負載均衡權重",
+      "region": "區域標籤",
+      "authHeader": "自定義認證標頭（key=value）"
+    },
+    "update": {
+      "baseUrl": "新的基礎 URL",
+      "name": "新名稱",
+      "weight": "新權重",
+      "region": "新區域",
+      "enabled": "啟用或停用（true|false）"
+    },
+    "remove": {
+      "yes": "跳過確認"
+    },
+    "validate": {
+      "baseUrl": "要驗證的 URL",
+      "provider": "要驗證的提供商"
+    },
+    "test": {
+      "description": "向節點發送測試請求"
+    },
+    "metrics": {
+      "description": "顯示節點指標",
+      "period": "時間範圍（例如 24h, 7d）"
+    }
+  },
+  "context": {
+    "description": "配置上下文工程管道（Caveman, RTK）",
+    "analytics": {
+      "period": "時間範圍（例如 7d, 30d）"
+    },
+    "caveman": {
+      "description": "管理 Caveman 上下文壓縮器",
+      "config": {
+        "description": "顯示或更新 Caveman 配置",
+        "aggressiveness": "激程序度 0.0–1.0",
+        "maxShrinkPct": "最大壓縮百分比",
+        "preserveTags": "要保留的逗號分隔標籤"
+      }
+    },
+    "rtk": {
+      "description": "管理 RTK 上下文最佳化器",
+      "config": {
+        "description": "顯示或更新 RTK 配置",
+        "tokenBudget": "RTK 令牌預算",
+        "reservePct": "保留百分比"
+      },
+      "filters": {
+        "description": "管理 RTK 過濾器",
+        "pattern": "過濾器模式（正則）",
+        "priority": "過濾器優先順序（預設：100）",
+        "action": "過濾器操作：drop|shrink|replace",
+        "yes": "跳過確認"
+      },
+      "test": {
+        "file": "請求 JSON 檔案路徑"
+      }
+    },
+    "combos": {
+      "description": "上下文感知的組合管理"
+    }
+  },
+  "sessions": {
+    "description": "檢查和管理活動會話",
+    "list": {
+      "user": "按使用者篩選",
+      "kind": "按型別篩選（dashboard|api-key|mcp|a2a）",
+      "active": "僅顯示活動會話",
+      "limit": "最大結果數（預設：100）"
+    },
+    "expire": {
+      "yes": "跳過確認"
+    },
+    "expireAll": {
+      "user": "要過期其會話的使用者",
+      "yes": "跳過確認"
+    }
+  },
+  "tags": {
+    "description": "管理資源標籤",
+    "add": {
+      "color": "標籤顏色（十六進位制或名稱）",
+      "description": "標籤描述"
+    },
+    "remove": {
+      "yes": "跳過確認"
+    },
+    "assign": {
+      "tag": "標籤名稱",
+      "to": "目標資源，格式為 type:id（例如 provider:openai）"
+    },
+    "unassign": {
+      "tag": "標籤名稱",
+      "from": "來源資源，格式為 type:id"
+    }
+  },
+  "openapi": {
+    "description": "訪問和測試 OmniRoute OpenAPI 規範",
+    "dump": {
+      "description": "將 OpenAPI 規範輸出到 stdout 或檔案",
+      "format": "輸出格式：yaml|json（預設：yaml）",
+      "out": "儲存到檔案路徑"
+    },
+    "validate": {
+      "description": "驗證 OpenAPI 規範"
+    },
+    "try": {
+      "description": "通過規範測試 API 端點",
+      "method": "HTTP 方法（預設：GET）",
+      "body": "請求體 JSON 檔案路徑",
+      "query": "查詢引數 key=value（可重複）",
+      "header": "標頭 key=value（可重複）"
+    },
+    "endpoints": {
+      "description": "列出所有 API 端點",
+      "search": "按路徑或摘要篩選"
+    },
+    "paths": {
+      "description": "列出所有 API 路徑"
+    }
+  },
+  "combo": {
+    "title": "組合",
+    "switched": "當前組合：{name}",
+    "created": "組合已建立：{name}",
+    "deleted": "組合已刪除：{name}",
+    "noCombos": "未配置組合。",
+    "confirmDelete": "刪除組合 {name}？",
+    "suggest": {
+      "description": "使用 AI 評分為任務推薦最佳組合",
+      "task": "任務描述",
+      "maxCost": "每次請求的最大成本（美元）",
+      "maxLatencyMs": "最大延遲（毫秒）",
+      "weights": "JSON 評分權重，例如 {\"latency\":0.7,\"cost\":0.3}",
+      "top": "要顯示的候選數（預設：5）",
+      "explain": "將理由列印到 stderr",
+      "switch": "啟用排名最高的組合"
+    }
+  },
+  "oneproxy": {
+    "description": "管理 OneProxy 上游代理池",
+    "stats": {
+      "provider": "按提供商篩選",
+      "period": "時間範圍（預設：24h）"
+    },
+    "fetch": {
+      "description": "從代理池獲取代理",
+      "count": "要獲取的代理數（預設：1）",
+      "type": "代理型別：http|socks5（預設：http）"
+    },
+    "rotate": {
+      "description": "強制輪換代理",
+      "provider": "要輪換的提供商",
+      "connectionId": "要輪換的特定連線 ID"
+    },
+    "config": {
+      "description": "顯示或更新 OneProxy 配置",
+      "enabled": "啟用代理池（true|false）",
+      "poolSize": "池大小",
+      "providerSource": "代理提供商的 URL",
+      "rotationPolicy": "輪換策略：sticky|per-request|periodic"
+    },
+    "pool": {
+      "description": "列出當前代理池及指標"
+    }
+  },
+  "open": {
+    "description": "在瀏覽器中開啟特定的 OmniRoute 儀表盤頁面",
+    "url": "僅列印 URL，不開啟瀏覽器"
+  },
+  "telemetry": {
+    "description": "訪問聚合遙測資料",
+    "summary": {
+      "description": "顯示聚合遙測摘要",
+      "period": "時間範圍：24h|7d|30d（預設：24h）",
+      "compareTo": "與上一時期比較"
+    },
+    "export": {
+      "description": "將遙測事件匯出到 JSONL",
+      "out": "輸出檔案路徑（預設：telemetry.jsonl）",
+      "period": "匯出時間範圍（預設：7d）"
+    }
+  },
+  "sync": {
+    "description": "在 OmniRoute 例項之間同步配置",
+    "push": {
+      "description": "將配置推送到雲或遠端例項",
+      "target": "目標（cloud 或 context:name）",
+      "bundle": "要同步的包部分",
+      "dryRun": "預覽但不應用"
+    },
+    "pull": {
+      "description": "從雲或遠端拉取配置",
+      "source": "來源（cloud 或 context:name）",
+      "merge": "與現有配置合併",
+      "replace": "替換現有配置",
+      "dryRun": "預覽但不應用"
+    },
+    "diff": {
+      "source": "源上下文",
+      "target": "目標上下文"
+    },
+    "bundle": {
+      "description": "將配置匯出為包檔案",
+      "include": "要包含的部分（逗號分隔）"
+    },
+    "import": {
+      "description": "匯入包檔案",
+      "dryRun": "驗證但不應用"
+    },
+    "initialize": {
+      "fromCloud": "從雲備份初始化"
+    },
+    "tokens": {
+      "description": "管理同步令牌",
+      "create": {
+        "name": "令牌名稱",
+        "scope": "令牌作用域",
+        "ttl": "令牌有效期（例如 30d）"
+      },
+      "revoke": {
+        "yes": "跳過確認"
+      }
+    },
+    "resolve": {
+      "description": "互動式解決同步衝突"
+    }
+  },
+  "config": {
+    "contexts": {
+      "description": "管理伺服器上下文/配置檔案（新增、使用、列出、顯示、移除、重新命名、匯出、匯入）"
+    },
+    "lang": {
+      "description": "管理 CLI 顯示語言",
+      "getDescription": "顯示當前活動的語言程式碼",
+      "setDescription": "設定顯示語言並儲存到配置",
+      "listDescription": "列出所有可用語言",
+      "listTitle": "可用語言",
+      "current": "語言：{code}（{name}）",
+      "saved": "語言已設定為 {code}（{name}）。",
+      "noCode": "需要語言程式碼。執行 omniroute config lang list 檢視可用程式碼。",
+      "unknown": "未知語言程式碼：{code}。執行 omniroute config lang list 檢視可用程式碼。",
+      "alreadySet": "語言已設定為 {code}。",
+      "envHint": "提示：您也可以在環境中設定 OMNIROUTE_LANG={code}。"
+    }
+  },
+  "completion": {
+    "description": "生成或安裝 Shell 補全指令碼",
+    "zsh": "列印 zsh 補全指令碼",
+    "bash": "列印 bash 補全指令碼",
+    "fish": "列印 fish 補全指令碼",
+    "install": "為檢測到的 Shell 全域性安裝補全指令碼",
+    "refresh": "重新整理組合/提供商/模型快取"
+  },
+  "logs": {
+    "description": "流式傳輸或匯出請求日誌",
+    "follow": "即時流式傳輸日誌",
+    "filter": "按級別篩選（error,warn,info）— 逗號分隔",
+    "lines": "要獲取的行數",
+    "timeout": "連線超時（毫秒）",
+    "baseUrl": "OmniRoute API 基礎 URL",
+    "requestId": "按請求 ID 篩選",
+    "apiKey": "按 API 金鑰篩選",
+    "combo": "按組合名稱篩選",
+    "status": "按 HTTP 狀態碼篩選",
+    "durationMin": "最小請求持續時間（毫秒）",
+    "durationMax": "最大請求持續時間（毫秒）",
+    "export": "將日誌儲存到檔案（json/jsonl/csv）",
+    "exported": "日誌已儲存至 {path}",
+    "stopped": "日誌流已停止。",
+    "streamError": "日誌流錯誤：{message}"
+  },
+  "tray": {
+    "description": "控制系統托盤圖示",
+    "show": "顯示托盤圖示（如果伺服器使用 --tray 執行）",
+    "hide": "隱藏托盤圖示",
+    "quit": "通過托盤退出 OmniRoute"
+  },
+  "autostart": {
+    "description": "管理 OmniRoute 開機自啟（Linux：systemd 使用者服務）",
+    "enable": "啟用開機自啟",
+    "disable": "停用開機自啟",
+    "status": "顯示自啟狀態",
+    "toggle": "切換開機自啟"
+  },
+  "runtime": {
+    "description": "管理本地執行時依賴",
+    "check": "檢查執行時目錄中本地依賴的狀態",
+    "repair": "重新安裝執行時目錄中的本地依賴",
+    "repair_force": "即使有效也強制重新安裝",
+    "clean": "刪除執行時目錄（釋放磁碟空間）",
+    "clean_yes": "跳過確認"
+  },
+  "repl": {
+    "description": "與 LLM 互動式多輪 REPL",
+    "model": "要使用的模型（預設：auto）",
+    "combo": "要使用的組合名稱",
+    "system": "系統提示",
+    "resume": "按名稱恢復儲存的會話"
+  },
+  "plugin": {
+    "description": "管理 CLI 外掛（omniroute-cmd-*）",
+    "list": "列出已安裝的外掛",
+    "install": "從 npm 或本地路徑安裝外掛",
+    "remove": "刪除已安裝的外掛",
+    "info": "顯示已安裝外掛的詳情",
+    "search": "搜尋 npm 登錄檔中的可用外掛",
+    "update": "更新已安裝的外掛",
+    "scaffold": "搭建新的外掛模板"
+  }
+}
diff --git a/bin/cli/output.mjs b/bin/cli/output.mjs
index 786c3da340..69f2518b74 100644
--- a/bin/cli/output.mjs
+++ b/bin/cli/output.mjs
@@ -37,6 +37,7 @@ function inferSchema(sample) {
 function formatCell(v, col) {
   if (v == null) return "";
   if (col.formatter) return col.formatter(v);
+  if (typeof v === "object") return JSON.stringify(v);
   return String(v);
 }
 
diff --git a/bin/cli/runtime/processSupervisor.mjs b/bin/cli/runtime/processSupervisor.mjs
index 63f2a9912f..1af7c9313c 100644
--- a/bin/cli/runtime/processSupervisor.mjs
+++ b/bin/cli/runtime/processSupervisor.mjs
@@ -35,22 +35,32 @@ export class ServerSupervisor {
     // heap via NODE_OPTIONS (a CLI arg would shadow/override their value). The
     // calibrated heap is already carried by env.NODE_OPTIONS either way.
     const heapArgs = buildNodeHeapArgs(process.env, this.memoryLimit);
+    // #6321: stdout used to be discarded (`"ignore"`) whenever `--log`/OMNIROUTE_SHOW_LOG
+    // wasn't set (the default) — any debug/pino output written to stdout vanished
+    // silently, so a boot that never becomes ready looked like a dead hang with zero
+    // output even at APP_LOG_LEVEL=debug. Pipe stdout too and buffer it alongside
+    // stderr so a readiness timeout can surface what the child actually printed.
     this.child = spawn("node", [...heapArgs, this.serverPath], {
       cwd: dirname(this.serverPath),
       env: this.env,
-      stdio: showLog ? "inherit" : ["ignore", "ignore", "pipe"],
+      stdio: showLog ? "inherit" : ["ignore", "pipe", "pipe"],
     });
 
     writePidFile("server", this.child.pid);
 
+    const bufferOutput = (data) => {
+      const lines = data.toString().split("\n").filter(Boolean);
+      this.crashLog.push(...lines);
+      if (this.crashLog.length > CRASH_LOG_LINES) {
+        this.crashLog = this.crashLog.slice(-CRASH_LOG_LINES);
+      }
+    };
+
+    if (this.child.stdout) {
+      this.child.stdout.on("data", bufferOutput);
+    }
     if (this.child.stderr) {
-      this.child.stderr.on("data", (data) => {
-        const lines = data.toString().split("\n").filter(Boolean);
-        this.crashLog.push(...lines);
-        if (this.crashLog.length > CRASH_LOG_LINES) {
-          this.crashLog = this.crashLog.slice(-CRASH_LOG_LINES);
-        }
-      });
+      this.child.stderr.on("data", bufferOutput);
     }
 
     this.child.on("error", (err) => this.handleExit(-1, err));
@@ -107,6 +117,12 @@ export class ServerSupervisor {
     }, delay);
   }
 
+  // #6321: exposes the buffered stdout+stderr lines so a caller (e.g. a readiness
+  // timeout) can print what the child actually said instead of silence.
+  getRecentLog() {
+    return [...this.crashLog];
+  }
+
   dumpCrashLog() {
     console.error("\n--- Server crash log ---");
     this.crashLog.forEach((l) => console.error(l));
diff --git a/bin/cli/utils/pid.mjs b/bin/cli/utils/pid.mjs
index 6c94437e37..1149c67251 100644
--- a/bin/cli/utils/pid.mjs
+++ b/bin/cli/utils/pid.mjs
@@ -65,34 +65,52 @@ export function sleep(ms) {
 // cold start due to filesystem watchers, antivirus, etc.) get a working
 // "server ready" signal instead of a phantom timeout while the server is
 // still booting. TCP fallback marks the server as ready when the port
-// has been listening for >= 3s consecutively but /api/monitoring/health
-// has not yet been mounted — common during dev cold start.
+// has been listening for >= 3s consecutively AND the health route is
+// actively rejecting/resetting connections fast (route not mounted yet,
+// but the HTTP server is clearly alive and responsive) — never for a
+// socket that merely accepts TCP and then hangs without ever completing
+// a single request (#6800: that's a still-booting/CPU-bound process, not
+// a "route not mounted" gap, and must NOT be reported as ready).
 export async function waitForServer(port, timeout = 60000) {
   const start = Date.now();
   let tcpListeningSince = null;
   while (Date.now() - start < timeout) {
-    try {
-      const res = await fetch(`http://localhost:${port}/api/monitoring/health`, {
-        signal: AbortSignal.timeout(2000),
-      });
-      if (res.ok) return true;
-      // Server responded but health endpoint is not ready yet — keep
-      // polling, but the fact that we got a response means TCP is open.
+    const outcome = await pollHealthOnce(port);
+    if (outcome === "ready") return true;
+    if (outcome === "fast-reject") {
       if (tcpListeningSince === null) tcpListeningSince = Date.now();
-    } catch {
-      const listening = await isPortListening(port).catch(() => false);
-      if (listening) {
-        if (tcpListeningSince === null) tcpListeningSince = Date.now();
-        if (Date.now() - tcpListeningSince >= 3000) return true;
-      } else {
-        tcpListeningSince = null;
-      }
+      if (Date.now() - tcpListeningSince >= 3000) return true;
+    } else {
+      // "hanging" (request timed out with no response at all) or
+      // "not-listening" — neither counts toward the grace window.
+      tcpListeningSince = null;
     }
     await sleep(500);
   }
   return false;
 }
 
+// Polls /api/monitoring/health once and classifies the outcome:
+// - "ready": got a 2xx HTTP response.
+// - "fast-reject": got a non-2xx HTTP response, or the connection was
+//   actively refused/reset (not a timeout) — the HTTP server is alive and
+//   answering quickly, just not routing this endpoint yet (#2460).
+// - "hanging": the request timed out waiting for any response — the
+//   process accepted the TCP connection but never answered (#6800).
+// - "not-listening": nothing is accepting connections on the port at all.
+async function pollHealthOnce(port) {
+  try {
+    const res = await fetch(`http://localhost:${port}/api/monitoring/health`, {
+      signal: AbortSignal.timeout(2000),
+    });
+    return res.ok ? "ready" : "fast-reject";
+  } catch (err) {
+    if (err?.name === "TimeoutError") return "hanging";
+    const listening = await isPortListening(port).catch(() => false);
+    return listening ? "fast-reject" : "not-listening";
+  }
+}
+
 async function isPortListening(port) {
   const net = await import("node:net");
   return new Promise((resolve) => {
diff --git a/changelog.d/README.md b/changelog.d/README.md
new file mode 100644
index 0000000000..1e383a0a1d
--- /dev/null
+++ b/changelog.d/README.md
@@ -0,0 +1,42 @@
+# changelog.d/ — changelog fragments
+
+**A PR never edits `CHANGELOG.md` directly during the cycle.** Instead it adds ONE new
+file here — its changelog entry as a *fragment*. Two PRs never touch the same file, so
+changelog merge conflicts (the "CHANGELOG-eat" cascade that forced a re-sync push + full
+CI re-run after every sibling merge) are structurally impossible.
+
+## Convention
+
+| Directory      | Aggregates under        |
+| -------------- | ----------------------- |
+| `features/`    | `### ✨ New Features`   |
+| `fixes/`       | `### 🐛 Bug Fixes`      |
+| `maintenance/` | `### 📝 Maintenance`    |
+
+- **Filename**: `<PR-number>-<short-slug>.md` (e.g. `fixes/6700-dockerfile-better-sqlite3.md`).
+  The PR number prefix keeps aggregation order deterministic.
+- **Content**: the exact bullet line(s) that should land in `CHANGELOG.md`, starting with
+  `- `. Multi-line (continuation) bullets are fine. Keep the repo's credit format:
+  `(#PR — thanks @user)`.
+- One fragment per PR (rarely more, e.g. a PR that both fixes and adds).
+
+## Example
+
+`changelog.d/fixes/6496-cloudflare-relay-worker-syntax.md`:
+
+```markdown
+- **fix(providers):** Cloudflare relay Worker deploys use Service Worker syntax with `body_part` metadata ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)) — thanks @SeaXen
+```
+
+## Aggregation
+
+The release captain (or `/generate-release`) folds all fragments into `CHANGELOG.md` and
+deletes them:
+
+```bash
+node scripts/release/aggregate-changelog.mjs            # write + delete fragments
+node scripts/release/aggregate-changelog.mjs --dry-run  # preview only
+```
+
+Fragment well-formedness is enforced by `npm run check:changelog-integrity` (the same
+gate that guards against CHANGELOG-eat for legacy direct edits).
diff --git a/changelog.d/features/.gitkeep b/changelog.d/features/.gitkeep
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/changelog.d/fixes/.gitkeep b/changelog.d/fixes/.gitkeep
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/changelog.d/maintenance/.gitkeep b/changelog.d/maintenance/.gitkeep
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/config/i18n.json b/config/i18n.json
index 6e1492496b..2b44ee7aa8 100644
--- a/config/i18n.json
+++ b/config/i18n.json
@@ -340,6 +340,14 @@
       "native": "中文 (简体)",
       "english": "Chinese (Simplified)",
       "flag": "🇨🇳"
+    },
+    {
+      "code": "zh-TW",
+      "label": "ZH-TW",
+      "name": "中文 (繁體)",
+      "native": "中文 (繁體)",
+      "english": "Chinese (Traditional)",
+      "flag": "🇹🇼"
     }
   ]
 }
diff --git a/config/quality/complexity-baseline.json b/config/quality/complexity-baseline.json
index 7a26300e35..361666034a 100644
--- a/config/quality/complexity-baseline.json
+++ b/config/quality/complexity-baseline.json
@@ -1,6 +1,9 @@
 {
   "_comment": "Catraca de complexidade (check-complexity.mjs, ESLint core rules complexity>=15 e max-lines-per-function>80 sobre src+open-sse+electron+bin via eslint.complexity.config.mjs). Conta total de violacoes; so pode cair. --update ratcheta.",
-  "count": 2050,
+  "count": 2056,
+  "_rebaseline_2026_07_10_v3847_merge_burst": "2053->2054 (+1). Drift herdado do merge burst do dia em release/v3.8.47 (campanha /implement-prs: ~36 PRs mergeados — órfãos, features do dono, ports). O check:complexity NÃO roda no fast-path PR->release, então o ramo acumulou o +1 sem rebaselinar (mesma família de todos os rebaselines abaixo). Trust-but-verify: medido 2054 no tip da release pós-burst; a única função flagada nova é pré-existente (getResolvedModelCapabilities em modelCapabilities.ts, já >teto antes de #6714). Nenhum PR órfão/feature introduz violação NOVA — os fixes deste ciclo são complexity-net-zero. Rebaseline aprovado pelo dono (2026-07-10) para destravar o FQG dos ~7 órfãos verdes-exceto-complexity. Tighten via --update next cycle.",
+  "_rebaseline_2026_07_10_gcf_v3_2": "2054->2056 (+2). PR feat/headroom-gcf-v3.2-nested-flattening: own growth from re-vendoring the GCF (Headroom) codec to spec v3.2 (nested flattening). The 2 new over-threshold functions are the v3.2 `>`-path flatten/unflatten walk in the vendored generic-profile encode/decode paths (open-sse/services/compression/engines/headroom/gcf/{generic,decode_generic}.ts). This is imported third-party code kept byte-faithful to upstream gcf-typescript, not extractable without diverging from the vendored source; local measures 2055 on the merged tree; frozen at 2056 = the base's CI-observed 2054 + this PR's 2 new functions, matching the documented local-vs-CI off-by-one convention (see _rebaseline_2026_07_02_v3844_ci_observed) so the GitHub runner stays green. Round-trip guarded by tests/unit/compression/headroom-smartcrusher.test.ts (deep-nested case). Structural shrink belongs upstream in gcf, not here.",
+  "_rebaseline_2026_07_08_6556_inherited_drift": "2052->2053 (+1). PR #6556 (omniglyph engine): drift herdado do merge burst da base (a catraca nao roda no fast-path PR->release, mesmo padrao dos rebaselines v3.8.44/46). Trust-but-verify: o proprio codigo do PR e complexity-net-zero — as 2 violacoes que ele introduzia (runCompressionAsync complexity 17 apos o branch do modo omniglyph; OmniglyphContextPageClient 161 linhas) foram CORRIGIDAS por extracao real (engines/omniglyphSingleMode.ts + split do componente em section components), medido: 2055->2053 local; base pura origin/release/v3.8.47 mede 2053 identico. Tighten via --update next cycle.",
   "_rebaseline_2026_07_07_v3846_release_close": "2035->2050 (+15). v3.8.46 release close (generate-release Phase 0 pre-flight): drift herdado do merge burst do ciclo (39 commits do dia + campanha /review-*). Trust-but-verify: os fixes de base-red do captain (agentSkills path.resolve #6366, catalogo cache #6408, tipagem de teste no-explicit-any, MitmProxyTab suppression) sao complexity-net-zero — check:complexity mede 2050 identico com e sem os fixes (a catraca NAO roda no fast-path PR->release, entao o ramo acumulou sem rebaselinar). Tighten via --update next cycle.",
   "_rebaseline_2026_07_04_v3844_release_close": "2026->2028 (+2). v3.8.44 release close (generate-release Phase 0/1): drift residual do fim do ciclo medido no tip pos-#6155 (merge burst final: #6155 cooling-panel + #6104 Kenari + #6139/#6128 provider-limits). Trust-but-verify: os 2 fixes de codigo do release-captain (model.ts alias boundary, auggie.ts stdin error handlers) adicionam 0 violacoes NOVAS — eslint.complexity direto nos 2 arquivos flagra apenas funcoes que ja estouravam o limite antes (runStreaming/start ja >80 linhas; resolveModelByProviderInference/getModelInfoCore pre-existentes de #5918), e resolveProviderAlias segue abaixo de 15. Logo o +2 e drift herdado do burst. Tighten via --update next cycle.",
   "_rebaseline_2026_07_03_v3844_ipfilter_release_green": "2015->2026 (+11). v3.8.44 cycle drift measured on release tip 32e4c906e during the #6131/#5975 release-green rebaseline. Inherited from the merge burst (Quality Ratchet does not run on PR->release fast-gates). route-edge-coverage +7 is my #5975 test comment; the rest is parallel-session drift. Tighten via --update next cycle.",
@@ -35,5 +38,6 @@
   "_rebaseline_2026_06_10": "Re-baseline consciente: 1739 foi medido na branch das Fases 0-6 (base ~v3.8.17); a v3.8.18 publicada ja carrega 1746 (provado: o commit-base 5f2722bd6, anterior a qualquer commit do ciclo v3.8.19, mede 1746 — funcoes complexas dos reworks RequestLoggerV2/stream/combo). Mesma familia dos re-baselines de eslintWarnings/file-size. Reducao = Fase 6A (2026-06-16).",
   "_rebaseline_2026_06_13_6a11": "Re-baseline consciente Task 6A.11: escopo ampliado para src+open-sse+electron+bin (electron/bin contribuem 0 violacoes novas — todos os 4 arquivos .ts em bin/ estao abaixo dos thresholds). Drift 1746→1794 pre-existente de features mergeadas nos ciclos v3.8.22/v3.8.23 (nao causado por esta task). Congelado no valor real medido para destrancar o gate.",
   "_rebaseline_2026_06_26_v3837_release": "1950->1963 (+13). v3.8.37 cycle drift surfaced by the release-green pre-flight (the Quality Ratchet does NOT run on PR->release fast-gates, so warnings/complexity accrued unmeasured across this cycle's 76 commits — provider adds DGrid/Pioneer/xAI, headroom proxy lifecycle #4649, ~50 SSE/translator fixes, Engine Combos #5062). Trust-but-verify: this release-finalize working tree touches ONLY CHANGELOG.md, docs/i18n/*/CHANGELOG.md mirrors, and these baselines — 0 production-code change, so all drift is inherited cycle drift (`any` warn-allowed in open-sse/ + tests/). Tighten via --require-tighten next cycle.",
-  "_rebaseline_2026_07_06_v3845_release_close": "2028->2035 (+7). v3.8.45 release close (generate-release Phase 0): drift herdado do merge burst final do ciclo (#6216 streaming fixes, #6251/#6253 dashboard UX, #6292 zero-width, fixes do pre-flight ce897453 — todos test/config/workflow-neutros em complexidade nova, verificado pelo validador no tip 5ecca12aa5). Tighten via --update next cycle."
+  "_rebaseline_2026_07_06_v3845_release_close": "2028->2035 (+7). v3.8.45 release close (generate-release Phase 0): drift herdado do merge burst final do ciclo (#6216 streaming fixes, #6251/#6253 dashboard UX, #6292 zero-width, fixes do pre-flight ce897453 — todos test/config/workflow-neutros em complexidade nova, verificado pelo validador no tip 5ecca12aa5). Tighten via --update next cycle.",
+  "_rebaseline_2026_07_07_6552_chirag_api_models_filter": "2050->2052 (+2). PR #6552 (@chirag127, #6328): hidePaidModels filter across the 4 dashboard /api/models endpoints adds 2 functions over the complexity threshold. Owner-approved rebaseline (contributor own-growth). Tighten via --update next cycle."
 }
diff --git a/config/quality/dependency-allowlist.json b/config/quality/dependency-allowlist.json
index c5c9518414..6dae8b6274 100644
--- a/config/quality/dependency-allowlist.json
+++ b/config/quality/dependency-allowlist.json
@@ -91,6 +91,7 @@
     "next-themes",
     "node-loader",
     "node-machine-id",
+    "omniglyph",
     "open",
     "ora",
     "parse5",
diff --git a/config/quality/eslint-suppressions.json b/config/quality/eslint-suppressions.json
index 075ef65db1..dcea92f2a9 100644
--- a/config/quality/eslint-suppressions.json
+++ b/config/quality/eslint-suppressions.json
@@ -131,7 +131,7 @@
   },
   "open-sse/services/compression/engines/headroom/gcf/decode_generic.ts": {
     "@typescript-eslint/no-explicit-any": {
-      "count": 18
+      "count": 22
     }
   },
   "open-sse/services/compression/engines/headroom/gcf/scalar.ts": {
@@ -412,11 +412,6 @@
       "count": 1
     }
   },
-  "tests/integration/liveGeminiShared.ts": {
-    "@typescript-eslint/no-explicit-any": {
-      "count": 3
-    }
-  },
   "tests/integration/llama-cpp-provider.test.ts": {
     "@typescript-eslint/no-explicit-any": {
       "count": 4
@@ -737,11 +732,6 @@
       "count": 6
     }
   },
-  "tests/unit/chatgpt-web.test.ts": {
-    "@typescript-eslint/no-explicit-any": {
-      "count": 6
-    }
-  },
   "tests/unit/chipotle-executor.test.ts": {
     "@typescript-eslint/no-explicit-any": {
       "count": 3
@@ -1064,7 +1054,7 @@
   },
   "tests/unit/combo-strategy-fallbacks.test.ts": {
     "@typescript-eslint/no-explicit-any": {
-      "count": 35
+      "count": 33
     }
   },
   "tests/unit/combo-stream-readiness-fallback.test.ts": {
@@ -1507,16 +1497,6 @@
       "count": 1
     }
   },
-  "tests/unit/live-ws-public-url.test.ts": {
-    "@typescript-eslint/no-explicit-any": {
-      "count": 5
-    }
-  },
-  "tests/unit/lmarena-provider.test.ts": {
-    "@typescript-eslint/no-explicit-any": {
-      "count": 9
-    }
-  },
   "tests/unit/lmarena-split-cookie-4271.test.ts": {
     "@typescript-eslint/no-explicit-any": {
       "count": 1
@@ -1789,7 +1769,7 @@
   },
   "tests/unit/provider-models-route.test.ts": {
     "@typescript-eslint/no-explicit-any": {
-      "count": 58
+      "count": 55
     }
   },
   "tests/unit/provider-models-token-limits.test.ts": {
@@ -1837,11 +1817,6 @@
       "count": 1
     }
   },
-  "tests/unit/provider-validation-specialty.test.ts": {
-    "@typescript-eslint/no-explicit-any": {
-      "count": 8
-    }
-  },
   "tests/unit/providers-route-managed-catalog.test.ts": {
     "@typescript-eslint/no-explicit-any": {
       "count": 4
@@ -2247,11 +2222,6 @@
       "count": 75
     }
   },
-  "tests/unit/translator-resp-openai-responses.test.ts": {
-    "@typescript-eslint/no-explicit-any": {
-      "count": 5
-    }
-  },
   "tests/unit/translator-resp-openai-to-claude.test.ts": {
     "@typescript-eslint/no-explicit-any": {
       "count": 14
@@ -2334,7 +2304,7 @@
   },
   "tests/unit/vscode-token-routes.test.ts": {
     "@typescript-eslint/no-explicit-any": {
-      "count": 76
+      "count": 65
     }
   },
   "tests/unit/web-runtime-env.test.ts": {
diff --git a/config/quality/file-size-baseline.json b/config/quality/file-size-baseline.json
index 4f9b334783..6cc3bba432 100644
--- a/config/quality/file-size-baseline.json
+++ b/config/quality/file-size-baseline.json
@@ -5,6 +5,7 @@
   "_rebaseline_2026_07_03_v3844_ipfilter_release_green": "testFrozen bumps: models-catalog-route 1507->1600, perplexity-web 959->999, route-edge-coverage 1234->1241 (last is my #5975 comment +7). v3.8.44 cycle drift measured on release tip 32e4c906e during the #6131/#5975 release-green rebaseline. Inherited from the merge burst (Quality Ratchet does not run on PR->release fast-gates). route-edge-coverage +7 is my #5975 test comment; the rest is parallel-session drift. Tighten via --update next cycle.",
   "_rebaseline_2026_07_03_v3844_residual_release_green": "Residual file-size drift on tip 716041223: providerLimits.ts 955->982 + accountFallback.ts 1790->1864 (production god-files grown by parallel-session merges e.g. #6128; ideally DECOMPOSE not rebaseline, tracked as debt) + sse-auth.test.ts 1553->1600. None mine.",
   "_comment": "Catraca de tamanho (check-file-size.mjs). frozen so pode encolher; arquivos novos <= cap. --update ratcheta.",
+  "_rebaseline_2026_07_09_pr6647_winget_claude_detect": "PR #6647 (enjoyer-hub, /implement-prs sync): cliRuntime.ts 1100->1110 (split('\\n').length metric; +10, was already exactly at the 1100 frozen cap). Adds the WinGet-installed Claude Code fallback path (%LOCALAPPDATA%\\Microsoft\\WinGet\\Packages\\Anthropic.ClaudeCode_Microsoft.Winget.Source_8wekyb3d8bbwe\\claude.exe) to getKnownToolPaths() alongside the two sibling Claude Code paths, so WinGet installs are auto-detected without CLI_CLAUDE_BIN. The package folder name (62 chars) forces Prettier's 100-char width to break the path.join call across the full 10-line multi-arg form used elsewhere in this same function for long paths; irreducible without changing the shared getKnownToolPaths() structure. Covered by the PR's own regression test (tests/unit/cli-runtime-detection.test.ts, win32-gated).",
   "_rebaseline_2026_07_03_review_prs_release_green": "Release-green unblock (2026-07-03, /review-prs): the quality.yml fast-gates job was base-red for EVERY PR->release from growth inherited via already-merged PRs on the release tip — no offending PR branch left to fix in-place. Prod frozen raised: ApiManagerPageClient.tsx 3017->3058, OAuthModal.tsx 969->989, cliRuntime.ts 1090->1100, webProvidersA.ts 805->809. Test frozen raised: deepseek-web.test.ts 1081->1092. Real sizes (check-file-size.mjs reported). These stay frozen (cannot grow further); structural shrink tracked under decomposition roadmap #3501; the release captain's rebaseline-at-release supersedes this note. Bundled with the #5695 quick-start test regex fix (multi-line <Link> tolerance) in the same release-green PR.",
   "_rebaseline_2026_07_02_5798_release_green": "Release-green unblock #5798 / PR #5896 (2026-07-02): the quality.yml fast-gates job was base-red for EVERY PR->release (whole queue failing), from growth inherited via already-merged PRs — no offending PR branch left to fix. Prod frozen raised: AddApiKeyModal.tsx 869->905, providerPageHelpers.ts 996->1021, RequestLoggerV2.tsx 1316->1553, src/sse/services/auth.ts 2403->2405, antigravity.ts 1806->1813, base.ts 1502->1536 (1533 inherited + 3 lines from this PR's own typecheck:core fix in resolveBaseUrl), advancedTools.ts 1118->1120, accountFallback.ts 1783->1790, openai-to-kiro.ts 842->853, openai-responses.ts 1035->1092, stream.ts 2710->2727; new-above-cap frozen: webProvidersA.ts 805, tokenHealthCheck.ts 830. Test frozen raised: cc-compatible-provider 1179->1217, translator-openai-to-kiro 999->1088, web-cookie-providers-new 827->845; new-above-cap: response-sanitizer.test.ts 906. These files remain frozen (cannot grow further); the release captain's rebaseline-at-release supersedes this note.",
   "_rebaseline_2026_06_30_5552_flat_rate_cost": "Issue #5552 own growth: src/app/api/usage/analytics/route.ts 941->942 (+1 = the `flatRateAsZero: true` cost option at the existing computeUsageRowCost chokepoint, so subscription/cookie-web providers show $0 instead of an inflated per-token estimate in analytics). The flat-rate classifier (isFlatRateProvider + the provider-id set) lives in a new leaf src/lib/usage/flatRateProviders.ts (61 LOC, <cap) and the guard in computeCostFromPricing (src/lib/usage/costCalculator.ts, not baselined). Irreducible 1-line wiring at the analytics chokepoint; covered by tests/unit/flat-rate-cost-5552.test.ts.",
@@ -56,8 +57,8 @@
   "_rebaseline_2026_06_20_4380_parse_once": "PR #4380 own growth: src/sse/handlers/chat.ts 1486->1491 (+5 = thread the once-parsed request body from the route guard into handleChat, replacing the duplicate re-parse). The reusable body accessor lives in the new src/sse/handlers/requestBody.ts (<cap). Thin wiring at the single entry chokepoint; not extractable. Covered by tests/unit/chat-request-body-parse-once-4380.test.ts.",
   "_rebaseline_2026_06_20_escalated_api_airforce_live_discovery": "escalated cmqlvxg4o (WhatsApp): providers/[id]/models/route.ts 2586->2590 (+4 = one NAMED_OPENAI_STYLE_PROVIDERS Set entry `api-airforce` + a 3-line comment). Same fix shape as the provider-sweep rows (#4249/#4202/#3976): api-airforce carries a real live `https://api.airforce/v1/models` catalog but was left out of the sweep, so import served its stale hardcoded seed (grok-3/grok-2-1212/claude-3.7-sonnet …) — models that no longer exist upstream, so chat failed though the connection test still passed. The `<baseUrl>/models` probe (after stripping /chat/completions and a trailing /v1) resolves to https://api.airforce/v1/models; the registry seed stays as the offline fallback so import never breaks. Pure additive Set membership; not extractable (it IS the list). Covered by tests/unit/provider-sweep-live-discovery.test.ts. Structural shrink of this route tracked in #3789.",
   "_rebaseline_2026_06_19_4313_harvest_x_sweep_reconcile": "RECONCILIACAO ao mergear #4313 (5 harvested features) APOS o provider-sweep #4324: valores MEDIDOS na arvore combinada release(com #4324)+#4313. route.ts 2580->2586 (sweep +19 NAMED_OPENAI_STYLE + #4313 +3 openadapter/dit/tokenrouter = uniao no Set, regioes disjuntas). providers.ts 3198->3242 (sweep 6 dead-provider marks + #4313 3 novas entries APIKEY_PROVIDERS). combos/page.tsx 4350->4385 (#4313 #3266 allowlist UI) e providers/page.tsx 1925->1927 (#4313 #4240 serviceKind state) — intocados pelo sweep, crescimento puro do #4313. Mesmo padrao release-volatil de medir-no-merge dos baselines de complexity/zizmor deste lote.",
-  "_rebaseline_2026_06_19_provider_sweep_merge_reconcile": "provider-model-sweep PR merge into release/v3.8.30: the sweep's route.ts growth (NAMED_OPENAI_STYLE_PROVIDERS +19 entries, base 2538->2564) and #4259's cloudflare parseResponse (2538->2554) are disjoint regions that both land, so the merged route.ts frozen value is reconciled to its measured size here. constants/providers.ts carries the sweep's 6 dead-provider deprecation marks on top of release. chatCore.ts stays at #4266's 5128 (sweep does not touch it).",
-  "_rebaseline_2026_06_19_provider_sweep_dead_providers": "provider-model-sweep Track C: src/shared/constants/providers.ts 3169->3198 (+29 = deprecated:true + riskNoticeVariant:\"deprecated\" + a deprecationReason for six providers the sweep confirmed dead — kluster/glhf/predibase/inclusionai/galadriel (DNS no longer resolves) + phind (API shut down 2026-01). Mirrors the existing qwen deprecation-flag pattern; pure additive metadata so the UI surfaces a deprecation notice instead of silently offering a non-working provider. Not extractable (it IS the per-provider constant data).",
+  "_rebaseline_2026_06_19_provider_sweep_merge_reconcile": "provider-model-sweep PR merge into release/v3.8.30: the sweep's route.ts growth (NAMED_OPENAI_STYLE_PROVIDERS +19 entries, base 2538->2564) and #4259's cloudflare parseResponse (2538->2554) are disjoint regions that both land, so the merged route.ts frozen value is reconciled to its measured size here. constants/providers.ts carries the sweep's dead-provider deprecation marks on top of release. chatCore.ts stays at #4266's 5128 (sweep does not touch it).",
+  "_rebaseline_2026_06_19_provider_sweep_dead_providers": "provider-model-sweep Track C: src/shared/constants/providers.ts 3169->3198 (+29 = deprecated:true + riskNoticeVariant:\"deprecated\" + a deprecationReason for providers the sweep confirmed dead — kluster/predibase/inclusionai/galadriel (DNS no longer resolves) + phind (API shut down 2026-01). Mirrors the existing qwen deprecation-flag pattern; pure additive metadata so the UI surfaces a deprecation notice instead of silently offering a non-working provider. Not extractable (it IS the per-provider constant data).",
   "_rebaseline_2026_06_19_provider_sweep_live_discovery_2": "provider-model-sweep cont.: providers/[id]/models/route.ts 2548->2564 (+16 = twelve more NAMED_OPENAI_STYLE_PROVIDERS Set entries `crof`/`featherless-ai`/`ovhcloud`/`sambanova`/`orcarouter`/`uncloseai`/`opencode-go`/`baseten`/`hyperbolic`/`nebius`/`scaleway`/`together` + a 4-line comment). Same fix shape: GPU-cloud / aggregator marketplaces hosting large volatile OSS catalogs, each with a live `<baseUrl>/v1/models` endpoint the sweep probed (200 public or 401/403 = exists+keyed); live fetch keeps the catalog fresh, the registry seed stays as the offline fallback. Pure additive Set membership; not extractable. Covered by tests/unit/provider-sweep-live-discovery.test.ts.",
   "_rebaseline_2026_06_19_provider_sweep_live_discovery": "provider-model-sweep own growth: providers/[id]/models/route.ts 2538->2548 (+10 = seven NAMED_OPENAI_STYLE_PROVIDERS Set entries `venice`/`deepinfra`/`wandb`/`pollinations`/`nscale`/`inference-net`/`moonshot` + a 3-line comment). Same fix shape as #4249 (vercel-ai-gateway) / #4202 (zenmux) / #3976 (llm7/byteplus): each is a keyed format-openai provider that exposes a real live `<baseUrl>/models` catalog (the sweep probed each: venice/deepinfra/pollinations/inference-net public 200, wandb/nscale/moonshot 401 = exists+keyed) but was unclassified by every live-fetch branch, so import served its small hardcoded seed instead of the upstream list, re-staling the catalog the sweep set out to fix. The `<baseUrl>/models` probe (after stripping /chat/completions and a trailing /v1) resolves to the endpoints pinned in tests/unit/provider-sweep-live-discovery.test.ts; the small registry seed stays as the offline fallback so import never breaks. Pure additive Set membership; not extractable (it IS the list). Structural shrink of this route tracked in #3789.",
   "_rebaseline_2026_06_19_4266_pollinations_auth": "PR #4266 own growth: chatCore.ts 5125->5128 (+3 net, +4/-1 at the existing error-classify chokepoint ~line 3514 — preserve numeric HTTP status from executor-thrown errors and set authentication_error type for 401s instead of mapping all to 502). The reusable guard lives at the existing catch chokepoint; not extractable without hiding the error boundary. (Rebased onto release tip 5125 from the PR's original 5111 base.)",
@@ -178,16 +179,20 @@
     "_rebaseline_2026_06_26_fidelity_gate_extraction": "Milestone-B fidelity-gate wiring residual: bodyToText+gateAdvance extracted to fidelityGateStep.ts (889->854, -35), but the StackOptions.fidelityGate field, the `const fidelityGate` reads at the two stacked-loop dispatch chokepoints, and the import of FidelityGateConfig are irreducible wiring that cannot leave strategySelector without an architectural refactor of the pre-existing stacked pipeline. Net: 889->854 (+6 vs the pre-Milestone-B frozen 848). Covered by tests/unit/compression/*.test.ts (940 pass).",
     "_rebaseline_2026_06_28_5243_risk_gate_prepass": "PR #5243 (compression risk-gate pre-pass) own growth: open-sse/services/compression/strategySelector.ts 854->899 (+45). The three exported entry points (applyCompression/applyStackedCompression/applyStackedCompressionAsync) become thin wrappers over pure-extracted private bodies (runCompression/runStackedCompression/runStackedCompressionAsync) so the risk-gate mask->run->restore wrapper sits strictly OUTSIDE the per-step loop — a single universal integration point. The wrapper logic itself (resolveRiskGate/withRiskGate) lives in the new riskGate/strategyWrap.ts (<cap); the residual growth is the duplicated thin-wrapper signatures + the extracted bodies' dispatch boundary, guarded by a byte-identical parity test (riskGateIntegration). Default off (DEFAULT_COMPRESSION_CONFIG unchanged). Not extractable without hiding the dispatch boundary, mirroring prior compression rebaselines. Structural shrink tracked in #3501.",
     "_rebaseline_2026_06_29_5286_memoization": "PR #5286 own growth: strategySelector.ts 899->960 (+61 = the opt-in result-memoization branches in applyCompression/applyCompressionAsync — principal+determinism gate, makeMemoKey lookup/store with model+supportsVision folded into the key, recompute-with-memo-off). Default off (memoizeCompressionResults), so zero behavior change. The memo helpers live in the leaf resultMemo.ts (<cap); the chokepoint wiring here is not extractable. Structural shrink of this hot-path file tracked in #3501.",
-    "open-sse/services/compression/strategySelector.ts": 1022,
+    "open-sse/services/compression/strategySelector.ts": 1043,
+    "_rebaseline_2026_07_10_gcf_v3_2_decode": "PR #6838 own growth: new vendored file open-sse/services/compression/engines/headroom/gcf/decode_generic.ts frozen at 880 (> 800 cap). It is the vendored GCF generic-profile decoder (spec v3.2 nested flattening plus the prototype-pollution / hasOwnProperty hardening added in this PR's Gemini review). Kept as one file faithful to upstream gcf-typescript so re-vendoring stays a clean copy rather than a re-split each cycle (sibling generic.ts/scalar.ts stay < cap; extraction would also fragment the file's frozen eslint no-explicit-any suppressions). Round-trip + prototype-pollution regression coverage in tests/unit/compression/headroom-smartcrusher.test.ts. Frozen: only shrinks from here.",
+    "open-sse/services/compression/engines/headroom/gcf/decode_generic.ts": 880,
     "open-sse/services/rateLimitManager.ts": 1035,
     "_rebaseline_2026_06_29_4038_cas_guard": "PR (#4038) own growth: tokenRefresh.ts 2103->2181 (+78 = the compare-and-swap guard on the refresh persist — runWithCasGuard/getActiveCasGuard AsyncLocalStorage pair mirroring runWithOnPersist, casGuardShouldSkipPersist that rereads the row right before persisting and skips the write when a concurrent writer already rotated the refresh_token past the one presented, plus getCasGuardStats counters). Fixes the sibling-rotation-revert → token-family-revocation storm. Gated behind an active guard (opt-in; no guard => byte-identical). Wiring lives at the two persist chokepoints inside getAccessToken; the comparison reuses wasRefreshTokenRotated from refreshSerializer. Not extractable without splitting the refresh hot path.",
-    "open-sse/services/tokenRefresh.ts": 2181,
+    "_rebaseline_2026_07_09_6126_clinepass_dual_auth": "PR #6126 (@hajilok, dual-auth ClinePass) own growth: tokenRefresh.ts 2181->2182 (+1 = a single `case \"clinepass\":` fallthrough label added to the existing `case \"cline\":` in _getAccessTokenInternal's provider switch, so clinepass token refresh dispatches to the already-shared refreshClineToken() instead of silently falling through to the generic OAuth refresh). Irreducible 1-line switch-case wiring at the existing chokepoint; the header-building logic for the same feature was extracted to a new leaf src/shared/utils/clineAuth.ts::buildClinepassHeaders() (well under cap) to avoid growing open-sse/executors/default.ts. Covered by tests/unit/clinepass-provider.test.ts.",
+    "_rebaseline_2026_07_09_6363_kiro_external_idp": "PR #6363 (@artickc, Kiro external IdP) own growth: tokenRefresh.ts 2182->2249 (+67 = the external_idp refresh branch inside refreshKiroToken — standard public-client OAuth2 refresh_token grant against the org IdP tokenEndpoint via buildExternalIdpRefreshParams/isExternalIdpAuthMethod from the new leaf open-sse/services/kiroExternalIdp.ts, with invalid_grant/invalid_client -> unrecoverable_refresh_error mapping). Cohesive addition at the existing refreshKiroToken chokepoint. Covered by tests/unit/kiro-external-idp.test.ts.",
+    "open-sse/services/tokenRefresh.ts": 2249,
     "open-sse/services/usage.ts": 3454,
     "open-sse/translator/request/openai-to-gemini.ts": 906,
-    "open-sse/translator/request/openai-to-kiro.ts": 890,
+    "open-sse/translator/request/openai-to-kiro.ts": 912,
     "open-sse/translator/response/openai-responses.ts": 1092,
     "open-sse/utils/cursorAgentProtobuf.ts": 1521,
-    "open-sse/utils/stream.ts": 2792,
+    "open-sse/utils/stream.ts": 2796,
     "src/app/(dashboard)/dashboard/HomePageClient.tsx": 1385,
     "src/app/(dashboard)/dashboard/analytics/ComboHealthTab.tsx": 1028,
     "src/app/(dashboard)/dashboard/api-manager/ApiManagerPageClient.tsx": 3120,
@@ -201,9 +206,9 @@
     "src/app/(dashboard)/dashboard/endpoint/EndpointPageClient.tsx": 2612,
     "src/app/(dashboard)/dashboard/health/page.tsx": 1091,
     "src/app/(dashboard)/dashboard/playground/components/tabs/ApiTab.tsx": 847,
-    "src/app/(dashboard)/dashboard/providers/[id]/ProviderDetailPageClient.tsx": 784,
+    "src/app/(dashboard)/dashboard/providers/[id]/ProviderDetailPageClient.tsx": 786,
     "src/app/(dashboard)/dashboard/providers/[id]/components/ConnectionRow.tsx": 942,
-    "src/app/(dashboard)/dashboard/providers/[id]/components/modals/AddApiKeyModal.tsx": 959,
+    "src/app/(dashboard)/dashboard/providers/[id]/components/modals/AddApiKeyModal.tsx": 961,
     "src/app/(dashboard)/dashboard/providers/[id]/components/modals/EditConnectionModal.tsx": 1278,
     "src/app/(dashboard)/dashboard/providers/[id]/hooks/useProviderConnections.ts": 954,
     "src/app/(dashboard)/dashboard/providers/[id]/hooks/useProviderModels.ts": 155,
@@ -217,7 +222,7 @@
     "src/app/(dashboard)/dashboard/settings/components/CompressionSettingsTab.tsx": 974,
     "src/app/(dashboard)/dashboard/settings/components/MemorySkillsTab.tsx": 898,
     "src/app/(dashboard)/dashboard/settings/components/PricingTab.tsx": 1012,
-    "src/app/(dashboard)/dashboard/settings/components/ProxyRegistryManager.tsx": 1437,
+    "src/app/(dashboard)/dashboard/settings/components/ProxyRegistryManager.tsx": 1461,
     "src/app/(dashboard)/dashboard/settings/components/ResilienceTab.tsx": 1183,
     "src/app/(dashboard)/dashboard/settings/components/RoutingTab.tsx": 1629,
     "src/app/(dashboard)/dashboard/settings/components/SystemStorageTab.tsx": 1924,
@@ -245,36 +250,47 @@
     "src/lib/resilience/settings.ts": 841,
     "src/lib/tailscaleTunnel.ts": 1202,
     "src/lib/usage/callLogs.ts": 997,
-    "src/lib/usage/providerLimits.ts": 998,
+    "src/lib/usage/providerLimits.ts": 1000,
     "src/lib/usage/usageHistory.ts": 988,
     "_rebaseline_2026_06_27_5193_5203_antigravity_oauthmodal": "Antigravity remote-login own growth: OAuthModal.tsx 960->969 (gate units). #5193 (+~4: remote paste instruction shown for all remote incl. Google + its rationale comment) and #5203 (+~5: handleManualSubmit credential-blob branch + button guard; submit logic extracted to oauthBlobSubmit.ts to minimize). Frozen set to the SUM so either merge order passes. Cohesive at the existing manual-submit chokepoint.",
     "src/shared/components/OAuthModal.tsx": 993,
     "src/shared/components/RequestLoggerV2.tsx": 1629,
     "src/shared/components/analytics/charts.tsx": 1558,
-    "src/shared/constants/cliTools.ts": 875,
+    "_rebaseline_2026_07_10_6318_omp_letta": "PR #6318 (@hamsa0x7, omp+letta CLI integrations) own growth: cliTools.ts (+53 = 2 registry entries incl. omp docsUrl) and cliRuntime.ts (+18 = runtime-detection wiring for the 2 new tools). Cohesive registry/wiring growth at the existing chokepoints; scope reduced from the original 5 tools (pi/codewhale/jcode shipped separately).",
+    "src/shared/constants/cliTools.ts": 916,
     "src/shared/constants/pricing.ts": 1662,
     "src/shared/constants/providers.ts": 3276,
     "src/shared/constants/sidebarVisibility.ts": 1198,
-    "src/shared/services/cliRuntime.ts": 1100,
+    "src/shared/services/cliRuntime.ts": 1128,
     "src/shared/validation/schemas.ts": 2523,
     "_rebaseline_2026_06_28_5275_correlation_id_extract": "Extraction of the safe CorrelationId subset of #5275 (hartmark) — request correlation id stored in call_logs (migration 109) and returned via the X-Correlation-Id response header, WITHOUT the combo/resilience or build/lazy-loading changes (those stay in #5275). Own growth: callLogs.ts 975->985 (correlation_id column on CallLogSummaryRow + read/map), usageHistory.ts 983->988 (correlationId metadata normalize), chat.ts 1575->1632 (withCorrelationId response wiring + combo-failure log carrying correlationId), chatHelpers.ts new 811 (withCorrelationId helper + reqId threading; was 791<cap pre-feature). Cohesive request/logging chokepoint wiring; structural shrink of chat.ts tracked in #3501.",
-    "src/sse/handlers/chat.ts": 1751,
-    "src/sse/handlers/chatHelpers.ts": 860,
-    "src/sse/services/auth.ts": 2447,
+    "_rebaseline_2026_07_09_6678_routing_strategy_9router": "#6678 (SeaXen) — 9router-parity Routing Strategy settings card + per-provider/combo sticky-round-robin override. Own growth: ProviderDetailPageClient.tsx 784->786 (single ProviderAccountRoutingCard mount + import), auth.ts 2448->2458 (providerStrategies override resolution: fallbackStrategy/stickyRoundRobinLimit per-provider cascade in getProviderCredentials). Both additive, zero unrelated refactor; new UI/logic lives in new files (ProviderAccountRoutingCard.tsx, RoutingStrategyCard.tsx, rrState.ts::resolveComboStickyRoundRobinLimit). chat.ts value below reflects the current release tip (grown by other concurrent PRs, e.g. #6640), not this PR own change.",
+    "src/sse/handlers/chat.ts": 1796,
+    "src/sse/handlers/chatHelpers.ts": 876,
+    "src/sse/services/auth.ts": 2458,
     "open-sse/executors/default.ts": 877,
     "open-sse/translator/request/openai-responses.ts": 902,
     "open-sse/executors/kiro.ts": 944,
     "open-sse/translator/request/openai-to-claude.ts": 823,
     "tests/unit/account-fallback-service.test.ts": 1572,
-    "tests/unit/provider-validation-specialty.test.ts": 2843,
+    "tests/unit/provider-validation-specialty.test.ts": 2980,
     "open-sse/executors/huggingchat.ts": 813,
     "_rebaseline_2026_07_01_v3843_release_5609": "Rebaseline v3.8.43 (PR #5609 release reconciliation). DRIFT dos 109 commits do ciclo: 8 god-files existentes cresceram (ApiManagerPageClient 2983->3017, combos/page 4594->4608, AddApiKeyModal 868->869, providerPageHelpers 974->996, chat.ts 1635->1647, auth.ts 2401->2403, batchProcessor 828->915, combo.ts 3368->3387) + 2 novos acima do cap (huggingchat.ts 813, tests web-cookie-providers-new 827) + 4 test files cresceram. Modularizacao deferida (blast-radius mid-release); congelado no estado atual p/ o proximo ciclo ratchetar daqui.",
     "src/lib/providers/validation/webProvidersA.ts": 809,
-    "src/lib/tokenHealthCheck.ts": 830
+    "src/lib/tokenHealthCheck.ts": 832,
+    "_rebaseline_2026_07_09_6587_kiro_api_key_auth": "PR #6587 (@strangersp) own growth for Kiro long-lived API-key auth, merged onto v3.8.47 tip: openai-to-kiro.ts 890->912 (+22, auth-header selection for API-key-vs-OAuth-token connections), providerLimits.ts 998->1000 (+2, API-key auth-type branch), translator-openai-to-kiro.test.ts 1234->1257 (+23), providers-page-utils.test.ts 1109->1107 (net -2 after merging with parallel release drift; connectionMatchesProviderCard api_key coverage added), provider-validation-specialty.test.ts 2856->2980 (+124 net after merge with parallel release drift; this PR also removed the file's `@typescript-eslint/no-explicit-any` eslint-suppression entry by fixing all `any` usages, adding typed replacements). Cohesive additive feature growth, well tested; not extractable without splitting the existing chokepoints mid-merge.",
+    "src/lib/localDb.ts": 805,
+    "_rebaseline_2026_07_12_v3847_mergeprs_tail": "v3.8.47 /merge-prs tail (owner-approved): src/lib/localDb.ts NEW>800 (799->805, +6 re-exports countFreeProxies + recordFreeProxySyncErrors/clearFreeProxySyncErrors/getFreeProxySyncErrors + FreeProxySyncErrors type for #6909 free-pool relay-repair; re-export-only per Hard Rule #2, not extractable)."
   },
   "testCap": 800,
   "testFrozen": {
-    "tests/integration/chat-pipeline.test.ts": 1671,
+    "_rebaseline_2026_07_09_6126_clinepass_dualauth": "#6126 (ClinePass dual-auth) own test growth: oauth-providers-config.test.ts 842->845 (+3: clinepass key/config/required-fields entries reusing the Cline WorkOS flow config, needed after registering clinepass in the oauth.ts PROVIDERS enum).",
+    "_rebaseline_2026_06_27_5193_antigravity_test": "#5193 own test growth: oauth-providers-config.test.ts 870->873 (+3: antigravity projectId assertion + 50ms tick for the now fire-and-forget onboarding, matching the no-PKCE/no-openid flow).",
+    "_rebaseline_2026_07_02_5928_base_red": "web-cookie-providers-new.test.ts 845->850: #5928 (test(security) Kimi Web URL host parse, CodeQL #689) grew the file +5 lines and merged into release/v3.8.44 WITHOUT rebaselining, leaving a fast-gates base-red that blocked every subsequent PR->release. Test growth is legitimate (a security regression test); maintainer absorbs the drift here. Frozen at 850.",
+    "_rebaseline_basered_codebuddy_cn": "Base-red fix (#4664 CodeBuddy CN): oauth-providers-config.test.ts 867->870 (+3) to align the EXPECTED provider list/config with the codebuddy-cn provider that #4664 added to the registry without updating this test (it asserts 'exactly once').",
+    "_rebaseline_pr4561_qwen_oauth_url": "Reconcile #4561 (port decolua/9router#683) already-merged growth: oauth-providers-config.test.ts 855->867 (+12, qwen.ai URL regression-pin test). Fast-gate PR->release does not run check:file-size, so this surfaced post-merge.",
+    "_rebaseline_pr4613_compatible_provider_groups": "Reconcile #4613 already-merged growth: providers-page-utils.test.ts 1004->1052 (+48, buildCompatibleProviderGroups partition unit test). Fast-gate PR->release does not run check:file-size, so this surfaced post-merge.",
+    "tests/integration/chat-pipeline.test.ts": 1601,
     "tests/integration/chatcore-compression-integration.test.ts": 1111,
     "tests/integration/skills-pipeline.test.ts": 918,
     "tests/unit/account-fallback-service.test.ts": 1572,
@@ -284,29 +300,27 @@
     "tests/unit/chatcore-sanitization.test.ts": 831,
     "tests/unit/chatcore-translation-paths.test.ts": 2810,
     "tests/unit/chatgpt-web.test.ts": 3170,
-    "tests/unit/combo-routing-engine.test.ts": 3213,
+    "tests/unit/combo-config.test.ts": 881,
+    "tests/unit/combo-routing-engine.test.ts": 3209,
     "tests/unit/combo-strategy-fallbacks.test.ts": 880,
     "tests/unit/db-core-init.test.ts": 877,
     "tests/unit/db-migration-runner.test.ts": 1491,
     "tests/unit/db-settings-crud.test.ts": 941,
     "tests/unit/deepseek-web.test.ts": 1092,
     "tests/unit/executor-antigravity.test.ts": 942,
-    "tests/unit/executor-codex.test.ts": 1347,
+    "tests/unit/executor-codex.test.ts": 1340,
     "tests/unit/executor-default-base.test.ts": 1523,
     "tests/unit/grok-web.test.ts": 2437,
     "tests/unit/image-generation-handler.test.ts": 2019,
     "tests/unit/model-sync-route.test.ts": 1016,
     "tests/unit/models-catalog-route.test.ts": 1605,
-    "_rebaseline_pr4561_qwen_oauth_url": "Reconcile #4561 (port decolua/9router#683) already-merged growth: oauth-providers-config.test.ts 855->867 (+12, qwen.ai URL regression-pin test). Fast-gate PR->release does not run check:file-size, so this surfaced post-merge.",
-    "_rebaseline_basered_codebuddy_cn": "Base-red fix (#4664 CodeBuddy CN): oauth-providers-config.test.ts 867->870 (+3) to align the EXPECTED provider list/config with the codebuddy-cn provider that #4664 added to the registry without updating this test (it asserts 'exactly once').",
-    "_rebaseline_2026_06_27_5193_antigravity_test": "#5193 own test growth: oauth-providers-config.test.ts 870->873 (+3: antigravity projectId assertion + 50ms tick for the now fire-and-forget onboarding, matching the no-PKCE/no-openid flow).",
-    "tests/unit/oauth-providers-config.test.ts": 873,
+    "tests/unit/oauth-providers-config.test.ts": 845,
     "tests/unit/perplexity-web.test.ts": 999,
     "tests/unit/provider-models-route.test.ts": 1752,
-    "tests/unit/provider-validation-specialty.test.ts": 2874,
-    "_rebaseline_pr4613_compatible_provider_groups": "Reconcile #4613 already-merged growth: providers-page-utils.test.ts 1004->1052 (+48, buildCompatibleProviderGroups partition unit test). Fast-gate PR->release does not run check:file-size, so this surfaced post-merge.",
-    "tests/unit/providers-page-utils.test.ts": 1109,
+    "tests/unit/provider-validation-specialty.test.ts": 2980,
+    "tests/unit/providers-page-utils.test.ts": 1107,
     "tests/unit/reasoning-cache.test.ts": 980,
+    "tests/unit/response-sanitizer.test.ts": 1063,
     "tests/unit/route-edge-coverage.test.ts": 1241,
     "tests/unit/search-handler-extended.test.ts": 1124,
     "tests/unit/sse-auth.test.ts": 1600,
@@ -314,16 +328,14 @@
     "tests/unit/token-refresh-service.test.ts": 1353,
     "tests/unit/translator-friendly-test-bench.test.tsx": 848,
     "tests/unit/translator-helper-branches.test.ts": 870,
-    "tests/unit/translator-openai-responses-req.test.ts": 1172,
-    "tests/unit/translator-openai-to-gemini.test.ts": 1579,
-    "tests/unit/translator-openai-to-kiro.test.ts": 1234,
+    "tests/unit/translator-openai-responses-req.test.ts": 1195,
+    "tests/unit/translator-openai-to-gemini.test.ts": 1553,
+    "tests/unit/translator-openai-to-kiro.test.ts": 1257,
     "tests/unit/translator-resp-gemini-to-openai.test.ts": 1234,
-    "tests/unit/usage-service-hardening.test.ts": 1633,
+    "tests/unit/usage-service-hardening.test.ts": 1503,
     "tests/unit/vscode-token-routes.test.ts": 1285,
-    "tests/unit/combo-config.test.ts": 881,
-    "_rebaseline_2026_07_02_5928_base_red": "web-cookie-providers-new.test.ts 845->850: #5928 (test(security) Kimi Web URL host parse, CodeQL #689) grew the file +5 lines and merged into release/v3.8.44 WITHOUT rebaselining, leaving a fast-gates base-red that blocked every subsequent PR->release. Test growth is legitimate (a security regression test); maintainer absorbs the drift here. Frozen at 850.",
     "tests/unit/web-cookie-providers-new.test.ts": 890,
-    "tests/unit/response-sanitizer.test.ts": 1063
+    "_rebaseline_2026_07_12_v3847_mergeprs_tail": "v3.8.47 /merge-prs tail: translator-openai-responses-req.test.ts 1172->1195 (+23 = #6807 reasoning-summary-for-effort-only regression tests). Frozen only shrinks."
   },
   "_rebaseline_2026_06_09": "Re-baseline consciente pre-release v3.8.19: 9 arquivos cresceram durante o ciclo (features mergeadas: RequestLoggerV2 +281 request-logger rework, stream +101, combo +73, chatCore +45, catalog +32 fable-5/catalog-flag, callLogs +4, accountFallback +2, usageHistory novo 840) + core.ts +7 (fix resetAllDbModuleState, PR 3536). A catraca segue valendo destes valores — proximo crescimento falha. Decisao: encolher (esp. RequestLoggerV2/chatCore) e a issue #3501 ficam para o ciclo seguinte.",
   "_rebaseline_2026_06_11_phase1f": "Phase 1f (#3501): ProviderDetailPageClient.tsx 4948→4062 (-886 LOC); 3 novos hooks extraídos. useProviderConnections.ts=954 acima do cap=800 — justificado: extração direta do god-component (zero lógica nova), própria redução do cliente supera o custo. useProviderSettings.ts=263 e useProviderModels.ts=154 já abaixo do cap.",
@@ -381,5 +393,13 @@
   "_rebaseline_2026_07_06_v3845_release_close": "Release v3.8.45 cycle-close rebaseline (captain, sess ce897453): 13 files grown by the cycle's merged fix/feature PRs (#6216 streaming fixes + request-logger UI grew RequestLoggerV2/chat/chatHelpers/auth/stream/response-sanitizer.test; #6251/#6253 dashboard UX grew combos page/modals/wizard/ComboDefaultsTab/ProxyRegistryManager/providerPageHelpers). Growth is legitimate merged-feature code, absorbed at release per Phase 0 drift policy; all remain frozen (cannot grow further).",
   "_rebaseline_2026_07_06_6118_zed_oauthmodal": "PR #6118 own growth: OAuthModal.tsx 989->993 (+4 = Zed hosted native-app sign-in modal branch). Cohesive UI growth for the zed-hosted OAuth provider; not extractable. The prior 6118 comment set the note but left the frozen value at 989.",
   "_rebaseline_2026_07_06_6351_glm_team_quota": "PR #6351 own growth (GLM team-plan quota fields threaded through the connection modals; new GlmTeamQuotaFields.tsx extracted): AddApiKeyModal.tsx ->951 (+9), EditConnectionModal.tsx ->1277 (+18). Absorbs the pre-existing session base-red on these frozen modals; release captain rebaseline-at-release supersedes.",
-  "_rebaseline_2026_07_06_6499_unique_default_name": "PR #6499 own growth: AddApiKeyModal.tsx 952->959 (+7 = a unique default connection name so a second API key for the same provider does not reuse 'main' and trigger the backend name-based upsert that silently overwrote the first connection). The pure name derivation was extracted to computeConnectionDefaultName.ts (unit-tested) to keep the growth minimal; the contributor's original full-form-reset rewrite was trimmed to a spread reset to avoid dropping the GLM team-quota fields #6351 added and to hold the frozen god-file growth down. Release captain rebaseline-at-release supersedes."
+  "_rebaseline_2026_07_06_6499_unique_default_name": "PR #6499 own growth: AddApiKeyModal.tsx 952->959 (+7 = a unique default connection name so a second API key for the same provider does not reuse 'main' and trigger the backend name-based upsert that silently overwrote the first connection). The pure name derivation was extracted to computeConnectionDefaultName.ts (unit-tested) to keep the growth minimal; the contributor's original full-form-reset rewrite was trimmed to a spread reset to avoid dropping the GLM team-quota fields #6351 added and to hold the frozen god-file growth down. Release captain rebaseline-at-release supersedes.",
+  "_rebaseline_2026_07_08_vb_reroute": "PR #6640 (Vision Bridge reroute) own growth, re-measured post-merge with origin/release/v3.8.47 + /implement-prs mandatory pre-merge fixes (wc -l + 1): chat.ts 1778->1796 (+18, stacking on #6515/#6525 chirag growth already frozen at 1778) = the original +3 guardrail modelStr sync block PLUS +15 for the policy re-validation added during review (a guardrail-driven model change is now re-checked against isModelAllowedForKey before being honored, closing an allowlist-bypass gap; see tests/unit/vision-bridge-policy-reroute-6640.test.ts). Irreducible wiring at the guardrail post-execution/policy chokepoint; covered by tests/unit/guardrails/visionBridge.test.ts (22 tests) + the 3 new policy-reroute regression tests.",
+  "_rebaseline_2026_07_07_6523_chirag_cooldown_body": "PR #6523 (@chirag127, #6460) own growth: chatHelpers.ts 860->866 (+6 = retryAfterAt/credentialsCoolingCount fields on modelCooldownResponse) and auth.ts 2447->2448 (+1 = connectionsCount threaded through no-credentials fallback). Owner-approved rebaseline (file-size cap for contributor PR). Frozen (cannot grow further); release captain's rebaseline-at-release supersedes.",
+  "_rebaseline_2026_07_07_6526_chirag_modal_1080p": "PR #6526 (@chirag127, #6265): AddApiKeyModal.tsx ->961 (1080p sizing). Owner-approved. Frozen.",
+  "_rebaseline_2026_07_07_6515_chirag": "PR #6515 (@chirag127) own growth: src/sse/handlers/chat.ts ->1763. Owner-approved rebaseline. Frozen.",
+  "_rebaseline_2026_07_07_6534_chirag": "PR #6534 (@chirag127) own growth: open-sse/services/compression/strategySelector.ts ->1025. Owner-approved rebaseline. Frozen.",
+  "_rebaseline_2026_07_08_6556_omniglyph_mode": "PR #6556 (omniglyph engine) own growth: open-sse/services/compression/strategySelector.ts 1025->1043 (+18 at the existing mode-dispatch chokepoints). Two single-mode branches (sync no-op + async resolve via the engine registry, mirroring the rtk single-mode pattern, B-MODE-ENGINE-DECOUPLE) plus the optional providerTransport field threaded through the three options types (gates transport-sensitive engines). The engine itself lives in engines/omniglyphAdapter.ts (<cap); the residual is cohesive dispatch/type wiring not extractable without hiding the dispatch boundary, mirroring the prior compression rebaselines (#5243/#5286/phase4b/#6534). Covered by tests/unit/compression/omniglyph-*.test.ts (22). Structural shrink of this file tracked in #3501.",
+  "_rebaseline_2026_07_07_6546_chirag": "PR #6546 (@chirag127) own growth: src/sse/handlers/chatHelpers.ts ->876. Owner-approved rebaseline. Frozen.",
+  "_rebaseline_2026_07_07_6525_chirag_image_guard": "PR #6525 (@chirag127, #6457) own growth: chat.ts ->1778 (reject image-only models on /v1/chat/completions; stacks on #6515). Owner-approved. Frozen."
 }
diff --git a/config/quality/quality-baseline.json b/config/quality/quality-baseline.json
index b1cd01d12b..f660fc33d3 100644
--- a/config/quality/quality-baseline.json
+++ b/config/quality/quality-baseline.json
@@ -96,19 +96,21 @@
       "tightenSlack": 10
     },
     "openapiCoverage.pct": {
-      "value": 39.3,
+      "value": 38.0,
       "direction": "up",
       "eps": 0.5,
       "_tighten_2026_07_04_v3844_release": "36.9 -> 39.3 (aperto exigido pelo --require-tighten no PR de release #5925). A cobertura OpenAPI melhorou no ciclo (9 rotas documentadas em 8fb020676 + as rotas novas de #5939/#5817/#6034/#5998 documentadas junto das features). 39.3 = valor medido pelo CI Quality Ratchet no run 28708141003 (tip 00c55afcb).",
       "_rebaseline_2026_06_28_v3839_release": "37.8 -> 36.9 (-0.9, beyond the 0.5 eps). v3.8.39 cycle drift surfaced ONLY on the release PR (the openapi-coverage ratchet does NOT run on PR->release fast-gates). The cycle added API/internal routes (antigravity paste-credentials onboarding, CCR ranged/grep/stats retrieve params, mcp 404 session handling) faster than docs/openapi.yaml coverage; documenting LOCAL_ONLY/internal onboarding routes in the PUBLIC spec would be gaming (same precedent as _rebaseline_2026_06_18_v3828_cycle_close). Measured by CI collect-metrics (run 28317145160) = 36.9. My release-finalize tree touches no routes (only the openapi.yaml version bump). Raising coverage by documenting public routes is tracked as follow-up doc debt.",
-      "_rebaseline_2026_06_23_v3834_release": "38.4 -> 37.8 (-0.6, beyond the 0.5 eps so it failed the ratchet). v3.8.34 cycle drift: contributor PRs added API routes (e.g. quota/usage/opencode-go endpoints) faster than openapi.yaml coverage; the openapi-coverage ratchet does NOT run on PR->release fast-gates so it surfaced only on the release PR. Verified my release-finalize working tree touches no routes / openapi paths (only version bump in openapi.yaml). Measured by CI quality:collect (run 28000387577) = 37.8. Raising coverage by documenting the new routes is tracked as follow-up doc debt."
+      "_rebaseline_2026_06_23_v3834_release": "38.4 -> 37.8 (-0.6, beyond the 0.5 eps so it failed the ratchet). v3.8.34 cycle drift: contributor PRs added API routes (e.g. quota/usage/opencode-go endpoints) faster than openapi.yaml coverage; the openapi-coverage ratchet does NOT run on PR->release fast-gates so it surfaced only on the release PR. Verified my release-finalize working tree touches no routes / openapi paths (only version bump in openapi.yaml). Measured by CI quality:collect (run 28000387577) = 37.8. Raising coverage by documenting the new routes is tracked as follow-up doc debt.",
+      "_rebaseline_2026_07_13_v3847_release": "39.3 -> 38.0 (-1.3, beyond the 0.5 eps). v3.8.47 cycle drift: the cycle merged ~45 PRs adding API routes (relay repair/free-pool #6909, backpressure #6590, combo context requirements #6907, services/usage endpoints) faster than openapi.yaml documentation; same class as the v3.8.34/v3.8.39 rebaselines. Documented follow-up: raise coverage next cycle via docs/openapi.yaml additions."
     },
     "i18nUiCoverage.pct": {
-      "value": 76.8,
+      "value": 75.5,
       "direction": "up",
       "eps": 0.5,
       "_rebaseline_2026_07_04_v3844_release": "77.5 -> 76.8 (-0.7, beyond the 0.5 eps). v3.8.44 cycle drift surfaced only on the release PR (i18n-ui-coverage does NOT run on PR->release fast-gates). The cycle added ~1352 new UI keys to the en.json denominator (Discovery dashboard tab #5939, Bifrost/Mux embedded-service tabs #5817/#6034, proxy batch-ops #5918, fusion defaults #5598, tool-source toggle #5978, quota-row collapse #5977, CodeWhale/Crush CLI cards #5996/#5970, etc.) that the async i18n translation workflow has not yet back-filled (worst locales measure 76.8; __MISSING__ placeholders count as uncovered by design). Same shape and remedy as _rebaseline_2026_06_28_v3839_release. Recover via the i18n workflow next cycle; tighten with --require-tighten once translations land.",
-      "_rebaseline_2026_06_28_v3839_release": "78.4 -> 77.5 (-0.9, beyond the 0.5 eps). v3.8.39 cycle drift surfaced ONLY on the release PR (i18n-ui-coverage does NOT run on PR->release fast-gates). The cycle added new UI strings (compression studio TOON A/B table, antigravity remote-login dashboard field, amber warning icon) to the en denominator faster than the 37 non-en locales were translated; those locales need `npm run i18n:run` with OMNIROUTE_TRANSLATION_API_KEY (unavailable locally) — same precedent as _rebaseline_2026_06_18_v3828_cycle_close + _quality_rebaseline_2026_06_20_ci_ratchet. Measured by CI collect-metrics (run 28317145160) = 77.5. My release-finalize tree changes no src/i18n/messages/*.json. Tightening is tracked as follow-up (run i18n:run with creds)."
+      "_rebaseline_2026_06_28_v3839_release": "78.4 -> 77.5 (-0.9, beyond the 0.5 eps). v3.8.39 cycle drift surfaced ONLY on the release PR (i18n-ui-coverage does NOT run on PR->release fast-gates). The cycle added new UI strings (compression studio TOON A/B table, antigravity remote-login dashboard field, amber warning icon) to the en denominator faster than the 37 non-en locales were translated; those locales need `npm run i18n:run` with OMNIROUTE_TRANSLATION_API_KEY (unavailable locally) — same precedent as _rebaseline_2026_06_18_v3828_cycle_close + _quality_rebaseline_2026_06_20_ci_ratchet. Measured by CI collect-metrics (run 28317145160) = 77.5. My release-finalize tree changes no src/i18n/messages/*.json. Tightening is tracked as follow-up (run i18n:run with creds).",
+      "_rebaseline_2026_07_13_v3847_release": "76.8 -> 75.5 (-1.3, beyond the 0.5 eps). v3.8.47 cycle drift: merged UI features added EN strings (relay repair UI #6909, combo builder #6907/#6991, capability override UI #6727) ahead of the 42-locale mirrors; same class as the v3.8.39/v3.8.44 rebaselines."
     },
     "deadExports": {
       "value": 227,
@@ -120,7 +122,10 @@
       "_rebaseline_2026_06_26_v3837_release": "343->345. v3.8.37 cycle drift surfaced by the release-green pre-flight (the Quality Ratchet does NOT run on PR->release fast-gates, so warnings/complexity accrued unmeasured across this cycle's 76 commits — provider adds DGrid/Pioneer/xAI, headroom proxy lifecycle #4649, ~50 SSE/translator fixes, Engine Combos #5062). Trust-but-verify: this release-finalize working tree touches ONLY CHANGELOG.md, docs/i18n/*/CHANGELOG.md mirrors, and these baselines — 0 production-code change, so all drift is inherited cycle drift (`any` warn-allowed in open-sse/ + tests/). Tighten via --require-tighten next cycle."
     },
     "cognitiveComplexity": {
-      "value": 882,
+      "value": 890,
+      "_rebaseline_2026_07_10_gcf_v3_2": "885->888 (+3). PR feat/headroom-gcf-v3.2-nested-flattening: own growth from re-vendoring the GCF (Headroom) codec to spec v3.2 (nested flattening). The new over-threshold functions are the vendored v3.2 flatten/unflatten walk in open-sse/services/compression/engines/headroom/gcf/{generic,decode_generic}.ts. Imported third-party code kept byte-faithful to upstream gcf-typescript; measured 888 with the update vs 885 on the pristine origin/release/v3.8.47 tip. Guarded by tests/unit/compression/headroom-smartcrusher.test.ts (deep-nested case). Structural shrink belongs upstream in gcf.",
+      "_rebaseline_2026_07_12_v3847_mergetrain_burst": "885->890 (+5). v3.8.47 /merge-prs merge-train batch (23 merge-ready PRs) inherited drift: cognitive-complexity does NOT run on PR->release fast-gates, so incidental growth accrued unmeasured across the batch. Measured 890 on the combined merge-train tip (5d980352d) vs 885 on the pristine release tip 1b7a9150e. #6838 (headroom gcf codec re-vendor) accounts for +3 (its own baseline bump to 888, superseded here by this later 890 rebaseline which already covers it); the remaining +2 is parallel-batch drift across the other 22 PRs. Owner-approved rebaseline (merge-burst reconciliation, same class as the v3.8.46/v3.8.44 notes below). Tighten via --update next cycle.",
+      "_rebaseline_2026_07_09_6587_kiro_api_key_auth": "884->885 (+1). PR #6587 (@strangersp) own growth: open-sse/services/usage/kiro.ts gains ONE new over-threshold function — getKiroUsage grew from a single fetch to a 3-endpoint fallback chain (codewhisperer-get / codewhisperer-post / q-get) with per-attempt auth-header selection (tokentype: API_KEY vs Bearer-only), needed so usage/quota lookups work for the new long-lived-API-key auth path in addition to the existing OAuth path (measured: 0 violations on release tip -> 1 violation, complexity 33, at open-sse/services/usage/kiro.ts). Covered by tests/unit/kiro-iam-profilearn-usage.test.ts (tokentype header selection, friendly auth-expired/rejected-token messages). Cohesive multi-endpoint-fallback logic at an existing usage chokepoint; not extractable without splitting the fallback loop mid-merge. Structural shrink tracked in #3501.",
       "_rebaseline_2026_07_07_v3846_release_close": "877->882 (+5). v3.8.46 release close (generate-release Phase 0 pre-flight): drift herdado do merge burst do ciclo. Trust-but-verify: os fixes de base-red do captain (agentSkills path.resolve #6366, catalogo cache #6408, tipagem de teste, MitmProxyTab suppression) sao cognitive-net-zero — check:cognitive-complexity mede 882 identico com e sem os fixes (a catraca NAO roda no fast-path PR->release). Tighten via --update next cycle.",
       "_rebaseline_2026_07_03_v3844_ipfilter_release_green": "861->867 (+6). v3.8.44 cycle drift measured on release tip 32e4c906e during the #6131/#5975 release-green rebaseline. Inherited from the merge burst (Quality Ratchet does not run on PR->release fast-gates). route-edge-coverage +7 is my #5975 test comment; the rest is parallel-session drift. Tighten via --update next cycle.",
       "_rebaseline_2026_07_03_v3844_review_prs_fix_batch": "860->861 (+1). Inherited v3.8.44 cycle drift surfaced by the release-green pre-flight during the /review-prs fix-batch round; check:cognitive-complexity measures 861 on the release tip 72ee80649. Negligible +1 from the round's / parallel-session merge burst (cognitive-complexity does NOT run on PR->release fast-gates). Structural shrink tracked in #3501. Tighten via --update next cycle.",
@@ -137,7 +142,9 @@
       "_rebaseline_2026_06_22_v3833_release": "793→797 (+4) — pre-existing cycle drift on origin/release/v3.8.33.",
       "_rebaseline_2026_06_26_v3837_release": "816->826. v3.8.37 cycle drift surfaced by the release-green pre-flight (the Quality Ratchet does NOT run on PR->release fast-gates, so warnings/complexity accrued unmeasured across this cycle's 76 commits — provider adds DGrid/Pioneer/xAI, headroom proxy lifecycle #4649, ~50 SSE/translator fixes, Engine Combos #5062). Trust-but-verify: this release-finalize working tree touches ONLY CHANGELOG.md, docs/i18n/*/CHANGELOG.md mirrors, and these baselines — 0 production-code change, so all drift is inherited cycle drift (`any` warn-allowed in open-sse/ + tests/). Tighten via --require-tighten next cycle.",
       "_rebaseline_2026_06_26_v3838_release": "826->833. v3.8.38 release base measures 833 locally on origin/release/v3.8.38 (800b04ad6) while the committed baseline still says 826. This PR measures the same 833 after refactoring jsonToSse helpers back under the sonarjs/cognitive-complexity threshold, so it does not add a net cognitive-complexity violation. The baseline bump records inherited release-base drift only; structural shrink remains tracked by the existing chatCore decomposition work.",
-      "_rebaseline_2026_07_06_v3845_release_close": "867->877 (+10). v3.8.45 cycle drift measured by check:release-green (hermetic) on release tip 5ecca12aa5 during the /generate-release Phase 0 pre-flight. Inherited from the cycle's merge burst (cognitive-complexity does not run on PR->release fast-gates); the captain's pre-flight fixes are gate/test/workflow changes (complexity-neutral). Tighten via --update next cycle."
+      "_rebaseline_2026_07_06_v3845_release_close": "867->877 (+10). v3.8.45 cycle drift measured by check:release-green (hermetic) on release tip 5ecca12aa5 during the /generate-release Phase 0 pre-flight. Inherited from the cycle's merge burst (cognitive-complexity does not run on PR->release fast-gates); the captain's pre-flight fixes are gate/test/workflow changes (complexity-neutral). Tighten via --update next cycle.",
+      "_rebaseline_2026_07_07_6519_chirag_fallback_reasons": "882->883 (+1). PR #6519 (@chirag127, #6461): the preview route's fallbackReasons dedup loop adds one function over the cognitive threshold. Owner-approved rebaseline (contributor own-growth). Tighten via --update next cycle.",
+      "_rebaseline_2026_07_08_6556_inherited_drift": "883->884 (+1). PR #6556 (omniglyph engine): drift herdado do merge burst da base (cognitive-complexity nao roda no fast-path PR->release). Trust-but-verify: check:cognitive-complexity mede 884 IDENTICO na base pura origin/release/v3.8.47 e neste HEAD — o PR e cognitive-net-zero (runCompressionAsync extraido para engines/omniglyphSingleMode.ts e o page client dividido em section components na mesma rodada). Tighten via --update next cycle."
     },
     "typeCoveragePct": {
       "value": 92.17,
@@ -156,11 +163,12 @@
       "dedicatedGate": true
     },
     "zizmorFindings": {
-      "value": 159,
+      "value": 169,
       "direction": "down",
       "dedicatedGate": true,
       "_rebaseline_2026_06_23_fastpath_gates": "155 -> 159 (+4). Two new jobs added to .github/workflows/quality.yml (fast-vitest, fast-unit) to run vitest + the full unit suite on the PR->release fast-path (release-acceleration plan, _tasks/release-bench/v3.8.35/PLANO-IMPLEMENTACAO.md). The +4 are unpinned-uses: actions/checkout@v7 + actions/setup-node@v6 in each of the 2 jobs — the SAME deliberate @vN convention as every other workflow (see _scanner_harden_workflows_2026_06_16). SHA-pinning only these would violate the convention. No new template-injection/artipacked/cache-poisoning. Measured locally via `npm run check:workflows -- --ratchet` = 159.",
-      "_rebaseline_2026_06_23_v3834_release": "152 -> 155 (+3). The 3 new unpinned-uses are in .github/workflows/nightly-release-green.yml (added by #4622 this cycle): actions/checkout@v7, actions/setup-node@v6, actions/upload-artifact@v4 — the SAME deliberate @vN convention as ci.yml's own checkout@v7/setup-node@v6 and every other workflow (see _scanner_harden_workflows_2026_06_16 + _zizmor_rebaseline_2026_06_20_ci_build_artifact_reuse). SHA-pinning only this workflow would violate the convention. The workflow-lint ratchet does NOT run on PR->release fast-gates, so it surfaced only on the release PR; measured locally via `npm run check:workflows -- --ratchet` = 155. No new template-injection/artipacked/cache-poisoning."
+      "_rebaseline_2026_06_23_v3834_release": "152 -> 155 (+3). The 3 new unpinned-uses are in .github/workflows/nightly-release-green.yml (added by #4622 this cycle): actions/checkout@v7, actions/setup-node@v6, actions/upload-artifact@v4 — the SAME deliberate @vN convention as ci.yml's own checkout@v7/setup-node@v6 and every other workflow (see _scanner_harden_workflows_2026_06_16 + _zizmor_rebaseline_2026_06_20_ci_build_artifact_reuse). SHA-pinning only this workflow would violate the convention. The workflow-lint ratchet does NOT run on PR->release fast-gates, so it surfaced only on the release PR; measured locally via `npm run check:workflows -- --ratchet` = 155. No new template-injection/artipacked/cache-poisoning.",
+      "_rebaseline_2026_07_13_v3847_release_preflight": "159 -> 169 (+10). Findings from cycle-merged workflow changes: #6716 (PR gate restructure), #6781 (unit fast-path shard 2->4), #6788 (TIA tsx loader split), #6881 (electron-updater latest.yml manifests in release assets) — same deliberate @vN unpinned-uses convention as prior rebaselines; no new template-injection/artipacked/cache-poisoning classes. Measured via `npm run check:workflows -- --ratchet` = 169 on the v3.8.47 release pre-flight."
     },
     "vulnCount": {
       "value": 10,
diff --git a/config/quality/test-masking-allowlist.json b/config/quality/test-masking-allowlist.json
index 1dcd4c08cc..bd31fb2bbe 100644
--- a/config/quality/test-masking-allowlist.json
+++ b/config/quality/test-masking-allowlist.json
@@ -18,6 +18,11 @@
   "tests/unit/qoder-jobtoken-exchange-4683.test.ts": "v3.8.44 #5816: feat(qoder) drive PAT auth via qodercli — o exchange de job token deixou de fazer o POST personal_token direto (agora via qodercli); 2 asserts da superfície HTTP aposentada removidos, demais migrados (27→25). Verificado legítimo, não mascaramento. Prune após v3.8.44 mergear para main.",
   "tests/integration/v1-contracts-behavior.test.ts": "v3.8.46 #6303: fix(api) filter specialty model catalogs — os 10 asserts inline de SHAPE das listas embedding/image (object=='model', type=='embedding'/'image', typeof id/owned_by) foram removidos porque #6303 unificou os catálogos de especialidade e moveu a cobertura de shape para tests/unit/models-catalog-route.test.ts (que asserta embedding.type/gpt-image-2.type=='image'/owned_by de forma mais abrangente, +audio/rerank/video/music) e o comportamento de credential-hiding para tests/unit/specialty-model-catalog-routes.test.ts; net 44→42. Cobertura migrada, não enfraquecida. Verificado legítimo. Prune após v3.8.46 mergear para main.",
   "tests/unit/check-docs-symbols.test.ts": "v3.8.46 release-PR CI: o gate check:docs-symbols (stale-enforcement) flagou as 2 ultimas entradas de KNOWN_STALE_DOC_REFS (/api/chat, /api/settings/tunnels) como CORRIGIDAS e exigiu remove-las, esvaziando o allowlist. Os 2 asserts removidos eram `assert.ok(size > 0)` (guarda non-empty) que ficaram FALSOS — um allowlist vazio e o estado valido/ideal (todo ref stale foi corrigido). A invariante significativa (/api/-shape de cada entrada presente) foi mantida; net 28->26. Nao e enfraquecimento — a assuncao non-empty tornou-se obsoleta. Prune apos v3.8.46 mergear para main.",
+  "tests/unit/combo-quota-share-cooldown-wait.test.ts": "v3.8.47 #6897: de-flake redesign dos testes timing-sensitive de cooldown/breaker do combo (#6803) — asserts dependentes de timing real substituídos por asserts determinísticos com clock controlado, net 12→6. Asserts redesenhados, não enfraquecidos (a suíte prova o MESMO contrato sem flake). Verificado legítimo. Prune após v3.8.47 mergear para main.",
+  "tests/unit/combo-strategy-fallbacks.test.ts": "v3.8.47 #6897: mesmo de-flake redesign (#6803) — asserts timing-sensitive de fallback de estratégia consolidados em asserts determinísticos, net 58→52. Verificado legítimo, não mascaramento. Prune após v3.8.47 mergear para main.",
+  "tests/unit/provider-page-helpers-3501.test.ts": "v3.8.47 #6862: feat GPT-5.6 family — 2 assert.ok(values.includes(...)) substituídos por 1 assert.deepEqual(values, [lista completa ordenada de effort tiers]) — asserção estritamente MAIS FORTE, net 69→68. Verificado legítimo. Prune após v3.8.47 mergear para main.",
+  "tests/unit/vscode-token-routes.test.ts": "v3.8.47 #6862: feat GPT-5.6 family — a matriz de modelos do VS Code token route migrou de GPT-5.4/5.5 para a família 5.6 (tiers consolidados, context 200k→500k, novos slugs sol); os asserts da matriz aposentada foram substituídos pelos da nova (net 247→200). Asserts migrados ao novo catálogo, não enfraquecidos. Verificado legítimo. Prune após v3.8.47 mergear para main.",
+  "tests/unit/providers-page-utils.test.ts": "v3.8.47 #6675: remoção dos providers obsoletos glhf/kluster/cablyai/inclusionai — os 2 asserts que citavam providers removidos do catálogo foram removidos junto (net 276→274). Superfície aposentada, não mascaramento. Verificado legítimo. Prune após v3.8.47 mergear para main.",
   "_deletedWithReplacement": {
     "_comment": "Deleções de arquivo de teste com SUBSTITUTO verificado (o gate exige que o replacement exista no HEAD e seja arquivo de teste). Uso restrito ao caso 'reescrito em outro path sem rename detectável pelo -M do git'. Cada entrada precisa de reason com PR ref e passa por revisão humana no release PR. Prune após o release mergear para main.",
     "open-sse/services/combo/__tests__/targetExhaustion.test.ts": {
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index b442de5f10..3c995fa15e 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -58,12 +58,16 @@ services:
       - PORT=${PORT:-20128}
       - DASHBOARD_PORT=${DASHBOARD_PORT:-${PORT:-20128}}
       - API_PORT=${API_PORT:-20129}
+      - LIVE_WS_PORT=${LIVE_WS_PORT:-20132}
+      - LIVE_WS_HOST=${LIVE_WS_HOST:-0.0.0.0}
+      - LIVE_WS_ALLOWED_ORIGINS=${LIVE_WS_ALLOWED_ORIGINS:-http://localhost:${PROD_DASHBOARD_PORT:-20130},http://127.0.0.1:${PROD_DASHBOARD_PORT:-20130}}
       - API_HOST=${API_HOST:-0.0.0.0}
       - HOSTNAME=0.0.0.0
       - DATA_DIR=/app/data
     ports:
       - "${PROD_DASHBOARD_PORT:-20130}:${DASHBOARD_PORT:-${PORT:-20128}}"
       - "${PROD_API_PORT:-20131}:${API_PORT:-20129}"
+      - "${PROD_LIVE_WS_PORT:-20132}:${LIVE_WS_PORT:-20132}"
     volumes:
       - omniroute-prod-data:/app/data
     healthcheck:
diff --git a/docker-compose.yml b/docker-compose.yml
index 2560644527..9b3add8ee3 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -37,6 +37,9 @@ x-common: &common
     - DASHBOARD_PORT=${DASHBOARD_PORT:-20128}
     - API_PORT=${API_PORT:-20129}
     - API_HOST=${API_HOST:-0.0.0.0}
+    - LIVE_WS_PORT=${LIVE_WS_PORT:-20132}
+    - LIVE_WS_HOST=${LIVE_WS_HOST:-0.0.0.0}
+    - LIVE_WS_ALLOWED_ORIGINS=${LIVE_WS_ALLOWED_ORIGINS:-http://localhost:20128,http://127.0.0.1:20128}
     - REDIS_URL=${REDIS_URL:-redis://redis:6379}
   volumes:
     - ./data:/app/data
@@ -75,6 +78,7 @@ services:
     ports:
       - "${DASHBOARD_PORT:-20128}:${DASHBOARD_PORT:-20128}"
       - "${API_PORT:-20129}:${API_PORT:-20129}"
+      - "${LIVE_WS_PORT:-20132}:${LIVE_WS_PORT:-20132}"
     profiles:
       - base
 
@@ -92,6 +96,7 @@ services:
     ports:
       - "${DASHBOARD_PORT:-20128}:${DASHBOARD_PORT:-20128}"
       - "${API_PORT:-20129}:${API_PORT:-20129}"
+      - "${LIVE_WS_PORT:-20132}:${LIVE_WS_PORT:-20132}"
     profiles:
       - web
 
@@ -106,6 +111,7 @@ services:
     ports:
       - "${DASHBOARD_PORT:-20128}:${DASHBOARD_PORT:-20128}"
       - "${API_PORT:-20129}:${API_PORT:-20129}"
+      - "${LIVE_WS_PORT:-20132}:${LIVE_WS_PORT:-20132}"
     volumes:
       - ./data:/app/data
       - /var/run/docker.sock:/var/run/docker.sock
@@ -125,12 +131,16 @@ services:
     ports:
       - "${DASHBOARD_PORT:-20128}:${DASHBOARD_PORT:-20128}"
       - "${API_PORT:-20129}:${API_PORT:-20129}"
+      - "${LIVE_WS_PORT:-20132}:${LIVE_WS_PORT:-20132}"
     environment:
       - DATA_DIR=/app/data
       - PORT=${PORT:-20128}
       - DASHBOARD_PORT=${DASHBOARD_PORT:-20128}
       - API_PORT=${API_PORT:-20129}
       - API_HOST=${API_HOST:-0.0.0.0}
+      - LIVE_WS_PORT=${LIVE_WS_PORT:-20132}
+      - LIVE_WS_HOST=${LIVE_WS_HOST:-0.0.0.0}
+      - LIVE_WS_ALLOWED_ORIGINS=${LIVE_WS_ALLOWED_ORIGINS:-http://localhost:20128,http://127.0.0.1:20128}
       - CLI_MODE=host
       - CLI_EXTRA_PATHS=/host-local/bin:/host-node/bin
       - CLI_CONFIG_HOME=/host-home
diff --git a/docs/README.md b/docs/README.md
index d43de85363..9cb3895425 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -177,7 +177,7 @@ Mermaid sources and exported SVG/PNG diagrams referenced from the docs above. Se
 
 ## i18n/
 
-Translated mirrors of the documentation in 42 locales. See [i18n/README.md](i18n/README.md) for the supported language list.
+Translated mirrors of the documentation in 43 locales. See [i18n/README.md](i18n/README.md) for the supported language list.
 
 ## screenshots/
 
diff --git a/docs/architecture/CODEBASE_DOCUMENTATION.md b/docs/architecture/CODEBASE_DOCUMENTATION.md
index 3c6f09022b..ccf2ea0d36 100644
--- a/docs/architecture/CODEBASE_DOCUMENTATION.md
+++ b/docs/architecture/CODEBASE_DOCUMENTATION.md
@@ -793,6 +793,20 @@ See [A2A-SERVER.md § Adding a New Skill](../frameworks/A2A-SERVER.md). Skills l
   inference for cross-module boundaries.
 - **Database**: never write raw SQL in routes or handlers — always go through
   `src/lib/db/` modules. Never add logic to `src/lib/localDb.ts`.
+- **DB-entity typing (#3512)**: a function that writes or reads a DB table's
+  row shape should take/return a named TS interface mirroring that table's
+  columns 1:1, not `any` or an inline anonymous type at the call site. Land
+  the interface next to the function (e.g. `export interface UsageEntry` in
+  `src/lib/usage/usageHistory.ts` above `saveRequestUsage`), keep individual
+  fields optional/nullable when different writers populate the row
+  incrementally, and prefer `unknown` over `any` for a field whose shape
+  varies across callers (documented on the field, e.g. `UsageEntry.tokens`
+  accepts both raw provider-shaped usage and the normalized shape). Once a
+  file's `any` count reaches zero this way, add it to the
+  `check:any-budget:t11` allowlist (`scripts/check/check-t11-any-budget.mjs`,
+  `maxAny: 0`) so it can't regress. This is a first-slice convention — the
+  broader "no anonymous `any`" cleanup is iterative across the rest of the
+  codebase.
 - **Errors**: try/catch with specific error types, log with pino context. Never
   silently swallow errors in SSE streams; use abort signals for cleanup.
 - **Security**: never use `eval()` / `new Function()` / implied eval. Validate
diff --git a/design.md b/docs/architecture/DESIGN_SYSTEM.md
similarity index 92%
rename from design.md
rename to docs/architecture/DESIGN_SYSTEM.md
index 64794e44a1..f68f1dd272 100644
--- a/design.md
+++ b/docs/architecture/DESIGN_SYSTEM.md
@@ -1,7 +1,18 @@
+---
+title: "Design System & Visual Identity"
+lastUpdated: 2026-07-11
+---
+
 # OmniRoute — Design System & Visual Identity
 
-> **Status:** standardization plan. **Phases 1–3 are implemented in this PR** (grid, primitives, status-color centralization, mono token, and the DataTable token migration). The DataTable migration is **faithful** — dark stays byte-identical (the new `--table-*` dark values equal the old hardcoded rgba); light is fixed (it was buggy always-dark via dead `var()` fallbacks). **⚠️ Wants a visual pass before merge** (light-theme tables + the secondary-text shift `#888`→`--color-text-muted`). **Phase 4 is now largely done too** (C6 focus-ring → accent, C7 Checkbox/Textarea primitives, C9 `cn()`→tailwind-merge); only the selective C8 hex-sweep remains. Note several remaining "hardcoded" hex are _intentional_ (always-dark console terminal, ReactFlow SVG strokes) and must NOT be swept. **Phase 5 (D4 + D8): the grid now reaches every standalone screen** (login/auth/error/legal/status/onboarding — their opaque `bg-bg` full-screen wrappers were hiding it) **and the dashboard content shell is fluid up to 4K** (`max-w-7xl` → `max-w-[3840px]`) so it follows the viewport on large monitors instead of centering with wide side gutters. **Phase 6 (D9): data tables are now opaque surfaces** so the grid no longer bleeds through their rows — card-less tables paint `bg-surface`, and the two log tables' semi-transparent `bg-black/5` tint (which tailwind-merge let win over the Card's `bg-surface`) is removed. The grid size itself is already correct (32px, identical to the site); a "bigger" grid on a running instance is a stale build, not code.
-> **Date:** 2026-06-16 · **Scope:** unify the OmniRoute dashboard (`src/`) with the marketing site (`_mono_repo/omnirouteSite/`) into **one visual identity** — same graph-paper grid background, same color tokens, standardized components.
+> **Status:** reference — the standardization described here is **implemented** (phases 1–6: grid wallpaper, primitives, status-color centralization, mono token, DataTable token migration, focus-ring → accent, Checkbox/Textarea primitives, `cn()` → tailwind-merge, grid on every standalone screen, fluid 4K content shell, opaque data-table surfaces). This document is the canonical description of the dashboard's design tokens, components, and conventions; the phase framing below is kept as the rationale for each decision.
+> **Scope:** the OmniRoute dashboard (`src/`) and the marketing site (`_mono_repo/omnirouteSite/`) share **one visual identity** — same graph-paper grid background (32px), same color tokens, standardized components.
+>
+> Practical notes for maintainers:
+>
+> - Several remaining hardcoded hex values are **intentional** (always-dark console terminal, ReactFlow SVG strokes) and must **NOT** be swept into tokens.
+> - A "bigger" grid on a running instance is a stale build, not code — the grid size is 32px, identical to the site.
+> - Dark-theme `--table-*` values are byte-identical to the pre-migration hardcoded rgba; light theme was fixed (it was buggy always-dark via dead `var()` fallbacks).
 
 ---
 
diff --git a/docs/architecture/QUALITY_GATES.md b/docs/architecture/QUALITY_GATES.md
index 0b0c977012..3686b9eef4 100644
--- a/docs/architecture/QUALITY_GATES.md
+++ b/docs/architecture/QUALITY_GATES.md
@@ -34,7 +34,7 @@ Runs on every PR to `main`. Blocks merge on failure.
 | `audit:deps`                   | `npm audit` (root + electron) — no high/critical advisories (overlaps osv `check:vuln-ratchet`; see Rationalization Backlog)                                       | Yes                                      |
 | `check:lockfile`               | `package-lock.json` integrity — https registry, integrity hashes, no host overrides                                                                                | Yes                                      |
 | `check:licenses`               | SPDX license allowlist for production dependencies                                                                                                                 | Yes                                      |
-| `check:tracked-artifacts`      | No build artifacts / committed `node_modules` symlinks (also runs in husky pre-push)                                                                               | Yes                                      |
+| `check:tracked-artifacts`      | No build artifacts / committed `node_modules` symlinks (also runs in husky pre-commit; pre-push is intentionally light — #6716)                                     | Yes                                      |
 | `check:file-size`              | No source file exceeds the per-extension cap (ratchet: frozen large files in `frozen` list)                                                                        | Yes                                      |
 | `check:error-helper`           | Error responses in executors/handlers use `buildErrorBody()` / `sanitizeErrorMessage()` (Hard Rule #12)                                                            | Yes                                      |
 | `check:migration-numbering`    | Migration SQL files are sequentially numbered, no gaps or duplicates                                                                                               | Yes                                      |
@@ -259,9 +259,10 @@ several "obvious" merges turned out to hide debt and are **not** clean drop-ins.
 - **`check:docs-sync` runs twice** — standalone in the `lint` job and again inside `check:docs-all` (`docs-sync-strict`) and the husky pre-commit hook. ✅ **DONE** — standalone `lint` invocation removed.
 - **CVE scanning** — ❌ **NOT a clean merge.** `audit:deps` hard-fails on any high/critical CVE; `check:vuln-ratchet` (osv) only fails on a _regression_ vs baseline (currently 1 MODERATE). Different semantics — dropping `audit:deps` would lose the absolute high/critical gate. Keep both.
 - **Cycle detection** — ❌ **NOT a clean merge.** `check:circular-deps` (dpdm) reports **91 cycles** (that is why it is advisory); it cannot be promoted to blocking without first resolving them, and it has a broader scope than the green, curated `check:cycles`. Keep `check:cycles` blocking; resolving the 91 dpdm cycles is its own backlog.
-- **Complexity** — ⏳ valid but real surgery. `check:complexity` (core ESLint) + `check:cognitive-complexity` (sonarjs) are two ESLint passes over `src` + `open-sse`; merging into one config emitting both metrics needs careful ratchet re-wiring. Deferred.
-- **`/api` anti-hallucination** — ⏳ valid but script surgery. `check:openapi-routes` (spec→route) + `check:docs-symbols` (prose→route) share resolution logic; collapsing them is a non-trivial script change. Deferred.
+- **Complexity** — ✅ **DONE** (`check:complexity-ratchets` / `eslint.complexity-ratchets.config.mjs`): one ESLint walk, counts by ruleId so cyclomatic+max-lines and cognitive baselines stay independent; individual `check:complexity` / `check:cognitive-complexity` remain for local `--update`.
+- **`/api` anti-hallucination** — ✅ **DONE** (`check:api-docs-refs` + `scripts/check/lib/apiRoutes.mjs`): one FS inventory of `src/app/api`, openapi-routes + docs-symbols still report independently; individuals remain for local runs.
 - **`check:node-runtime` runs in 11 jobs** — ⚠️ **low ROI.** Each is a separate runner and the check is <1s; total savings ~10s, against losing a cheap per-job guard. Not worth the churn.
+- **`typecheck:noimplicit:core` on CI lint** — ✅ **removed from lint job** (was advisory `continue-on-error`); blocking type surface is `typecheck:core` + `check:type-coverage`. Local script retained.
 
 ### Flip / decide (operator policy)
 
diff --git a/docs/combo-context-requirements.md b/docs/combo-context-requirements.md
new file mode 100644
index 0000000000..184f01b2b9
--- /dev/null
+++ b/docs/combo-context-requirements.md
@@ -0,0 +1,262 @@
+# Combo Context Requirements Feature
+
+## Overview
+
+The Context Requirements feature allows combo configurations to filter and sort targets based on their context window size. This is useful for use cases requiring large context windows like:
+
+- Long document processing (100k+ tokens)
+- Large codebase analysis
+- Extensive conversation histories
+- Multi-file code reviews
+
+## Configuration
+
+### Schema
+
+Add `contextRequirements` to your combo's runtime config:
+
+```json
+{
+  "contextRequirements": {
+    "minContextWindow": 128000,
+    "preferLargeContext": true,
+    "contextFilterMode": "strict"
+  }
+}
+```
+
+### Fields
+
+#### `minContextWindow` (optional)
+
+- **Type**: `number` (0 to 10,000,000)
+- **Default**: `undefined` (no filtering)
+- **Description**: Filters out models with context windows below this threshold
+
+**Examples**:
+
+- `32000` - Filter out models with <32K context
+- `128000` - Require 128K+ context (GPT-4 Turbo, Claude 3)
+- `200000` - Require 200K+ context (Claude 3 Opus)
+- `1000000` - Require 1M+ context (Gemini 1.5 Pro)
+
+#### `preferLargeContext` (optional)
+
+- **Type**: `boolean`
+- **Default**: `false`
+- **Description**: When `true`, sorts remaining targets by context size (descending). Large context models are tried first.
+
+#### `contextFilterMode` (optional)
+
+- **Type**: `"strict"` | `"lenient"`
+- **Default**: `"lenient"`
+- **Description**: How to handle models with unknown context window limits
+  - `"strict"`: Excludes models with unknown context limits
+  - `"lenient"`: Includes models with unknown context limits
+
+## Behavior
+
+### Filtering Pipeline
+
+Context requirements are applied after `filterTargetsByRequestCompatibility()`:
+
+1. **Request compatibility filtering** - Removes models incompatible with request (tools, vision, structured output)
+2. **Context requirements filtering** - Applies `minContextWindow` and `contextFilterMode`
+3. **Context-based sorting** - If `preferLargeContext` is true, sorts by context size descending
+
+### Filter Mode Logic
+
+When `minContextWindow` is set:
+
+**Lenient mode** (default):
+
+- ✅ Includes models with context >= minContextWindow
+- ✅ Includes models with unknown context limits
+- ❌ Excludes models with context < minContextWindow
+
+**Strict mode**:
+
+- ✅ Includes models with context >= minContextWindow
+- ❌ Excludes models with unknown context limits
+- ❌ Excludes models with context < minContextWindow
+
+### Sorting Logic
+
+When `preferLargeContext` is true:
+
+- Models are sorted by context window size (descending)
+- Unknown context models sort to the end
+- Original strategy order is used as a tiebreaker
+
+## Use Cases
+
+### Example 1: Long Document Processing
+
+```json
+{
+  "name": "Document Analysis",
+  "strategy": "fusion",
+  "config": {
+    "contextRequirements": {
+      "minContextWindow": 128000,
+      "preferLargeContext": true,
+      "contextFilterMode": "strict"
+    }
+  }
+}
+```
+
+This configuration:
+
+- Requires 128K+ context window
+- Prefers larger context models (Gemini 1.5 Pro > Claude 3 Opus > GPT-4 Turbo)
+- Excludes models with unknown context limits
+
+### Example 2: Large Codebase Analysis
+
+```json
+{
+  "name": "Code Review",
+  "strategy": "auto",
+  "config": {
+    "contextRequirements": {
+      "minContextWindow": 200000,
+      "preferLargeContext": true,
+      "contextFilterMode": "lenient"
+    }
+  }
+}
+```
+
+This configuration:
+
+- Requires 200K+ context window
+- Prefers larger context models
+- Includes models with unknown limits (lenient)
+
+### Example 3: Prefer Large Context Without Strict Requirements
+
+```json
+{
+  "name": "Flexible Chat",
+  "strategy": "weighted",
+  "config": {
+    "contextRequirements": {
+      "preferLargeContext": true
+    }
+  }
+}
+```
+
+This configuration:
+
+- No minimum requirement (all models eligible)
+- Sorts by context size (largest first)
+- Useful when large context is preferred but not required
+
+## API Response
+
+When context requirements filter targets, the combo logger outputs:
+
+```
+[COMBO] Context requirements: filtered 10 → 3 targets (minContextWindow: 128000, mode: strict)
+[COMBO] Context requirements: kept models gemini-1.5-pro, claude-3-opus-20240229, gpt-4-turbo
+[COMBO] Context requirements: sorted by context size (descending): gemini-1.5-pro(1000000), claude-3-opus-20240229(200000), gpt-4-turbo(128000)
+```
+
+## Implementation Details
+
+### Backend Module
+
+`open-sse/services/combo/contextRequirements.ts`:
+
+- `applyContextRequirements()` - Main filtering function
+- `getTargetContextWindow()` - Context lookup helper
+- Uses `getModelContextLimit()` from `modelCapabilities.ts`
+
+### Integration Point
+
+`open-sse/services/combo.ts` line 1187:
+
+```typescript
+orderedTargets = filterTargetsByRequestCompatibility(orderedTargets, body, log);
+orderedTargets = applyContextRequirements(orderedTargets, config.contextRequirements, log);
+```
+
+### Schema Definition
+
+`src/shared/validation/schemas/combo.ts`:
+
+```typescript
+contextRequirements: z
+  .object({
+    minContextWindow: z.coerce.number().int().min(0).max(10_000_000).optional(),
+    preferLargeContext: z.boolean().optional(),
+    contextFilterMode: z.enum(["strict", "lenient"]).optional(),
+  })
+  .strict()
+  .optional(),
+```
+
+## Testing
+
+### Run Tests
+
+```bash
+# Unit tests (schema + logic)
+npm test tests/unit/combo-context-requirements.test.ts
+
+# Integration tests (end-to-end)
+npm test tests/unit/combo/context-requirements-integration.test.ts
+```
+
+### Test Coverage
+
+- Schema validation: 6 tests
+- Filtering logic: 6 tests
+- Integration: 5 tests
+- **Total**: 17/17 passing ✅
+
+## Troubleshooting
+
+### All targets filtered out
+
+**Problem**: All targets removed, combo returns "no compatible models"
+
+**Solutions**:
+
+1. Lower `minContextWindow` threshold
+2. Switch to `"lenient"` mode to include unknown context models
+3. Remove `minContextWindow` and use only `preferLargeContext`
+
+### Unknown context models excluded
+
+**Problem**: Custom/new models excluded even though they have large context
+
+**Solutions**:
+
+1. Switch to `"lenient"` mode (default)
+2. Add model context limit to `modelCapabilities.ts`
+3. Remove context filtering and rely on strategy order
+
+### Sorting not applied
+
+**Problem**: `preferLargeContext` doesn't change order
+
+**Check**:
+
+1. Verify `preferLargeContext: true` in config
+2. Check if all targets have unknown context (all sort equal)
+3. Verify multiple targets remain after filtering
+
+## Related
+
+- [Auto-Combo Routing Strategies](./routing/AUTO-COMBO.md)
+- [Resilience Guide](./architecture/RESILIENCE_GUIDE.md)
+
+## Version History
+
+- **v3.8.47**: Initial implementation
+  - Added `contextRequirements` config
+  - Created backend filtering module
+  - Full test coverage (no dedicated dashboard UI yet — configure via combo JSON)
diff --git a/docs/guides/FEATURES.md b/docs/guides/FEATURES.md
index 807352b977..6f7ece1eb3 100644
--- a/docs/guides/FEATURES.md
+++ b/docs/guides/FEATURES.md
@@ -23,7 +23,7 @@ The v3.7.x → v3.8.0 cycle added zero-config auto routing, new providers, OAuth
 - 🆕 **Z.AI provider** — new free-tier provider with quota labels
 - 🎬 **KIE media expansion** — extended catalog including video generation models
 - 🔐 **Windsurf + Devin CLI OAuth flows** (#2168) — end-to-end browser-based login
-- 🆓 **9 new free providers** — LLM7, Lepton, Kluster, UncloseAI, BazaarLink, Completions, Enally, FreeTheAi, Command Code
+- 🆓 **8 new free providers** — LLM7, Lepton, UncloseAI, BazaarLink, Completions, Enally, FreeTheAi, Command Code
 - 🎯 **Manifest-aware tier routing W1–W4** — provider manifests drive weighted tier selection
 - 🎨 **Cursor full OpenAI parity** — tool calls, streaming, session management end-to-end
 - 📊 **Cursor Pro plan usage** — quota & cycle data surfaced in the provider-limits dashboard
diff --git a/docs/guides/I18N.md b/docs/guides/I18N.md
index 355093f24f..ed684900b9 100644
--- a/docs/guides/I18N.md
+++ b/docs/guides/I18N.md
@@ -6,7 +6,7 @@ lastUpdated: 2026-06-28
 
 # i18n — Internationalization Guide
 
-OmniRoute supports **42 languages** with full dashboard UI translation, translated documentation, and RTL support for Arabic and Hebrew.
+OmniRoute supports **43 languages** with full dashboard UI translation, translated documentation, and RTL support for Arabic and Hebrew.
 
 🌐 **Languages:** 🇺🇸 [English](./I18N.md) | 🇧🇷 [Português (Brasil)](../i18n/pt-BR/docs/guides/I18N.md) | 🇪🇸 [Español](../i18n/es/docs/guides/I18N.md) | 🇫🇷 [Français](../i18n/fr/docs/guides/I18N.md) | 🇩🇪 [Deutsch](../i18n/de/docs/guides/I18N.md) | 🇮🇹 [Italiano](../i18n/it/docs/guides/I18N.md) | 🇷🇺 [Русский](../i18n/ru/docs/guides/I18N.md) | 🇨🇳 [中文 (简体)](../i18n/zh-CN/docs/guides/I18N.md) | 🇯🇵 [日本語](../i18n/ja/docs/guides/I18N.md) | 🇰🇷 [한국어](../i18n/ko/docs/guides/I18N.md) | 🇸🇦 [العربية](../i18n/ar/docs/guides/I18N.md) | 🇮🇳 [हिन्दी](../i18n/hi/docs/guides/I18N.md) | 🇹🇭 [ไทย](../i18n/th/docs/guides/I18N.md) | 🇹🇷 [Türkçe](../i18n/tr/docs/guides/I18N.md) | 🇺🇦 [Українська](../i18n/uk-UA/docs/guides/I18N.md) | 🇻🇳 [Tiếng Việt](../i18n/vi/docs/guides/I18N.md) | 🇧🇬 [Български](../i18n/bg/docs/guides/I18N.md) | 🇩🇰 [Dansk](../i18n/da/docs/guides/I18N.md) | 🇫🇮 [Suomi](../i18n/fi/docs/guides/I18N.md) | 🇮🇱 [עברית](../i18n/he/docs/guides/I18N.md) | 🇭🇺 [Magyar](../i18n/hu/docs/guides/I18N.md) | 🇮🇩 [Bahasa Indonesia](../i18n/id/docs/guides/I18N.md) | 🇲🇾 [Bahasa Melayu](../i18n/ms/docs/guides/I18N.md) | 🇳🇱 [Nederlands](../i18n/nl/docs/guides/I18N.md) | 🇳🇴 [Norsk](../i18n/no/docs/guides/I18N.md) | 🇵🇹 [Português (Portugal)](../i18n/pt/docs/guides/I18N.md) | 🇷🇴 [Română](../i18n/ro/docs/guides/I18N.md) | 🇵🇱 [Polski](../i18n/pl/docs/guides/I18N.md) | 🇸🇰 [Slovenčina](../i18n/sk/docs/guides/I18N.md) | 🇸🇪 [Svenska](../i18n/sv/docs/guides/I18N.md) | 🇵🇭 [Filipino](../i18n/phi/docs/guides/I18N.md) | 🇨🇿 [Čeština](../i18n/cs/docs/guides/I18N.md)
 
@@ -134,6 +134,7 @@ README variants) are not yet handled by the new pipeline and are still used.
 | `uk-UA` | Українська           | No  | `uk`                  |
 | `vi`    | Tiếng Việt           | No  | `vi`                  |
 | `zh-CN` | 中文 (简体)          | No  | `zh-CN`               |
+| `zh-TW` | 中文 (繁體)          | No  | `zh-TW`               |
 
 ## Adding a New Language
 
@@ -241,7 +242,7 @@ python3 scripts/i18n/i18n_autotranslate.py \
 - Scans `docs/i18n/` markdown files for English paragraphs
 - Skips code blocks, tables, and already-translated content
 - Sends paragraphs to LLM with technical translation system prompt
-- Supports all 42 languages
+- Supports all 43 languages
 
 ## CLI i18n
 
@@ -250,7 +251,7 @@ The `omniroute` CLI has its own i18n layer separate from the Next.js dashboard.
 ### How it works
 
 - Every user-facing string in CLI commands goes through `t("module.key", vars)` from `bin/cli/i18n.mjs`.
-- Catalogs are JSON files in `bin/cli/locales/` — 42 ship out-of-the-box.
+- Catalogs are JSON files in `bin/cli/locales/` — 43 ship out-of-the-box.
 - Locale falls back to `en` for any missing key, so partial translations are valid.
 - The source of truth for available locales is `config/i18n.json` (shared with the dashboard).
 
@@ -301,7 +302,7 @@ invocation. Use `config lang set` to persist.
 
 ### Available locales
 
-42 locale files ship in `bin/cli/locales/`. Full translations: `en`, `pt-BR`.
+43 locale files ship in `bin/cli/locales/`. Full translations: `en`, `pt-BR`.
 Scaffold-only (all keys fall back to `en`): `bn`, `gu`, `he`, `in`, `mr`, `ms`, `phi`, `sw`, `ta`, `te`, `ur`.
 All other 29 locales have `common` + `program` keys translated.
 
@@ -348,12 +349,13 @@ python3 scripts/i18n/validate_translation.py -l cs
 - **Placeholder mismatches** — ICU placeholders that don't match between source and translation
 
 **Exit codes:**
-| Code | Meaning |
-|------|---------|
-| 0 | OK |
-| 1 | Generic error |
-| 2 | Missing strings (hard error) |
-| 3 | Untranslated warning (soft) |
+
+| Code | Meaning                      |
+| ---- | ---------------------------- |
+| 0    | OK                           |
+| 1    | Generic error                |
+| 2    | Missing strings (hard error) |
+| 3    | Untranslated warning (soft)  |
 
 **Environment:** Set `TRANSLATION_LANG=cs` or use `-l cs` flag.
 
diff --git a/docs/guides/KIRO_SETUP.md b/docs/guides/KIRO_SETUP.md
index 737ff8c2e7..1730076647 100644
--- a/docs/guides/KIRO_SETUP.md
+++ b/docs/guides/KIRO_SETUP.md
@@ -29,7 +29,8 @@ Kiro connection import. This gives each OmniRoute connection its own dedicated O
 client registration. Because each client registration is independent, refreshing or
 re-authenticating one account does not affect any other account's refresh token.
 
-The isolation applies to all three import methods:
+The isolation applies to the refresh-token import methods, and API-key auth avoids
+OIDC refresh sessions entirely:
 
 | Import method                                 | Isolation status                                                                                 |
 | --------------------------------------------- | ------------------------------------------------------------------------------------------------ |
@@ -37,6 +38,7 @@ The isolation applies to all three import methods:
 | **Import Token** (manual refresh token paste) | Isolated from v3.8.0                                                                             |
 | **Google / GitHub social login**              | Isolated from v3.8.0                                                                             |
 | **Auto-Import** (kiro-cli SQLite)             | Isolated from v3.8.0 (SQLite path was already isolated; SSO-cache fallback is now also isolated) |
+| **API Key** (long-lived CodeWhisperer key)    | No refresh session; the key is validated and stored as a bearer credential                       |
 
 ---
 
@@ -66,10 +68,12 @@ receive their own client registration automatically.
 1. Open **Dashboard → Providers → Add Provider → Kiro**.
 2. Choose one of:
    - **Import Token** — paste a refresh token starting with `aorAAAAAG`.
+   - **API Key** — paste a long-lived Kiro / CodeWhisperer API key.
    - **Google / GitHub login** — complete the OAuth flow in the browser.
    - **Auto-Import** — click the button; OmniRoute reads credentials from the
      local kiro-cli database or `~/.aws/sso/cache`.
-3. The connection is saved. OmniRoute automatically registers a dedicated OIDC client for it.
+3. The connection is saved. Refresh-token flows automatically register a dedicated
+   OIDC client. API-key flows validate the key with AWS and do not store a refresh token.
 
 ### Step 2: Import the second account
 
@@ -112,6 +116,52 @@ The `region` field defaults to `us-east-1` when omitted.
 
 ---
 
+## API-Key Import Flow
+
+API-key auth is for long-lived Kiro / AWS CodeWhisperer bearer credentials. It does
+not use OAuth refresh, so it avoids shared OIDC session invalidation.
+
+### Dashboard
+
+1. Open **Dashboard -> Providers -> Kiro**.
+2. Choose **API Key**.
+3. Paste the API key and optional AWS region (`us-east-1` by default).
+4. OmniRoute validates the key and saves the connection.
+
+### API
+
+```bash
+curl -X POST http://localhost:20128/api/oauth/kiro/api-key \
+  -H "Content-Type: application/json" \
+  -d '{"apiKey": "kiro_or_codewhisperer_key", "region": "us-east-1"}'
+```
+
+### Internal Contract
+
+The API route validates the key by calling `KiroService.validateApiKey()`, which
+uses `ListAvailableProfiles` against the region-matched CodeWhisperer/Amazon Q
+endpoint and resolves a `profileArn`.
+
+The saved connection uses:
+
+```json
+{
+  "authType": "apikey",
+  "providerSpecificData": {
+    "authMethod": "api_key",
+    "region": "us-east-1",
+    "profileArn": "arn:aws:codewhisperer:..."
+  }
+}
+```
+
+At runtime, `KiroExecutor.buildHeaders()` sends the key as
+`Authorization: Bearer <key>` and adds `tokentype: API_KEY`. Quota/profile calls
+use the same marker so AWS treats the bearer as a long-lived API key rather than
+an OIDC or social access token.
+
+---
+
 ## OIDC Client Expiry
 
 AWS SSO OIDC public clients typically expire after 90 days
@@ -120,6 +170,9 @@ for observability. If a connection stops refreshing after ~90 days, re-import th
 connection to obtain a fresh OIDC client registration. Automatic re-registration on
 expiry is tracked as a future improvement.
 
+API-key connections do not have OIDC client expiry because they do not refresh
+through AWS SSO OIDC.
+
 ---
 
 ## Troubleshooting
@@ -137,4 +190,11 @@ expiry is tracked as a future improvement.
   region). If you are behind a corporate proxy, set a provider-level proxy in
   **Dashboard → Settings → Proxies**.
 
+### API-key import fails
+
+- Confirm the key is a Kiro / CodeWhisperer API key, not a refresh token.
+- Confirm the AWS region matches the key/account. `us-east-1` is the default.
+- The key must be able to call `ListAvailableProfiles`; otherwise OmniRoute cannot
+  resolve the required `profileArn`.
+
 For other issues, see the main [TROUBLESHOOTING.md](./TROUBLESHOOTING.md).
diff --git a/docs/i18n/ar/CHANGELOG.md b/docs/i18n/ar/CHANGELOG.md
index a797adc551..106a1fce5d 100644
--- a/docs/i18n/ar/CHANGELOG.md
+++ b/docs/i18n/ar/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/ar/llm.txt b/docs/i18n/ar/llm.txt
index 775cd2b66e..bbf5c27c78 100644
--- a/docs/i18n/ar/llm.txt
+++ b/docs/i18n/ar/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/az/CHANGELOG.md b/docs/i18n/az/CHANGELOG.md
index 9221f2516a..e97c468c32 100644
--- a/docs/i18n/az/CHANGELOG.md
+++ b/docs/i18n/az/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/az/llm.txt b/docs/i18n/az/llm.txt
index 45c98fe7db..f687ce262d 100644
--- a/docs/i18n/az/llm.txt
+++ b/docs/i18n/az/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/bg/CHANGELOG.md b/docs/i18n/bg/CHANGELOG.md
index 9221f2516a..e97c468c32 100644
--- a/docs/i18n/bg/CHANGELOG.md
+++ b/docs/i18n/bg/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/bg/llm.txt b/docs/i18n/bg/llm.txt
index 45c98fe7db..f687ce262d 100644
--- a/docs/i18n/bg/llm.txt
+++ b/docs/i18n/bg/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/bn/CHANGELOG.md b/docs/i18n/bn/CHANGELOG.md
index 83d1791945..f52deaab68 100644
--- a/docs/i18n/bn/CHANGELOG.md
+++ b/docs/i18n/bn/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/bn/llm.txt b/docs/i18n/bn/llm.txt
index fdb0178a80..14269bdeaa 100644
--- a/docs/i18n/bn/llm.txt
+++ b/docs/i18n/bn/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/cs/CHANGELOG.md b/docs/i18n/cs/CHANGELOG.md
index 96e0ae32d7..2593fd7099 100644
--- a/docs/i18n/cs/CHANGELOG.md
+++ b/docs/i18n/cs/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/cs/llm.txt b/docs/i18n/cs/llm.txt
index baf7b823d8..d26dc026f3 100644
--- a/docs/i18n/cs/llm.txt
+++ b/docs/i18n/cs/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/da/CHANGELOG.md b/docs/i18n/da/CHANGELOG.md
index d37fd85c11..c469f84733 100644
--- a/docs/i18n/da/CHANGELOG.md
+++ b/docs/i18n/da/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/da/llm.txt b/docs/i18n/da/llm.txt
index 819865a7ed..8c54b16c7f 100644
--- a/docs/i18n/da/llm.txt
+++ b/docs/i18n/da/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/de/CHANGELOG.md b/docs/i18n/de/CHANGELOG.md
index 2191b07fd1..a6fe3eb1b1 100644
--- a/docs/i18n/de/CHANGELOG.md
+++ b/docs/i18n/de/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/de/llm.txt b/docs/i18n/de/llm.txt
index fd8b2bb12c..fc82d6b08e 100644
--- a/docs/i18n/de/llm.txt
+++ b/docs/i18n/de/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/es/CHANGELOG.md b/docs/i18n/es/CHANGELOG.md
index bf42c8136a..88b2a9dabf 100644
--- a/docs/i18n/es/CHANGELOG.md
+++ b/docs/i18n/es/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/es/llm.txt b/docs/i18n/es/llm.txt
index dc3ca451f0..fa6930d790 100644
--- a/docs/i18n/es/llm.txt
+++ b/docs/i18n/es/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/fa/CHANGELOG.md b/docs/i18n/fa/CHANGELOG.md
index fd48c4ec31..110fb1a70d 100644
--- a/docs/i18n/fa/CHANGELOG.md
+++ b/docs/i18n/fa/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/fa/llm.txt b/docs/i18n/fa/llm.txt
index 6848cd28f9..8758d5925b 100644
--- a/docs/i18n/fa/llm.txt
+++ b/docs/i18n/fa/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/fi/CHANGELOG.md b/docs/i18n/fi/CHANGELOG.md
index 15d5e6abfc..3c08a59814 100644
--- a/docs/i18n/fi/CHANGELOG.md
+++ b/docs/i18n/fi/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/fi/llm.txt b/docs/i18n/fi/llm.txt
index 96224f8a4d..7b832d7f64 100644
--- a/docs/i18n/fi/llm.txt
+++ b/docs/i18n/fi/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/fr/CHANGELOG.md b/docs/i18n/fr/CHANGELOG.md
index 6542d7fd21..9334f0f87e 100644
--- a/docs/i18n/fr/CHANGELOG.md
+++ b/docs/i18n/fr/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/fr/llm.txt b/docs/i18n/fr/llm.txt
index 7de5c69aac..7978e1e722 100644
--- a/docs/i18n/fr/llm.txt
+++ b/docs/i18n/fr/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/gu/CHANGELOG.md b/docs/i18n/gu/CHANGELOG.md
index f13b630a3a..c70a05932a 100644
--- a/docs/i18n/gu/CHANGELOG.md
+++ b/docs/i18n/gu/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/gu/llm.txt b/docs/i18n/gu/llm.txt
index 3123e0b0aa..716a3c1a50 100644
--- a/docs/i18n/gu/llm.txt
+++ b/docs/i18n/gu/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/he/CHANGELOG.md b/docs/i18n/he/CHANGELOG.md
index 8bd9c31f47..fde50a438a 100644
--- a/docs/i18n/he/CHANGELOG.md
+++ b/docs/i18n/he/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/he/llm.txt b/docs/i18n/he/llm.txt
index f73b2bb1cc..17466a0dce 100644
--- a/docs/i18n/he/llm.txt
+++ b/docs/i18n/he/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/hi/CHANGELOG.md b/docs/i18n/hi/CHANGELOG.md
index 2fedc88fed..8264341102 100644
--- a/docs/i18n/hi/CHANGELOG.md
+++ b/docs/i18n/hi/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/hi/llm.txt b/docs/i18n/hi/llm.txt
index 64c9880884..45f2f5ee0e 100644
--- a/docs/i18n/hi/llm.txt
+++ b/docs/i18n/hi/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/hu/CHANGELOG.md b/docs/i18n/hu/CHANGELOG.md
index 2d5496de6d..1458b79827 100644
--- a/docs/i18n/hu/CHANGELOG.md
+++ b/docs/i18n/hu/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/hu/llm.txt b/docs/i18n/hu/llm.txt
index 9f574945c0..ba6d27cb24 100644
--- a/docs/i18n/hu/llm.txt
+++ b/docs/i18n/hu/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/id/CHANGELOG.md b/docs/i18n/id/CHANGELOG.md
index 803d94c222..bbd3e83e28 100644
--- a/docs/i18n/id/CHANGELOG.md
+++ b/docs/i18n/id/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/id/llm.txt b/docs/i18n/id/llm.txt
index e05008dedb..281a63458b 100644
--- a/docs/i18n/id/llm.txt
+++ b/docs/i18n/id/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/in/CHANGELOG.md b/docs/i18n/in/CHANGELOG.md
index 9c5ec35b8f..f7f1026990 100644
--- a/docs/i18n/in/CHANGELOG.md
+++ b/docs/i18n/in/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/in/llm.txt b/docs/i18n/in/llm.txt
index 6e91c869fd..3a9d45ef20 100644
--- a/docs/i18n/in/llm.txt
+++ b/docs/i18n/in/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/it/CHANGELOG.md b/docs/i18n/it/CHANGELOG.md
index 7f97d3f406..c6bc1c3804 100644
--- a/docs/i18n/it/CHANGELOG.md
+++ b/docs/i18n/it/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/it/llm.txt b/docs/i18n/it/llm.txt
index 6db7b5f06a..c25fa077ba 100644
--- a/docs/i18n/it/llm.txt
+++ b/docs/i18n/it/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/ja/CHANGELOG.md b/docs/i18n/ja/CHANGELOG.md
index 415027a226..2497e3dace 100644
--- a/docs/i18n/ja/CHANGELOG.md
+++ b/docs/i18n/ja/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/ja/llm.txt b/docs/i18n/ja/llm.txt
index ab529087fe..0469265645 100644
--- a/docs/i18n/ja/llm.txt
+++ b/docs/i18n/ja/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/ko/CHANGELOG.md b/docs/i18n/ko/CHANGELOG.md
index a06e0636a1..25cfda34be 100644
--- a/docs/i18n/ko/CHANGELOG.md
+++ b/docs/i18n/ko/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/ko/llm.txt b/docs/i18n/ko/llm.txt
index 8c0aeb75c6..f33c181566 100644
--- a/docs/i18n/ko/llm.txt
+++ b/docs/i18n/ko/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/mr/CHANGELOG.md b/docs/i18n/mr/CHANGELOG.md
index af7da74a4a..a6f88c8ce4 100644
--- a/docs/i18n/mr/CHANGELOG.md
+++ b/docs/i18n/mr/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/mr/llm.txt b/docs/i18n/mr/llm.txt
index cde497ddc3..f052ca9bd4 100644
--- a/docs/i18n/mr/llm.txt
+++ b/docs/i18n/mr/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/ms/CHANGELOG.md b/docs/i18n/ms/CHANGELOG.md
index 0655946871..fb673f81f2 100644
--- a/docs/i18n/ms/CHANGELOG.md
+++ b/docs/i18n/ms/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/ms/llm.txt b/docs/i18n/ms/llm.txt
index daf937c1f3..8850fb0de7 100644
--- a/docs/i18n/ms/llm.txt
+++ b/docs/i18n/ms/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/nl/CHANGELOG.md b/docs/i18n/nl/CHANGELOG.md
index 64de2d608e..f3f811d413 100644
--- a/docs/i18n/nl/CHANGELOG.md
+++ b/docs/i18n/nl/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/nl/llm.txt b/docs/i18n/nl/llm.txt
index 38c2c89661..6465050541 100644
--- a/docs/i18n/nl/llm.txt
+++ b/docs/i18n/nl/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/no/CHANGELOG.md b/docs/i18n/no/CHANGELOG.md
index d30f6e40ab..e8890ea671 100644
--- a/docs/i18n/no/CHANGELOG.md
+++ b/docs/i18n/no/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/no/llm.txt b/docs/i18n/no/llm.txt
index 1d19c59c96..be667f94f0 100644
--- a/docs/i18n/no/llm.txt
+++ b/docs/i18n/no/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/phi/CHANGELOG.md b/docs/i18n/phi/CHANGELOG.md
index af64a21733..4e4d1fd087 100644
--- a/docs/i18n/phi/CHANGELOG.md
+++ b/docs/i18n/phi/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/phi/llm.txt b/docs/i18n/phi/llm.txt
index 783034fdfb..fae6a95de1 100644
--- a/docs/i18n/phi/llm.txt
+++ b/docs/i18n/phi/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/pl/CHANGELOG.md b/docs/i18n/pl/CHANGELOG.md
index 04d0beb10b..83ac358eed 100644
--- a/docs/i18n/pl/CHANGELOG.md
+++ b/docs/i18n/pl/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/pl/llm.txt b/docs/i18n/pl/llm.txt
index 1072ad9f24..50a20e3320 100644
--- a/docs/i18n/pl/llm.txt
+++ b/docs/i18n/pl/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/pt-BR/CHANGELOG.md b/docs/i18n/pt-BR/CHANGELOG.md
index f6671c9353..dc010e1f36 100644
--- a/docs/i18n/pt-BR/CHANGELOG.md
+++ b/docs/i18n/pt-BR/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/pt-BR/llm.txt b/docs/i18n/pt-BR/llm.txt
index c117a31086..b40da47c95 100644
--- a/docs/i18n/pt-BR/llm.txt
+++ b/docs/i18n/pt-BR/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/pt/CHANGELOG.md b/docs/i18n/pt/CHANGELOG.md
index 59749572c0..e12f7be313 100644
--- a/docs/i18n/pt/CHANGELOG.md
+++ b/docs/i18n/pt/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/pt/llm.txt b/docs/i18n/pt/llm.txt
index 0624b72f3b..9568237c5d 100644
--- a/docs/i18n/pt/llm.txt
+++ b/docs/i18n/pt/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/ro/CHANGELOG.md b/docs/i18n/ro/CHANGELOG.md
index e5ea8952e9..56fc5b20b9 100644
--- a/docs/i18n/ro/CHANGELOG.md
+++ b/docs/i18n/ro/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/ro/llm.txt b/docs/i18n/ro/llm.txt
index 2810dae83d..f92f0b2444 100644
--- a/docs/i18n/ro/llm.txt
+++ b/docs/i18n/ro/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/ru/CHANGELOG.md b/docs/i18n/ru/CHANGELOG.md
index 3c57e6f197..a5129e26fb 100644
--- a/docs/i18n/ru/CHANGELOG.md
+++ b/docs/i18n/ru/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/ru/llm.txt b/docs/i18n/ru/llm.txt
index 923ed9e785..ccd8bcecc4 100644
--- a/docs/i18n/ru/llm.txt
+++ b/docs/i18n/ru/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/sk/CHANGELOG.md b/docs/i18n/sk/CHANGELOG.md
index e7ccac3dfc..79a47b5578 100644
--- a/docs/i18n/sk/CHANGELOG.md
+++ b/docs/i18n/sk/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/sk/llm.txt b/docs/i18n/sk/llm.txt
index bf2646ae46..e19bf8803f 100644
--- a/docs/i18n/sk/llm.txt
+++ b/docs/i18n/sk/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/sv/CHANGELOG.md b/docs/i18n/sv/CHANGELOG.md
index 5133caee05..b79564bcb5 100644
--- a/docs/i18n/sv/CHANGELOG.md
+++ b/docs/i18n/sv/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/sv/llm.txt b/docs/i18n/sv/llm.txt
index 9415c9010d..2d7cc63ed2 100644
--- a/docs/i18n/sv/llm.txt
+++ b/docs/i18n/sv/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/sw/CHANGELOG.md b/docs/i18n/sw/CHANGELOG.md
index 00220fa69a..16c7ef5242 100644
--- a/docs/i18n/sw/CHANGELOG.md
+++ b/docs/i18n/sw/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/sw/llm.txt b/docs/i18n/sw/llm.txt
index f9ebdc2a3d..fc08f7b142 100644
--- a/docs/i18n/sw/llm.txt
+++ b/docs/i18n/sw/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/ta/CHANGELOG.md b/docs/i18n/ta/CHANGELOG.md
index 101e8390ca..417c62272b 100644
--- a/docs/i18n/ta/CHANGELOG.md
+++ b/docs/i18n/ta/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/ta/llm.txt b/docs/i18n/ta/llm.txt
index 91f2022328..1015b8850a 100644
--- a/docs/i18n/ta/llm.txt
+++ b/docs/i18n/ta/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/te/CHANGELOG.md b/docs/i18n/te/CHANGELOG.md
index 2ec1d797d8..9c49d296b5 100644
--- a/docs/i18n/te/CHANGELOG.md
+++ b/docs/i18n/te/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/te/llm.txt b/docs/i18n/te/llm.txt
index 1de33d1956..375192f15a 100644
--- a/docs/i18n/te/llm.txt
+++ b/docs/i18n/te/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/th/CHANGELOG.md b/docs/i18n/th/CHANGELOG.md
index f2c8563340..8e5755b1ed 100644
--- a/docs/i18n/th/CHANGELOG.md
+++ b/docs/i18n/th/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/th/llm.txt b/docs/i18n/th/llm.txt
index cd0a37688c..64e8b57d81 100644
--- a/docs/i18n/th/llm.txt
+++ b/docs/i18n/th/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/tr/CHANGELOG.md b/docs/i18n/tr/CHANGELOG.md
index b2191034cd..7dc6c505c1 100644
--- a/docs/i18n/tr/CHANGELOG.md
+++ b/docs/i18n/tr/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/tr/llm.txt b/docs/i18n/tr/llm.txt
index 634d4bc259..74ef1375db 100644
--- a/docs/i18n/tr/llm.txt
+++ b/docs/i18n/tr/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/uk-UA/CHANGELOG.md b/docs/i18n/uk-UA/CHANGELOG.md
index 1f7ea3a26e..d6bdc1d1e5 100644
--- a/docs/i18n/uk-UA/CHANGELOG.md
+++ b/docs/i18n/uk-UA/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/uk-UA/llm.txt b/docs/i18n/uk-UA/llm.txt
index 14cf3b6600..54e0cafbc0 100644
--- a/docs/i18n/uk-UA/llm.txt
+++ b/docs/i18n/uk-UA/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/ur/CHANGELOG.md b/docs/i18n/ur/CHANGELOG.md
index bfdea49499..8cfe0a109d 100644
--- a/docs/i18n/ur/CHANGELOG.md
+++ b/docs/i18n/ur/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/ur/llm.txt b/docs/i18n/ur/llm.txt
index c402cff2a1..105c5cd699 100644
--- a/docs/i18n/ur/llm.txt
+++ b/docs/i18n/ur/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/vi/CHANGELOG.md b/docs/i18n/vi/CHANGELOG.md
index 31107e4de3..5ef240f54d 100644
--- a/docs/i18n/vi/CHANGELOG.md
+++ b/docs/i18n/vi/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/vi/llm.txt b/docs/i18n/vi/llm.txt
index e21816296c..24c03f7a2d 100644
--- a/docs/i18n/vi/llm.txt
+++ b/docs/i18n/vi/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/zh-CN/CHANGELOG.md b/docs/i18n/zh-CN/CHANGELOG.md
index 49ec2c3b63..17038fa999 100644
--- a/docs/i18n/zh-CN/CHANGELOG.md
+++ b/docs/i18n/zh-CN/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/zh-CN/README.md b/docs/i18n/zh-CN/README.md
index 33d254a5e2..7b8cc1f556 100644
--- a/docs/i18n/zh-CN/README.md
+++ b/docs/i18n/zh-CN/README.md
@@ -30,7 +30,7 @@
 [![50+ Free](https://img.shields.io/badge/50%2B-Free_Tiers-00B894?style=for-the-badge)](#-231-ai-providers--50-free)
 [![1.6B Free Tokens/mo](https://img.shields.io/badge/1.6B-Free_Tokens%2Fmo-00B894?style=for-the-badge)](../../reference/FREE_TIERS.md)
 [![Token Savings](https://img.shields.io/badge/up_to_95%25-Token_Savings-E17055?style=for-the-badge)](#%EF%B8%8F-save-1595-tokens--automatically)
-[![17 Strategies](https://img.shields.io/badge/17-Routing_Strategies-0984E3?style=for-the-badge)](#-combos--the-flagship)
+[![18 Strategies](https://img.shields.io/badge/18-Routing_Strategies-0984E3?style=for-the-badge)](#-combos--the-flagship)
 [![$0 to start](https://img.shields.io/badge/%240-To_Start-FDCB6E?style=for-the-badge&logoColor=black)](#-quick-start)
 
 <br/>
diff --git a/docs/i18n/zh-CN/docs/reference/ENVIRONMENT.md b/docs/i18n/zh-CN/docs/reference/ENVIRONMENT.md
index 9dd8f61069..b97bf07d96 100644
--- a/docs/i18n/zh-CN/docs/reference/ENVIRONMENT.md
+++ b/docs/i18n/zh-CN/docs/reference/ENVIRONMENT.md
@@ -480,7 +480,7 @@ process.env[`${PROVIDER_ID}_USER_AGENT`]
 
 | 变量 | 默认值 | 何时更新 |
 | --- | --- | --- |
-| `CLAUDE_USER_AGENT` | `claude-cli/2.1.195 (external, cli)` | Anthropic 发布新的 CLI 版本时 |
+| `CLAUDE_USER_AGENT` | `claude-cli/2.1.207 (external, cli)` | Anthropic 发布新的 CLI 版本时 |
 | `CLAUDE_DISABLE_TOOL_NAME_CLOAK` | `false` | `executors/base.ts` + `executors/cliproxyapi.ts` | 设为 `1`/`true` 可将第三方测试工具的工具名称原封不动地转发到 Anthropic 的两条绑定路径上（原生 OAuth 和 CLIProxyAPI）。默认情况下 executor 会将非 Claude Code 的工具名称确定性别名化（Claude Code 存在规范映射的用规范映射，否则用 PascalCase），并通过 `_toolNameMap` 在响应中还原，从而确保带 snake_case 工具的测试工具不会被视为指纹化第三方客户端而被拒绝。仅供调试。 |
 | `CODEX_USER_AGENT` | `codex-cli/0.142.0 (Windows 10.0.26200; x64)` | OpenAI 更新 Codex CLI 时 |
 | `CODEX_CLIENT_VERSION` | `0.131.0` | 独立于完整 UA 字符串覆盖 Codex 客户端版本 |
@@ -1112,4 +1112,4 @@ CLI_COMPAT_ALL=1
 
 | 变量 | 默认值 | 源文件 | 说明 |
 | --- | --- | --- | --- |
-| `OMNIROUTE_EVAL_CREDENTIALS` | `{}`（空） | `scripts/compression-eval/index.ts` | 运维人员提供的 JSON 凭证，供离线压缩评估 CLI 使用的服务商使用（通过 `JSON.parse` 解析）。未设置时进行试运行。 |
\ No newline at end of file
+| `OMNIROUTE_EVAL_CREDENTIALS` | `{}`（空） | `scripts/compression-eval/index.ts` | 运维人员提供的 JSON 凭证，供离线压缩评估 CLI 使用的服务商使用（通过 `JSON.parse` 解析）。未设置时进行试运行。 |
diff --git a/docs/i18n/zh-CN/llm.txt b/docs/i18n/zh-CN/llm.txt
index 090969a4f0..4a21c4fe0d 100644
--- a/docs/i18n/zh-CN/llm.txt
+++ b/docs/i18n/zh-CN/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/i18n/zh-TW/CHANGELOG.md b/docs/i18n/zh-TW/CHANGELOG.md
index 0c0d2726c6..71fffc6ee4 100644
--- a/docs/i18n/zh-TW/CHANGELOG.md
+++ b/docs/i18n/zh-TW/CHANGELOG.md
@@ -6,6 +6,328 @@
 
 ## [3.8.31] — 2026-06-20
 
+## [3.8.47] — 2026-07-13
+
+_Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
+
+- **9router Codex import**: the Codex bulk-import endpoint (`POST /api/oauth/codex/import`) now accepts 9router's camelCase account export (`accessToken`/`refreshToken`/`idToken`/`expiresAt` + nested `providerSpecificData`), not just snake_case — `normalizeCodexImportRecord` maps the camelCase aliases onto the existing snake_case keys, filling each only when absent so snake_case/mixed exports keep working unchanged ([#6665](https://github.com/diegosouzapw/OmniRoute/issues/6665)) — thanks @deadcoder0904. Regression guard: `tests/unit/codexBulkImport.test.ts` (9router camelCase record, pre-supplied `providerSpecificData` without an id_token, snake_case-not-overridden, and a full `{accounts:[...]}` flatten).
+
+### ✨ New Features
+
+- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127)
+
+- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77)
+- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77)
+- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems)
+- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab)
+- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok)
+- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw)
+- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw)
+- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw)
+- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw)
+
+- **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber)
+- **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470)
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+- **Per-combo reasoning token buffer toggle**: the combo builder now exposes an explicit checkbox for the `#3587` reasoning-model `max_tokens` buffer, defaulting to the existing enabled behavior, so a combo can opt out without hand-editing raw JSON config (#6702 — thanks @xz-dev)
+- **feat(dashboard):** 9router-parity **Routing Strategy** settings card on Settings → Routing, plus a per-provider account-routing override on the provider detail page ([#6678](https://github.com/diegosouzapw/OmniRoute/pull/6678)) — surfaces the existing account round-robin / sticky-limit knobs and adds a new combo-level sticky round-robin (`comboStickyRoundRobinLimit`, resolved via `resolveComboStickyRoundRobinLimit()` — per-combo → global combo sticky → account sticky cascade) so combo targets can batch calls per target the same way account fallback already does. A new `providerStrategies` setting (Zod-validated map, `src/shared/validation/settingsSchemas.ts`) lets a specific provider override the global `fallbackStrategy`/`stickyRoundRobinLimit` without touching the account-wide default, wired into `getProviderCredentials()` (`src/sse/services/auth.ts`) ahead of the global fallback. Regression guard: `tests/unit/combo-rr-sticky-9router.test.ts`, `tests/unit/settings-ui-layout-static.test.ts`. (thanks @SeaXen)
+- **feat(icons):** provider logos now resolve local SVG assets first for faster rendering, with a 5-tier fallback chain — local SVG → `@lobehub/icons` React components → `thesvg.org` CDN (external SVG for unknown providers) → local PNG → generic AI icon — replacing the previous LobeHub-first order. Adds dozens of first-party provider SVGs and migrates several bitmap logos (continue/copilot/cursor/deepgram/heroku/openclaw/ovhcloud) from PNG to SVG. Regression guard: `tests/unit/ui/ProviderIcon-icon-url.test.tsx`. ([#6317](https://github.com/diegosouzapw/OmniRoute/pull/6317) — thanks @hamsa0x7)
+- **Skill Collector CLI detection**: new `GET /api/skills/collect/detect` + `POST /api/skills/collect/install` (and the `cli-skill-collector` agent skill) detect which coding CLIs (Claude Code, Codex, Cursor, Copilot, Cline, Hermes, OpenCode, etc.) are installed locally via `getCliRuntimeStatus()`, match them against GitHub agent-skill repos, and plan an install path per tool — replacing the standalone Skill Collector Python app. Both new routes and `GET/POST /api/github-skills` now require management auth (`requireManagementAuth()`) and are loopback-gated (`LOCAL_ONLY_API_PREFIXES` + `SPAWN_CAPABLE_PREFIXES`) since the detect route spawns a child process per candidate CLI tool (Hard Rules #15 + #17). The `omniroute_github_skills_install` MCP tool now reports the honest `action: "planned"` instead of `"installed"`, matching the REST route (#6294 — thanks @Moseyuh333)
+- **ClinePass dual-auth**: ClinePass now offers both sign-in methods on its dashboard page — OAuth (reusing the Cline WorkOS flow) as the primary "Connect" path, or a pasted BYOK API key via "Manual API key", instead of only the API-key-only provider shipped in #5942. The registry alias was aligned to `cp` (matching the `OAUTH_PROVIDERS` catalog alias) so `<alias>/<modelId>` routing resolves correctly, the OAuth refresh dispatch now routes `clinepass` to the shared Cline refresh flow, and the duplicate API-key-only catalog entry was removed to keep ClinePass listed once. Regression guard: `tests/unit/clinepass-provider.test.ts`. (#6126 — thanks @hajilok)
+- **feat(oauth):** Kiro/Amazon Q auto-import now supports enterprise **External IdP** ("Your organization") logins via Microsoft Entra/Okta/Auth0/OneLogin/Ping/Google/Cognito — these org-issued tokens are not AWS SSO tokens (no `aorAAAAAG`-prefixed refresh token) and can't refresh through the AWS OIDC/Kiro-social path, so `tryAwsSsoCache()` now detects them (`authMethod`/`provider === "externalidp"`) and refreshes via the org IdP's own `tokenEndpoint` (public-client OAuth2 refresh grant, no client secret), persisting `TokenType: EXTERNAL_IDP` gating so the runtime executor sends the header the AWS CodeWhisperer API requires for these accounts; `tokenEndpoint` is SSRF-guarded against an HTTPS + known-IdP-host-suffix allowlist. (#6363 — thanks @artickc)
+- **Kiro long-lived API key auth**: new `/api/oauth/kiro/api-key` route + `KiroService.validateApiKey` let a Kiro account be linked with a long-lived AWS CodeWhisperer/Kiro API key instead of the interactive OAuth device flow, with live per-account model discovery (`ListAvailableModels`, 5-minute cache) layered over the existing static registry fallback (#6587 — thanks @strangersp)
+- **Chaos Mode**: multi-model parallel/collaborative task execution — dispatches a task to every active provider connection at once (parallel) or chains outputs sequentially so each model builds on the previous one's answer (collaborative), configurable via Dashboard → Chaos Mode (`GET`/`PUT`/`DELETE /api/chaos/config`) and gated per-API-key via a new `chaosModeEnabled` permission (opt-in — disabled by default globally and per key). `POST /api/chaos/run` (dashboard session) and `POST /api/skills/collect/chaos` (external Bearer-token) delegate to a shared `executeChaosRun()` engine (`src/lib/chaos/chaosExecutor.ts`) that dispatches in-process via the established synthetic-Request/route-handler pattern (no network hop, no hardcoded port), with a concurrency cap (max 10 parallel), configurable `max_tokens` (256–128k), a clear error when `stream` is requested, and collaborative-chain info (provider order + input size). Fixes external Bearer-auth bypass and stale config-cache leakage. Regression guard: `tests/unit/chaos-config.test.ts`, `tests/unit/chaos-executor.test.ts`, `tests/unit/chaos-api-routes.test.ts`. ([#6728](https://github.com/diegosouzapw/OmniRoute/pull/6728) — thanks @Moseyuh333)
+- **feat(cli):** 2 new CLI tool integrations on Dashboard → CLI Tools — **omp** (Oh My Pi) and **letta** — each with binary detection, config apply/reset, and a settings card following the existing tool-card pattern. Both settings routes shell out to `which omp`/`which letta` to detect the local install, so they're loopback-gated (`LOCAL_ONLY_API_PREFIXES`, Hard Rules #15/#17) in addition to the shared `requireCliToolsAuth()` management-auth guard every cli-tools route requires, and route errors through `sanitizeErrorMessage()`; `src/lib/db/omp.ts` isolates the `omp` CLI's own local SQLite reads behind parameterized queries. (Note: the original PR also proposed **pi**, **codewhale**, and **jcode** integrations — those three had already shipped via a separate PR by the time this one was reconciled, so only omp+letta landed here.) Regression guard: `tests/unit/db/omp.test.ts`, `tests/unit/cli-tools-auth-hardening.test.ts`, `tests/integration/cli-settings-omp.test.ts`, `tests/integration/cli-settings-letta.test.ts`. ([#6318](https://github.com/diegosouzapw/OmniRoute/pull/6318) — thanks @hamsa0x7)
+- **feat(providers):** custom models now support a manual **Context Window Override** so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model silently getting dropped from combo routing once the wrong value lands in the catalog ([#4125](https://github.com/diegosouzapw/OmniRoute/issues/4125) — thanks @rucciva). Reuses the existing Feature-5004 `model_context_overrides` table (`source: "manual"`) — already the priority-0 source `getModelContextLimit()` (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: `PUT /api/provider-models` now accepts an optional `contextWindowOverride` (number to set, `null` to clear), `GET` surfaces the current value back on each custom-model row, and the provider detail page's custom-model edit form gained a Context Window Override field + badge. Regression guard: `tests/unit/provider-models-context-window-override-4125.test.ts`.
+- **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna)
+- **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`.
+- **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi).
+- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky).
+- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:<reason>` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661).
+- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari).
+- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211)
+- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit)
+- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev).
+- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc).
+- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell).
+- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn).
+- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell).
+- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/<PR>-<slug>.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`.
+- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan).
+- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127).
+- **feat(dashboard):** search box on the Playground's raw model `<select>` (#4086) — the shared `ModelSelectModal` (combo builder + CLI-code cards) already had search, but Playground's `StudioConfigPane` model dropdown stayed a flat unsearchable list, unusable once a provider like OpenRouter contributed 50+ models. Typing now filters the dropdown (Turkish-safe accent/case-insensitive match via `matchesSearch`), while the currently selected model always stays pinned in the list even if it no longer matches the query, so typing never silently swaps the active selection. Reuses the existing `common.search` i18n key (already translated in all 42 locales) — no new translation key needed. Regression guard: `tests/unit/playground-model-selection-3731.test.ts` (`filterModelsByQuery`), `tests/unit/ui/playground-model-search-4086.test.tsx`.
+- **feat(usage):** Antigravity/agy quota widget now surfaces the **weekly** window alongside the existing per-model 5-hour window ([#4017](https://github.com/diegosouzapw/OmniRoute/issues/4017)) — the weekly limit isn't part of the per-model `retrieveUserQuota` response the fetcher already calls; it only appears in a separate, undocumented `retrieveUserQuotaSummary` RPC that groups models into families ("Gemini Models", "Claude and GPT models") with one weekly bucket per family. A new `usage/antigravityWeeklyQuota.ts` leaf fetches that RPC (cached, best-effort — a failure or unavailable RPC never breaks the existing per-model quotas) and parses the weekly bucket per group into `gemini_weekly`/`claude_gpt_weekly` quota entries, merged into the same `quotas` map the widget already renders generically. Regression guard: `tests/unit/antigravity-weekly-quota-4017.test.ts` (bucket parsing, the alternate `quotaSummary`-nested envelope, and end-to-end merge via `getUsageForProvider`).
+- **feat(codex):** Codex CLI compatibility shim — the Responses API `response.created`/`response.in_progress`/`response.completed` payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested, effort-suffixed model id (e.g. `gpt-5.5-xhigh`) instead of the bare upstream id (`gpt-5.5`), so the Codex CLI status line/model button shows the active reasoning effort ([#3697](https://github.com/diegosouzapw/OmniRoute/issues/3697)). `openaiToOpenAIResponsesResponse` (`open-sse/translator/response/openai-responses.ts`) now threads the upstream model into the Responses event objects; a new `isCodexOriginatedHeaders()` (`open-sse/config/codexIdentity.ts`, reusing PR #3481's `originator`/User-Agent detection) makes chatCore's existing opt-in `echoRequestedModelName` (#1311) model-echo pipeline fire automatically for Codex clients regardless of the setting, detected by request headers so it still applies when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream; `echoModelInObject`/`echoModelInSseLine` (`open-sse/services/responseModelEcho.ts`) now also rewrite the nested `response.model` field the Responses API uses. `/v1/models` still returns `models: []` for Codex (unchanged). Regression guard: `tests/unit/codex-effort-model-echo-3697.test.ts`.
+- **Z.ai Web (free web-session provider)**: new `zai-web` web-cookie provider drives the free chat.z.ai consumer chat UI via a pasted browser session cookie, distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers (`api.z.ai`) — modeled on the `doubao-web`/`venice-web` cookie executors and the pre-existing `chatglm-web` credential requirement/token-extraction entries. `ZaiWebExecutor` (`open-sse/executors/zai-web.ts`) posts to `chat.z.ai/api/chat/completions` with the cookie forwarded both as `Cookie` and as `Authorization: Bearer <token>`, and normalizes both z.ai's internal `delta_content`/`phase` SSE envelope and a pass-through OpenAI-shaped `choices[].delta` frame into standard chat-completion chunks. Registered in `WEB_COOKIE_PROVIDERS`, `WEB_SESSION_CREDENTIAL_REQUIREMENTS`, the provider registry (`zai-web` entry, GLM-4.6/4.5/4.5V models), and `tokenExtractionConfig.ts` for in-app cookie capture. Regression guard: `tests/unit/executor-zai-web.test.ts` (16 tests — token extraction, frame parsing for both SSE shapes, streaming and non-streaming aggregation, error paths). (#4056)
+- **feat(compression):** update the vendored **GCF** codec behind the **Headroom** engine to spec **v3.2 (nested flattening)** ([#6837](https://github.com/diegosouzapw/OmniRoute/issues/6837)). Homogeneous arrays whose rows carry nested objects/arrays now tabularize via `>`-prefixed path fields instead of a low-yield per-row fallback, so nested MCP tool-result rows (`meta:{...}`, `tags:[...]`) compact like flat rows. On representative shapes the update takes deeply-nested payloads the old codec left near-uncompressed from ~3% to ~32% vs JSON (k8s pods, `cl100k_base`), with shallow-nested rows seeing a small bump and flat arrays unchanged. Re-vendored from current gcf-typescript (zero runtime deps, MIT, SPDX-marked, generic-profile only); also folds in the `[N]:` inline-array quoting fix and canonical decimal formatting. Round-trip stays lossless (order-insensitive), and the decoder is hardened against prototype pollution (a `__proto__`/`constructor` path segment never mutates `Object.prototype`, and keys shadowing built-ins like `toString` now round-trip correctly instead of misparsing). Regression guard: `tests/unit/compression/headroom-smartcrusher.test.ts` (deep-nested + prototype-pollution cases).
+- **feat(providers):** Add GPT-5.6 support across OpenAI API, Codex, and ChatGPT Web, including Codex Max/Ultra efforts, VS Code metadata, Fast-tier credit accounting, curated live discovery, the Codex 0.144.1 client identity, and correct chat routing for models that also support image generation ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+- **chore(providers):** Align emitted Claude Code identity headers, bridge fingerprints, provider profiles, and documented defaults with claude-cli 2.1.207 ([#6862](https://github.com/diegosouzapw/OmniRoute/pull/6862)) - thanks @backryun
+
+### 🐛 Bug Fixes
+
+- **fix(dashboard):** the Proxy Registry settings page crashed at runtime (`ReferenceError: poolLoaded/bulkImportOpen is not defined`) — the #6625/#6909 hook-extraction refactors deleted 10 state declarations (`poolLoaded`, `poolSaving`, and the 8-member bulk-import family) while ~30 usages remained; all restored (caught by the release E2E; `typecheck:core` does not cover dashboard TSX — follow-up #7021). (thanks @diegosouzapw)
+
+- **fix(combo):** `comboStickyRoundRobinLimit` now defaults to inherit (`null`) instead of `1` — the literal default silently shadowed the documented batched round-robin rotation (`stickyRoundRobinLimit: 3`), flipping every round-robin combo to per-request alternation (#6678 follow-up, caught by the release CI). (thanks @diegosouzapw)
+- **fix(ws):** the standalone LiveWS startup script exited 0 without ever listening — its bootstrapped child re-spawned with the import-suppressor `OMNIROUTE_ENABLE_LIVE_WS=0` and then honored it as an operator disable (#6072 follow-up, caught by the release CI). (thanks @diegosouzapw)
+
+- **fix(api):** compression PUT schema accepts every catalog engine. ([#6792](https://github.com/diegosouzapw/OmniRoute/pull/6792) — thanks @Pitchfork-and-Torch)
+- **fix(compression):** surface fallback reasons in the preview response. ([#6461](https://github.com/diegosouzapw/OmniRoute/issues/6461), [#6519](https://github.com/diegosouzapw/OmniRoute/pull/6519) — thanks @chirag127)
+- **fix(providers):** fail fast on an empty auto-combo pool instead of a 15s timeout. ([#6458](https://github.com/diegosouzapw/OmniRoute/issues/6458), [#6546](https://github.com/diegosouzapw/OmniRoute/pull/6546) — thanks @chirag127)
+- **fix(compression):** honor UI-toggled engines in the stackedPipeline dispatch + surface substitutions. ([#6463](https://github.com/diegosouzapw/OmniRoute/issues/6463), [#6534](https://github.com/diegosouzapw/OmniRoute/pull/6534) — thanks @chirag127)
+- **fix(api):** return 400 for missing/invalid `messages` before model resolution. ([#6402](https://github.com/diegosouzapw/OmniRoute/issues/6402), [#6515](https://github.com/diegosouzapw/OmniRoute/pull/6515) — thanks @chirag127)
+- **fix(providers):** enrich the model_cooldown 429 body with a `retry_after` ISO timestamp + credential count. ([#6460](https://github.com/diegosouzapw/OmniRoute/issues/6460), [#6523](https://github.com/diegosouzapw/OmniRoute/pull/6523) — thanks @chirag127)
+
+- **fix(sse):** default reasoning summary for effort-only Responses requests. ([#6807](https://github.com/diegosouzapw/OmniRoute/pull/6807) — thanks @rushsinging)
+- **fix(sse):** compression no-op treated as zero-savings, not inflation/silent-drop. ([#6883](https://github.com/diegosouzapw/OmniRoute/pull/6883) — thanks @chirag127)
+- **fix(oauth):** Trae OAuth client_id embedded via `resolvePublicCred()` (Hard Rule #11). ([#6870](https://github.com/diegosouzapw/OmniRoute/pull/6870) — thanks @chirag127)
+- **fix(sse):** combo path no longer trips the whole-provider breaker on a plain 429. ([#6868](https://github.com/diegosouzapw/OmniRoute/pull/6868) — thanks @chirag127)
+- **fix(api):** malformed JSON bodies now return 400 instead of 500. ([#6871](https://github.com/diegosouzapw/OmniRoute/pull/6871) — thanks @chirag127)
+- **fix(fusion):** judge selected from a surviving panel member when no explicit judge is configured. ([#6869](https://github.com/diegosouzapw/OmniRoute/pull/6869) — thanks @chirag127)
+- **fix(sse):** combo model lockout honors the parsed upstream quota reset. ([#6863](https://github.com/diegosouzapw/OmniRoute/issues/6863), [#6866](https://github.com/diegosouzapw/OmniRoute/pull/6866) — thanks @AgentKiller45)
+- **fix(dashboard):** logs detail modal no longer reopens on first close. ([#6830](https://github.com/diegosouzapw/OmniRoute/pull/6830) — thanks @MikeTuev)
+- **fix(usage):** honor xAI provider-reported exact cost. ([#6711](https://github.com/diegosouzapw/OmniRoute/pull/6711) — thanks @diegosouzapw)
+- **fix(kiro):** probe IdC region during profileArn discovery, cross-region (recovers #6099). ([#6840](https://github.com/diegosouzapw/OmniRoute/pull/6840) — thanks @diegosouzapw)
+- **fix(antigravity):** sanitize Cloud Code safety settings. ([#6839](https://github.com/diegosouzapw/OmniRoute/pull/6839) — thanks @diegosouzapw)
+- **fix(translator):** defer `content_block_start` until GLM streams the tool name. ([#6730](https://github.com/diegosouzapw/OmniRoute/pull/6730) — thanks @diegosouzapw)
+- **fix(translator):** strip empty `cloud_base_branch` from Cursor Subagent tool calls. ([#6729](https://github.com/diegosouzapw/OmniRoute/pull/6729) — thanks @diegosouzapw)
+- **fix(antigravity):** surface aborted Gemini tool calls off `end_turn`. ([#6713](https://github.com/diegosouzapw/OmniRoute/pull/6713) — thanks @diegosouzapw)
+- **fix(volcengine):** clamp Kimi `max_tokens` to the Ark endpoint cap. ([#6712](https://github.com/diegosouzapw/OmniRoute/pull/6712) — thanks @diegosouzapw)
+- **fix(codex):** surface capacity errors embedded in 200-OK SSE streams. ([#6710](https://github.com/diegosouzapw/OmniRoute/pull/6710) — thanks @diegosouzapw)
+- **fix(sse):** skip `thinkingConfig` for gemma models in openai→gemini translation. ([#6708](https://github.com/diegosouzapw/OmniRoute/pull/6708) — thanks @diegosouzapw)
+- **fix(oauth):** avoid bare-email dedup of Codex OAuth logins. ([#6706](https://github.com/diegosouzapw/OmniRoute/pull/6706) — thanks @diegosouzapw)
+- **fix(sse):** unwrap bare `{function:{…}}` tools in openai→claude translation. ([#6704](https://github.com/diegosouzapw/OmniRoute/pull/6704) — thanks @diegosouzapw)
+- **fix(db):** eliminate a redundant `getApiKeyMetadata` call in the embeddings route. ([#6929](https://github.com/diegosouzapw/OmniRoute/pull/6929) — thanks @oyi77)
+- **fix(db):** `authType` filter support in `getProviderConnections`. ([#6946](https://github.com/diegosouzapw/OmniRoute/pull/6946) — thanks @oyi77)
+- **fix(i18n):** the provider-detail (`/dashboard/providers/[id]`) visibility + free/paid model filter labels (`showVisibleOnly`, `showHiddenOnly`, `freeFilterAll`, `freeFilterFreeOnly`, `freeFilterPaidOnly`, `hideAllModels`, plus the currently-unused `filterVisible`/`filterHidden`/`filterByVisibility`) rendered as the literal `__MISSING__:<english>` sentinel in 15 locales, including pt-BR ([#6694](https://github.com/diegosouzapw/OmniRoute/issues/6694)) — `providerText()` (`providerPageHelpers.ts`) checks `t.has(key)` before falling back to clean English, and `t.has()` returns `true` even when the stored value is the `__MISSING__:` sentinel `scripts/i18n/sync-ui-keys.mjs` writes when mirroring keys across locales, so the sentinel rendered verbatim instead of the fallback. Disjoint key set from #6290 (`filterAll`/`filterActive`/`filterError`/`filterBanned`/`filterCreditsExhausted`). All 9 keys now carry real translations across the 15 affected locale files (`it`, `ja`, `ko`, `mr`, `ms`, `nl`, `no`, `phi`, `pl`, `pt`, `pt-BR`, `ro`, `ru`, `sk`, `sv`). Regression guard: `tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts`.
+
+- **fix(cli):** the dashboard's Claude Code CLI card could report "Not detected"/"Not installed" even when Claude Code was genuinely installed and previously used ([#6701](https://github.com/diegosouzapw/OmniRoute/issues/6701)) — `getCliRuntimeStatus()` (`src/shared/services/cliRuntime.ts`) determined `installed` purely from binary resolution (known install paths + a `where`/`which` PATH search), with no fallback when that lookup fails for reasons unrelated to whether the CLI is actually installed (stale PATH inherited by a long-running/background process, the binary having moved, an install method not yet catalogued, etc.) — even though `~/.claude/settings.json` on disk proves the tool was installed and used before. Upstream 9router's equivalent route already has this exact fallback. A new `withSettingsFallback()` (`src/shared/services/cliInstallFallback.ts`) restores 9router parity: when the binary lookup's own reason is `"not_found"` (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk, `installed` now reports `true`. Regression guard: `tests/unit/repro-6701-claude-detect-fallback.test.ts`.
+- **fix(cli):** per-agent AgentBridge DNS toggle was broken for 8 of the 9 supported agents, and a failed MITM startup step could orphan the spawned proxy child — `addDNSEntry`/`removeDNSEntry` (`src/mitm/dns/dnsConfig.ts`) always resolved the legacy Antigravity default hosts regardless of which agent's toggle was flipped, so enabling DNS for Cursor/Codex/Claude Code/etc. silently added only `daily-cloudcode-pa.googleapis.com` while the DB recorded `dns_enabled=true` for the selected agent. Both functions now accept an optional `agentId` and resolve hosts via `ALL_TARGETS`; `POST /api/tools/agent-bridge/agents/[id]/dns` passes the route's `id` through and now returns 404 for an id that doesn't match a known target instead of silently falling back. Separately, `startMitmInternal()` (`src/mitm/manager.ts`) now wraps `generateCert()` (log + rethrow), the `provisionDnsEntries()` call, and the PID-file write in try/catch so a mid-startup failure can't orphan the already-spawned MITM child process. On Windows, `addDNSEntries`/`removeDNSEntries` also batch every missing/present entry into a single elevated PowerShell invocation instead of one UAC prompt per host line. Regression guard: `tests/unit/dns-config-generic.test.ts` (agent-specific resolution + batching), `tests/unit/agent-bridge-dns-route-validation.test.ts` (404 for unknown agent id). ([#6338](https://github.com/diegosouzapw/OmniRoute/pull/6338) — thanks @hamsa0x7)
+- **fix(guardrails):** Vision Bridge's individual-model auto-reroute (route an image-bearing request straight to a vision-capable model instead of describe-then-forward) could bypass a policy-restricted API key's model allowlist/budget ([#6640](https://github.com/diegosouzapw/OmniRoute/pull/6640)) — `VisionBridgeGuardrail.preCall()` (`src/lib/guardrails/visionBridge.ts`) swaps `body.model` to the best available vision-capable model, but that swap happens in the guardrail pipeline AFTER `chat.ts` already called `enforceApiKeyPolicy()` against the ORIGINAL model, so a key scoped to a narrow `allowedModels` list could still execute against an unvetted (and possibly costlier) vision model the reroute picked. `chat.ts` now re-validates any guardrail-driven model change against the same per-key allowlist (`isModelAllowedForKey`) before honoring it, falling back to the original already-approved model when the reroute target is not allowed. The reroute path also now honors an explicit `settings.visionBridgeModel` operator override (previously ignored, unlike the combo/describe path a few lines below it, which already respects it via `getVisionBridgeConfig`). Regression guard: `tests/unit/guardrails/visionBridge.test.ts` (22 tests). (thanks @herjarsa)
+- **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy). (thanks @Squawk7777 for the report and an independent fix via #6565)
+- **fix(security):** loopback-gate `/api/middleware/*` so a leaked JWT over a tunnel can't install or trigger a middleware hook — middleware hooks compile + run arbitrary JS via `new vm.Script` on the request hot path (`src/lib/middleware/registry.ts`), the same RCE class as the already-gated `/api/plugins/*`; `/api/middleware/` is now in `LOCAL_ONLY_API_PREFIXES` so loopback enforcement runs unconditionally before any auth check (Hard Rules #15 + #17). Regression guard: `tests/unit/route-guard-middleware-local-only.test.ts`. ([#6541](https://github.com/diegosouzapw/OmniRoute/pull/6541)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM server no longer fails to start with `ROUTER_API_KEY is required` on a normal install ([#6403](https://github.com/diegosouzapw/OmniRoute/issues/6403)) — `POST /api/tools/agent-bridge/server` resolved the spawned MITM child's router key from only an explicit `apiKey` body field (never sent by the AgentBridge UI — the schema has no such field) and the `ROUTER_API_KEY` env var (unset by default), so `startMitm()` always received `""` and the child hard-exited, even though OmniRoute already had a usable API key in its own DB. A new `resolveRouterApiKey()` now falls back to `pickApiKeyForInternalUse()` (the same DB-backed selector the combo-health-check / cloud-sync internal probes use), resolving in order: explicit key → `ROUTER_API_KEY` env → an existing DB key. Regression guard: `tests/unit/agentbridge-mitm-router-key-6403.test.ts`.
+- **fix(providers):** deploying a Cloudflare relay Worker from Dashboard → System → Proxy pool → Cloudflare relay failed immediately with `Cloudflare Worker upload failed: Content-Type must be one of: application/javascript, text/javascript, multipart/form-data`, even with a valid token/account ([#6416](https://github.com/diegosouzapw/OmniRoute/issues/6416)) — the Worker-script upload built a native `FormData` and let `fetch` derive the multipart Content-Type automatically, but in production `globalThis.fetch` is patched with `node_modules/undici`'s own fetch (`open-sse/utils/proxyFetch.ts`), whose `FormData`/`Request` classes differ from the runtime's global `FormData` (same cross-realm class mismatch already fixed once for image edits in #3273); passing a native `FormData` instance through undici's patched fetch made it serialize the body as the literal string `"[object FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare rejects outright. `buildCloudflareWorkerUploadRequest()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now builds the multipart body as a raw `Buffer` with an explicit boundary and `Content-Type: multipart/form-data; boundary=…` header, accepted verbatim by any fetch implementation. Regression guard: `tests/unit/cloudflare-worker-upload-content-type-6416.test.ts` + updated `tests/unit/relay-deploy-5128.test.ts`.
+- **fix(security):** SSRF-guard the provider-validation probes so they can no longer be used as an open relay to cloud-metadata endpoints — `directHttpsRequest()` (web-cookie / NVIDIA / Z.AI validation, all with a caller-controllable `baseUrl`) ran with `guard:"none"` + `allowRedirect:true`; it now applies `getProviderValidationGuard()` (default `block-metadata`: LAN/localhost allowed, `169.254.169.254`/link-local IMDS rejected, opt-out via `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`) and `allowRedirect:false` so a provider can't 3xx-redirect the probe to metadata past the initial-URL guard. Regression guard: `tests/unit/provider-validation-ssrf-guard.test.ts`. ([#6542](https://github.com/diegosouzapw/OmniRoute/pull/6542)) — see PR. (thanks @developerjillur)
+- **fix(startup):** AgentBridge's MITM proxy served a mismatched cert for 3 of the 4 antigravity/cloudcode-pa hosts it terminates TLS for, breaking interception ([#6494](https://github.com/diegosouzapw/OmniRoute/issues/6494)) — `src/mitm/server.cjs`'s `TARGET_HOSTS` decrypts all 4 hosts locally (`daily-cloudcode-pa.googleapis.com`, `cloudcode-pa.googleapis.com`, `daily-cloudcode-pa.sandbox.googleapis.com`, `autopush-cloudcode-pa.sandbox.googleapis.com`), but `src/mitm/cert/generate.ts`'s self-signed cert only carried a SAN entry for the first host — a request to any of the other 3 got served a cert whose CN/SAN didn't match (confirmed via `curl -k https://cloudcode-pa.googleapis.com/` showing `CN=daily-cloudcode-pa.googleapis.com`). `generateCert()` now sources its host list from `ANTIGRAVITY_TARGET.hosts` (`src/mitm/targets/antigravity.ts`, the single authoritative registry already kept in lock-step with `server.cjs`/`dnsConfig.ts`/`mitmToolHosts.ts` by their own drift tests) and emits a SAN entry for all 4 hosts instead of hard-coding a second, incomplete copy. Regression guard: `tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts` (asserts the host list covers all 4 hosts and that the real generated cert's SAN includes each one).
+- **fix(resilience):** a `priority` combo never fell back when a target masked credit/quota exhaustion behind an HTTP 200 ([#6427](https://github.com/diegosouzapw/OmniRoute/issues/6427)) — `validateResponseQuality()` (`open-sse/services/combo/validateQuality.ts`) only inspected the response body's top-level `error` field when `choices` was ALSO missing/empty (the narrower #3424 empty-completion case); a masked 200 that echoed a non-empty stub `choices` alongside a structured error object, or a known exhaustion phrase (e.g. "insufficient credits", "quota exceeded") in the error envelope, slipped through as "valid" and the combo kept returning the dead target's response forever instead of failing over. The quality check now inspects the error envelope — a top-level OpenAI-shape `error` object, or a bounded, case-insensitive exhaustion-phrase match against `error.message`/`error.code`/`error.type`/top-level `message`/`detail` — unconditionally, before any shape-specific branch, and regardless of whether `choices`/`output` also look structurally present. The check never inspects `choices[].message.content`, so a legitimate completion that merely mentions "quota" or "credits" in assistant prose is not misclassified. Regression guard: `tests/unit/masked-200-exhaustion-fallback-6427.test.ts`.
+- **fix(security):** fail-closed CORS for the cookie/session-authed cloud-agent management routes — `getCloudAgentCorsHeaders()` reflected any caller's `Origin` and paired it with `Allow-Credentials: true` (a CSRF/exfil hole); it now defers to the central allowlist (`resolveAllowedOrigin`), echoes only an allowlisted origin with `Vary: Origin`, and emits `Allow-Credentials` only for an explicitly allowlisted origin — never for a `CORS_ALLOW_ALL` wildcard echo. Regression guard: `tests/unit/cloud-agent-cors-failclosed.test.ts`. ([#6543](https://github.com/diegosouzapw/OmniRoute/pull/6543)) — see PR. (thanks @developerjillur)
+- **fix(compression):** adaptive-compression ladder ranked 6 real catalog engines (`ccr`, `ionizer`, `relevance`, `llmlingua`, `llm`, `read-lifecycle`) as if they didn't exist ([#6533](https://github.com/diegosouzapw/OmniRoute/issues/6533)) — `ladder.ts`'s `AGGRESSIVENESS` and `REDUCTION_FACTOR` maps only covered the 7 engines wired into `DEFAULT_LADDER` (session-dedup/rtk/headroom/lite/caveman/aggressive/ultra); every other engine registered in `open-sse/services/compression/engines/index.ts` — including `ccr`/`llmlingua`, which the ladder doc comment already says are intentionally addable via `ladderOverride` — fell through to `aggressivenessOf()`'s `?? 0` default (same rank as `"off"`) and `expectedReductionFactor()`'s generic `?? 0.9` fallback, so `floor`-mode escalation could not rank or escalate past them once added to a custom ladder. Both maps now carry entries for all 6 missing real engines, rescaled ×10 (`off:0` … `ultra:70`) and placed by each engine's documented `stackPriority` (`ionizer` between `rtk`/`headroom`, `relevance` before `caveman`, `llmlingua`/`llm` between `aggressive` and `ultra`, etc.); `mcpAccessibility` — named in the report — is not a registered `CompressionEngine` (it's a separate MCP tool-response truncation mechanism) and was correctly left out. Regression guard: `tests/unit/ladder-engine-maps-6533.test.ts` (asserts every id from `listCompressionEngines()` ranks above `"off"` with a non-default reduction factor). (thanks @chirag127)
+- **fix(api):** tool-call arguments could render as `[object Object]` sequences instead of the real JSON through the `/anthropic` (Anthropic-shape `/messages`) routing path ([#6459](https://github.com/diegosouzapw/OmniRoute/issues/6459)) — `appendToolCallArgumentDelta()` (`open-sse/utils/toolCallArguments.ts`), the shared accumulator the streaming `openai-to-claude` response translator, `openai-responses` translator, and `responsesTransformer` all call to build up a tool call's `arguments`/`input_json_delta` buffer, treated any non-string `incoming` fragment as an empty string. Some upstreams deliver the full `tool_calls[].function.arguments` value as an already-parsed JSON object/array instead of the OpenAI-contracted JSON-encoded string; the old code silently discarded that fragment, leaving `tool_use.input` empty, and left downstream buffers open to a plain string coercion of the object (`[object Object]`) once client-side concatenation kicked in. `appendToolCallArgumentDelta()` now `JSON.stringify()`s a non-string, non-null object/array fragment into a valid JSON fragment instead of dropping it, so the assembled `partial_json` always parses back into the original structured value. Regression guard: `tests/unit/anthropic-toolcall-args-6459.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo returned the opaque `"All fusion panel models failed"` 503 even when only a minority of panel members were actually cooling down / rate-limited, and a user-supplied `fusionTuning.minPanel=1` was silently overridden ([#6454](https://github.com/diegosouzapw/OmniRoute/issues/6454)) — `handleFusionChat()` hard-clamped the quorum floor via `Math.min(Math.max(2, cfg.minPanel), panel.length)`, so an operator-configured `minPanel=1` never took effect: `collectPanel()`'s straggler-grace timer only starts once `ok >= minPanel`, and with the floor forced to 2 a single fast success plus N slow-failing stragglers never reached quorum, so the panel sat waiting instead of degrading to the survivor. Per-member failure reasons (`straggler_dropped`/`timeout`/`threw`/`status_XXX`/`empty_content`/`unparseable`) were also logged server-side but never surfaced in the 503 body, leaving operators unable to tell a rate-limit fan-fail from a broader outage. Fixed by honoring `Math.max(1, cfg.minPanel)` and threading a `failures: Array<{ model, reason }>` collector into the 503 message (`model=reason` per entry) — production fix already merged via #6521; this entry backfills the missing CHANGELOG bullet and adds an 11-member, `fusion-free`-scale regression test matching the original repro shape (a cooling minority must not sink a healthy majority; a genuinely all-failed panel still returns the documented 503). Regression guard: `tests/unit/services/fusion-min-panel-and-failure-detail.test.ts` + `tests/unit/fusion-partial-panel-failure-6454.test.ts`. (thanks @chirag127)
+- **fix(providers):** `fusion` combo strategy silently returned a panel member's raw answer instead of the configured `config.judgeModel` synthesis ([#6455](https://github.com/diegosouzapw/OmniRoute/issues/6455)) — `handleFusionChat()`'s single-survivor "degrade gracefully" path (added for #6454) returned the lone panel answer directly whenever only one panelist succeeded, regardless of whether an explicit `judgeModel` was configured; with the default `minPanel: 2` and a 2-model panel, any single flaky/rate-limited panelist forced this path on every request, so the configured judge (e.g. `auto/claude-opus`) was never invoked and the client-visible `.model` reflected whichever panelist happened to survive. The judge is now still invoked to synthesize a lone surviving answer whenever `judgeModel` is explicitly configured; the cheap direct-answer shortcut is kept only for the implicit case (no `judgeModel` set, where the "judge" is just `panel[0]`). Regression guard: `tests/unit/fusion-judge-model-6455.test.ts` + updated `tests/unit/combo-fusion-strategy.test.ts`. (thanks @chirag127)
+- **feat(combo):** sanitized diagnostic trace on an auto-combo terminal failure — instead of an opaque 503, a terminal combo failure now returns a whitelist-projected trace (candidate pool size, attempted count, excluded provider/reason codes, attempt order, and a terminal-reason code) via the new `errorResponseWithComboDiagnostics()`/`sanitizeComboDiagnostics()` in `open-sse/utils/error.ts` — provider/model ids and enumerated reason codes only, never keys/tokens/bodies, length- and count-capped. A reasoning-budget-exhausted panel now returns an actionable "increase max_tokens" message rather than a blind retry-limit 503. Regression guard: `tests/unit/combo-diagnostics-trace.test.ts`. ([#6545](https://github.com/diegosouzapw/OmniRoute/pull/6545)) — see PR. (thanks @developerjillur)
+- **fix(providers):** image/diffusion models discovered from an upstream catalog (e.g. HuggingFace's live `/v1/models`) are no longer advertised as chat models ([#6457](https://github.com/diegosouzapw/OmniRoute/issues/6457)) — the chat catalog builder defaulted synced models with no modality info to `endpoints: ["chat"]`, so `huggingface/stabilityai/stable-diffusion-xl-base-1.0` showed up in the chat `/v1/models` listing and returned `400 "not a chat model"` when called. `catalog.ts` now skips any synced model already registered as an image model for that provider (via the new `isRegisteredImageModel()`), leaving `getAllImageModels()` to list it with the correct `type: "image"`. Regression guard: `tests/unit/image-model-not-in-chat-catalog-6457.test.ts`.
+- **fix(resilience):** combo session stickiness never released a pin on a credits-exhausted/banned/expired account, permanently defeating failover for that conversation ([#6692](https://github.com/diegosouzapw/OmniRoute/issues/6692)) — `applySessionStickiness()` (`open-sse/services/combo/sessionStickiness.ts`) gated the sticky pin only on 5h/weekly usage-percentage headroom, which is orthogonal to account availability: a `credits_exhausted`/`banned`/`expired` connection, or one still inside its `rateLimitedUntil` cooldown, reports perfectly healthy headroom, so the pin was force-promoted back to the front of the target list on every subsequent turn. `clearStickyBinding()` also had zero call sites in `combo.ts`'s failure paths, so a quality-validation-rejected 200 (a masked daily-cap refusal) never released the pin either. The gate now also resolves the bound connection's terminal status/cooldown via a new injectable fetcher seam (fail-open on lookup errors, mirroring the existing saturation fetcher), and `combo.ts`'s two dispatchers (`handleComboChat`/`handleRoundRobinCombo`) release the pin immediately at both their connection-exhaustion classification point and their quality-validation-failure branch via the new `releaseStickyPinOnFailure()`. Regression guard: `tests/unit/repro-6692-sticky-terminal.test.ts` + extended `tests/unit/combo-session-stickiness.test.ts`.
+- **fix(test):** replace the bare `expect(true).toBe(true)` tautology in `playground-api-tab.test.tsx`'s SSE test and close the `check:test-masking` gap that let it slip through for a full cycle ([#6404](https://github.com/diegosouzapw/OmniRoute/issues/6404)) — a prior pass (#6548) had already swapped the literal to `expect(sendBtn).toBeDefined()`, but that stayed just as vacuous: the test's fetch mock returned an empty `/v1/models` list, so `ApiTab`'s Send button is always `disabled` (`!selectedModel`) and the SSE branch never runs — the "SSE infra is verified" comment was never true. The test now mocks a real model, drives the model `<select>` to enable Send, asserts `sendBtn.disabled === false` before clicking, and asserts the streamed SSE delta (`"Hello!"`) actually reached the response editor. Root cause on the detector side: `check-test-masking.mjs`'s tautology subcheck only compares base-vs-HEAD counts within a PR's own diff (`headExtTaut > baseExtTaut`) and no-ops locally when `GITHUB_BASE_SHA`/`GITHUB_BASE_REF` are unset ("sem base ref — pulando") — so a tautology merged once, or checked with a bare local run, was invisible forever after. Added a new always-on, PR-independent absolute-floor scan (`scanBareTautologies` + `countBareTautologies`) over every git-tracked test file for the bare `expect(true).toBe(true)` / `assert.equal(1,1)` / `assert.strictEqual(1,1)` patterns specifically (deliberately excluding `assert.ok(true)`, which has ~15 pre-existing verified-legitimate try/catch-fallback uses repo-wide and stays governed by the lenient diff-only subcheck) — verified zero pre-existing hits repo-wide once this file was fixed, so the new floor is safe to enforce unconditionally. Regression guard: `tests/unit/check-test-masking.test.ts` (new `scanBareTautologies`/`countBareTautologies` cases) + `tests/unit/ui/playground-api-tab.test.tsx`. (thanks @chirag127)
+- **fix(oauth):** Codex/ChatGPT (and every other OAuth provider) connection stays stuck showing "Auth Failed" even after a genuinely successful token refresh ([#6352](https://github.com/diegosouzapw/OmniRoute/issues/6352)) — `updateProviderCredentials()` (the shared `onPersist` callback for the manual "Refresh token" route, the reactive per-request refresh in `chat.ts`, and the Codex/Claude auth-file importers) correctly reused the stored `refresh_token`, persisted the new `access_token`, and replaced a rotated `refresh_token`, but never cleared the stale `testStatus`/`lastError*`/`errorCode` fields left over from a prior expired/invalid refresh or upstream 401/403 — only the separate background health-check sweep did that clearing. A successful refresh now resets `testStatus` to `"active"` and clears `lastError`, `lastErrorAt`, `lastErrorType`, `lastErrorSource`, and `errorCode` (an explicit `testStatus` from the caller still wins). Regression guard: `tests/unit/codex-oauth-refresh-persist-6352.test.ts`.
+- **perf(health):** short-TTL (1s) cache for the frequently-polled `GET /api/monitoring/health` payload — rebuilding it every request (DB reads + status aggregation across 8 subsystems) was wasteful under rapid polling; the cache stays near-real-time and is invalidated immediately on `DELETE` (circuit-breaker reset) so a manual reset is reflected at once. Regression guard: `tests/integration/monitoring-health-cache.test.ts`. ([#6553](https://github.com/diegosouzapw/OmniRoute/pull/6553)) — see PR. (thanks @developerjillur)
+- **fix(resilience):** `headroom` combo routing did not always select the Codex account with the most free quota ([#6379](https://github.com/diegosouzapw/OmniRoute/issues/6379)) — `orderTargetsByHeadroom` (`open-sse/services/combo/quotaStrategies.ts`) already loaded the per-connection DB snapshot (with decrypted credentials) via `expandTargetsByQuotaAwareConnections`, but discarded it before calling `getSaturation`; for Codex, `fetchCodexSaturation` forwards straight to `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a prior `registerCodexConnection()` call, which never happens before headroom ranking runs) to read `accessToken` — so it returned `null` for every candidate, saturation failed open to `0` across the board, and ranking fell back to the original combo order regardless of actual free quota. `getSaturation()` and the headroom `SaturationFetcher` seam now accept and thread the loaded connection snapshot through to `fetchCodexQuota`. Kilo's dup flag vs #5903 was a false positive — that issue is about session-sticky reset-aware/least-used selection, not headroom's Codex saturation lookup. Regression guard: `tests/unit/headroom-codex-quota-snapshot-6379.test.ts`. (thanks @eidoog)
+- **fix(providers):** custom models a provider actually has are no longer dropped from the Free Provider Rankings when both **"Configured only"** and **"Available only"** filters are applied ([#6368](https://github.com/diegosouzapw/OmniRoute/issues/6368)), follow-up to #6150 — `freeProviderRankings.ts::getProviderModels()` only ever walked the static `open-sse/config/providerRegistry.ts` catalog, so a user-added custom model (e.g. a Puter `claude-fable-5` model saved as "Claude Fable 5") never entered the candidate model list the ranking scores against, and could never survive the #6150 configured/available filters even when actually configured and available. It now additively merges the provider's custom models (`db/models.ts::getCustomModels`) into that candidate list via a new pure, de-duping `mergeProviderModels()` helper, before scoring/filtering runs — catalog free/paid filtering elsewhere is untouched. Regression guard: `tests/unit/free-provider-rankings-custom-models-6368.test.ts`. (thanks @shabeer)
+- **fix(playground):** accept a valid dashboard session for `GET/POST /api/playground/presets` under `REQUIRE_API_KEY=true` — the Playground page calls this route with a cookie/session and no API key, which previously 401'd the authenticated dashboard; `checkAuth()` now accepts a management/dashboard session (`requireManagementAuth`) as an alternative to an API key, while a presented API key must still be valid and the anonymous-allowed default is preserved. Regression guard: `tests/integration/presets-dashboard-auth.test.ts`. ([#6554](https://github.com/diegosouzapw/OmniRoute/pull/6554)) — see PR. (thanks @developerjillur)
+- **fix(providers):** `cloudflare-ai` no longer silently drops image/non-text content parts ([#6390](https://github.com/diegosouzapw/OmniRoute/issues/6390)) — `transformRequest()`'s `flattenContent()` (added for #2539 to satisfy the Workers AI `/ai/v1/chat/completions` plain-string `content` requirement) mapped any non-text OpenAI content part (e.g. `image_url`) to `""` and joined the rest, so a request carrying an image quietly went out as text-only with the attachment gone and no error surfaced. It now throws a clear error on the first non-text part instead of dropping it silently, which the existing top-level `chatCore.ts` catch already routes through `buildErrorBody()`/`sanitizeErrorMessage()` (same pattern as `buildUrl()`'s missing-Account-ID error). Regression guard: `tests/unit/cloudflare-ai-image-parts-6390.test.ts`.
+- **fix(providers):** stop Antigravity connections from falsely reporting **all-accounts quota-exhausted** ([#6295](https://github.com/diegosouzapw/OmniRoute/issues/6295)) — `genericQuotaFetcher.ts::percentUsedForQuota()` ignored the `fractionReported` flag and defaulted an unreported model's `remainingPercentage` to 0, which computed as 100% used; since `convertUsageToQuotaInfo()` takes the worst-case window across a connection, a single model with no reported fraction dragged the whole account into `limitReached` and `quotaPreflight` skipped it. `percentUsedForQuota()` now returns `null` (unknown, window ignored) whenever `fractionReported === false`, before falling back to `remainingPercentage`. Regression guard: `tests/unit/generic-quota-fetcher.test.ts`.
+- **fix(fusion):** the fusion judge no longer replays a panel member's answer via an idempotency-key collision — fusion's panel + judge sub-requests re-enter `chatCore` sharing the client's headers, so they derived the same `Idempotency-Key`/`x-request-id` and a panel answer saved under the key was replayed by the judge's check ~1ms later (inside the 5s window), returning a panel member's answer instead of the judge synthesis (observed live on `nexa/conversation-fusion`). `composeIdempotencyKey()` now namespaces the key by target provider/model + a digest of the request messages, so sub-requests can't collide while a genuine client retry (same key/model/body) still replays. Regression guard: `tests/unit/idempotency-fusion-collision.test.ts`. ([#6558](https://github.com/diegosouzapw/OmniRoute/pull/6558)) — see PR. (thanks @developerjillur)
+- **fix(providers):** grok-cli (Grok Build) now strips `reasoning_effort`/`reasoning` before forwarding the request ([#6288](https://github.com/diegosouzapw/OmniRoute/issues/6288)) — Claude Code sends `reasoning_effort` on every request (routing the Opus slot), which Grok Build's upstream chat-proxy endpoint rejects with a 400; `transformRequest()`'s existing `UNSUPPORTED` sampling-param strip list (#5273) never covered it. Regression guard: `tests/unit/grok-cli-reasoning-strip-6288.test.ts`.
+- **fix(cli):** `omniroute serve` no longer hangs silently on a readiness timeout ([#6321](https://github.com/diegosouzapw/OmniRoute/issues/6321)) — the child server's stdout was piped to `"ignore"` whenever `--log`/`OMNIROUTE_SHOW_LOG` wasn't set (the default), discarding any debug output, and `runWithSupervisor`'s `waitForServer(...).then((up) => { if (up) {...} })` had no `else` branch, so a boot that never became ready produced zero further output after "⏳ Starting server...". Stdout is now buffered alongside stderr (`ServerSupervisor.getRecentLog()`), and a timeout prints a clear diagnostic plus the buffered output instead of staying silent. Does not by itself explain why boot never completes on a given machine — see the issue for further reproduction. Regression guard: `tests/unit/cli-serve-readiness-timeout-6321.test.ts`.
+- **fix(pricing):** Pricing Sync dashboard no longer stuck on "Next Sync: Never" / "Synced Models: 0" ([#6325](https://github.com/diegosouzapw/OmniRoute/issues/6325)) — `pricingSync.ts` kept sync state (`lastSyncTime`, `lastSyncModelCount`) in module-level vars, but the background periodic sync (`instrumentation-node.ts`) and the dashboard status route (`/api/pricing/sync`) each import the module from separate Next.js standalone webpack chunks, giving each its own independent state; `getSyncStatus()` read the (empty) API-route instance's vars. Sync status is now additionally persisted to a new `pricing_sync_status` `key_value` namespace and `getSyncStatus()` falls back to it when the local module instance never ran a sync itself. Regression guard: `tests/unit/pricing-sync-cross-instance.test.ts`.
+- **fix(api):** stop spuriously 403-ing "Invalid request origin" on `POST /api/providers/health-autopilot/actions` for Docker/LAN dashboard requests ([#6277](https://github.com/diegosouzapw/OmniRoute/issues/6277)) — the route carried a duplicate per-route `validateBrowserMutationOrigin` check re-added by the v3.8.42 release squash after PR #5278 centralized origin enforcement in the authz pipeline; the pipeline strips `PEER_IP_HEADER` before forwarding, so the stale duplicate check could no longer resolve the LAN "direct-local-host" candidate and rejected legitimate same-origin LAN mutations (e.g. clicking "remove cooldown" when accessed via a LAN IP). Removed the duplicate check — origin validation is now solely enforced by the centralized pipeline check, which already handles this case correctly. Regression guard: `tests/unit/serial/provider-health-autopilot.test.ts`.
+- **fix(resilience):** a bare, unrecognized `403` from a no-credential (`authType:"none"`) provider like mimocode or theoldllm no longer permanently bans the connection ([#6315](https://github.com/diegosouzapw/OmniRoute/issues/6315), [#6345](https://github.com/diegosouzapw/OmniRoute/issues/6345)) — `classifyProviderError()`'s 403 branch only exempted `apikey` providers from the terminal `FORBIDDEN` classification, so these free/stateless proxies (no real account/credential to revoke) fell through to `FORBIDDEN` on the first unmatched 403 and got `isActive:false, testStatus:"banned"` with no cooldown or retry. The exemption now also covers `authType:"none"` providers, returning `null` (recoverable) so the existing connection-cooldown/retry layer handles it. Regression guard: `tests/unit/errorClassifier-noauth-403-6315.test.ts`.
+- **fix(providers):** the **Auggie (Augment CLI)** executor no longer fails on Windows with `spawn EINVAL` ([#6304](https://github.com/diegosouzapw/OmniRoute/issues/6304)) — the global-npm install exposes `auggie` as a `.cmd` shim, which Node's `child_process.spawn` cannot launch on win32 without `shell: true`. Both spawn sites (streaming + the `auggie --version` test) now go through a shared `buildAuggieSpawnOptions()` that sets `shell: process.platform === "win32"`; the argv (built by `buildAuggieArgs()` with a registry-validated `model` and a trailing `--` end-of-options marker) is unchanged, so the argument-injection surface stays closed on non-Windows. Regression guard: `tests/unit/auggie-win32-spawn-6304.test.ts`.
+- **fix(api):** the dashboard **"Test model"** action is now a clean connection test ([#6240](https://github.com/diegosouzapw/OmniRoute/issues/6240)) — `modelTestRunner` sent its probe request without an explicit compression override, so whenever the operator's global `compression.enabled` flag was on the test call inherited compression (and any Output-Styles system prompt), polluting the result. The internal test requests now send `X-OmniRoute-Compression: off`, and `chatCore` honors an explicit `off` header even when `compression.enabled` is globally true. Regression guards: `tests/unit/model-test-runner-compression-off-6240.test.ts`, `tests/integration/test-model-compression-off-6240.test.ts`.
+- **fix(startup):** an update/restart could crash the whole server at boot with `TypeError: Cannot create property 'message' on string 'Database closed'`, masking the real failure and 500-ing every request until manually restarted ([#6560](https://github.com/diegosouzapw/OmniRoute/issues/6560), plausibly the root cause of #6594's post-upgrade 500) — `driverFactory.ts::preInitSqlJs()` cached its sql.js WASM adapter per file path in a `globalThis`-backed map for idempotency, but never checked whether the cached adapter had since been closed (e.g. by `gracefulShutdown`/`resetDbInstance` racing a reload); reusing that dead handle made the very next query throw sql.js's own bare string `"Database closed"` (not an `Error`) straight out of `instrumentation-node.ts`'s previously-unguarded `ensureDbInitialized()` call, and Next.js's internal `registerInstrumentation()` wrapper unconditionally does `err.message = ...` on whatever `register()` rejects with — assigning `.message` on a primitive string throws in strict mode, so the secondary `TypeError` is what actually crashed the process. Fixed in two parts: `preInitSqlJs()` now evicts a closed cached adapter and creates a fresh one instead of returning it; a new `ensureDbReadyForBoot()` wraps the DB-init call, normalizes any non-Error throw via `normalizeBootError()`, and retries once specifically for a transient "database closed" message (now succeeding against the fresh adapter) before re-throwing anything else as a real `Error`. Regression guard: `tests/unit/instrumentation-database-closed-6560.test.ts`.
+- **fix(api):** `POST /api/keys` no longer hangs 20–90+ seconds on a fresh install, even with valid auth ([#6570](https://github.com/diegosouzapw/OmniRoute/issues/6570)) — `cloudEnabled` defaults to `true` in `src/lib/db/settings.ts::getSettings()` on any install with no persisted settings row (i.e. every fresh install), so the create-key handler's unconditional `await syncKeysToCloudIfEnabled()` always attempted a real outbound `fetch()` to `CLOUD_URL` via `syncToCloud()`; when that endpoint is unset/unreachable/slow, the HTTP response blocked until the request settled or timed out — unlike sibling routes (`POST /api/keys/:id/regenerate`, `GET /api/combos`), which never touch this side effect at all. `src/app/api/keys/route.ts` now dispatches `syncKeysToCloudIfEnabled()` fire-and-forget (`void`) instead of awaiting it; its internal try/catch already logs failures, so cloud sync still runs, it just no longer blocks the response. Regression guard: `tests/unit/api-keys-create-no-hang-6570.test.ts` (asserts the route resolves in well under 2s even when the Cloud-sync `fetch()` is stubbed to never settle) + updated `tests/integration/api-keys.test.ts` (the pre-existing "triggers cloud sync"/"still succeeds when cloud sync fails" tests, which previously hung indefinitely on this exact path, now await the fire-and-forget sync tick before asserting).
+- **fix(api):** editing any existing OpenAI Codex provider connection in the dashboard returned "Invalid request" and the edit could never be saved ([#6562](https://github.com/diegosouzapw/OmniRoute/issues/6562)) — `createProviderConnection()` (`src/lib/db/providers.ts`) auto-increments a new connection's `priority` to `MAX(priority)+1` per provider with no upper bound, and OAuth-imported connections (Codex `codex-auth/import` / `import-bulk`, up to 50 accounts per call, callable repeatedly — the standard Codex bulk-account-rotation workflow) never pass through `createProviderSchema`'s Zod validation at all, so nothing ever capped that value; `EditConnectionModal`'s `handleSubmit` always resends the connection's current `priority` unchanged on every save, and `updateProviderConnectionSchema` capped `priority`/`globalPriority` at `max(100)` — a UI-only ceiling the create path never enforced — so the first edit of any connection whose priority had already grown past 100 (routine once a Codex account count exceeds 100) failed validation regardless of which field the user actually changed. Raised the ceiling to `max(100_000)` on both fields — still bounded (a genuinely out-of-range value is still rejected), just wide enough to accept priorities the app itself already produces. Regression guard: `tests/unit/codex-connection-edit-6562.test.ts` (a Codex OAuth connection whose priority already exceeds the old 100 cap now validates + persists on edit; a control payload with a still-genuinely-invalid priority is still rejected with "Invalid request").
+- **mimocode**: rotate accounts on MiMoCode's rate-limit-style 400s (body-classified) instead of failing on the first account; malformed 400s still fail fast with the real upstream error (#6648 — thanks @pizzav-xyz)
+- **fix(cli):** compression CLI REST fallback now reads/writes the canonical `defaultMode` field (surfaced as `strategy`) instead of a nonexistent `engine` key, and table output renders nested objects as JSON instead of `[object Object]` (#6571 — thanks @charleszolot)
+- **fix(providers):** web-cookie providers without a `providerRegistry.ts` entry (`lmarena`, `gemini-business`, `poe-web`, `venice-web`, `v0-vercel-web`) now report `unsupported: true` instead of silently "OK" ([#6309](https://github.com/diegosouzapw/OmniRoute/pull/6309)) — `validateWebCookieProvider()` (`src/lib/providers/validation.ts`) previously required a registry entry and returned "Provider not found in registry" for these; a fallback to `WEB_COOKIE_PROVIDERS[provider].website` was proposed, but live verification showed the `${website}/models` probe does not reliably signal session validity for these providers (redirects/SPA 200s regardless of cookie validity — e.g. lmarena's real API is `arena.ai`, not `lmarena.ai`; Poe's real endpoint is a GraphQL POST, not a REST `/models`), so it would report an expired or garbage cookie as valid. Until each provider has a verified, side-effect-free auth probe against its real API host, the fallback now returns `unsupported` (no network call) instead of a false positive. Regression guard: `tests/unit/web-cookie-validation-fallback.test.ts`. (thanks @oyi77)
+- **fix(api):** `POST /api/middleware/hooks` and `PUT /api/middleware/hooks/[name]` no longer leak raw internal error messages in their 500 responses (#6645 — thanks @chirag127) — both catch blocks returned `error?.message` directly (Hard Rule #12), which could surface internal SQLite path fragments on a DB failure; both now route through `sanitizeErrorMessage()` from `open-sse/utils/error.ts`. Regression guard: `tests/unit/middleware-hooks-error-sanitization.test.ts`.
+- **fix(docker):** compile better-sqlite3 for the server Docker image (Dokploy/self-hosted builds) via a direct `node-gyp rebuild` inside `node_modules/better-sqlite3`, instead of `npm rebuild better-sqlite3` ([#6700](https://github.com/diegosouzapw/OmniRoute/pull/6700)) — the `builder` stage installs dependencies with `npm ci --ignore-scripts` (deliberate: closes the supply-chain surface where a transitive dep's install script runs arbitrary code) and re-enables the native build for the one package that needs it; `npm rebuild <pkg>` re-runs that indirectly through the package's own install script, which under npm 11 depends on npm's script-allowlist machinery correctly re-enabling it — some self-hosted build environments (e.g. Dokploy) hit a broken/mismatched native binding through that indirection. Invoking `node-gyp rebuild` directly bypasses npm's script-running layer entirely and is deterministic regardless of npm version. Regression guard: `tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts`. (thanks @nowhats-br)
+- **fix(providers):** the Cloudflare relay Worker deploy fix in #6416/#6618 still failed uploads in practice — it changed the multipart Content-Type but kept the emitted worker source as an ES module (`export default { fetch(...) }`) with `main_module` metadata; Cloudflare's Workers upload API parses a plain `application/javascript` script part as Service Worker syntax regardless of the `main_module` metadata field, and `main_module` requires the script to actually be an ES module (top-level `export`), so the mismatch still rejected the upload ([#6496](https://github.com/diegosouzapw/OmniRoute/pull/6496)). `buildCloudflareWorkerScript()` (`src/lib/proxyRelay/cloudflareWorkerScript.ts`) now emits Service Worker syntax (`addEventListener("fetch", ...)`, no top-level `export`) and the upload metadata uses `body_part` instead of `main_module`. Regression guard: `tests/unit/relay-deploy-5128.test.ts` (asserts the emitted script has no `export default`, registers a `fetch` listener, and the upload metadata carries `body_part`/omits `main_module`; also proves the inlined `isPrivateHostname()` SSRF guard still rejects bracketed IPv6 loopback/ULA hosts like `[::1]`/`[fd00::1]` after the script-body rewrite). (thanks @SeaXen)
+- **fix(providers):** ChatGPT Web (`chatgpt-web`) responses rendered raw ChatGPT UI citation markup — private-use marker tokens (e.g. `citeturn0search0`) and `url…` inline-link markers — instead of real Markdown links, since these only ever get resolved client-side by chatgpt.com's own JS using `message.metadata.content_references` ([#6635](https://github.com/diegosouzapw/OmniRoute/pull/6635)) — `cleanChatGptText()` now resolves `content_references` (grouped webpages, footnote sources, inline `webpage`/`url` mentions) into `[label](url)` Markdown links for both the streaming and non-streaming response builders, and for the GPT-5.5 Pro `stream_handoff` polled-answer path, falling back to stripping any marker that has no resolvable source instead of leaking the raw private-use bytes. The citation parsing/rendering logic was extracted into a new pure sibling module (`open-sse/executors/chatgpt-web/citations.ts`) to keep the executor under the frozen file-size cap. Regression guard: `tests/unit/chatgpt-web-citations.test.ts` (non-streaming citation resolution, streaming marker buffering across split SSE chunks, and the Pro-handoff polled-answer path). (thanks @Thinkscape)
+- **fix(dashboard):** the live-dashboard WebSocket descriptor handshake (`GET /api/v1/ws?handshake=1`) and the lightweight `GET /api/health/ping` liveness probe both 401'd for unauthenticated callers, even though both are metadata-only reads intended to be public ([#6335](https://github.com/diegosouzapw/OmniRoute/pull/6335)) — `clientApiPolicy` required a bearer/dashboard-session before the WS route handler could even return its own `wsAuth`/protocol descriptor, and `/api/health/ping` was never added to `PUBLIC_READONLY_API_ROUTE_PREFIXES` despite its own docstring documenting it as "No auth required." `clientApiPolicy.evaluate()` now allows an anonymous `{kind:"anonymous", id:"ws-handshake"}` subject for GET/HEAD/OPTIONS on `/api/v1/ws?handshake=1` (the route handler still performs its own real wsAuth/dashboard/API-key decision before opening the socket), and `/api/health/ping` is now in `PUBLIC_READONLY_API_ROUTE_PREFIXES`. Regression guard: `tests/unit/authz/client-api-policy.test.ts` (WS handshake allowed, including relative request URLs), `tests/unit/public-api-routes.test.ts`, and `tests/unit/authz/classify.test.ts` (`/api/health/ping` classified `PUBLIC`). (thanks @JxnLexn)
+- fix(providers): wire the Devin cloud-agent provider into the generic provider-page validator and static model catalog, matching the existing `jules` cloud-agent pattern (#6142)
+- fix(providers): honor a provider-level proxy assigned to no-auth providers like MiMoCode Free (#6272)
+- fix(api): merge tool_call continuation deltas that carry only `id` (no `index`) so tool-call arguments are no longer split/lost in request/response logs (#6276)
+- **fix(providers):** modernize the `lmarena` provider for the Arena.ai rebrand — route chat through `arena.ai` create-evaluation with Chrome TLS impersonation, seed a static Direct-chat Text/Search + Image catalog, and keep the `lmarena`/`lma` wire id for back-compat ([#6280](https://github.com/diegosouzapw/OmniRoute/pull/6280)) — thanks @backryun
+- **fix(providers):** web-provider model discovery updated — qwen-web uses the slash-terminated models endpoint (avoiding a blocked 307 redirect), and kimi-web matches the current request shape (POST with bearer + `kimi-auth` cookie replay) with its catalog refreshed to the current non-agent models (#6308 — thanks @janeza2).
+- **fix(logs):** the request-log detail modal no longer reopens by itself after being closed — a stale in-flight detail refresh resolved after close and re-triggered the modal open state (#6323 — thanks @xz-dev).
+- **fix(providers):** update SenseNova Token Plan support — register the token-plan model ids/constants and adjust the SenseNova registry so token-plan accounts route correctly (#6330 — thanks @xz-dev).
+- fix(providers): give v0-vercel-web its own alias so its credentials are detected (#6343)
+- fix(providers): route AgentRouter key validation through the CC wire image so a valid key no longer 403s as "Invalid API key" (#6377)
+- fix(db): stop legacy log-archive migration from deleting the live app-logger directory and crashing startup on a stat/stream race (#6401, #6799)
+- fix(docs): document Turbopack build memory tradeoff and `OMNIROUTE_USE_TURBOPACK=0` webpack fallback for RAM-constrained machines (#6409)
+- fix(compression): surface silently-dropped stacked-pipeline steps (session-dedup, ccr) and stop the aggregate inflation guard from misfiring on a genuine no-op (#6479, #6480, #6491)
+- fix(providers): honor the `max_token` capability override in the reasoning-token-buffer output cap (#6524)
+- **fix(dashboard):** the onboarding tier-flow diagram rendered broken — its SVGs lived in the repo-root `images/` (not a served path); moved to `public/images/` so Next.js serves them (#6538 — thanks @ianriizky).
+- **fix(routing):** the `auto` combo's no-auth candidate pool now honors a disabled provider connection's own `isActive=false` (the toggle on the main Providers grid card), not just the separate global `blockedProviders` setting — disabling opencode/mimocode/etc. via the grid toggle no longer leaves it in rotation ([#6557](https://github.com/diegosouzapw/OmniRoute/issues/6557)).
+- **fix(sse):** server-tool literal names (e.g. `web_search`) are preserved in message history and `tool_choice` instead of being namespaced/rewritten, so follow-up turns referencing those tools keep working (#6586 — thanks @MikeTuev).
+- fix(api): recognize OpenRouter reasoning/reasoning_details in non-streaming OpenAI-to-Claude conversion (#6623)
+- fix(db): share one in-flight sql.js load across concurrent `preInitSqlJs()` callers to stop the boot-time thundering-herd re-decode of the whole database file (#6628)
+- fix(db): unwrap lone named-parameter objects before `sql.js` `stmt.bind()` so `@`/`:`/`$`-style named placeholders bind correctly instead of throwing "Wrong API use" (#6802)
+- **fix(db): break probe-failed/restore loop on large storage.sqlite** (#6632 — thanks @KooshaPari).
+- fix(ci): exclude check-test-masking.test.ts's own tautology fixtures from the diff-based test-masking gate and recognize `✗` in validate-release-green's failure-line detector (#6634)
+- fix(routing): recognize Kimi-style "exceeded model token limit" 400 as context overflow so combo fallback continues to the next target (#6637)
+- **fix(cli):** Claude Code installed via WinGet is now detected on Windows (the WinGet install path was missing from the binary lookup) (#6647 — thanks @enjoyer-hub).
+- **fix(providers):** removed obsolete/defunct providers from the catalog (glhf, kluster, cablyai, inclusionai) (#6675 — thanks @backryun).
+- **fix(sse):** requests rejected before `handleChatCore` (circuit-breaker/cooldown gate or combo with all targets exhausted) are now recorded in `usage_history` too, so a key whose traffic was entirely gate-rejected no longer shows "zero requests" in the per-API-key usage counter (#6698).
+- **fix(sse):** unwrap bare `{function:{…}}` tools so OpenAI-shape clients no longer have tools silently dropped in Claude translation. (thanks @samir-abis)
+- **fix(oauth):** stop merging distinct Codex OAuth logins that share an email but lack a verifiable account id, preventing silent token overwrite. (thanks @lucasjustinudin)
+- **fix(codex):** detect "model at capacity"/overloaded errors embedded in a 200-OK SSE stream and surface them as a real error so account fallback rotates, instead of passing them through as a successful response. (thanks @ryanngit)
+- **fix(volcengine):** clamp `max_tokens` to the VolcEngine Ark endpoint cap for the Kimi model so oversized values no longer 400. (thanks @whale9820)
+- **fix(antigravity):** surface aborted/malformed Gemini tool calls (e.g. `MALFORMED_FUNCTION_CALL`) as an explicit non-`end_turn` finish reason instead of a silent clean completion. (thanks @anhdiepmmk)
+- **fix(routing):** the reasoning-token headroom buffer clamps to the model's explicit output cap instead of inflating past it, and `getExplicitModelOutputCap` falls through to the registry/spec cap when a synced capability row exists without a numeric `limit_output` ([#6714](https://github.com/diegosouzapw/OmniRoute/pull/6714)) — thanks @xz-dev
+- **fix(api):** `omniroute health` (and `health components`/`health watch`) returned `Error: HTTP 404` ([#6677](https://github.com/diegosouzapw/OmniRoute/issues/6677)) — `bin/cli/commands/health.mjs` called `apiFetch("/api/health", ...)`, a route that was moved to `GET /api/monitoring/health` (`src/app/api/monitoring/health/route.ts`) without updating the CLI; `src/app/api/health/` on disk only has `degradation/route.ts` and `ping/route.ts`, no top-level handler. `runHealthCommand()`/`runHealthComponentsCommand()` now call `/api/monitoring/health` and read its actual payload shape (`activeConnections`, `circuitBreakers: {open, halfOpen, closed}`, `memoryUsage`) instead of the old, nonexistent `requests`/`breakers`/`cache`/`memory` fields. Regression guard: `tests/unit/cli-health-monitoring-route.test.ts`.
+- **fix(startup):** webpack build broke on case-insensitive filesystems (macOS APFS default, Windows) with a casing-collision warning plus "not exported" errors in `StudioConfigPane.tsx`/`ChatTab.tsx` (#6584) — `src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx` (the component) and `reasoningControls.ts` (the utils module) shared the same lower-cased stem in the same directory, and two importers used the extensionless form `from "./reasoningControls"`, the exact resolution path that becomes ambiguous once casing is folded. Renamed the utils module to `reasoningControlUtils.ts` (no collision) and updated the 3 import sites. Regression guard: `tests/unit/case-collision-6584.test.ts` (scans `src/`/`open-sse/` for any same-directory, case-only filename collision). (#6584)
+- **fix(build):** Turbopack production build emitted an "Overly broad patterns can lead to build performance issues" warning per entry point importing `src/lib/agentSkills/generator.ts` (603 warnings reported on v3.8.46, up from 379 on v3.8.45) ([#6582](https://github.com/diegosouzapw/OmniRoute/issues/6582)) — `generator.ts`'s `outputBase` is built as `path.isAbsolute(outputDir) ? outputDir : path.join(process.cwd(), outputDir)`, where `outputDir` is a runtime function parameter, not a compile-time literal, so Turbopack's build-time file-tracing analyzer can't statically narrow the several dynamic `readdirSync`/`rmSync`/`readFileSync`/`writeFileSync` call sites a few lines below and falls back to a project-wide glob; #6366's commit message claimed to "anchor the base path with a literal" but the shipped code never did. Since this fs access is legitimate and bounded (`skills/<id>/SKILL.md`, ~48 known IDs), `next.config.mjs`'s `turbopack.ignoreIssue` (Next.js 16.2+) now suppresses this specific, known-benign diagnostic, mirroring the existing `webpack.ignoreWarnings`/`isNextIntlExtractorDynamicImportWarning` precedent already in the same file for the webpack path. Regression guard: `tests/unit/next-config.test.ts` (asserts the `turbopack.ignoreIssue` rule shape targeting `src/lib/agentSkills/**`).
+- **fix(providers):** Codex Desktop requests to `gpt-5.3-codex-spark` failed with `[400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark`, even on paid-plan accounts ([#6651](https://github.com/diegosouzapw/OmniRoute/issues/6651)) — `CodexExecutor.transformRequest` (`open-sse/executors/codex.ts`) only dropped the Codex Desktop-injected `image_generation` hosted tool when `isCodexFreePlan()` matched the account's plan, with no awareness that Spark-scope Codex models reject `image_generation` upstream regardless of plan. `dropImageGeneration` now also drops it when `getCodexModelScope(model) === "spark"` (the existing Spark classifier from `open-sse/config/codexQuotaScopes.ts`), independent of account plan. Regression guard: `tests/unit/codex-spark-image-generation.test.ts` (thanks @alltomatos for independently catching and fixing it via #6819).
+- **fix(providers):** the provider quota card's weekly/session bars re-sorted by remaining percentage instead of staying in a fixed, deterministic order ([#6687](https://github.com/diegosouzapw/OmniRoute/issues/6687)) — `QuotaCardExpanded.tsx`'s `sortQuotasByRemaining()` (added in #5977) was applied unconditionally via `useMemo(() => sortQuotasByRemaining(quotas), [quotas])`, undoing the deterministic `CODEX_QUOTA_ORDER`/`GLM_QUOTA_ORDER` window order `quotaParsing.ts`'s `sortCodexOrder()`/`sortGlmOrder()` (added in #6336) already established for Codex and the GLM family — since #6336 never touched `QuotaCardExpanded.tsx`, the two orderings never composed, so e.g. a Codex `session` window with less headroom than `weekly` rendered after it instead of staying first. A new `hasFixedQuotaOrder()` (`quotaParsing.ts`) and `resolveQuotaDisplayOrder()` (`QuotaCardExpanded.tsx`) now skip the remaining-% re-sort for providers with a fixed window order, threading `providerId` from `QuotaCard.tsx` through to the display layer; every other provider still gets the remaining-% sort. Regression guard: `tests/unit/quota-card-expanded-fixed-order-6687.test.ts`.
+- **fix(i18n):** pt-BR was missing 194 UI keys present in `en.json` — a real, silent data-sync gap, not covered by any duplicate/mislabeled #6694 (that issue's 9 `providers.*` keys are disjoint, present-but-untranslated sentinels caused by a separate `providerText()` fallback bug) ([#6695](https://github.com/diegosouzapw/OmniRoute/issues/6695)) — `scripts/i18n/sync-ui-keys.mjs` (which mirrors newly-added `en.json` keys into every locale) wasn't re-run after recent `en.json` additions, and the CI `i18n:check-ui-coverage` gate only fails a locale below an 80% threshold, so pt-BR stayed green at 93.8% coverage despite the gap. Backfilled all 194 missing keys into `src/i18n/messages/pt-BR.json` (translated to Brazilian Portuguese, no leftover `__MISSING__` markers) via `npm run i18n:sync-ui -- --locale=pt-BR` + manual translation. Regression guard: `tests/unit/i18n-pt-br.test.ts` (new case asserting full `en.json`→`pt-BR.json` key parity, so a future drift fails a fast unit test instead of silently degrading the coverage percentage).
+- **fix(startup):** `omniroute --mcp` crashed at Node ESM link time with `ERR_MODULE_NOT_FOUND` for `ioredis` on installs where the published MCP bundle didn't happen to have `ioredis` rescued from a parent `node_modules` ([#6559](https://github.com/diegosouzapw/OmniRoute/issues/6559)) — `src/shared/utils/rateLimiter.ts` had a top-level static `import Redis from "ioredis"`; that module is only ever reached via a lazy `await import(...)` several call-sites deep in the MCP tool chain, but esbuild's `--packages=external` bundling of the MCP server (`scripts/build/prepublish.ts` Step 8.5) still hoisted rateLimiter.ts's own static import into a real top-level ESM import in the compiled `dist/open-sse/mcp-server/server.js`, forcing Node to resolve `ioredis` at module-link time — before any `--mcp` startup code runs — and `ioredis` is not guaranteed to ship in the MCP-only bundle's `node_modules`. `getRedisClient()` now lazily imports `ioredis` on first use (matching the established soft-dependency pattern in `src/lib/quota/redisQuotaStore.ts`) while still throwing synchronously when Redis isn't configured. Regression guard: `tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts` (bundles the real MCP server entrypoint with the exact publish-time esbuild flags and asserts no top-level static `ioredis` import remains, while the pre-existing lazy `await import("ioredis")` in `redisQuotaStore.ts` stays intact).
+- **fix(providers):** Kiro sent the adaptive-thinking `additionalModelRequestFields` envelope for `claude-sonnet-4.5`/`claude-haiku-4.5`, which Kiro/CodeWhisperer rejects upstream with a raw `[400]: additionalModelRequestFields is not supported for this model` ([#6576](https://github.com/diegosouzapw/OmniRoute/issues/6576)) — `buildKiroPayload()` (`open-sse/translator/request/openai-to-kiro.ts`) gated the field on the generic Anthropic-API `supportsReasoning()` capability flag, which is `true` for both models on Anthropic's direct API but does not reflect what Kiro's CodeWhisperer backend actually accepts; only `claude-sonnet-5` is confirmed adaptive-thinking-capable there. A new Kiro-specific allowlist (`supportsKiroAdaptiveThinking()` in `open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts`) now gates the envelope instead. Regression guard: `tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts`.
+- **fix(translator):** Cursor's local **Subagent** tool call is no longer rejected with `cloud_base_branch may only be specified when environment equals cloud` — the Responses→Chat tool-arg cleanup (`stripEmptyOptionalToolArgs`) was scoped to Claude Code's `Read` tool only, so Cursor's `Subagent` tool passed through with the cloud-only `cloud_base_branch: ""` (Cursor treats an empty string as "specified" and rejects the call before starting the local subagent). The cleanup now covers an allowlist of `Read` + `Subagent`; arbitrary tools are still left untouched (empty strings/arrays can be valid payloads for them). Regression guard: `tests/unit/openai-responses-subagent-strip-2446.test.ts`. (thanks @like3213934360-lab)
+- **fix(translator):** GLM 5.2 (and other OpenAI-compatible upstreams that stream a tool call's `id` and `function.name` in **separate** SSE chunks) no longer produce an empty tool name / `No such tool available:` error through the Claude `/messages` path — the `openai-to-claude` streaming translator emitted `content_block_start` immediately on the id-only chunk with an empty `name`, and the Claude SSE protocol cannot patch a block after it is emitted, so the later name-only chunk was silently dropped. It now **defers** `content_block_start` until the tool name arrives (falling back to starting the block when arguments arrive first), so the emitted `tool_use` always carries the real name. Regression guard: `tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts`. (thanks @itiwant)
+- **fix(resilience):** OmniRoute didn't respect an exhausted Ollama Cloud (or any other apikey-category provider) quota — it retried the account seconds later instead of waiting out the real reset window ([#6638](https://github.com/diegosouzapw/OmniRoute/issues/6638)) — `shouldPreserveQuotaSignalsFor429()`/`checkFallbackError()` (`open-sse/services/accountFallback.ts`) only applied body-text quota classification (daily/monthly/weekly quota-exhausted detection) to OAuth-category providers; apikey-category 429s (Ollama Cloud, OpenAI, etc.) always fell through to the generic short rate-limit cooldown regardless of what the error body said, and `parseRetryFromErrorText()` also had no support for day-granularity reset hints ("Your quota will reset in 3 days.") — only Xh/Ym/Zs combos. An explicit quota-exhausted signal in the body (`looksLikeQuotaExhausted()`) now overrides the apikey-category default via the new `shouldPreserveQuotaSignals()` (`open-sse/services/quotaResetParsing.ts`), and `parseDayGranularityResetMs()` parses whole-day reset countdowns so the real multi-day window is honored instead of a few seconds of backoff. Regression guard: `tests/unit/issue-6638-ollama-quota.test.ts` + 2 aligned `tests/unit/account-fallback-service.test.ts` cases that previously asserted the buggy rate_limit_exceeded/undefined-dailyQuotaExhausted behavior for apikey-provider quota text.
+- **fix(resilience):** a combo step "pinned" to one fingerprint account (mimocode/mcode/opencode multi-account providers) never actually resolved to that account, so it couldn't fail over when the pinned account was depleted ([#6696](https://github.com/diegosouzapw/OmniRoute/issues/6696), relates #6612) — the combo builder UI encodes an account pin as a composite connectionId (`${rowId}|fp|${fingerprint}`, `src/lib/combos/builderOptions.ts`), but `expandTargetsByFingerprints()` (`open-sse/services/combo/fingerprintExpansion.ts`) looked that composite string up directly in `connectionById` (keyed by real DB row ids), got `undefined`, and passed the target through unchanged, still carrying the bogus composite id — so downstream credential resolution could never match it either. `expandTargetsByFingerprints()` now splits the `|fp|` composite id back into the real connection row id + the pinned fingerprint (new `splitFingerprintPin()` helper) before any lookup, resolving the target to the real connectionId (with the pinned fingerprint carried on the new `pinnedFingerprint` field) instead of the inert composite string. Regression guard: `tests/unit/combo-fingerprint-pin-6696.test.ts`.
+- **fix(api):** Responses passthrough emitted event-only SSE frames (no `data:` line) for every dropped commentary event, breaking the OpenAI Python SDK's `sse.json()` parser ([#6561](https://github.com/diegosouzapw/OmniRoute/issues/6561)), follow-up to #6199/#6232 — the commentary-drop `continue;` branches in `open-sse/utils/stream.ts` skipped the `data:` line for a dropped commentary event but never cleared the already-buffered `event:` line for that same frame, so the next blank line flushed the stale `event:` line alone. Both drop sites now call `clearPendingPassthroughEvent()` before `continue`, discarding the buffered prefix along with the dropped payload; the commentary-drop decision itself was extracted into a new `open-sse/utils/responsesCommentaryDrop.ts` so the fix does not grow the frozen `stream.ts`. Regression guard: `tests/unit/responses-commentary-event-frame-6561.test.ts` (realistic `event:\ndata:\n\n` frames — the existing #6199 test only used bare `data:` lines and never exercised this path).
+- **fix(compression):** `/api/compression/preview`'s top-level `originalTokens`/`compressedTokens` diverged from `engineBreakdown[0]`'s counts for the same single-engine run (tiktoken outer counts vs the `JSON.stringify(...).length/4` estimate per engine), worst on small inputs. A new `reconcileSingleEngineTokens()` overwrites the single-engine breakdown entry with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched ([#6488](https://github.com/diegosouzapw/OmniRoute/issues/6488)). Regression guard: `tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts`.
+- **fix(resilience):** account selection could pick an account already out of quota upstream on every credentialed route except `chat`/`codex` ([#6686](https://github.com/diegosouzapw/OmniRoute/issues/6686)) — `getProviderCredentials()` (`src/sse/services/auth.ts`) only skips a connection when a *local cache* already flags it exhausted (`isQuotaExhaustedForRequest`/`src/domain/quotaCache.ts`); it never itself calls the registered upstream `QuotaFetcher`. Only `getProviderCredentialsWithQuotaPreflight()` performs that live upstream check, and it was wired into exactly 2 call sites (`src/sse/handlers/chat.ts`, `src/app/api/internal/codex-responses-ws/route.ts`) — every other credentialed route (`rerank`, `images/generations`, `images/edits`, `audio/transcriptions|speech|translations`, `videos/generations`, `music/generations`, `ocr`, `providers/[provider]/embeddings`, `providers/[provider]/images/generations`, `web/fetch`, `moderations`, `search`) called the plain, cache-only selector, so an account whose cache entry was never populated (e.g. its first request landed on one of these routes) could be selected even at 0% quota remaining. Those 14 call sites now go through `getProviderCredentialsWithQuotaPreflight()` instead, matching chat/codex coverage. Regression guard: `tests/unit/issue-6686-quota-preflight-coverage.test.ts` (static check that none of the routes call the plain selector anymore + a behavioral check that the preflight-aware selector blocks a 100%-used account).
+- **fix(api):** `reasoning_content` (extended-thinking text) was silently dropped from `/v1/chat/completions` SSE on the `claude-web` and `v0-vercel-web` executors ([#6662](https://github.com/diegosouzapw/OmniRoute/issues/6662)) — every chunk builder in both adapters hardcoded `delta: { content: ... }` with no reasoning path, unlike the established pattern already used by `default.ts`/`deepseek-web.ts`/`bedrock.ts` and the real-Anthropic-API `claude-to-openai.ts` translator (`thinking_delta` → `reasoning_content`). `v0-vercel-web.ts` now forwards an upstream `delta.reasoning_content` field (streaming and non-streaming) the same way `deepseek-web.ts` does. `claude-web.ts`'s `buildClaudeStreamingResponse` now maps a `content_block_start`(`type: "thinking"`)/`content_block_delta`(`delta.thinking`) pair onto `delta.reasoning_content`, and `claude-web/payload.ts`'s `transformToClaude()` no longer hardcodes `thinking_mode: "off"` — a new `wantsExtendedThinking()` derives it from the request's `reasoning_effort`/`reasoning.effort`/`thinking.type` signal, so extended thinking can actually be requested. Regression guard: `tests/unit/issue-6662-repro.test.ts` (RED→GREEN for both adapters).
+- **fix(api):** the compression config PUT schema now accepts `enableRenderers` for the RTK engine instead of rejecting the documented option (#6703, #6757 — thanks @alltomatos, with an independent duplicate fix from @chirag127 via #6756).
+- **fix(api):** raised the provider `apiKey` length cap for cookie-based web providers, whose session-cookie credentials legitimately exceed the previous limit (#6715, #6759 — thanks @alltomatos).
+- fix(ci): publish electron-updater `latest*.yml` manifests in electron release assets so auto-update can find them ([#6766](https://github.com/diegosouzapw/OmniRoute/issues/6766))
+- **fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6761, #6768)** (#6769 — thanks @chirag127).
+- fix(providers): strip redundant node prefix when resolving custom OpenAI/Anthropic-compatible connections by raw connection id, preventing double-namespaced model ids from 400ing upstream (#6772)
+- fix(providers): scope nvidia NIM 404s to the single failing model instead of cooling down the whole connection (#6773)
+- **fix(codex):** bump the default Codex CLI client identity from `0.142.0` to `0.144.0` for compatibility with newer Codex-backed models ([#6780](https://github.com/diegosouzapw/OmniRoute/pull/6780)) — thanks @quanturbo
+- **fix(ci):** the blocking "Impacted unit tests (TIA)" step false-redded any PR whose impact graph reached a dashboard component — it ran every selected test under `--import tsx/esm`, but `tests/unit/dashboard/**` requires the `--import tsx` CJS transform (ESM-only deep imports like `@lobehub/icons/es/*`), exactly as the canonical `test:unit:ci:shard` already does per segment. The impacted selection is now split by segment with matching loaders (closes #6787).
+- **fix(translator):** read PDF/video `file_data` attachments on the OpenAI→Gemini/Antigravity and OpenAI→Claude paths so multimodal documents (not just images) reach the upstream — PDFs map to `document`/`inlineData` and videos keep their `video/mp4` mime instead of being dropped (#6790 — thanks @Witroch4, with an independent report/fix from @samimozcan via #6762/#6753).
+- **fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED** (#6791 — thanks @Pitchfork-and-Torch).
+- **fix(api):** the compression config `PUT` schema (`stackedPipelineStepSchema`) now accepts every `ENGINE_CATALOG` id — the structural engines `session-dedup`/`ccr`/`headroom`/`relevance`/`llmlingua`/`omniglyph` and the `aggressive` `ultra` intensity — so a `GET`→`PUT` round-trip of a stacked pipeline no longer 400s on a valid engine the discriminated union had omitted (#6747 — thanks @Pitchfork-and-Torch).
+- **fix(cursor):** send the Agent CLI build id as `x-cursor-client-version` so Cursor upstream accepts requests from the current CLI build instead of a stale hardcoded version (#6795 — thanks @andrewmunsell).
+- fix(cli): waitForServer() no longer reports ready from a raw TCP accept alone — requires a fast HTTP rejection or a real health response, so the "OmniRoute is running!" banner no longer fires 30-60s before the server can actually answer requests (#6800)
+- fix(sse): de-flake timing-sensitive combo cooldown/breaker tests + add explicit MCP audit shutdown timeout (#6803)
+- **fix(codex): strip include from compact responses requests** (#6805 — thanks @yinaoxiong).
+- fix(dashboard): surface Claude extraUsage credits in quota card when quotas is empty (#6806)
+- **Request count by provider & date**: Dashboard → Analytics now shows a dedicated table of request counts grouped by provider and calendar date (plus token totals), for providers that bill per-request rather than per-token — sortable columns and a single-date filter. New `getProviderDailyUsageRows()` query (`src/lib/db/usageAnalytics.ts`) and its own `GET /api/usage/requests-by-provider-date` route (kept separate from the frozen `/api/usage/analytics` route). Regression guard: `tests/unit/db-provider-daily-usage-4009.test.ts`. (#4009 — thanks @tjengbudi)
+- **fix(resilience):** an Ollama Cloud (or any apikey-category provider) account that hit a weekly usage cap kept getting retried every few minutes instead of backing off ([#3709](https://github.com/diegosouzapw/OmniRoute/issues/3709)) — the upstream 429 body ("you (\<account\>) have reached your weekly usage limit") was invisible to `checkFallbackError`'s existing subscription-quota-text classifier (Issue #2321) because that branch is gated by `shouldUseQuotaSignal`, which is oauth-only, so apikey providers like `ollama-cloud` fell through to the generic exponential backoff (~1s, capped at 2min) — one account took 285x429 in 48h. A new `isWeeklyUsageLimitText`/`buildWeeklyQuotaFallback` classifier (extracted, with the existing subscription-quota logic, into a new `open-sse/services/quotaTextCooldowns.ts` module so the frozen `accountFallback.ts` didn't have to grow) runs unconditionally and applies a 24h `QUOTA_EXHAUSTED` cooldown regardless of provider category. Regression guard: `tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts`.
+- **fix(providers):** an explicit `thinking.budget_tokens: 0` is now honored in the OpenAI→Gemini transform (thinking disabled) instead of being treated as unset (#6813, #6821 — thanks @alltomatos).
+- **fix(bootstrap):** filter empty `process.env` values before spawning embedded services so a blank env var no longer crashes the Docker bootstrap in a restart loop (#6828 — thanks @AndrianBalanescu).
+- **fix(providers):** classify upstream `404` responses as `MODEL_NOT_FOUND` (model lockout) instead of a retryable provider error, stopping the retry storm when a single model is missing (#6829 — thanks @AndrianBalanescu).
+- fix(mcp): de-duplicate `TOTAL_MCP_TOOL_COUNT` by tool name instead of double-counting collections (#6854)
+- **fix(usage):** xAI's exact provider-reported `cost_in_usd_ticks` no longer silently accepts `null`/`""`/negative values as a valid `$0` exact cost — `extractUsageFromResponse()` (`open-sse/handlers/usageExtractor.ts`) and `normalizeUsage()` (`open-sse/utils/usageTracking.ts`) now require `typeof value === "number" && Number.isFinite(value) && value >= 0` instead of coercing with `Number(x)`, so a malformed exact cost correctly falls back to the token-based estimate instead of masking it with a bogus `$0`. Regression guard: `tests/unit/xai-exact-cost-2453.test.ts` (rejects null/empty/negative exact costs on both call sites). ([#6856](https://github.com/diegosouzapw/OmniRoute/pull/6856) — thanks @KooshaPari)
+- **fix(plugin):** the `@omniroute/opencode-plugin` dynamic provider hook stopped embedding its OC-1.17.8+-gate-compatible `opencode-`-prefixed provider id into model routing fields (`ModelV2.id`/`providerID`, combo catalog keys) — OmniRoute's server has no `opencode-<x>` provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" (#6859).
+- fix(sse): apply cliproxyapiModelMapping at CLIProxyAPI dispatch time (#6876)
+- fix(sse): defer `response.completed` until a trailing usage-only chunk arrives on `/v1/responses` streams (#6906)
+- **fix(cli):** ship `head-response-guard.cjs` into the standalone bundle — `server-ws.mjs` imported it without a matching `EXTRA_MODULE_ENTRIES` entry, so every `build:release` dist crashed at boot with `ERR_MODULE_NOT_FOUND`; a new regression test derives the required sidecars from `server-ws.mjs` imports (#6908)
+- fix(sse): wire the shared quota-fetch throttle into DeepSeek, Bailian, OpenCode, and Crof quota fetchers, not just Codex (#6911)
+- fix(sse): rename client-sent `max_completion_tokens` to `max_tokens` for providers/models that only accept the legacy field (e.g. Volcengine Ark / DeepSeek), mirroring the existing reverse rename from #1961 (#6912)
+- fix(sse): set includeServerSideToolInvocations on Antigravity tool cloak decoys (#6914)
+- fix(sse): classify LAN embeddings providers (10/8, 192.168/16, CGNAT) as no-auth instead of forcing bearer auth (#6925)
+- fix(sse): Qwen Web executor no longer sends `[object Object]` when a message uses structured (array) content — the text parts are now flattened (#6927)
+- perf(api): relay chat-completions routes now thread the already-fetched `RelayToken` into `checkRateLimit`, skipping a redundant `SELECT * FROM relay_tokens WHERE id = ?` re-query on every request (#6930)
+- fix(sse): `normalizeCodexMessageContentPart` now rewrites explicit `type: "input_text"` (not just `type: "text"`) to `output_text` on assistant-role Codex Responses input parts, so replayed assistant history sent by codex-cli as `input_text` is no longer rejected by the Codex/OpenAI backend (#6932)
+- fix(sse): omit removed `attachments` field from Muse Spark Web (Meta AI) persisted GraphQL query to fix `Unknown type "AttachmentInput"` 502s (#6935)
+- fix(dashboard): label audio/embeddings/image compatible providers by kind instead of "Chat" on ProviderCard (#6936)
+- fix(api): model-list discovery for LAN-local OpenAI-compatible providers (e.g. LM Studio) now uses the same local-first SSRF guard as the connection test, instead of the stricter guard that always blocked LAN hosts (#6939)
+- fix(providers): `openai->gemini` transform now maps `reasoning_effort: "none"` to `thinkingConfig.thinkingBudget: 0` (with `includeThoughts: false`), giving callers an explicit, documented off-switch for Gemini thinking; the no-knob-at-all default injection (#4170) is unchanged (#6813, thanks @rafaumeu)
+- **fix(sse):** escape backslash before brackets in ChatGPT-web citation link text, preventing a citation label containing `\` from corrupting the generated Markdown link ([#6944](https://github.com/diegosouzapw/OmniRoute/pull/6944)) — thanks @brick30llc-ctrl
+- fix(oauth): tokenHealthCheck now lowercase-normalizes `conn.provider` before checking `ROTATING_REFRESH_PROVIDERS.has()` and the GitHub Copilot sub-token refresh guard, so mixed-case provider values (e.g. "OpenAI", "Github") no longer bypass the rotating-refresh-token skip or the Copilot sub-token refresh (#6947)
+- fix(sse): make Codex Responses tool-arg normalization schema-aware — drop values equal to the tool's declared JSON Schema `default`, generalize empty-optional stripping to any tool (not just `Read`/`Subagent`) via `schema.required`, and thread each tool's schema from the request's `tools[]` into the streaming response translator (#6951)
+- fix(sse): drop internal commentary-phase Responses output in TRANSLATE-mode streams, not just PASSTHROUGH — codex/Responses-upstream routes translated into another client format (e.g. Claude Code) no longer leak duplicate prose and narrated tool-call arguments into the client text channel (#6952)
+- **fix(combos):** embeddings-only and rerank-only models (e.g. JinaAI, Gemini auto-imported, OpenRouter custom, reranker models) no longer disappear from the combo builder's model picker — the leftover chat-only `isChatCapable` gate in `addModelOption()` has been removed (#6975).
+- **fix(combos):** when 2+ distinct model ids from the same provider would render an identical display name in the combo builder picker (e.g. Mistral's `codestral-latest`/`codestral-2508` aliases sharing one upstream catalog name), each colliding entry now falls back to its own id as the display label so every row stays visually distinguishable and findable (#6957).
+
+### 📝 Maintenance
+
+- **chore(release-captain):** v3.8.47 pre-flight closed every deterministic release-tip base-red ([#6967](https://github.com/diegosouzapw/OmniRoute/issues/6967)): restored the `no-explicit-any` severity silently downgraded by #6786 (439 bulk suppressions had stopped matching), made the openadapter live-catalog test deterministic (`test.after()` was tearing the DB down mid-request), aligned the emergency-fallback and Cloud Code Gemini tests with the #6912/#6943 contracts, backfilled the #6909 i18n keys (en + pt-BR), re-exported `relayProbeStats` (db-rules), documented `OMNI_MAX_CONCURRENT_CONNECTIONS`, and allowlisted migration gap 121. (thanks @diegosouzapw)
+- **chore(security):** unbiased crypto digits for the doubao synthetic device id (CodeQL `js/biased-cryptographic-random`); 405 method-first for `/api/keys/{id}/devices` (dast-smoke); Zod-validation for `POST /api/github-skills`; the missing `omni-github-skills` registry entry + catalog count alignment. (thanks @diegosouzapw)
+- **chore(quality):** cycle-close ratchet work — cleared the cycle's 11 net-new ESLint errors and made `validate-release-green` suppressions-aware; cleared the 2 remaining heavy-gate reds on the release tip; cycle rebaselines (cognitive/file-size/zizmor/coverage pcts) with justification keys. (thanks @diegosouzapw)
+
+- **chore(open-sse):** removed the vestigial `// @ts-nocheck` directive from `open-sse/utils/usageTracking.ts` ([#6173](https://github.com/diegosouzapw/OmniRoute/pull/6173)) — `tsc` under the standard `typecheck:core` gate reports 0 errors for this 595-line hot-path file (executed for every provider response), so the suppression was no longer needed; removing it restores type-checking on the token-usage extraction/normalization path. (thanks @KooshaPari)
+- **chore(cli):** the shell-completion cache paths (`readCache`/`refreshCache`/`writeCache`) in `bin/cli/commands/completion.mjs` no longer swallow errors into a bare `catch {}` ([#6257](https://github.com/diegosouzapw/OmniRoute/pull/6257)) — each now binds the error and, when the new `OMNIROUTE_DEBUG_COMPLETION` env var is set, emits a `[omniroute completion]` diagnostic to `stderr`; the caches still fail silently by default so a missing/corrupt cache never breaks tab-completion. (thanks @KooshaPari)
+- **chore(quality):** `validate-release-green --full-ci` reproduces the full `ci.yml` static gate set locally — the pre-flight now reads `ci.yml` itself and runs every `npm run check:*` from the `lint` / `quality-gate` / `quality-extended` / `docs-sync-strict` / `pr-test-policy` jobs (`--` ratchet flags preserved, `test-masking` against `GITHUB_BASE_REF=main`), skipping only the non-local `pr-evidence`/`codeql-ratchet`. Closes the gap where 11 static base-reds leaked to the v3.8.46 release PR in ~2h of layered CI. Also wired into `nightly-release-green` so a static base-red opens a tracking issue the night it lands. Regression guard: `tests/unit/validate-release-green.test.ts` (+5 `extractCiGates` cases).
+- **refactor(usage):** `saveRequestUsage(entry: any)` is now typed with a new `UsageEntry` interface mirroring the `usage_history` columns 1:1 (#3512) — the other stray `any`s in `src/lib/usage/usageHistory.ts` (`getUsageHistory` filter, the `getUsageDb` next-cursor cast, `appendRequestLog`'s legacy `tokens` param, `getRecentLogs`'s catch) were cleaned in the same pass, so the file now sits in the `check:any-budget:t11` zero-`any` allowlist. The DB-entity ↔ TS-interface convention is documented in `docs/architecture/CODEBASE_DOCUMENTATION.md` §11.
+- **Merge-train script** (`scripts/release/merge-train.sh`): batch-validates N queued PRs as ONE merged result on the runner box — merges every queued PR into a throwaway worktree cut from the release tip, runs the fast-gates parity suite once, and prints the `--admin` evidence block per PR (merge-gates §7). Replaces O(N²) per-PR CI re-runs in merge-storms. Regression guard: `tests/unit/merge-train-plan.test.ts`.
+- **release:** `list-uncovered-commits.mjs` now unions the CHANGELOG scan window with `changelog.d/` fragment refs (filename `<PR>-` prefix + every `#N` in the body), so a commit covered only by a fragment is no longer reported as an uncovered reconciliation gap ([#6857](https://github.com/diegosouzapw/OmniRoute/issues/6857) via [#6878](https://github.com/diegosouzapw/OmniRoute/pull/6878))
+- chore(quality): restore no-explicit-any severity to error (silently downgraded by #6786, broke 439 bulk suppressions), fix 2 unsuppressed anys in repro-6912 test, allowlist migration gap 121, freeze-bump stream.ts/ProxyRegistryManager/tokenHealthCheck (combined-merge drift)
+- chore(base): pt-BR/en i18n keys for #6909 relay-repair/free-pool UI + align Cloud Code Gemini defaults test with the #6943 non-thinking-model contract
+- chore(base): re-export relayProbeStats from localDb (db-rules gate, #6909 follow-up) and document OMNI_MAX_CONCURRENT_CONNECTIONS in .env.example/ENVIRONMENT.md (env-doc gate, #6590 follow-up)
+- **ci:** unit fast-path sharding doubled 2→4 (halves the heaviest job's wall time) (#6781); the 3 heaviest fast-path jobs can route to the self-hosted VPS runner pool behind `USE_VPS_RUNNER` (#6691); `VPS_ALWAYS_ON` keeps the dedicated 24/7 CI host up across releases (teardown becomes a no-op) (#6693).
+- **docs:** routing-strategy count reconciled to 18 across AUTO-COMBO.md, README and AGENTS.md, and `p2c` casing fixed to match `ROUTING_STRATEGY_VALUES` (#6643, #6644, #6646 — thanks @chirag127); CLAUDE.md updated with the renamed review/triage/implement skill-family names (#6663).
+- chore(release): v3.8.47 pre-flight — relocate #6943 orphan test to a collected path, restore no-explicit-any suppression match, testFrozen bump translator-openai-to-gemini (1541→1553), zizmor rebaseline 159→169
+- **docs(readme):** fix stale counts — 18 routing strategies (adds the missing `pipeline` row), 94 MCP tools, 12-factor Auto-Combo scoring.
+- **chore(ci):** fix two shared base-reds on the release tip that blocked the PR queue — register `cliproxyapi-model-mapping-dispatch.test.ts` in `stryker.conf.json` `tap.testFiles` (mutation-coverage gap left by #6903) and update `provider-models-route-codex.test.ts` to expect Codex client version `0.144.0` (stale assertion left by #6780's production bump).
+- **docs:** refresh `llm.txt` to the current project state (248 providers, 94 MCP tools / 30 scopes, 18 routing strategies, 12-factor Auto-Combo scoring, v3.8.47) and sync its 42 i18n mirrors; move the implemented design-system plan from the repo root to `docs/architecture/DESIGN_SYSTEM.md` rewritten as a reference doc.
+- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.
+
+
+
+### 🙌 Contributors
+
+Thanks to everyone whose work landed in v3.8.47:
+
+| Contributor | PRs / Issues |
+| --- | --- |
+| [@AgentKiller45](https://github.com/AgentKiller45) | #6863, #6866 |
+| [@alltomatos](https://github.com/alltomatos) | #6703, #6715, #6756, #6757, #6759, #6813, #6819, #6821 |
+| [@andrewmunsell](https://github.com/andrewmunsell) | #6774, #6779, #6795 |
+| [@AndrianBalanescu](https://github.com/AndrianBalanescu) | #6828, #6829 |
+| [@anhdiepmmk](https://github.com/anhdiepmmk) | direct commit / report |
+| [@artickc](https://github.com/artickc) | #6363, #6763 |
+| [@backryun](https://github.com/backryun) | #6280, #6675, #6862 |
+| [@blackwell-systems](https://github.com/blackwell-systems) | #6838 |
+| [@brick30llc-ctrl](https://github.com/brick30llc-ctrl) | #6944 |
+| [@charleszolot](https://github.com/charleszolot) | #6571 |
+| [@chirag127](https://github.com/chirag127) | #6402, #6458, #6460, #6461, #6463, #6515, #6519, #6523, #6534, #6546, #6577, #6643, #6644, #6645, #6646, #6769, #6804, #6868, #6869, #6870, #6871, #6883 |
+| [@chy1211](https://github.com/chy1211) | direct commit / report |
+| [@crochabe-cyber](https://github.com/crochabe-cyber) | #4013 |
+| [@deadcoder0904](https://github.com/deadcoder0904) | #6665 |
+| [@developerjillur](https://github.com/developerjillur) | direct commit / report |
+| [@eidoog](https://github.com/eidoog) | direct commit / report |
+| [@enjoyer-hub](https://github.com/enjoyer-hub) | #6647 |
+| [@gdevenyi](https://github.com/gdevenyi) | direct commit / report |
+| [@growab](https://github.com/growab) | #6867 |
+| [@hajilok](https://github.com/hajilok) | #6126, #6833 |
+| [@hamsa0x7](https://github.com/hamsa0x7) | #6317, #6318, #6338 |
+| [@herjarsa](https://github.com/herjarsa) | direct commit / report |
+| [@iamraydoan](https://github.com/iamraydoan) | #6798 |
+| [@ianriizky](https://github.com/ianriizky) | #6072, #6538 |
+| [@itiwant](https://github.com/itiwant) | direct commit / report |
+| [@janeza2](https://github.com/janeza2) | #6308 |
+| [@JxnLexn](https://github.com/JxnLexn) | #6776 |
+| [@KooshaPari](https://github.com/KooshaPari) | #6611, #6632, #6856 |
+| [@like3213934360-lab](https://github.com/like3213934360-lab) | direct commit / report |
+| [@lucasjustinudin](https://github.com/lucasjustinudin) | direct commit / report |
+| [@lunkerchen](https://github.com/lunkerchen) | #6320 |
+| [@MikeTuev](https://github.com/MikeTuev) | #6586, #6830 |
+| [@Moseyuh333](https://github.com/Moseyuh333) | #6294, #6728 |
+| [@nowhats-br](https://github.com/nowhats-br) | direct commit / report |
+| [@oyi77](https://github.com/oyi77) | #6907, #6926, #6929, #6946 |
+| [@Pitchfork-and-Torch](https://github.com/Pitchfork-and-Torch) | #6747, #6791, #6792 |
+| [@pizzav-xyz](https://github.com/pizzav-xyz) | #6648 |
+| [@quanturbo](https://github.com/quanturbo) | #6780 |
+| [@rafaumeu](https://github.com/rafaumeu) | #6813 |
+| [@rafpigna](https://github.com/rafpigna) | #6574 |
+| [@rucciva](https://github.com/rucciva) | #4125 |
+| [@rushsinging](https://github.com/rushsinging) | #6807 |
+| [@ryanngit](https://github.com/ryanngit) | direct commit / report |
+| [@samir-abis](https://github.com/samir-abis) | direct commit / report |
+| [@SeaXen](https://github.com/SeaXen) | direct commit / report |
+| [@shabeer](https://github.com/shabeer) | direct commit / report |
+| [@Squawk7777](https://github.com/Squawk7777) | #6565 |
+| [@strangersp](https://github.com/strangersp) | #6587 |
+| [@Thinkscape](https://github.com/Thinkscape) | direct commit / report |
+| [@ThongAccount](https://github.com/ThongAccount) | #6625, #6649 |
+| [@tjengbudi](https://github.com/tjengbudi) | #4009 |
+| [@whale9820](https://github.com/whale9820) | direct commit / report |
+| [@Witroch4](https://github.com/Witroch4) | #6753, #6762, #6790 |
+| [@xz-dev](https://github.com/xz-dev) | #6323, #6330, #6702, #6714, #6727 |
+| [@yinaoxiong](https://github.com/yinaoxiong) | #6805 |
+| [@diegosouzapw](https://github.com/diegosouzapw) | maintainer |
+
+---
+
 ## [3.8.46] — 2026-07-07
 
 ### ✨ New Features
@@ -144,6 +466,7 @@
 - **fix(api):** `POST /api/github-skills` now Zod-validates its request body; documented the new quality-gate env vars and pinned the merge-integrity GitHub Actions to a commit SHA.
 - **fix(skills):** generate the missing `omni-github-skills` registry entry and align the agent-skills catalog-count tests (follow-up to #6186).
 - **fix(quality):** clear the cycle's 11 net-new ESLint errors and make `validate-release-green` suppressions-aware.
+- **fix(security):** proxy-pool `random` rotation now selects via `crypto.randomInt` instead of `Math.random` — silences the post-release CodeQL `js/insecure-randomness` alerts (#698/#699) that flagged `Math.random` flowing into the selected proxy's credentials. Load-balancing selection is not a secret, but the crypto source is unbiased and clears the alert at the origin (#6365 follow-up).
 
 ### 📝 Maintenance
 
diff --git a/docs/i18n/zh-TW/README.md b/docs/i18n/zh-TW/README.md
index 40137a2f05..3dfdaaada2 100644
--- a/docs/i18n/zh-TW/README.md
+++ b/docs/i18n/zh-TW/README.md
@@ -30,7 +30,7 @@
 [![50+ Free](https://img.shields.io/badge/50%2B-Free_Tiers-00B894?style=for-the-badge)](#-231-ai-providers--50-free)
 [![1.6B Free Tokens/mo](https://img.shields.io/badge/1.6B-Free_Tokens%2Fmo-00B894?style=for-the-badge)](../../reference/FREE_TIERS.md)
 [![Token Savings](https://img.shields.io/badge/up_to_95%25-Token_Savings-E17055?style=for-the-badge)](#%EF%B8%8F-save-1595-tokens--automatically)
-[![17 Strategies](https://img.shields.io/badge/17-Routing_Strategies-0984E3?style=for-the-badge)](#-combos--the-flagship)
+[![18 Strategies](https://img.shields.io/badge/18-Routing_Strategies-0984E3?style=for-the-badge)](#-combos--the-flagship)
 [![$0 to start](https://img.shields.io/badge/%240-To_Start-FDCB6E?style=for-the-badge&logoColor=black)](#-quick-start)
 
 <br/>
diff --git a/docs/i18n/zh-TW/llm.txt b/docs/i18n/zh-TW/llm.txt
index 891f389de1..0c39f612a5 100644
--- a/docs/i18n/zh-TW/llm.txt
+++ b/docs/i18n/zh-TW/llm.txt
@@ -4,7 +4,7 @@
 
 ---
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -12,12 +12,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -45,7 +45,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -106,7 +106,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -128,7 +128,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -169,7 +169,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -186,7 +186,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -212,15 +212,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -228,7 +228,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -257,24 +257,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -282,15 +279,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -303,7 +300,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -319,7 +316,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -349,18 +346,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -385,17 +385,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -439,15 +439,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -478,21 +478,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index 991c650227..bd35e4ab03 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OmniRoute API
-  version: 3.8.46
+  version: 3.8.47
   description: |
     OmniRoute is a local-first AI API proxy router. It provides an OpenAI-compatible
     endpoint that routes requests to multiple AI providers with load balancing,
diff --git a/docs/providers/AGENTROUTER.md b/docs/providers/AGENTROUTER.md
index dcd54c7777..c5b1538fc9 100644
--- a/docs/providers/AGENTROUTER.md
+++ b/docs/providers/AGENTROUTER.md
@@ -130,7 +130,7 @@ request (see `open-sse/services/claudeCodeCompatible.ts`):
 | Header                                      | Value                                                                                                   |
 | ------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
 | `Authorization`                             | `Bearer <api-key>`                                                                                      |
-| `User-Agent`                                | `claude-cli/2.1.195 (external, sdk-cli)`                                                                |
+| `User-Agent`                                | `claude-cli/2.1.207 (external, sdk-cli)`                                                                |
 | `anthropic-version`                         | `2023-06-01`                                                                                            |
 | `anthropic-beta`                            | `claude-code-20250219,interleaved-thinking-2025-05-14,effort-2025-11-24`                                |
 | Per-connection redact-thinking beta toggle  | Adds `redact-thinking-2026-02-12` for upstreams that specifically require redacted thinking streams     |
diff --git a/docs/reference/ENVIRONMENT.md b/docs/reference/ENVIRONMENT.md
index 1ca37d603f..bd8fe06946 100644
--- a/docs/reference/ENVIRONMENT.md
+++ b/docs/reference/ENVIRONMENT.md
@@ -96,6 +96,7 @@ OmniRoute uses **SQLite** (via `better-sqlite3`) for all persistence. These vari
 | `OMNIROUTE_SPEND_FLUSH_INTERVAL_MS`    | _(default in code)_  | `src/lib/spend/batchWriter.ts`                        | Flush interval (ms) for the batched spend/cost writer. Lower values reduce write coalescing; higher values reduce DB contention.                                                                                                                |
 | `OMNIROUTE_SPEND_MAX_BUFFER_SIZE`      | _(default in code)_  | `src/lib/spend/batchWriter.ts`                        | Max buffered spend entries before a forced flush. Raise on high-QPS deployments; lower when bounded memory matters more.                                                                                                                        |
 | `OMNIROUTE_PROXY_FETCH_DEBUG`          | _(unset)_            | `open-sse/utils/proxyFetch.ts`                        | Set to `"true"` to emit `[ProxyFetch]` debug logs on the Vercel relay path. Off by default to avoid leaking routing hints.                                                                                                                      |
+| `OMNIROUTE_DEBUG_COMPLETION`           | _(unset)_            | `bin/cli/commands/completion.mjs`                    | Set to any non-empty value to emit `[omniroute completion]` diagnostics from the CLI shell-completion cache paths (read/refresh/write). Off by default — those caches fail silently so a missing/corrupt cache never breaks tab-completion.       |
 | `BATCH_RETRY_DURATION_MS`              | `86400000` (24h)     | `open-sse/services/batchProcessor.ts`                 | Maximum retry window for individual batch items (ms). Items exceeding this duration are marked failed.                                                                                                                                          |
 | `BATCH_BACKOFF_BASE_MS`                | `5000`               | `open-sse/services/batchProcessor.ts`                 | Base delay (ms) for exponential backoff on batch item retries.                                                                                                                                                                                  |
 | `BATCH_BACKOFF_MAX_MS`                 | `3600000` (1h)       | `open-sse/services/batchProcessor.ts`                 | Cap (ms) for exponential backoff between batch item retries.                                                                                                                                                                                    |
@@ -114,33 +115,33 @@ OmniRoute uses **SQLite** (via `better-sqlite3`) for all persistence. These vari
 
 ## 3. Network & Ports
 
-| Variable                                    | Default                         | Source File                                                              | Description                                                                                                                                                    |
-| ------------------------------------------- | ------------------------------- | ------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `PORT`                                      | `20128`                         | `src/lib/runtime/ports.ts`                                               | Primary port for both Dashboard UI and API endpoints (single-port mode).                                                                                       |
-| `OMNIROUTE_BASE_PATH`                       | _(empty = root)_                | `next.config.mjs`                                                        | URL subpath for serving OmniRoute behind a reverse proxy under a subpath (sets Next.js `basePath`; auth redirects are basePath-aware). E.g. `/omniroute`.       |
-| `API_PORT`                                  | _(unset)_                       | `src/lib/runtime/ports.ts`                                               | When set, serves the `/v1/*` proxy API on this separate port.                                                                                                  |
-| `API_HOST`                                  | `0.0.0.0`                       | `src/lib/runtime/ports.ts`                                               | Bind address for the API port.                                                                                                                                 |
-| `DASHBOARD_PORT`                            | _(unset)_                       | `src/lib/runtime/ports.ts`                                               | When set, serves the Dashboard UI on this separate port.                                                                                                       |
-| `PROD_DASHBOARD_PORT`                       | `20130`                         | `docker-compose.prod.yml`                                                | Host-side published port for the Dashboard in Docker production mode.                                                                                          |
-| `PROD_API_PORT`                             | `20131`                         | `docker-compose.prod.yml`                                                | Host-side published port for the API in Docker production mode.                                                                                                |
-| `OMNIROUTE_PORT`                            | _(unset)_                       | `src/lib/runtime/ports.ts`                                               | Takes precedence over `PORT` when running inside Electron or other wrappers.                                                                                   |
-| `LIVE_WS_PORT`                              | `20129`                         | `src/server/ws/liveServer.ts`                                            | Port for the real-time WebSocket live monitoring server.                                                                                                       |
-| `LIVE_WS_HOST`                              | `127.0.0.1`                     | `src/server/ws/liveServer.ts`                                            | Bind address for the live WebSocket server. Set to `0.0.0.0` to expose on LAN (also configure `LIVE_WS_ALLOWED_ORIGINS`).                                      |
-| `LIVE_WS_ALLOWED_ORIGINS`                   | _(unset)_                       | `src/server/ws/liveServer.ts`                                            | Comma-separated extra origins allowed to open a live WebSocket. Loopback dashboard origins are already permitted by default.                                   |
-| `LIVE_WS_ALLOWED_HOSTS`                     | _(unset)_                       | `src/server/ws/liveServerAllowList.ts`                                   | Comma-separated extra hostnames allowed for live WebSocket origins. Unlike `LIVE_WS_ALLOWED_ORIGINS` (full origin URLs), matches only the host portion — useful for LAN/Tailscale setups. |
-| `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`            | _(unset)_                       | `src/hooks/useLiveDashboard.ts`                                          | Public URL for the live dashboard WebSocket (browser-side). Set when fronting the WS server with a reverse proxy or Cloudflare Tunnel (e.g. `wss://ws.my-ai.com/live-ws`); the browser connects there instead of `ws://hostname:20129`. |
-| `OMNIROUTE_ENABLE_LIVE_WS`                  | `true`                          | `src/server/ws/liveServer.ts`                                            | Set to `0` or `false` to disable the real-time WebSocket server (enabled by default, loopback-bound).                                                          |
-| `OMNIROUTE_DISABLE_LIVE_WS`                 | `false`                         | `scripts/start-ws-server.mjs`                                            | CI/harness toggle that disables the standalone live WebSocket helper script.                                                                                   |
-| `RELAY_IP_PER_MINUTE`                       | `30`                            | `src/app/api/v1/relay/chat/completions/route.ts`                         | Per-(token, IP) relay rate limit, requests/minute. In-memory, per instance. `0` or negative disables the IP-dimension gate (per-token DB limit still applies). |
-| `NODE_ENV`                                  | `production`                    | Next.js core                                                             | Controls logging verbosity, caching, error detail exposure, and Next.js optimizations.                                                                         |
-| `OMNIROUTE_USE_TURBOPACK`                   | `1` (Turbopack — code default)  | `package.json` / Next.js 16                                              | Turbopack is the default bundler for `npm run dev` and `npm run build` (2-3× faster builds, benchmarked). Set to `0` to fall back to webpack on Windows or when running into native binding / bundler-compat incompatibilities.    |
-| `OMNIROUTE_SKIP_DB_HEALTHCHECK`             | _(unset)_                       | `src/lib/db/core.ts` / `src/lib/db/healthCheck.ts`                       | Set to `1` to skip the SQLite integrity health check on startup. Useful for faster boot on large databases.                                                    |
-| `CREDENTIAL_HEALTH_CHECK_INTERVAL`          | `300000`                        | `open-sse/config/constants.ts` / `src/lib/credentialHealth/scheduler.ts` | Interval (ms) for the background credential health check scheduler. Minimum: 10000 (10s).                                                                      |
-| `CREDENTIAL_HEALTH_CACHE_TTL`               | `300000`                        | `open-sse/config/constants.ts` / `src/lib/credentialHealth/cache.ts`     | TTL (ms) for cached credential health status.                                                                                                                  |
-| `OMNIROUTE_DISABLE_CREDENTIAL_HEALTH_CHECK` | `false`                         | `src/lib/credentialHealth/scheduler.ts`                                  | Set to `1` or `true` to disable background periodic testing of provider connections.                                                                           |
-| `HOST`                                      | `0.0.0.0`                       | `scripts/dev/run-next.mjs`                                               | Bind address for the Next.js dev/start server. Overrides the default `0.0.0.0` when set.                                                                       |
-| `HOSTNAME`                                  | `127.0.0.1`                     | `scripts/dev/run-next-playwright.mjs`                                    | Bind address used by the Playwright runner when launching Next.js. Defaults to `127.0.0.1` for hermetic tests. **Do not use for `omniroute serve`** — use `OMNIROUTE_SERVER_HOST` instead (POSIX shells auto-set `HOSTNAME` to the machine name; `.env` cannot override it). |
-| `OMNIROUTE_SERVER_HOST`                     | `0.0.0.0`                       | `bin/cli/commands/serve.mjs`                                             | Bind address for `omniroute serve`. Avoids collision with the POSIX shell `HOSTNAME` variable (always set to the machine name by bash/zsh). Falls back to `0.0.0.0` when unset. (#6194) |
+| Variable                                    | Default                        | Source File                                                              | Description                                                                                                                                                                                                                                                                                                                    |
+| ------------------------------------------- | ------------------------------ | ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `PORT`                                      | `20128`                        | `src/lib/runtime/ports.ts`                                               | Primary port for both Dashboard UI and API endpoints (single-port mode).                                                                                                                                                                                                                                                       |
+| `OMNIROUTE_BASE_PATH`                       | _(empty = root)_               | `next.config.mjs`                                                        | URL subpath for serving OmniRoute behind a reverse proxy under a subpath (sets Next.js `basePath`; auth redirects are basePath-aware). E.g. `/omniroute`.                                                                                                                                                                      |
+| `API_PORT`                                  | _(unset)_                      | `src/lib/runtime/ports.ts`                                               | When set, serves the `/v1/*` proxy API on this separate port.                                                                                                                                                                                                                                                                  |
+| `API_HOST`                                  | `0.0.0.0`                      | `src/lib/runtime/ports.ts`                                               | Bind address for the API port.                                                                                                                                                                                                                                                                                                 |
+| `DASHBOARD_PORT`                            | _(unset)_                      | `src/lib/runtime/ports.ts`                                               | When set, serves the Dashboard UI on this separate port.                                                                                                                                                                                                                                                                       |
+| `OMNI_MAX_CONCURRENT_CONNECTIONS`           | `0` _(disabled)_               | `src/sse/utils/backpressure.ts`                                          | Caps concurrent in-flight chat connections; requests over the cap get `503` with `Retry-After`. Positive integer enables the guard; unset/`0` disables it.                                                                                                                                                                     |
+| `PROD_DASHBOARD_PORT`                       | `20130`                        | `docker-compose.prod.yml`                                                | Host-side published port for the Dashboard in Docker production mode.                                                                                                                                                                                                                                                          |
+| `PROD_API_PORT`                             | `20131`                        | `docker-compose.prod.yml`                                                | Host-side published port for the API in Docker production mode.                                                                                                                                                                                                                                                                |
+| `OMNIROUTE_PORT`                            | _(unset)_                      | `src/lib/runtime/ports.ts`                                               | Takes precedence over `PORT` when running inside Electron or other wrappers.                                                                                                                                                                                                                                                   |
+| `LIVE_WS_PORT`                              | `20129`                        | `src/server/ws/liveServer.ts`                                            | Port for the real-time WebSocket live monitoring server.                                                                                                                                                                                                                                                                       |
+| `LIVE_WS_HOST`                              | `127.0.0.1`                    | `src/server/ws/liveServer.ts`                                            | Bind address for the live WebSocket server. Set to `0.0.0.0` to expose on LAN (also configure `LIVE_WS_ALLOWED_ORIGINS`).                                                                                                                                                                                                      |
+| `LIVE_WS_ALLOWED_ORIGINS`                   | _(unset)_                      | `src/server/ws/liveServer.ts`                                            | Comma-separated extra origins allowed to open a live WebSocket. Loopback dashboard origins are already permitted by default.                                                                                                                                                                                                   |
+| `LIVE_WS_ALLOWED_HOSTS`                     | _(unset)_                      | `src/server/ws/liveServerAllowList.ts`                                   | Comma-separated extra hostnames allowed for live WebSocket origins. Unlike `LIVE_WS_ALLOWED_ORIGINS` (full origin URLs), matches only the host portion — useful for LAN/Tailscale setups.                                                                                                                                      |
+| `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`            | _(unset)_                      | `src/hooks/useLiveDashboard.ts`                                          | Public URL for the live dashboard WebSocket (browser-side). Set when fronting the WS server with a reverse proxy or Cloudflare Tunnel (e.g. `wss://ws.my-ai.com/live-ws`); the browser connects there instead of `ws://hostname:20132`. The pathname portion is also used as the WebSocket upgrade path (default: `/live-ws`). |
+| `OMNIROUTE_ENABLE_LIVE_WS`                  | `true`                         | `src/server/ws/liveServer.ts` and `scripts/start-ws-server.mjs`          | Set to `0` or `false` to disable the real-time WebSocket server (enabled by default, loopback-bound). CI/harness toggle that disables the standalone live WebSocket helper script.                                                                                                                                             |
+| `RELAY_IP_PER_MINUTE`                       | `30`                           | `src/app/api/v1/relay/chat/completions/route.ts`                         | Per-(token, IP) relay rate limit, requests/minute. In-memory, per instance. `0` or negative disables the IP-dimension gate (per-token DB limit still applies).                                                                                                                                                                 |
+| `NODE_ENV`                                  | `production`                   | Next.js core                                                             | Controls logging verbosity, caching, error detail exposure, and Next.js optimizations.                                                                                                                                                                                                                                         |
+| `OMNIROUTE_USE_TURBOPACK`                   | `1` (Turbopack — code default) | `package.json` / Next.js 16                                              | Turbopack is the default bundler for `npm run dev` and `npm run build` (2-3× faster builds, benchmarked). Set to `0` to fall back to webpack on Windows, when running into native binding / bundler-compat incompatibilities, **or on RAM-constrained machines** — Turbopack production builds on this Next.js version line (16.2.x) are known upstream to peak far higher in memory than webpack on large module graphs (Next 16.3's Turbopack memory-eviction fix is not yet stable); webpack fallback peaks much lower. See #6409.                                                                                                |
+| `OMNIROUTE_SKIP_DB_HEALTHCHECK`             | _(unset)_                      | `src/lib/db/core.ts` / `src/lib/db/healthCheck.ts`                       | Set to `1` to skip the SQLite integrity health check on startup. Useful for faster boot on large databases.                                                                                                                                                                                                                    |
+| `CREDENTIAL_HEALTH_CHECK_INTERVAL`          | `300000`                       | `open-sse/config/constants.ts` / `src/lib/credentialHealth/scheduler.ts` | Interval (ms) for the background credential health check scheduler. Minimum: 10000 (10s).                                                                                                                                                                                                                                      |
+| `CREDENTIAL_HEALTH_CACHE_TTL`               | `300000`                       | `open-sse/config/constants.ts` / `src/lib/credentialHealth/cache.ts`     | TTL (ms) for cached credential health status.                                                                                                                                                                                                                                                                                  |
+| `OMNIROUTE_DISABLE_CREDENTIAL_HEALTH_CHECK` | `false`                        | `src/lib/credentialHealth/scheduler.ts`                                  | Set to `1` or `true` to disable background periodic testing of provider connections.                                                                                                                                                                                                                                           |
+| `HOST`                                      | `0.0.0.0`                      | `scripts/dev/run-next.mjs`                                               | Bind address for the Next.js dev/start server. Overrides the default `0.0.0.0` when set.                                                                                                                                                                                                                                       |
+| `HOSTNAME`                                  | `127.0.0.1`                    | `scripts/dev/run-next-playwright.mjs`                                    | Bind address used by the Playwright runner when launching Next.js. Defaults to `127.0.0.1` for hermetic tests. **Do not use for `omniroute serve`** — use `OMNIROUTE_SERVER_HOST` instead (POSIX shells auto-set `HOSTNAME` to the machine name; `.env` cannot override it).                                                   |
+| `OMNIROUTE_SERVER_HOST`                     | `0.0.0.0`                      | `bin/cli/commands/serve.mjs`                                             | Bind address for `omniroute serve`. Avoids collision with the POSIX shell `HOSTNAME` variable (always set to the machine name by bash/zsh). Falls back to `0.0.0.0` when unset. (#6194)                                                                                                                                        |
 
 ### Port Modes
 
@@ -418,7 +419,7 @@ detection above).
 | `MODEL_SYNC_INTERVAL_HOURS`                     | `24`                                                | `src/shared/services/modelSyncScheduler.ts`                 | Model catalog sync interval in hours.                                                                                                                                   |
 | `PROVIDER_LIMITS_SYNC_INTERVAL_MINUTES`         | `70`                                                | `src/server-init.ts`                                        | Provider rate-limit and quota polling interval.                                                                                                                         |
 | `PROVIDER_LIMITS_SYNC_SPACING_MS`               | `1500`                                              | `src/lib/usage/providerLimits.ts`                           | Gap (ms) between consecutive OAuth quota fetches in a bulk sync; OAuth connections are fetched one at a time to avoid bursting an upstream. `0` opts out (concurrent).  |
-| `OMNIROUTE_QUOTA_FETCH_MIN_INTERVAL_MS`         | `250`                                               | `open-sse/services/quotaFetchThrottle.ts`                   | Min interval (ms) between consecutive upstream quota fetches on the per-request preflight/monitor path (e.g. Codex `/wham/usage`); spaces concurrent network calls so many accounts on one IP don't burst the upstream (#6009). Cache hits unaffected. `0` disables; clamped `0..5000`.        |
+| `OMNIROUTE_QUOTA_FETCH_MIN_INTERVAL_MS`         | `250`                                               | `open-sse/services/quotaFetchThrottle.ts`                   | Min interval (ms) between consecutive upstream quota fetches on the per-request preflight/monitor path; spaces concurrent network calls so many accounts on one IP don't burst the upstream. Wired into the Codex (`/wham/usage`), DeepSeek, Bailian (both fetch sites), OpenCode, and Crof quota fetchers (#6009, #6911). The generic `usage.ts::getUsageForProvider` dispatch path (github/glm/minimax/nanogpt/xai/etc.) is not yet covered — tracked separately. Cache hits unaffected. `0` disables; clamped `0..5000`.        |
 | `PROVIDER_LIMITS_POST_USAGE_REFRESH_DELAY_MS`   | `5000`                                              | `src/lib/usage/providerLimits.ts`                           | Delay (ms) before refreshing provider limits after a real usage event, giving the upstream quota API time to register consumption.                                      |
 | `OMNIROUTE_DISABLE_BACKGROUND_SERVICES`         | `false`                                             | `src/instrumentation-node.ts`                               | Disable all background services (sync, pricing, model refresh). Useful for CI/test.                                                                                     |
 | `OMNIROUTE_ENABLE_RUNTIME_BACKGROUND_TASKS`     | _(unset)_                                           | `src/lib/config/runtimeSettings.ts`                         | Force background tasks on under automated test detection. Set `1` to override the test heuristic.                                                                       |
@@ -512,7 +513,7 @@ process.env[`${PROVIDER_ID}_USER_AGENT`]
 
 | Variable                         | Default Value                                 | When to Update                                                                                   |
 | -------------------------------- | --------------------------------------------- | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `CLAUDE_USER_AGENT`              | `claude-cli/2.1.195 (external, cli)`          | When Anthropic releases a new CLI version                                                        |
+| `CLAUDE_USER_AGENT`              | `claude-cli/2.1.207 (external, cli)`          | When Anthropic releases a new CLI version                                                        |
 | `CLAUDE_DISABLE_TOOL_NAME_CLOAK` | `false`                                       | `executors/base.ts` + `executors/cliproxyapi.ts`                                                 | Set to `1`/`true` to forward third-party harness tool names verbatim to Anthropic on both Anthropic-bound paths (native OAuth and CLIProxyAPI). By default the executor deterministically aliases non-Claude-Code tool names (Claude Code canonical mapping where one exists, otherwise PascalCase) and reverses them on the response via `_toolNameMap`, so harnesses with snake_case tools are not refused as fingerprinted third-party clients. Debugging only. |
 | `CODEX_USER_AGENT`               | `codex-cli/0.142.0 (Windows 10.0.26200; x64)` | When OpenAI updates the Codex CLI                                                                |
 | `CODEX_CLIENT_VERSION`           | `0.131.0`                                     | Override Codex client version independently of full UA string                                    |
@@ -835,6 +836,7 @@ Anthropic-compatible provider instead.
 | Variable                                        | Default                 | Source File                                                                             | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | ----------------------------------------------- | ----------------------- | --------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `PROXY_FAST_FAIL_TIMEOUT_MS`                    | `2000`                  | `src/lib/proxyHealth.ts`                                                                | Fast-fail health check timeout.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| `PROXY_LATENCY_WINDOW_HOURS`                    | `3`                     | `src/lib/db/proxies.ts`                                                                 | Time window (hours) for calculating the average latency of candidate proxies in the latency-optimized pool strategy.                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | `PROXY_HEALTH_CACHE_TTL_MS`                     | `30000`                 | `src/lib/proxyHealth.ts`                                                                | Health check result cache TTL.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | `PROXY_HEALTH_UNHEALTHY_CACHE_TTL_MS`           | `2000`                  | `src/lib/proxyHealth.ts`                                                                | Cache TTL for failed proxy health probes. Keep this shorter than `PROXY_HEALTH_CACHE_TTL_MS` so transient proxy timeouts under high concurrency retry quickly without disabling fast-fail for truly dead proxies.                                                                                                                                                                                                                                                                                                                                                          |
 | `PROXY_HEALTH_ENABLED`                          | `true`                  | `src/lib/proxyHealth/scheduler.ts`                                                      | Set `false` to disable the background proxy health scheduler that periodically probes registered proxies.                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
@@ -893,7 +895,9 @@ changing them requires a code edit, not an env var:
 | `CURSOR_STREAM_TIMEOUT_MS`       | `300000`            | `open-sse/executors/cursor.ts`             | Stream idle timeout (ms) for the Cursor executor.                                            |
 | `CURSOR_TOOL_DIRECTIVE`          | enabled (`!== "0"`) | `open-sse/executors/cursor.ts`             | Tool-commit directive that makes composer-2.5 reliably issue tool calls. Set `0` to disable. |
 | `CURSOR_IMAGE_FETCH_TIMEOUT_MS`  | `15000`             | `open-sse/utils/cursorImages.ts`           | Per-image fetch timeout (ms) for remote `image_url` vision input.                            |
-| `CURSOR_STATE_DB_PATH`           | _(probed)_          | `open-sse/utils/cursorVersionDetector.ts`  | Override the Cursor state DB lookup used for version detection.                              |
+| `CURSOR_STATE_DB_PATH`           | _(probed)_          | `open-sse/utils/cursorVersionDetector.ts`  | Override the Cursor IDE state DB lookup used for IDE version detection.                      |
+| `CURSOR_AGENT_CLI_VERSION`       | _(detect / pin)_    | `open-sse/utils/cursorAgentCliVersion.ts`  | Agent CLI build id (`YYYY.MM.DD-<hash>`) for `x-cursor-client-version: cli-…` on Agent Run.   |
+| `CURSOR_DATA_DIR`                | _(probed)_          | `open-sse/utils/cursorAgentCliVersion.ts`  | Override Cursor Agent CLI data dir (`…/versions/<id>`); same var the official agent uses.    |
 | `CURSOR_TOKEN`                   | _(unset)_           | `scripts/ad-hoc/cursor-tap.cjs`            | Direct Cursor bearer token used by developer tooling.                                        |
 | `OMNIROUTE_LOG_REQUEST_SHAPE`    | enabled (`!== "0"`) | `src/app/api/v1/chat/completions/route.ts` | Log content-type/length markers for large chat payloads. Set `"0"` to silence.               |
 | `DEBUG_RESPONSES_SSE_TO_JSON`    | _(unset)_           | `open-sse/handlers/responseTranslator.ts`  | Set `true` to log Responses API SSE→JSON translation details.                                |
@@ -989,6 +993,7 @@ Limits and safety knobs applied when the Skills framework (`src/lib/skills/`) ex
 | `SKILLS_SANDBOX_NETWORK_ENABLED`  | `false`                                       | `src/lib/skills/builtins.ts` | Set `1`/`true` to allow outbound network from inside the sandbox. Defaults to **isolated** for safety.             |
 | `SKILLS_ALLOWED_SANDBOX_IMAGES`   | _(empty)_                                     | `src/lib/skills/builtins.ts` | Comma-separated allowlist of container images permitted for sandbox execution. Empty means built-in default only.  |
 | `SKILLS_SANDBOX_DOCKER_IMAGE`     | _(built-in default)_                          | `src/lib/skills/`            | Container image used when spawning a Docker-backed sandbox. Override to pin a custom hardened base image.          |
+| `SKILLS_SANDBOX_RUNTIME`          | `auto`                                        | `src/lib/skills/sandbox.ts`, `src/lib/skills/containerProvider.ts` | Container runtime for skill sandboxing: `auto` \| `docker` \| `apple` \| `wsl` \| `orbstack` \| `podman`. `auto` picks the best installed runtime per host OS (Apple Container/OrbStack on macOS, WSL Container on Windows, Podman on Linux), falling back to Docker. |
 
 > [!CAUTION]
 > Enabling `SKILLS_SANDBOX_NETWORK_ENABLED=true` opens an egress path from arbitrary skill code. Pair with `OUTBOUND_SSRF_GUARD_ENABLED=true` and a strict `CORS_ORIGIN`/proxy policy in shared deployments.
@@ -1090,6 +1095,21 @@ Provider quota endpoints, network tunnels (Tailscale, Ngrok, MITM debug proxy),
 | `QDRANT_EMBEDDING_MODEL`                    | `text-embedding-3-small`                                                    | _(opt-in cluster profile)_                                                | Default embedding model name recorded in the Qdrant collection metadata. Actual embeddings are generated by whatever provider the `embeddingModel` field in OmniRoute's settings points to.                                                                                                                                                                           |
 | `QDRANT_VECTOR_SIZE`                        | `1536`                                                                      | _(opt-in cluster profile)_                                                | Embedding vector dimension. Must match the model you embed with (text-embedding-3-small → 1536; ada-002 → 1536; nomic-embed-text → 768).                                                                                                                                                                                                                              |
 | `QDRANT_HNSW_EF_CONSTRUCT`                  | `128`                                                                       | _(opt-in cluster profile)_                                                | HNSW index construction-time accuracy. Higher = slower build, faster search.                                                                                                                                                                                                                                                                                          |
+| `OMNIROUTE_ROTATION_ENABLED`                | `true`                                                                      | `open-sse/services/rotationConfig.ts`                                     | Master switch for operator-configurable account rotation. When `false`, none of the `OMNIROUTE_ROTATE_*` classes below trigger account fallback (the master-off state also blocks the default-enabled 429/500/502 classes). Lets a supervising front-end (e.g. the VibeProxy desktop app) mirror its own rotation rules onto the backend's account-fallback engine. |
+| `OMNIROUTE_ROTATION_RATE_LIMIT_RESET_SECONDS` | `0`                                                                       | `open-sse/services/rotationConfig.ts`                                     | Cooldown (seconds) applied to a rate-limited account when the upstream gives no explicit reset hint. `0` = use the engine default cooldown instead of a fixed override.                                                                                                                                                                                             |
+| `OMNIROUTE_ROTATION_DISABLE_TAG_WITHOUT_RESET` | `true`                                                                   | `open-sse/services/rotationConfig.ts`                                     | Mirror of the front-end "don't tag as rate-limited without a reset time" preference.                                                                                                                                                                                                                                                                                  |
+| `OMNIROUTE_ROTATE_ON_429`                   | `true`                                                                      | `open-sse/services/rotationConfig.ts`                                     | Per-status fallback enable for `429` errors. When `false` (and `OMNIROUTE_ROTATION_ENABLED=true`), a `429` no longer triggers account rotation and is returned to the client instead.                                                                                                                                                                               |
+| `OMNIROUTE_ROTATE_429_THRESHOLD`            | `1`                                                                         | `open-sse/services/rotationConfig.ts`                                     | Number of `429` errors within `OMNIROUTE_ROTATE_429_WINDOW_SECONDS` required before the account is rotated. `1` (default) rotates immediately, preserving historical behavior.                                                                                                                                                                                       |
+| `OMNIROUTE_ROTATE_429_WINDOW_SECONDS`       | `120`                                                                       | `open-sse/services/rotationConfig.ts`                                     | Sliding window (seconds) over which `429` errors are counted toward `OMNIROUTE_ROTATE_429_THRESHOLD`.                                                                                                                                                                                                                                                                 |
+| `OMNIROUTE_ROTATE_ON_500`                   | `true`                                                                      | `open-sse/services/rotationConfig.ts`                                     | Per-status fallback enable for `5xx` server errors (excluding `502`, which has its own class). When `false`, these errors no longer trigger account rotation.                                                                                                                                                                                                        |
+| `OMNIROUTE_ROTATE_500_THRESHOLD`            | `1`                                                                         | `open-sse/services/rotationConfig.ts`                                     | Number of `5xx` errors within `OMNIROUTE_ROTATE_500_WINDOW_SECONDS` required before the account is rotated. `1` (default) rotates immediately.                                                                                                                                                                                                                        |
+| `OMNIROUTE_ROTATE_500_WINDOW_SECONDS`       | `120`                                                                       | `open-sse/services/rotationConfig.ts`                                     | Sliding window (seconds) over which `5xx` errors are counted toward `OMNIROUTE_ROTATE_500_THRESHOLD`.                                                                                                                                                                                                                                                                 |
+| `OMNIROUTE_ROTATE_ON_502`                   | `true`                                                                      | `open-sse/services/rotationConfig.ts`                                     | Per-status fallback enable for `502` (bad gateway) errors. When `false`, `502`s no longer trigger account rotation.                                                                                                                                                                                                                                                   |
+| `OMNIROUTE_ROTATE_502_THRESHOLD`            | `1`                                                                         | `open-sse/services/rotationConfig.ts`                                     | Number of `502` errors within `OMNIROUTE_ROTATE_502_WINDOW_SECONDS` required before the account is rotated. `1` (default) rotates immediately.                                                                                                                                                                                                                        |
+| `OMNIROUTE_ROTATE_502_WINDOW_SECONDS`       | `120`                                                                       | `open-sse/services/rotationConfig.ts`                                     | Sliding window (seconds) over which `502` errors are counted toward `OMNIROUTE_ROTATE_502_THRESHOLD`.                                                                                                                                                                                                                                                                 |
+| `OMNIROUTE_ROTATE_ON_400`                   | `false`                                                                     | `open-sse/services/rotationConfig.ts`                                     | Opt-in (default OFF): when `true`, a plain `400` (bad request) also triggers account rotation. This is additive only — it never blocks the engine's existing behavior where a `400` carrying rate-limit/quota text still falls over regardless of this flag.                                                                                                        |
+| `OMNIROUTE_ROTATE_400_THRESHOLD`            | `1`                                                                         | `open-sse/services/rotationConfig.ts`                                     | Number of `400` errors within `OMNIROUTE_ROTATE_400_WINDOW_SECONDS` required before the account is rotated (only consulted when `OMNIROUTE_ROTATE_ON_400=true`).                                                                                                                                                                                                     |
+| `OMNIROUTE_ROTATE_400_WINDOW_SECONDS`       | `120`                                                                       | `open-sse/services/rotationConfig.ts`                                     | Sliding window (seconds) over which `400` errors are counted toward `OMNIROUTE_ROTATE_400_THRESHOLD`.                                                                                                                                                                                                                                                                 |
 
 ---
 
diff --git a/docs/reference/FREE_PROXIES_API.md b/docs/reference/FREE_PROXIES_API.md
new file mode 100644
index 0000000000..0932297c6d
--- /dev/null
+++ b/docs/reference/FREE_PROXIES_API.md
@@ -0,0 +1,77 @@
+---
+title: "Free Proxies API"
+version: 3.8.43
+lastUpdated: 2026-07-11
+---
+
+# Free Proxies API
+
+OmniRoute ships a curated pool of free proxies in the `free_proxies` table,
+synced from external providers (1proxy, proxifly, iplocate, webshare). The
+dashboard surfaces these under **Settings → Free Proxies**. This document
+covers the server-side filtering, sorting, counting, and sync-error reporting
+that the list route exposes.
+
+## List route — `GET /api/settings/free-proxies`
+
+Returns a filtered, sorted, paginated slice plus a total count. Filtering and
+counting happen in SQL, so the UI can show the real total (e.g. `Total: 0`)
+without loading every row into memory.
+
+### Query parameters
+
+| Param             | Type                               | Default   | Meaning                                                                                        |
+| ----------------- | ---------------------------------- | --------- | ---------------------------------------------------------------------------------------------- |
+| `search`          | string                             | `""`      | Case-sensitive `LIKE` on the host (and source) column.                                         |
+| `protocol`        | string                             | `""`      | `type` filter: `http` / `https` / `socks4` / `socks5`. Empty = all.                            |
+| `country`         | string                             | `""`      | `countryCode` filter (ISO-2). Empty = all.                                                     |
+| `minQuality`      | number                             | `0`       | Only rows with `qualityScore >= minQuality`. `0` = no floor.                                   |
+| `disabledSources` | string                             | `""`      | Comma-separated source ids to exclude (e.g. `proxifly,webshare`).                              |
+| `sortBy`          | `quality` \| `latency` \| `recent` | `quality` | `quality` = score desc; `latency` = latency asc (nulls last); `recent` = `lastValidated` desc. |
+| `offset`          | number                             | `0`       | Pagination start.                                                                              |
+| `limit`           | number                             | `50`      | Page size (capped server-side).                                                                |
+
+### Response
+
+```json
+{
+  "success": true,
+  "data": {
+    "proxies": [/* FreeProxyRecord[] */],
+    "total": 137,
+    "hasMore": true
+  },
+  "stats": {
+    "total": 137,
+    "inPool": 12,
+    "avgQuality": 64.2,
+    "bySource": [{ "source": "1proxy", "count": 90 }],
+    "lastSyncAt": "2026-07-11T09:30:00.000Z"
+  },
+  "syncErrors": {
+    "proxifly": ["HTTP 429 from upstream"],
+    "webshare": ["network timeout"]
+  }
+}
+```
+
+`total` reflects the filtered total **before** pagination, so the UI can render
+`Total: N` and `hasMore` independently. `syncErrors` is keyed by source id and
+populated only for sources that failed their last sync — a `Total: 0` result is
+never silent.
+
+## Add-to-pool — `POST /api/settings/free-proxies/[id]/add-to-pool`
+
+Promotes a free proxy into the managed `proxy_registry` pool. Validates the
+upstream first; on success returns the new pool proxy id and measured latency.
+
+## Sync — `POST /api/settings/free-proxies/sync`
+
+Re-pulls all enabled sources (or the subset in `{ "sources": [...] }`). Each
+source syncs independently; a failing source is recorded in `syncErrors` and the
+others still complete, so partial syncs never wipe prior good data.
+
+## Stats — `GET /api/settings/free-proxies/stats`
+
+Returns the `total / inPool / avgQuality / bySource / lastSyncAt` aggregate
+without the row payload — used by the dashboard header widgets.
diff --git a/docs/reference/FREE_TIERS.md b/docs/reference/FREE_TIERS.md
index 5651dd658f..775586ab0a 100644
--- a/docs/reference/FREE_TIERS.md
+++ b/docs/reference/FREE_TIERS.md
@@ -23,7 +23,7 @@ lastUpdated: 2026-06-28
 
 **Honest headline:** _OmniRoute aggregates **~1.6B documented free tokens per month** (up to ~2.1B in your first month with signup credits) across 40+ free-tier pools — plus a long tail of permanently-free, no-cap providers — and RTK + Caveman compression (15–95% token savings) stretches that further._
 
-> **Why this dropped from the previous ~1.94B.** The 2026-06-17 refresh is an honesty correction, not a loss: `gemini` is now pool-deduped (was inflated by counting each Flash variant separately, 462M → 60M), `cloudflare-ai` corrected to its real 10k-Neurons/day (122M → 30M), `doubao` reclassified as a one-time signup credit (not recurring), and shut-down tiers removed (`github-models` closed to new signups, `chutes`/`phind`/`kluster`/`glhf` discontinued). Partly offset by `llm7` (correct 5M/day → 150M) and new free providers (Kilo, OpenCode Zen, Z.AI GLM-Flash).
+> **Why this dropped from the previous ~1.94B.** The 2026-06-17 refresh is an honesty correction, not a loss: `gemini` is now pool-deduped (was inflated by counting each Flash variant separately, 462M → 60M), `cloudflare-ai` corrected to its real 10k-Neurons/day (122M → 30M), `doubao` reclassified as a one-time signup credit (not recurring), and shut-down tiers removed (`github-models` closed to new signups, `chutes`/`phind`/`kluster` discontinued). Partly offset by `llm7` (correct 5M/day → 150M) and new free providers (Kilo, OpenCode Zen, Z.AI GLM-Flash).
 
 Biggest **documented** contributors: `mistral` 1.00B, `llm7` 150M, `groq` 117M, `gemini` 60M, `cerebras` 30M, `cloudflare-ai` 30M, `sambanova` 30M. (`longcat` is excluded — its 10M LongCat-2.0 grant is a one-time, KYC-gated signup credit, not a recurring monthly budget.)
 
@@ -35,7 +35,7 @@ Biggest **documented** contributors: `mistral` 1.00B, `llm7` 150M, `groq` 117M,
 
 A 50-agent web-research pass (official docs + last-7-days news, adversarially verified) refreshed the whole catalog. Highlights:
 
-- **Removed / no free tier (2026):** `chutes` (free tier ended 2026-03), `phind` (company shut down 2026-01), `kluster` (sunset 2026-06-09 → MITO), `glhf` (beta ended), `gitlawb` + `gitlawb-gmi` (MiMo free revoked 2026-05-24, Nemotron promo ended 2026-06 — re-verified 2026-06-18), `aimlapi` (free tier paused — re-verified 2026-06-18), `yi` (Yi-Light retired, pay-as-you-go — re-verified 2026-06-18), `theoldllm` / `featherless-ai` (no current free tier). `iflytek` / `sparkdesk` stay listed but carry a ToS-caution note (Spark Lite is free; the ToS restricts proxy/relay use).
+- **Removed / no free tier (2026):** `chutes` (free tier ended 2026-03), `phind` (company shut down 2026-01), `kluster` (sunset 2026-06-09 → MITO), `gitlawb` + `gitlawb-gmi` (MiMo free revoked 2026-05-24, Nemotron promo ended 2026-06 — re-verified 2026-06-18), `aimlapi` (free tier paused — re-verified 2026-06-18), `yi` (Yi-Light retired, pay-as-you-go — re-verified 2026-06-18), `theoldllm` / `featherless-ai` (no current free tier). `iflytek` / `sparkdesk` stay listed but carry a ToS-caution note (Spark Lite is free; the ToS restricts proxy/relay use).
 - **GitHub Models** — closed to **new** customers on 2026-06-16; existing accounts keep API/playground access, so it stays in the catalog with a note (not removed).
 - **Gemini** — `2.0 Flash` / `2.0 Flash-Lite` shut down 2026-06-01 and `2.5 Pro` left the free tier (2026-04); free tier is now **Flash-family only** (2.5/3/3.1/3.5 Flash + Gemma). The catalog now **pools** the Flash family (was inflated by counting each variant separately: 462M → 60M).
 - **Corrected numbers:** `cloudflare-ai` 122M → **30M** (real 10k-Neurons/day), `doubao` reclassified as a one-time signup credit (not recurring), `llm7` 4M → **150M** (documented 5M tokens/day), `together` "-Free" endpoints discontinued → only the **$25** signup credit remains, `longcat` Preview ended + Flash models retired → **LongCat-2.0** only, reclassified as a one-time **10M**-token signup credit (KYC-gated, not recurring).
@@ -73,11 +73,11 @@ A 50-agent web-research pass (official docs + last-7-days news, adversarially ve
 | `coze`           | Coze ToS explicitly restricts use to "personal and non-commercial use" and prohibits renting, distributing, sublicensing, or reselling the service; a… |
 | `duckduckgo-web` | Duck.ai ToS (duckduckgo.com/duckai/privacy-terms) explicitly prohibits "automated querying and developing or offering AI services" and circumventing … |
 | `featherless-ai` | Individual plans explicitly restricted to "interactive use or proto-typing and experimentation by the purchaser" — inference resale and proxy use req… |
-| `fireworks` | ToS explicitly prohibits proxy/intermediary use, API key transfers, and sublicensing (Sections 2.1 and 2.2(i)(j)); self-hosted personal proxies are n… |
-| `friendliai` | ToS Section 8(e) and 8(f) explicitly prohibit using FriendliAI as a proxy or allowing third-party access on a standalone basis, and forbid reselling/… |
-| `iflytek` | Section 2.4(3) of the iFlytek Spark LLM Service Agreement explicitly prohibits "using any automated or programmatic methods to extract data or output… |
-| `kiro` | Kiro FAQ explicitly prohibits use with "OpenClaw and similar tools that leverage third-party harnesses" — a self-hosted AI proxy (like OmniRoute) rou… |
-| `modal` | ToS Section 1.3 explicitly prohibits "rent, resell or otherwise allow any third party direct access to or use of the Service" — building a self-hoste… |
+| `fireworks`      | ToS explicitly prohibits proxy/intermediary use, API key transfers, and sublicensing (Sections 2.1 and 2.2(i)(j)); self-hosted personal proxies are n… |
+| `friendliai`     | ToS Section 8(e) and 8(f) explicitly prohibit using FriendliAI as a proxy or allowing third-party access on a standalone basis, and forbid reselling/… |
+| `iflytek`        | Section 2.4(3) of the iFlytek Spark LLM Service Agreement explicitly prohibits "using any automated or programmatic methods to extract data or output… |
+| `kiro`           | Kiro FAQ explicitly prohibits use with "OpenClaw and similar tools that leverage third-party harnesses" — a self-hosted AI proxy (like OmniRoute) rou… |
+| `modal`          | ToS Section 1.3 explicitly prohibits "rent, resell or otherwise allow any third party direct access to or use of the Service" — building a self-hoste… |
 | `muse-spark-web` | Meta ToS explicitly prohibits automated access without prior permission, reverse engineering without written permission, and circumventing technologi… |
 | `nlpcloud`       | ToS explicitly prohibits "setting up a proxy or other device that allows others to access the Service through it" and grants only a non-transferable,… |
 | `opencode`       | ToS (Anomaly Innovations, Inc.) explicitly restricts use to "your own internal use, and not on behalf of or for the benefit of any third party" — ope… |
@@ -86,85 +86,82 @@ A 50-agent web-research pass (official docs + last-7-days news, adversarially ve
 
 ### ✅ Generally permissive — caution / ambiguous / ok (the rest)
 
-| Provider | ToS | Note |
-|---|---|---|
-| `aimlapi` | ambiguous | ToS grants a non-exclusive use license but does not explicitly permit or prohibit self-hosted proxy or resale; no "pers… |
-| `baichuan` | ambiguous | No explicit prohibition on self-hosted personal proxies found in publicly accessible docs; however, the M3 Plus free pl… |
-| `bluesminds` | ambiguous | No explicit ToS clauses found regarding self-hosted proxying or resale; the pricing page focuses on feature/rate limits… |
-| `bytez` | ambiguous | No explicit ToS page was accessible (404); no public evaluation-only or no-proxy clauses found in docs, but the platfor… |
-| `doubao` | ambiguous | No explicit proxy/resale prohibition found in publicly indexed documentation; Volcengine is a developer-oriented cloud … |
-| `gitlawb-gmi` | ambiguous | No explicit ToS clause found prohibiting self-hosted personal proxy use; the free Nemotron model carries an NVIDIA disc… |
-| `inclusionai` | ambiguous | No explicit ToS found prohibiting proxy/self-hosted use, but the platform is operated by Ant Group (Chinese company) an… |
-| `kluster` | ambiguous | ToS primarily covers website content rights and does not specifically address API proxy use, resale, or self-hosted pro… |
-| `monsterapi` | ambiguous | MonsterAPI's ToS page (monsterapi.ai/terms-of-service) was unreachable during research; no specific proxy/resale/person… |
-| `nous-research` | ambiguous | Nous Portal itself is an aggregator/proxy service; using it as a backend for another self-hosted proxy creates a proxy-… |
-| `ollama-cloud` | ambiguous | ToS prohibits using the service "to develop competing products" but has no explicit ban on self-hosted personal proxies… |
-| `stepfun` | ambiguous | No explicit prohibition on self-hosted personal proxy found, but the Step Plan ToS targets developers using specific co… |
-| `api-airforce` | caution | ToS explicitly prohibits "building competing services without permission" and "credential sharing" — a self-hosted pers… |
-| `arcee-ai` | caution | Free access is via OpenRouter's :free routing layer (not Arcee's direct API terms); OpenRouter ToS permits personal dev… |
-| `baidu` | caution | ToS not explicitly reviewed for proxy/resale clauses, but platform requires real-name authentication (Chinese ID typica… |
-| `baseten` | caution | ToS restricts use to "Customer's internal business purposes" and explicitly prohibits sublicensing, reselling, or allow… |
-| `bazaarlink` | caution | ToS explicitly prohibits reselling or sublicensing API keys to third parties; a self-hosted personal proxy for personal… |
-| `brave-search` | caution | ToS prohibits redistribution, resale, and sublicensing of search results; using the API to "replicate or attempt to rep… |
-| `byteplus` | caution | Tokens are non-transferable and single-account only; no explicit proxy prohibition, but BytePlus reserves the right to … |
-| `cerebras` | caution | ToS grants a non-exclusive, non-transferable, non-sublicensable right for personal or business use; prohibits resale, s… |
-| `cloudflare-ai` | caution | Cloudflare Self-Serve ToS §2.2.1(j) prohibits using Services to "provide a virtual private network or other similar pro… |
-| `cohere` | caution | Cohere explicitly prohibits trial keys for "production or commercial purposes"; a self-hosted personal proxy routing re… |
-| `deepinfra` | caution | ToS allows legal commercial use broadly, but prohibits use "directly or indirectly competitive with any business of the… |
-| `deepseek` | caution | Open Platform ToS (effective 2026-04-29) permits broad use including "derivative product development" and personal/comm… |
-| `dify` | caution | Self-hosted single-user personal proxy is permitted under the modified Apache 2.0 license; however, multi-tenant deploy… |
-| `exa-search` | caution | No explicit "no proxy" or "evaluation only" clauses found; Exa actively offers a reseller partner program allowing API … |
-| `firecrawl` | caution | Cloud API ToS has no explicit personal-proxy prohibition found, but the open-source self-hosted version is AGPL-3.0 (re… |
-| `gemini` | caution | ToS explicitly states the free tier is for "developers building with Google AI models for professional or business purp… |
-| `github-models` | caution | GitHub's Acceptable Use Policy prohibits reselling/proxying the service; GitHub Models ToS delegates to each model's ho… |
-| `glhf` | caution | ToS explicitly prohibits sharing account credentials or making the account available to any third party, which makes a … |
-| `groq` | caution | Services Agreement §6.3 prohibits reselling, sublicensing, or distributing API access; §3.2 bars reselling/leasing acco… |
-| `hackclub` | caution | Service is explicitly scoped to Hack Club teen members building projects/learning; no public ToS found explicitly permi… |
-| `huggingchat` | caution | Hugging Face ToS does not explicitly ban personal self-hosted proxies, but supplemental terms (referenced but not fully… |
-| `huggingface` | caution | ToS grants a limited license to access/use the service; the document does not explicitly permit or forbid a single-user… |
-| `hyperbolic` | caution | ToS grants API access "solely for your own personal or internal business purposes" and explicitly prohibits licensing, … |
-| `inference-net` | caution | ToS explicitly prohibits "sublicense, resell, distribute" and transferring API keys without written consent; a single-u… |
-| `jina-ai` | caution | Free 10M tokens are explicitly non-commercial (CC-BY-NC 4.0 model license); a single-user personal proxy for personal L… |
-| `jina-reader` | caution | ToS prohibits using outputs to build competing services and bans "automated methods to extract information via scraping… |
-| `llm7` | caution | ToS positions the service as for "experimentation, development, and research"; no explicit ban on self-hosted personal … |
-| `longcat` | caution | The API Platform Service Agreement (longcat.chat/platform/private/) permits commercial integration and self-hosted apps… |
-| `mistral` | caution | Consumer ToS explicitly states APIs may only be used for "personal needs" and prohibits making API keys available to th… |
-| `morph` | caution | ToS allows commercial use generally; self-hosted proxy deployments require explicit arrangement with sales. Section 18.… |
-| `nebius` | caution | ToS (Section 5f) explicitly prohibits resale, redistribution, or offering the service "on a standalone basis" — a self-… |
-| `nomic` | caution | ToS grants a non-exclusive, non-transferable API license; Section 6.b prohibits building a competitive service. Using t… |
-| `novita` | caution | ToS prohibits resale and competing services but does not explicitly address personal self-hosted proxies; personal use … |
-| `nscale` | caution | AUP prohibits "copy, modify, duplicate... frame, mirror, republish... distribute all or any part of the Nscale Platform… |
-| `nvidia` | caution | Free tier is explicitly for prototyping/dev/research/evaluation only — production use (serving real end-users) requires… |
-| `openrouter` | caution | ToS explicitly prohibits reselling API access or developing a competing service; single-user self-hosted personal proxy… |
-| `pollinations` | caution | MIT License cited in API docs suggests liberal reuse; no explicit prohibition on self-hosted proxying found. However, u… |
-| `predibase` | caution | Predibase is positioned as an enterprise fine-tuning/serving platform; the free trial is explicitly for exploration and… |
-| `publicai` | caution | ToS (publicai.co/tc) designates services as "primarily for research and educational use"; no explicit proxy or resale p… |
-| `puter` | caution | Puter ToS forbids using services for "commercial purpose" without written consent; a self-hosted personal proxy consumi… |
-| `qoder` | caution | ToS page returned no readable content; Qoder is a coding IDE client (not a public API), and third-party proxy wrappers … |
-| `reka` | caution | Business Terms prohibit sublicensing or distributing access to third parties; a personal single-user proxy is likely fi… |
-| `sambanova` | caution | ToS Section 1.5(c) explicitly prohibits reselling, sublicensing, or making the service available to third parties; a se… |
-| `sensenova` | caution | No explicit proxy or resale prohibition found in reviewed ToS, but the free tier is a promotional beta with no SLA, Sen… |
-| `serper-search` | caution | ToS explicitly prohibits "mirroring materials on any other server as-is with no-value-added" — a simple pass-through pr… |
-| `siliconflow` | caution | ToS (Clause 3.4(e)(f)(p)) explicitly prohibits making the service available to any third party, reselling/sublicensing,… |
-| `sparkdesk` | caution | SparkDesk User Agreement grants only personal, non-commercial use rights; API Interface Policy prohibits automated data… |
-| `tavily-search` | caution | ToS explicitly states the API "may not be transferred, assigned, shared, or otherwise made available to any third party… |
-| `tencent` | caution | Tencent Cloud ToS explicitly prohibits sublicensing or reselling API access; a self-hosted personal proxy for personal … |
-| `together` | caution | ToS Section 4.3(d) explicitly prohibits transferring, distributing, reselling, leasing, or offering the Services on a s… |
-| `uncloseai` | caution | Personal proxy use is plausible but not explicitly permitted; ToS bans building "competing machine learning services wi… |
-| `veoaifree-web` | caution | ToS explicitly bans automated bots or scripts running at "inhuman speeds" and prohibits copying the platform to create … |
-| `vertex` | caution | Google Cloud Service Terms restrict resale to authorized resellers only (Section 14 requires a Reseller Agreement); a s… |
-| `voyage-ai` | caution | ToS grants "personal, non-commercial use" for site content and prohibits credential/account sharing with third parties;… |
-| `360ai` | unknown | ToS for developer API not publicly accessible without registration; access requires application approval which implies … |
-| `chutes` | unknown | ToS page exists at chutes.ai/terms but content was not accessible via fetch; no explicit proxy/resale clauses found in … |
-| `freemodel-dev` | unknown | The Terms of Service page (freemodel.dev/terms) returned only a header with no readable content via WebFetch; no clause… |
-| `gitlawb` | unknown | No ToS or acceptable-use policy found; proxy/resale restrictions unknown — assume caution for self-hosted proxy use. |
-| `liquid` | unknown | No hosted API exists to proxy; open-source model commercial use is free for orgs under $10M annual revenue. No self-hos… |
-| `theoldllm` | unknown | No terms of service document was found on the site; proxying, resale, or self-hosted use policy is entirely undocumente… |
-| `yi` | unknown | ToS not publicly accessible without login; no proxy/resale clauses could be reviewed. Self-hosted personal proxy use st… |
-| `comfyui` | ok | GPL-3.0 open-source license explicitly permits self-hosted personal proxy use; Comfy Org ToS confirms commercial use of… |
-| `scaleway` | ok | Scaleway's General Terms of Services are a standard commercial cloud agreement with no explicit prohibition on self-hos… |
-| `sdwebui` | ok | AGPL-3.0 license: free to self-host for personal use with no restrictions on usage volume; a personal proxy using this … |
-| `searxng-search` | ok | AGPL-3.0 open-source license explicitly permits self-hosted personal proxy use with no restriction on usage type, resal… |
+| Provider         | ToS       | Note                                                                                                                     |
+| ---------------- | --------- | ------------------------------------------------------------------------------------------------------------------------ |
+| `aimlapi`        | ambiguous | ToS grants a non-exclusive use license but does not explicitly permit or prohibit self-hosted proxy or resale; no "pers… |
+| `baichuan`       | ambiguous | No explicit prohibition on self-hosted personal proxies found in publicly accessible docs; however, the M3 Plus free pl… |
+| `bluesminds`     | ambiguous | No explicit ToS clauses found regarding self-hosted proxying or resale; the pricing page focuses on feature/rate limits… |
+| `bytez`          | ambiguous | No explicit ToS page was accessible (404); no public evaluation-only or no-proxy clauses found in docs, but the platfor… |
+| `doubao`         | ambiguous | No explicit proxy/resale prohibition found in publicly indexed documentation; Volcengine is a developer-oriented cloud … |
+| `gitlawb-gmi`    | ambiguous | No explicit ToS clause found prohibiting self-hosted personal proxy use; the free Nemotron model carries an NVIDIA disc… |
+| `monsterapi`     | ambiguous | MonsterAPI's ToS page (monsterapi.ai/terms-of-service) was unreachable during research; no specific proxy/resale/person… |
+| `nous-research`  | ambiguous | Nous Portal itself is an aggregator/proxy service; using it as a backend for another self-hosted proxy creates a proxy-… |
+| `ollama-cloud`   | ambiguous | ToS prohibits using the service "to develop competing products" but has no explicit ban on self-hosted personal proxies… |
+| `stepfun`        | ambiguous | No explicit prohibition on self-hosted personal proxy found, but the Step Plan ToS targets developers using specific co… |
+| `api-airforce`   | caution   | ToS explicitly prohibits "building competing services without permission" and "credential sharing" — a self-hosted pers… |
+| `arcee-ai`       | caution   | Free access is via OpenRouter's :free routing layer (not Arcee's direct API terms); OpenRouter ToS permits personal dev… |
+| `baidu`          | caution   | ToS not explicitly reviewed for proxy/resale clauses, but platform requires real-name authentication (Chinese ID typica… |
+| `baseten`        | caution   | ToS restricts use to "Customer's internal business purposes" and explicitly prohibits sublicensing, reselling, or allow… |
+| `bazaarlink`     | caution   | ToS explicitly prohibits reselling or sublicensing API keys to third parties; a self-hosted personal proxy for personal… |
+| `brave-search`   | caution   | ToS prohibits redistribution, resale, and sublicensing of search results; using the API to "replicate or attempt to rep… |
+| `byteplus`       | caution   | Tokens are non-transferable and single-account only; no explicit proxy prohibition, but BytePlus reserves the right to … |
+| `cerebras`       | caution   | ToS grants a non-exclusive, non-transferable, non-sublicensable right for personal or business use; prohibits resale, s… |
+| `cloudflare-ai`  | caution   | Cloudflare Self-Serve ToS §2.2.1(j) prohibits using Services to "provide a virtual private network or other similar pro… |
+| `cohere`         | caution   | Cohere explicitly prohibits trial keys for "production or commercial purposes"; a self-hosted personal proxy routing re… |
+| `deepinfra`      | caution   | ToS allows legal commercial use broadly, but prohibits use "directly or indirectly competitive with any business of the… |
+| `deepseek`       | caution   | Open Platform ToS (effective 2026-04-29) permits broad use including "derivative product development" and personal/comm… |
+| `dify`           | caution   | Self-hosted single-user personal proxy is permitted under the modified Apache 2.0 license; however, multi-tenant deploy… |
+| `exa-search`     | caution   | No explicit "no proxy" or "evaluation only" clauses found; Exa actively offers a reseller partner program allowing API … |
+| `firecrawl`      | caution   | Cloud API ToS has no explicit personal-proxy prohibition found, but the open-source self-hosted version is AGPL-3.0 (re… |
+| `gemini`         | caution   | ToS explicitly states the free tier is for "developers building with Google AI models for professional or business purp… |
+| `github-models`  | caution   | GitHub's Acceptable Use Policy prohibits reselling/proxying the service; GitHub Models ToS delegates to each model's ho… |
+| `groq`           | caution   | Services Agreement §6.3 prohibits reselling, sublicensing, or distributing API access; §3.2 bars reselling/leasing acco… |
+| `hackclub`       | caution   | Service is explicitly scoped to Hack Club teen members building projects/learning; no public ToS found explicitly permi… |
+| `huggingchat`    | caution   | Hugging Face ToS does not explicitly ban personal self-hosted proxies, but supplemental terms (referenced but not fully… |
+| `huggingface`    | caution   | ToS grants a limited license to access/use the service; the document does not explicitly permit or forbid a single-user… |
+| `hyperbolic`     | caution   | ToS grants API access "solely for your own personal or internal business purposes" and explicitly prohibits licensing, … |
+| `inference-net`  | caution   | ToS explicitly prohibits "sublicense, resell, distribute" and transferring API keys without written consent; a single-u… |
+| `jina-ai`        | caution   | Free 10M tokens are explicitly non-commercial (CC-BY-NC 4.0 model license); a single-user personal proxy for personal L… |
+| `jina-reader`    | caution   | ToS prohibits using outputs to build competing services and bans "automated methods to extract information via scraping… |
+| `llm7`           | caution   | ToS positions the service as for "experimentation, development, and research"; no explicit ban on self-hosted personal … |
+| `longcat`        | caution   | The API Platform Service Agreement (longcat.chat/platform/private/) permits commercial integration and self-hosted apps… |
+| `mistral`        | caution   | Consumer ToS explicitly states APIs may only be used for "personal needs" and prohibits making API keys available to th… |
+| `morph`          | caution   | ToS allows commercial use generally; self-hosted proxy deployments require explicit arrangement with sales. Section 18.… |
+| `nebius`         | caution   | ToS (Section 5f) explicitly prohibits resale, redistribution, or offering the service "on a standalone basis" — a self-… |
+| `nomic`          | caution   | ToS grants a non-exclusive, non-transferable API license; Section 6.b prohibits building a competitive service. Using t… |
+| `novita`         | caution   | ToS prohibits resale and competing services but does not explicitly address personal self-hosted proxies; personal use … |
+| `nscale`         | caution   | AUP prohibits "copy, modify, duplicate... frame, mirror, republish... distribute all or any part of the Nscale Platform… |
+| `nvidia`         | caution   | Free tier is explicitly for prototyping/dev/research/evaluation only — production use (serving real end-users) requires… |
+| `openrouter`     | caution   | ToS explicitly prohibits reselling API access or developing a competing service; single-user self-hosted personal proxy… |
+| `pollinations`   | caution   | MIT License cited in API docs suggests liberal reuse; no explicit prohibition on self-hosted proxying found. However, u… |
+| `predibase`      | caution   | Predibase is positioned as an enterprise fine-tuning/serving platform; the free trial is explicitly for exploration and… |
+| `publicai`       | caution   | ToS (publicai.co/tc) designates services as "primarily for research and educational use"; no explicit proxy or resale p… |
+| `puter`          | caution   | Puter ToS forbids using services for "commercial purpose" without written consent; a self-hosted personal proxy consumi… |
+| `qoder`          | caution   | ToS page returned no readable content; Qoder is a coding IDE client (not a public API), and third-party proxy wrappers … |
+| `reka`           | caution   | Business Terms prohibit sublicensing or distributing access to third parties; a personal single-user proxy is likely fi… |
+| `sambanova`      | caution   | ToS Section 1.5(c) explicitly prohibits reselling, sublicensing, or making the service available to third parties; a se… |
+| `sensenova`      | caution   | No explicit proxy or resale prohibition found in reviewed ToS, but the free tier is a promotional beta with no SLA, Sen… |
+| `serper-search`  | caution   | ToS explicitly prohibits "mirroring materials on any other server as-is with no-value-added" — a simple pass-through pr… |
+| `siliconflow`    | caution   | ToS (Clause 3.4(e)(f)(p)) explicitly prohibits making the service available to any third party, reselling/sublicensing,… |
+| `sparkdesk`      | caution   | SparkDesk User Agreement grants only personal, non-commercial use rights; API Interface Policy prohibits automated data… |
+| `tavily-search`  | caution   | ToS explicitly states the API "may not be transferred, assigned, shared, or otherwise made available to any third party… |
+| `tencent`        | caution   | Tencent Cloud ToS explicitly prohibits sublicensing or reselling API access; a self-hosted personal proxy for personal … |
+| `together`       | caution   | ToS Section 4.3(d) explicitly prohibits transferring, distributing, reselling, leasing, or offering the Services on a s… |
+| `uncloseai`      | caution   | Personal proxy use is plausible but not explicitly permitted; ToS bans building "competing machine learning services wi… |
+| `veoaifree-web`  | caution   | ToS explicitly bans automated bots or scripts running at "inhuman speeds" and prohibits copying the platform to create … |
+| `vertex`         | caution   | Google Cloud Service Terms restrict resale to authorized resellers only (Section 14 requires a Reseller Agreement); a s… |
+| `voyage-ai`      | caution   | ToS grants "personal, non-commercial use" for site content and prohibits credential/account sharing with third parties;… |
+| `360ai`          | unknown   | ToS for developer API not publicly accessible without registration; access requires application approval which implies … |
+| `chutes`         | unknown   | ToS page exists at chutes.ai/terms but content was not accessible via fetch; no explicit proxy/resale clauses found in … |
+| `freemodel-dev`  | unknown   | The Terms of Service page (freemodel.dev/terms) returned only a header with no readable content via WebFetch; no clause… |
+| `gitlawb`        | unknown   | No ToS or acceptable-use policy found; proxy/resale restrictions unknown — assume caution for self-hosted proxy use.     |
+| `liquid`         | unknown   | No hosted API exists to proxy; open-source model commercial use is free for orgs under $10M annual revenue. No self-hos… |
+| `theoldllm`      | unknown   | No terms of service document was found on the site; proxying, resale, or self-hosted use policy is entirely undocumente… |
+| `yi`             | unknown   | ToS not publicly accessible without login; no proxy/resale clauses could be reviewed. Self-hosted personal proxy use st… |
+| `comfyui`        | ok        | GPL-3.0 open-source license explicitly permits self-hosted personal proxy use; Comfy Org ToS confirms commercial use of… |
+| `scaleway`       | ok        | Scaleway's General Terms of Services are a standard commercial cloud agreement with no explicit prohibition on self-hos… |
+| `sdwebui`        | ok        | AGPL-3.0 license: free to self-host for personal use with no restrictions on usage volume; a personal proxy using this … |
+| `searxng-search` | ok        | AGPL-3.0 open-source license explicitly permits self-hosted personal proxy use with no restriction on usage type, resal… |
 
 ---
 
@@ -172,78 +169,77 @@ A 50-agent web-research pass (official docs + last-7-days news, adversarially ve
 
 > Regenerated from the per-model catalog (`open-sse/config/freeModelCatalog.ts`), pool-deduped. Sorted by recurring steady tokens/mo. `uncapped*` = permanently free but no published token cap (rate/concurrency-limited) — real access, **not** summed into the headline. `—` = credit-only / keyless / not token-quantifiable.
 
-| Provider | Free type | Steady tokens/mo | First-month credit | ToS | Models |
-|---|---|---|---|---|---|
-| `mistral` | recurring | ~1.00B | — | caution | 5 |
-| `llm7` | recurring | ~150M | — | caution | 4 |
-| `longcat` | one-time | — | 10M | caution | 1 |
-| `gemini` | recurring | ~60M | — | caution | 6 |
-| `cerebras` | recurring | ~30M | — | caution | 2 |
-| `cloudflare-ai` | recurring | ~30M | — | caution | 6 |
-| `api-airforce` | recurring | ~24M | — | caution | 7 |
-| `ollama-cloud` | recurring | ~20M | — | ambiguous | 8 |
-| `github-models` | recurring | ~18M | — | caution | 14 |
-| `groq` | recurring | ~15M | — | caution | 5 |
-| `inclusionai` | recurring | ~15M | — | ambiguous | 1 |
-| `bluesminds` | recurring | ~7M | — | ambiguous | 22 |
-| `sambanova` | recurring | ~6M | — | caution | 5 |
-| `arcee-ai` | recurring | ~5M | — | caution | 1 |
-| `bazaarlink` | recurring | ~4M | — | caution | 32 |
-| `openrouter` | recurring | ~1M | — | caution | 1 |
-| `cohere` | recurring | ~800K | — | caution | 6 |
-| `huggingchat` | recurring | ~500K | — | caution | 4 |
-| `morph` | recurring | ~400K | — | ok | 2 |
-| `huggingface` | recurring | ~200K | — | caution | 6 |
-| `kiro` | recurring | ~25K | — | avoid | 12 |
-| `glm-cn` | uncapped | uncapped\* | ~20M | ok | 4 |
-| `baidu` | uncapped | uncapped\* | — | caution | 1 |
-| `kilo-gateway` | uncapped | uncapped\* | — | caution | 7 |
-| `opencode-zen` | uncapped | uncapped\* | — | caution | 6 |
-| `siliconflow` | uncapped | uncapped\* | — | caution | 10 |
-| `tencent` | uncapped | uncapped\* | — | caution | 1 |
-| `vertex` | signup credit | — | ~300M | caution | 10 |
-| `agentrouter` | signup credit | — | ~200M | caution | 4 |
-| `predibase` | signup credit | — | ~25M | caution | 1 |
-| `together` | signup credit | — | ~25M | caution | 1 |
-| `doubao` | signup credit | — | ~15M | ambiguous | 1 |
-| `ai21` | signup credit | — | ~10M | avoid | 2 |
-| `deepseek` | signup credit | — | ~5M | ok | 2 |
-| `hyperbolic` | signup credit | — | ~5M | ok | 8 |
-| `nscale` | signup credit | — | ~5M | caution | 6 |
-| `bytez` | signup credit | — | ~1M | ambiguous | 3 |
-| `deepinfra` | signup credit | — | ~1M | caution | 22 |
-| `fireworks` | signup credit | — | ~1M | avoid | 10 |
-| `nebius` | signup credit | — | ~1M | caution | 1 |
-| `qoder` | signup credit | — | ~1M | caution | 14 |
-| `scaleway` | signup credit | — | ~1M | ok | 6 |
-| `novita` | signup credit | — | ~500K | caution | 1 |
-| `agy` | keyless | — | — | avoid | 16 |
-| `baichuan` | keyless | — | — | ambiguous | 1 |
-| `blackbox` | keyless | — | — | avoid | 6 |
-| `coze` | keyless | — | — | avoid | 1 |
-| `duckduckgo-web` | keyless | — | — | avoid | 6 |
-| `freemodel-dev` | keyless | — | — | unknown | 4 |
-| `friendliai` | keyless | — | — | avoid | 2 |
-| `hackclub` | keyless | — | — | caution | 3 |
-| `iflytek` | keyless | — | — | avoid | 1 |
-| `inference-net` | keyless | — | — | caution | 3 |
-| `liquid` | keyless | — | — | unknown | 1 |
-| `monsterapi` | keyless | — | — | ambiguous | 1 |
-| `muse-spark-web` | keyless | — | — | avoid | 3 |
-| `nlpcloud` | keyless | — | — | avoid | 1 |
-| `nous-research` | keyless | — | — | ambiguous | 2 |
-| `nvidia` | keyless | — | — | caution | 13 |
-| `opencode` | keyless | — | — | avoid | 7 |
-| `pollinations` | keyless | — | — | caution | 31 |
-| `publicai` | keyless | — | — | caution | 3 |
-| `puter` | keyless | — | — | caution | 33 |
-| `qwen-web` | keyless | — | — | avoid | 3 |
-| `reka` | keyless | — | — | caution | 2 |
-| `sensenova` | keyless | — | — | caution | 1 |
-| `sparkdesk` | keyless | — | — | caution | 1 |
-| `stepfun` | keyless | — | — | ok | 1 |
-| `t3-web` | keyless | — | — | avoid | 23 |
-| `uncloseai` | keyless | — | — | caution | 3 |
+| Provider         | Free type     | Steady tokens/mo | First-month credit | ToS       | Models |
+| ---------------- | ------------- | ---------------- | ------------------ | --------- | ------ |
+| `mistral`        | recurring     | ~1.00B           | —                  | caution   | 5      |
+| `llm7`           | recurring     | ~150M            | —                  | caution   | 4      |
+| `longcat`        | one-time      | —                | 10M                | caution   | 1      |
+| `gemini`         | recurring     | ~60M             | —                  | caution   | 6      |
+| `cerebras`       | recurring     | ~30M             | —                  | caution   | 2      |
+| `cloudflare-ai`  | recurring     | ~30M             | —                  | caution   | 6      |
+| `api-airforce`   | recurring     | ~24M             | —                  | caution   | 7      |
+| `ollama-cloud`   | recurring     | ~20M             | —                  | ambiguous | 8      |
+| `github-models`  | recurring     | ~18M             | —                  | caution   | 14     |
+| `groq`           | recurring     | ~15M             | —                  | caution   | 5      |
+| `bluesminds`     | recurring     | ~7M              | —                  | ambiguous | 22     |
+| `sambanova`      | recurring     | ~6M              | —                  | caution   | 5      |
+| `arcee-ai`       | recurring     | ~5M              | —                  | caution   | 1      |
+| `bazaarlink`     | recurring     | ~4M              | —                  | caution   | 32     |
+| `openrouter`     | recurring     | ~1M              | —                  | caution   | 1      |
+| `cohere`         | recurring     | ~800K            | —                  | caution   | 6      |
+| `huggingchat`    | recurring     | ~500K            | —                  | caution   | 4      |
+| `morph`          | recurring     | ~400K            | —                  | ok        | 2      |
+| `huggingface`    | recurring     | ~200K            | —                  | caution   | 6      |
+| `kiro`           | recurring     | ~25K             | —                  | avoid     | 12     |
+| `glm-cn`         | uncapped      | uncapped\*       | ~20M               | ok        | 4      |
+| `baidu`          | uncapped      | uncapped\*       | —                  | caution   | 1      |
+| `kilo-gateway`   | uncapped      | uncapped\*       | —                  | caution   | 7      |
+| `opencode-zen`   | uncapped      | uncapped\*       | —                  | caution   | 6      |
+| `siliconflow`    | uncapped      | uncapped\*       | —                  | caution   | 10     |
+| `tencent`        | uncapped      | uncapped\*       | —                  | caution   | 1      |
+| `vertex`         | signup credit | —                | ~300M              | caution   | 10     |
+| `agentrouter`    | signup credit | —                | ~200M              | caution   | 4      |
+| `predibase`      | signup credit | —                | ~25M               | caution   | 1      |
+| `together`       | signup credit | —                | ~25M               | caution   | 1      |
+| `doubao`         | signup credit | —                | ~15M               | ambiguous | 1      |
+| `ai21`           | signup credit | —                | ~10M               | avoid     | 2      |
+| `deepseek`       | signup credit | —                | ~5M                | ok        | 2      |
+| `hyperbolic`     | signup credit | —                | ~5M                | ok        | 8      |
+| `nscale`         | signup credit | —                | ~5M                | caution   | 6      |
+| `bytez`          | signup credit | —                | ~1M                | ambiguous | 3      |
+| `deepinfra`      | signup credit | —                | ~1M                | caution   | 22     |
+| `fireworks`      | signup credit | —                | ~1M                | avoid     | 10     |
+| `nebius`         | signup credit | —                | ~1M                | caution   | 1      |
+| `qoder`          | signup credit | —                | ~1M                | caution   | 14     |
+| `scaleway`       | signup credit | —                | ~1M                | ok        | 6      |
+| `novita`         | signup credit | —                | ~500K              | caution   | 1      |
+| `agy`            | keyless       | —                | —                  | avoid     | 16     |
+| `baichuan`       | keyless       | —                | —                  | ambiguous | 1      |
+| `blackbox`       | keyless       | —                | —                  | avoid     | 6      |
+| `coze`           | keyless       | —                | —                  | avoid     | 1      |
+| `duckduckgo-web` | keyless       | —                | —                  | avoid     | 6      |
+| `freemodel-dev`  | keyless       | —                | —                  | unknown   | 4      |
+| `friendliai`     | keyless       | —                | —                  | avoid     | 2      |
+| `hackclub`       | keyless       | —                | —                  | caution   | 3      |
+| `iflytek`        | keyless       | —                | —                  | avoid     | 1      |
+| `inference-net`  | keyless       | —                | —                  | caution   | 3      |
+| `liquid`         | keyless       | —                | —                  | unknown   | 1      |
+| `monsterapi`     | keyless       | —                | —                  | ambiguous | 1      |
+| `muse-spark-web` | keyless       | —                | —                  | avoid     | 3      |
+| `nlpcloud`       | keyless       | —                | —                  | avoid     | 1      |
+| `nous-research`  | keyless       | —                | —                  | ambiguous | 2      |
+| `nvidia`         | keyless       | —                | —                  | caution   | 13     |
+| `opencode`       | keyless       | —                | —                  | avoid     | 7      |
+| `pollinations`   | keyless       | —                | —                  | caution   | 31     |
+| `publicai`       | keyless       | —                | —                  | caution   | 3      |
+| `puter`          | keyless       | —                | —                  | caution   | 33     |
+| `qwen-web`       | keyless       | —                | —                  | avoid     | 3      |
+| `reka`           | keyless       | —                | —                  | caution   | 2      |
+| `sensenova`      | keyless       | —                | —                  | caution   | 1      |
+| `sparkdesk`      | keyless       | —                | —                  | caution   | 1      |
+| `stepfun`        | keyless       | —                | —                  | ok        | 1      |
+| `t3-web`         | keyless       | —                | —                  | avoid     | 23     |
+| `uncloseai`      | keyless       | —                | —                  | caution   | 3      |
 
 ---
 
@@ -283,18 +279,15 @@ A 50-agent web-research pass (official docs + last-7-days news, adversarially ve
 - **`github-models`** — Catalog note "Free GPT-5, o-series, DeepSeek-R1, Llama 4, Grok 3" is directionally correct about model availability but omits the daily rate limits (50 RPD for high-tier models, 150 RPD for low-tier)…
 - **`gitlawb`** — The shipped freeNote "Free tier available" is effectively stale. The original free MiMo access was removed in May 2026; the only remaining "free" option is a temporary promotional model (Nemotron 3 U…
 - **`gitlawb-gmi`** — Partially still accurate — free tier exists but is now narrowed to a single model (Nemotron 3 Ultra) after MiMo free access was revoked in late May 2026. The shipped note "Free tier available" unders…
-- **`glhf`** — The shipped freeNote ("Free tier for open-source model inference") is now stale. The free beta ended in January 2025; GLHF Chat is now a paid pay-as-you-go service. There is no ongoing recurring free…
 - **`groq`** — The shipped freeNote "30 RPM / 14.4K RPD" is accurate only for llama-3.1-8b-instant. Most other models (including llama-3.3-70b-versatile) have a much lower 1K RPD cap. The note omits model-specific …
 - **`hackclub`** — The "30+ models" count appears accurate and still matches. The core offering remains free for Hack Club members. No evidence of tightening — still "$0 ALWAYS FREE" per the homepage. The freeNote omit…
 - **`huggingchat`** — The shipped freeNote ("Free LLM chat — no subscription required. Rate limits apply.") is partially accurate but significantly understates the restrictions. The free tier now operates on a hard $0.10/…
 - **`huggingface`** — Significantly tightened. The shipped freeNote ("Free Inference API for thousands of models") implied unlimited/generous free access, but as of mid-2025 the free tier is capped at $0.10/month in recur…
 - **`hyperbolic`** — Our shipped freeNote says "$1-5 trial credits on signup" — the $1 trial credit portion is accurate, but the "$5" figure refers to the minimum deposit required to unlock GPU rental (not free credits g…
 - **`iflytek`** — Catalog says "Free Spark Lite models" — this is broadly accurate. However the current reality is more nuanced: only Spark Lite is free (the Max 100M token offer was a one-time promo, not recurring); …
-- **`inclusionai`** — Our shipped freeNote says "Free Ling-2.6-flash model (262K context)" without specifying token limits. Reality is more specific: the free tier is 500K tokens/day (shared across all models), with a 2 Q…
 - **`inference-net`** — The shipped freeNote states "$25 free credits on signup plus research grants." The current pricing page shows only $1 recurring monthly credits with no mention of a $25 signup bonus or research grant…
 - **`jina-reader`** — Our shipped freeNote was "(none)", which is incorrect. Jina Reader has had a publicly documented free tier since launch: keyless access at 20 RPM plus a 10M one-time token grant with a free API key. …
 - **`kiro`** — Catalog shipped freeNote "(none)" — but Kiro has a documented, perpetual free tier of 50 credits/month. The free tier existed since Kiro's public launch (pricing formalized ~October 2025). This is a …
-- **`kluster`** — The $5 free credits on signup appears to still match. However, there is evidence of an additional permanent free tier (post-credit) with undocumented limits, which may represent an improvement over t…
 - **`llm7`** — Rate limits have increased from the shipped freeNote (20 RPM / 100 req/hr → 40 RPM / 200 req/hr). The "no signup required" claim is now outdated — a free token from token.llm7.io is now required (tho…
 - **`longcat`** — The public preview/beta ended and the Flash models were retired; only the GA `LongCat-2.0` remains. The free tier is a **one-time 10M-token grant** unlocked after account signup + **KYC verification** — it does **not** reset daily or monthly. Beyond the grant it is pay-as-you-go.
 - **`mistral`** — The shipped freeNote ("Free Experiment tier: rate-limited access to all models") is directionally correct but understated. Current reality adds specific documented limits: 2 RPM, 500K TPM, 1B tokens/…
diff --git a/docs/reference/PROVIDER_REFERENCE.md b/docs/reference/PROVIDER_REFERENCE.md
index 63733efa31..f10d96ffd9 100644
--- a/docs/reference/PROVIDER_REFERENCE.md
+++ b/docs/reference/PROVIDER_REFERENCE.md
@@ -1,16 +1,16 @@
 ---
 title: "Provider Reference"
-version: 3.8.43
-lastUpdated: 2026-07-02
+version: 3.8.47
+lastUpdated: 2026-07-13
 ---
 
 # Provider Reference
 
 > **Auto-generated** from `src/shared/constants/providers.ts` — do not edit by hand.
 > Regenerate with: `npm run gen:provider-reference`
-> **Last generated:** 2026-07-02
+> **Last generated:** 2026-07-13
 
-Total providers: **237**. See category breakdown below.
+Total providers: **250**. See category breakdown below.
 
 ## Categories
 
@@ -31,7 +31,7 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
 
 ---
 
-## OAuth Providers (20)
+## OAuth Providers (22)
 
 | ID | Alias | Name | Tags | Website | Notes |
 |----|-------|------|------|---------|-------|
@@ -40,6 +40,7 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
 | `antigravity` | — | Antigravity | OAuth | — | — |
 | `claude` | `cc` | Claude Code | OAuth | — | — |
 | `cline` | `cl` | Cline | OAuth | — | — |
+| `clinepass` | `cp` | ClinePass | OAuth | [link](https://cline.bot/clinepass) | ClinePass is Cline's $9.99/mo subscription bundling 10 open coding models. Sign in with your Cline account (same login as the Cline CLI/IDE), or paste a direct ClinePass API key (app.cline.bot → Settings → API Keys). A ClinePass subscription unlocks the cline-pass/* models. Reuses the Cline WorkOS OAuth flow. |
 | `codebuddy-cn` | `cbcn` | CodeBuddy CN | OAuth | [link](https://copilot.tencent.com) | Tencent CodeBuddy CN (copilot.tencent.com). Sign in via the official CLI device-code flow, or paste a direct API key (sent as Authorization: Bearer). Catalog: GLM / Kimi / MiniMax / DeepSeek / Hunyuan. |
 | `codex` | `cx` | OpenAI Codex | OAuth | — | — |
 | `cursor` | `cu` | Cursor IDE | OAuth | — | — |
@@ -55,8 +56,9 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
 | `trae` | `tr` | Trae | OAuth | [link](https://trae.ai) | Trae is an AI-native IDE by ByteDance (SOLO remote agent). Authorize via trae.ai in the popup, or sign in at solo.trae.ai and paste the Cloud-IDE-JWT (sent as 'Authorization: Cloud-IDE-JWT <token>', ~14-day lifetime) as the access token; web_id/biz_user_id/user_unique_id/scope/tenant/region propagate via providerSpecificData. No headless refresh for pasted tokens — re-paste on expiry. |
 | `windsurf` | `ws` | Windsurf (Devin CLI) | OAuth | [link](https://windsurf.com) | In the Windsurf / VS Code IDE, open the command palette and run `Windsurf: Provide Auth Token` (or click the Jupyter "Get Windsurf Authentication Token" button), then copy the shown token and paste it here. Note: opening windsurf.com/show-auth-token directly only renders a "Redirecting" page — the IDE must initiate the flow (it adds a `?state=...` param) for the token to appear. |
 | `zed` | `zd` | Zed IDE | OAuth | [link](https://zed.dev) | Zed stores LLM provider credentials (OpenAI, Anthropic, Google, Mistral, xAI) in the OS keychain. Use the Import button below to discover and import them automatically. |
+| `zed-hosted` | — | Zed Hosted Models | OAuth | [link](https://zed.dev) | Sign in with your Zed account (native-app sign-in). OmniRoute generates a one-time RSA keypair and opens zed.dev to authorize it — on a remote/headless install, copy the resulting 127.0.0.1 callback URL from your browser's address bar and paste it back here. Distinct from the 'Zed IDE' credential-import entry above: this proxies chat completions through Zed's own hosted model aggregator (cloud.zed.dev), fronting Anthropic/OpenAI/Google/xAI models under your Zed plan. |
 
-## Web Cookie Providers (23)
+## Web Cookie Providers (25)
 
 | ID | Alias | Name | Tags | Website | Notes |
 |----|-------|------|------|---------|-------|
@@ -67,24 +69,26 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
 | `copilot-m365-web` | `m365copilot` | Microsoft 365 Copilot (BizChat) | Web cookie | [link](https://m365.cloud.microsoft/chat) | Sign in at m365.cloud.microsoft/chat, then open DevTools → Network → filter 'WS' → click the Chathub WebSocket connection. Copy both the access_token query parameter AND the account-specific Chathub path segment from its request URL (wss://…/Chathub/<path>?…&access_token=…). It is NOT an Authorization: Bearer header on an XHR/Fetch request. The token is short-lived; this is an unofficial integration. |
 | `copilot-web` | `copilot` | Microsoft Copilot Web | Web cookie | [link](https://copilot.microsoft.com) | Paste your access_token from copilot.microsoft.com (or export a .har file from DevTools while logged in) |
 | `deepseek-web` | `ds-web` | DeepSeek Web | Web cookie | [link](https://chat.deepseek.com) | Paste your userToken from chat.deepseek.com — DevTools → Application → Local Storage → userToken |
-| `doubao-web` | `db` | Doubao Web (ByteDance) | Web cookie | [link](https://www.doubao.com) | Paste your session cookie from doubao.com (DevTools → Application → Cookies) |
+| `doubao-web` | `db` | Dola Web (ByteDance) | Web cookie | [link](https://www.dola.com) | Paste the full Cookie header from www.dola.com. It should include sessionid, ttwid, and s_v_web_id. If s_v_web_id is unavailable, fp=verify_... from a chat/completion request URL can be used as a fallback. |
 | `gemini-business` | `gembiz` | Gemini Business (Enterprise) | Web cookie | [link](https://business.gemini.google) | From your enterprise account: open business.gemini.google/home/cid/{your-cid}, then copy __Secure-1PSID and __Secure-1PSIDTS cookies from DevTools → Application → Cookies. Paste as a cookie header below. |
 | `gemini-web` | `gweb` | Gemini Web (Free) | Web cookie | [link](https://gemini.google.com) | Paste your __Secure-1PSID cookie value from gemini.google.com. Optionally add __Secure-1PSIDTS separated by semicolon. |
 | `grok-web` | `gw` | Grok Web (Subscription) | Web cookie | [link](https://grok.com) | Paste the full grok.com cookie line from DevTools → Application → Cookies. Include both `sso` and `sso-rw` (e.g. `sso=...; sso-rw=...`) — Grok's anti-bot rejects `sso` on its own. |
 | `huggingchat` | `huggingchat` | HuggingChat (Free) | Web cookie | [link](https://huggingface.co/chat) | Paste the full Cookie header from huggingface.co/chat (DevTools → Network → /chat/conversation → Request Headers → Cookie). It should include hf-chat and may also include token / aws-waf-token. |
 | `inner-ai` | `in-ai` | Inner.ai (Subscription) | Web cookie | [link](https://app.innerai.com) | Paste your token cookie and email separated by a space: open DevTools → Application → Cookies → .innerai.com, copy the token value, then append a space and your Inner.ai login email. Example: eyJhbG... user@example.com |
 | `kimi-web` | `kimi-web` | Kimi Web (Moonshot AI) | Web cookie | [link](https://www.kimi.com) | Paste your Cookie header from www.kimi.com (must contain kimi-auth=...). Find it via DevTools → Network → request → Cookie. |
-| `lmarena` | `lma` | LMArena (Free) | Web cookie | [link](https://lmarena.ai) | Paste the full Cookie header from lmarena.ai (DevTools → Network → request → Cookie). The session is now split across arena-auth-prod-v1.0, .1, … — copy the whole header. Optional — works with free tier for basic comparisons. |
+| `lmarena` | `lma` | Arena (Free) | Web cookie | [link](https://arena.ai) | Paste the full Cookie header from arena.ai (DevTools → Network → request → Cookie). Include arena-auth-prod-v1.0/.1… and cf_clearance/__cf_bm when present. OmniRoute uses Chrome TLS impersonation; if Arena still 403s, set providerSpecificData.recaptchaV3Token from a live browser session. |
 | `muse-spark-web` | `ms-web` | Muse Spark Web (Meta AI) | Web cookie | [link](https://www.meta.ai) | Paste your ecto_1_sess value or full cookie header from meta.ai |
 | `perplexity-web` | `pplx-web` | Perplexity Web (Pro/Max) | Web cookie | [link](https://www.perplexity.ai) | Paste your __Secure-next-auth.session-token cookie value from perplexity.ai |
 | `poe-web` | `poe` | Poe Web (Subscription) | Web cookie | [link](https://poe.com) | Paste your p-b cookie value from poe.com (DevTools → Application → Cookies → p-b) |
 | `qwen-web` | `qwen-web` | Qwen Web (Free) | Web cookie | [link](https://chat.qwen.ai) | Open chat.qwen.ai, log in, then open DevTools → Application → Local Storage → copy the "token" value (or use tongyi_sso_ticket cookie as Bearer token). |
 | `t3-web` | `t3chat` | t3.chat (Pro/Free) | Web cookie | [link](https://t3.chat) | Open t3.chat in your browser, log in, then open DevTools → Application → Local Storage → https://t3.chat. Copy the value of 'convex-session-id'. Also open DevTools → Network, copy the Cookie header from any request. Paste both values here. See provider setup docs for a step-by-step guide. |
-| `v0-vercel-web` | `v0` | v0 Vercel Web (Code Gen) | Web cookie | [link](https://v0.dev) | Paste your session cookie from v0.dev (DevTools → Application → Cookies) |
+| `v0-vercel-web` | `v0-vercel-web` | v0 Vercel Web (Code Gen) | Web cookie | [link](https://v0.dev) | Paste your session cookie from v0.dev (DevTools → Application → Cookies) |
 | `venice-web` | `ven` | Venice Web (Privacy) | Web cookie | [link](https://venice.ai) | Paste your session cookie from venice.ai (DevTools → Application → Cookies) |
+| `yuanbao-web` | `ybw` | Tencent Yuanbao (Free) | Web cookie | [link](https://yuanbao.tencent.com) | Log in to yuanbao.tencent.com, then paste the full Cookie header (DevTools → Network → any /api request → Request Headers → Cookie). It must contain hy_user and hy_token. |
+| `zai-web` | `zw` | Z.ai Web (Free) | Web cookie | [link](https://chat.z.ai) | Paste the full Cookie header from chat.z.ai (must include the token=<JWT> cookie) |
 | `zenmux-free` | `zmf` | ZenMux Free (Web) | Web cookie | [link](https://zenmux.ai) | Login at zenmux.ai, then export all cookies using EditThisCookie or Cookie-Editor and paste the full Cookie header string here. Refresh every ~30 days. |
 
-## API Key Providers (paid / paid-with-free-credits) (158)
+## API Key Providers (paid / paid-with-free-credits) (167)
 
 | ID | Alias | Name | Tags | Website | Notes |
 |----|-------|------|------|---------|-------|
@@ -99,6 +103,7 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
 | `arcee-ai` | `arcee` | Arcee AI | API key | [link](https://arcee.ai) | Get API key at arcee.ai |
 | `azure-ai` | `azure-ai` | Azure AI Foundry | API key, enterprise | [link](https://learn.microsoft.com/azure/ai-foundry) | Use your Azure AI Foundry key. Base URL can be https://<resource>.services.ai.azure.com/openai/v1/ or https://<resource>.openai.azure.com/openai/v1/. |
 | `azure-openai` | `azure` | Azure OpenAI | API key, enterprise | [link](https://azure.microsoft.com/products/ai-services/openai-service) | Use your Azure OpenAI API key. Base URL should be your resource endpoint, for example https://my-resource.openai.azure.com. |
+| `bai` | `bai` | b.ai | API key | [link](https://b.ai) | Bearer API key for the b.ai OpenAI-compatible LLM gateway (distinct from TheB.AI). Create a key at https://docs.b.ai, then use https://api.b.ai/v1 as the OpenAI-compatible base URL. |
 | `baichuan` | `baichuan` | Baichuan | API key | [link](https://baichuan.com) | Get API key at platform.baichuan-ai.com |
 | `baidu` | `baidu` | Baidu (ERNIE) | API key | [link](https://yiyan.baidu.com) | Get API key at console.bce.baidu.com |
 | `bailian-coding-plan` | `bcp` | Alibaba Coding Plan | API key | [link](https://www.alibabacloud.com/help/en/model-studio/coding-plan) | — |
@@ -110,8 +115,8 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
 | `bluesminds` | `bm` | BluesMinds | API key | [link](https://www.bluesminds.com) | Free daily pi credits — supports 200+ models including GPT-4o, GPT-4.1, Claude Sonnet 4.5, Gemini 2.0 Flash, DeepSeek V4, Qwen, Kimi K2 |
 | `byteplus` | `bpm` | BytePlus ModelArk | API key | [link](https://console.byteplus.com/ark) | — |
 | `bytez` | `bytez` | Bytez | API key | [link](https://bytez.com) | $1 free credits, refreshes every 4 weeks |
-| `cablyai` | `cablyai` | CablyAI | API key, aggregator | [link](https://cablyai.com) | ⚠️ **DEPRECATED.** cablyai.com no longer resolves (DNS NXDOMAIN, verified 2026-06-30) — the domain is gone and every request fails with a DNS error (#5568). |
 | `cerebras` | `cerebras` | Cerebras | API key | [link](https://inference.cerebras.ai) | Free Trial: 1M tokens/day, 30K TPM, 5 RPM — no credit card. |
+| `charm-hyper` | `charm-hyper` | Charm Hyper | API key | [link](https://hyper.charm.land) | 100 free monthly Hypercredits on signup |
 | `chutes` | `chutes` | Chutes.ai | API key, aggregator | [link](https://chutes.ai) | Bearer API key for the Chutes OpenAI-compatible gateway. |
 | `clarifai` | `clarifai` | Clarifai | API key, enterprise | [link](https://docs.clarifai.com) | Use your Clarifai PAT or app-specific API key. OmniRoute targets the OpenAI-compatible endpoint at https://api.clarifai.com/v2/ext/openai/v1 and authenticates with Authorization: Key <token>. |
 | `cloudflare-ai` | `cf` | Cloudflare Workers AI | API key | [link](https://developers.cloudflare.com/workers-ai) | Requires API Token AND Account ID (found at dash.cloudflare.com) |
@@ -126,6 +131,7 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
 | `deepseek` | `ds` | DeepSeek | API key | [link](https://platform.deepseek.com) | 5M free tokens on signup - no credit card required |
 | `dgrid` | `dgrid` | DGrid | API key | [link](https://dgrid.ai) | DGrid Free Models Router: 10 requests/minute and 100 requests/day. A $5 lifetime top-up unlocks up to 20 requests/minute and 1,000 requests/day. |
 | `dify` | `dify` | Dify | API key | [link](https://dify.ai) | Get API key from your Dify instance. |
+| `digitalocean` | `digitalocean` | DigitalOcean | API key | [link](https://docs.digitalocean.com/products/ai-platform/) | — |
 | `dit` | `dai` | DIT.ai | API key | [link](https://dit.ai) | Use your dit.ai API key in Authorization: Bearer <key>. Fully OpenAI-compatible — a drop-in replacement, just change the base URL to https://api.dit.ai/v1. |
 | `doubao` | `doubao` | Doubao | API key | [link](https://doubao.com) | Get API key at console.volcengine.com |
 | `empower` | `empower` | Empower | API key, aggregator | [link](https://docs.empower.dev) | Bearer API key for the Empower OpenAI-compatible endpoint. |
@@ -146,27 +152,26 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
 | `gitlab` | `gitlab` | GitLab Duo PAT | API key | [link](https://docs.gitlab.com/user/duo_agent_platform/code_suggestions/) | GitLab personal access token for the public Code Suggestions API. Configure a self-hosted base URL when not using gitlab.com. |
 | `gitlawb` | `glb` | Gitlawb Opengateway (MiMo) | API key | [link](https://opengateway.gitlawb.com) | Free MiMo (xiaomi/mimo-v2.5) revoked 2026-05 — Opengateway is now a pay-as-you-go credit gateway; no recurring free model. |
 | `gitlawb-gmi` | `glb-gmi` | Gitlawb Opengateway (GMI Cloud) | API key | [link](https://opengateway.gitlawb.com) | Free Nemotron promo ended 2026-06 — the GMI Cloud route is now pay-as-you-go credit only. |
-| `glhf` | `glhf` | GLHF Chat | API key, aggregator | [link](https://glhf.chat) | ⚠️ **DEPRECATED.** glhf.chat shut down (2026); its api.laf.run gateway no longer serves the catalog (sweep 2026-06-19). |
 | `glm` | `glm` | GLM Coding | API key | [link](https://z.ai/subscribe) | — |
 | `glm-cn` | `glmcn` | GLM Coding (China) | API key | [link](https://open.bigmodel.cn) | — |
 | `glmt` | `glmt` | GLM Thinking | API key | [link](https://open.bigmodel.cn) | — |
 | `groq` | `groq` | Groq | API key | [link](https://groq.com) | Free tier: 30 RPM / 14.4K RPD — no credit card |
 | `hackclub` | `hc` | Hackclub AI | API key, aggregator | [link](https://ai.hackclub.com) | Sign in with your Hack Club account at ai.hackclub.com. |
 | `haiper` | `hp` | Haiper | API key, video | [link](https://haiper.ai) | Get API key at haiper.ai/haiper-api |
+| `hcnsec` | `hcnsec` | Huancheng Public API | API key | [link](https://api.hcnsec.cn) | Get API key at api.hcnsec.cn |
 | `heroku` | `heroku` | Heroku AI | API key, enterprise | [link](https://www.heroku.com) | — |
 | `huggingface` | `hf` | HuggingFace | API key | [link](https://huggingface.co) | Free Inference API for thousands of models (Whisper, VITS, SDXL…) |
 | `hyperbolic` | `hyp` | Hyperbolic | API key | [link](https://hyperbolic.xyz) | $1-5 trial credits on signup for serverless inference |
 | `ideogram` | `ideo` | Ideogram | API key | [link](https://ideogram.ai) | Get API key at ideogram.ai/docs/api |
 | `iflytek` | `iflytek` | iFlytek Spark | API key | [link](https://xinghuo.xfyun.cn) | Get API key at console.xfyun.cn |
-| `inclusionai` | `inclusion` | InclusionAI | API key | [link](https://inclusionai.com) | ⚠️ **DEPRECATED.** api.inclusionai.tech no longer resolves (sweep 2026-06-19); the inference API appears discontinued. |
 | `inference-net` | `inet` | Inference.net | API key | [link](https://inference.net) | $25 free credits on signup plus research grants available |
 | `jina-ai` | `jina` | Jina AI | API key, embed/rerank | [link](https://jina.ai) | Bearer API key for the Jina AI rerank API. |
 | `jina-reader` | `jr` | Jina Reader | API key | [link](https://jina.ai/reader) | — |
+| `kenari` | `kenari` | Kenari | API key | [link](https://kenari.id) | Use your Kenari API key (kn-...) in Authorization: Bearer <key>. Fully OpenAI-compatible. API base URL: https://kenari.id/v1. |
 | `kie` | `kie` | KIE.AI | API key | [link](https://kie.ai) | — |
 | `kilo-gateway` | `kg` | Kilo Gateway | API key, aggregator | [link](https://kilo.ai) | — |
 | `kimi` | `kimi` | Kimi | API key | [link](https://platform.moonshot.ai) | — |
 | `kimi-coding-apikey` | `kmca` | Kimi Coding (API Key) | API key | [link](https://www.kimi.com/code) | — |
-| `kluster` | `kluster` | Kluster AI | API key | [link](https://kluster.ai) | ⚠️ **DEPRECATED.** kluster.ai shut down (2026-06-09); api.kluster.ai no longer resolves (sweep 2026-06-19). Use another OpenAI-compatible provider. |
 | `lambda-ai` | `lambda` | Lambda AI | API key | [link](https://lambda.ai) | — |
 | `laozhang` | `lz` | LaoZhang AI | API key, aggregator | [link](https://api.laozhang.ai) | — |
 | `leonardo` | `leo` | Leonardo AI | API key, video | [link](https://leonardo.ai) | Get API key at leonardo.ai/developer |
@@ -180,6 +185,7 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
 | `minimax-cn` | `minimax-cn` | Minimax (China) | API key | [link](https://www.minimaxi.com) | — |
 | `mistral` | `mistral` | Mistral | API key | [link](https://mistral.ai) | Free Experiment tier: rate-limited access to all models, no credit card required |
 | `modal` | `mdl` | Modal | API key, enterprise | [link](https://modal.com/docs) | Use the bearer token that protects your Modal deployment, if enabled. Base URL should point to your OpenAI-compatible Modal app, for example https://<workspace>--<app>.modal.run/v1. |
+| `modelscope` | `ms` | ModelScope | API key | [link](https://modelscope.cn) | Free tier via ModelScope API-Inference — Alibaba account required. |
 | `monsterapi` | `monster` | MonsterAPI | API key | [link](https://monsterapi.ai) | Get API key at monsterapi.ai |
 | `moonshot` | `moonshot` | Moonshot AI | API key | [link](https://platform.moonshot.ai) | — |
 | `morph` | `morph` | Morph | API key | [link](https://morphllm.com) | Free tier: 250K credits/month, $0 |
@@ -190,6 +196,7 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
 | `nous-research` | `nous` | Nous Research | API key | [link](https://portal.nousresearch.com/help) | Use your Nous Portal API key. OmniRoute targets the official OpenAI-compatible inference endpoint at https://inference-api.nousresearch.com/v1. |
 | `novita` | `novita` | Novita AI | API key, aggregator | [link](https://novita.ai) | $0.50 trial credits on signup (valid about 1 year) |
 | `nscale` | `nscale` | nScale | API key | [link](https://nscale.com) | $5 free credits on signup for inference testing |
+| `nube` | `nube` | Nube.sh | API key | [link](https://nube.sh) | — |
 | `nvidia` | `nvidia` | NVIDIA NIM | API key | [link](https://build.nvidia.com) | Free dev access: ~40 RPM, 70+ models (Kimi K2.5, GLM 4.7, DeepSeek V3.2...) |
 | `oci` | `oci` | OCI Generative AI | API key, enterprise | [link](https://www.oracle.com/artificial-intelligence/generative-ai) | Use your OCI Generative AI API key or IAM bearer token. Base URL can be https://inference.generativeai.<region>.oci.oraclecloud.com/openai/v1/. |
 | `ollama-cloud` | `ollamacloud` | Ollama Cloud | API key | [link](https://ollama.com/settings/keys) | — |
@@ -198,6 +205,7 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
 | `opencode-go` | `opencode-go` | OpenCode Go | API key | [link](https://opencode.ai/go) | — |
 | `opencode-zen` | `opencode-zen` | OpenCode Zen | API key | [link](https://opencode.ai/zen) | — |
 | `openrouter` | `openrouter` | OpenRouter | API key, aggregator | [link](https://openrouter.ai) | Free models at $0/token with :free suffix - 20 RPM / 200 RPD |
+| `openvecta` | `openvecta` | OpenVecta | API key | [link](https://openvecta.com) | Free credits on signup for OpenAI-compatible inference across LLMs, embeddings, and reasoning models |
 | `orcarouter` | `orcarouter` | OrcaRouter | API key | [link](https://www.orcarouter.ai) | — |
 | `ovhcloud` | `ovh` | OVHcloud AI | API key | [link](https://www.ovhcloud.com) | — |
 | `perplexity` | `pplx` | Perplexity | API key | [link](https://www.perplexity.ai) | — |
@@ -209,8 +217,10 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
 | `publicai` | `publicai` | PublicAI | API key | [link](https://publicai.co) | Requires an API key — one-time signup credit, then paid |
 | `puter` | `pu` | Puter AI | API key | [link](https://puter.com) | Get token at puter.com/dashboard → Copy Auth Token |
 | `qianfan` | `qianfan` | Baidu Qianfan | API key | [link](https://cloud.baidu.com/product/wenxinworkshop) | — |
+| `qiniu` | `qiniu` | Qiniu | API key | [link](https://www.qiniu.com) | — |
 | `recraft` | `recraft` | Recraft | API key, image | [link](https://recraft.ai) | — |
 | `reka` | `reka` | Reka | API key | [link](https://docs.reka.ai/chat/overview) | Use your Reka API key. OmniRoute supports the OpenAI-compatible base URL https://api.reka.ai/v1 and sends both Authorization and X-Api-Key headers for compatibility. |
+| `requesty` | `requesty` | Requesty | API key | [link](https://requesty.ai) | Free tier ~200 requests/day - multi-model routing gateway (300+ models) |
 | `runwayml` | `runway` | Runway | API key, video | [link](https://docs.dev.runwayml.com) | Use your Runway API key in Authorization: Bearer <key>. OmniRoute targets the current Runway API at https://api.dev.runwayml.com/v1 and sends the required X-Runway-Version header automatically. |
 | `sambanova` | `samba` | SambaNova | API key | [link](https://sambanova.ai) | $5 free credits on signup (30-day validity), no credit card required |
 | `sap` | `sap` | SAP Generative AI Hub | API key, enterprise | [link](https://help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/generative-ai-hub-in-sap-ai-core) | Use your SAP AI Core bearer token. Base URL can be your AI_API_URL root or a deploymentUrl from Generative AI Hub. |
@@ -221,10 +231,12 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
 | `sparkdesk` | `sparkdesk` | SparkDesk | API key | [link](https://xinghuo.xfyun.cn) | Get API key at console.xfyun.cn |
 | `stability-ai` | `stability` | Stability AI | API key, image | [link](https://stability.ai) | — |
 | `stepfun` | `stepfun` | StepFun | API key | [link](https://stepfun.com) | Get API key at platform.stepfun.com |
+| `sumopod` | `sumopod` | SumoPod | API key | [link](https://ai.sumopod.com) | Use your SumoPod API key (sk-...) in Authorization: Bearer <key>. Fully OpenAI-compatible. API base URL: https://ai.sumopod.com/v1. |
 | `suno` | `suno` | Suno | API key | [link](https://suno.ai) | Paste session cookie from suno.ai (Clerk auth) |
 | `synthetic` | `synthetic` | Synthetic | API key, aggregator | [link](https://synthetic.new) | — |
 | `tencent` | `tencent` | Tencent Hunyuan | API key | [link](https://hunyuan.tencent.com) | Get API key at console.cloud.tencent.com |
 | `thebai` | `thebai` | TheB.AI | API key, aggregator | [link](https://theb.ai) | Bearer API key for the TheB.AI OpenAI-compatible gateway. |
+| `tinyfish` | `tf` | TinyFish Fetch | API key | [link](https://docs.tinyfish.ai/fetch-api) | X-API-Key from agent.tinyfish.ai/api-keys |
 | `together` | `together` | Together AI | API key, video | [link](https://www.together.ai) | — |
 | `tokenrouter` | `trk` | TokenRouter | API key | [link](https://tokenrouter.com) | Use your TokenRouter API key in Authorization: Bearer <key>. Fully OpenAI-compatible. API base URL: https://api.tokenrouter.com/v1. |
 | `topaz` | `topaz` | Topaz | API key, image | [link](https://topazlabs.com) | — |
@@ -241,6 +253,7 @@ Use the dashboard at `/dashboard/providers` to enable, configure, and test each
 | `wafer` | `wafer` | Wafer AI | API key | [link](https://wafer.ai) | — |
 | `wandb` | `wandb` | Weights & Biases Inference | API key | [link](https://wandb.ai) | — |
 | `watsonx` | `watsonx` | IBM watsonx.ai Gateway | API key, enterprise | [link](https://www.ibm.com/products/watsonx-ai) | Use your watsonx bearer token. Base URL can be https://<region>.ml.cloud.ibm.com/ml/gateway/v1/ or a self-managed /ml/gateway/v1 endpoint. |
+| `x5lab` | `x5lab` | X5Lab | API key | [link](https://x5lab.dev) | Use your X5Lab API key (x5-...) in Authorization: Bearer <key>. Fully OpenAI-compatible. API base URL: https://api.x5lab.dev/v1. |
 | `xai` | `xai` | xAI (Grok) | API key | [link](https://x.ai) | — |
 | `xiaomi-mimo` | `mimo` | Xiaomi MiMo | API key | [link](https://mimo.mi.com) | — |
 | `yi` | `yi` | Yi (01.AI) | API key | [link](https://01.ai) | Get API key at platform.lingyiwanwu.com |
diff --git a/docs/reference/RELAY_TROUBLESHOOTING.md b/docs/reference/RELAY_TROUBLESHOOTING.md
new file mode 100644
index 0000000000..f510a24a66
--- /dev/null
+++ b/docs/reference/RELAY_TROUBLESHOOTING.md
@@ -0,0 +1,93 @@
+---
+title: "Relay Troubleshooting"
+version: 3.8.43
+lastUpdated: 2026-07-11
+---
+
+# Relay Troubleshooting
+
+Relays (Vercel, Deno, Cloudflare) terminate the upstream connection on a
+serverless backend so OmniRoute can egress from a stable region while keeping
+the provider API key server-side. This document covers the two failure modes
+that operators hit in production and the recovery paths OmniRoute ships for
+each.
+
+## How relay auth is stored
+
+When you deploy a relay from **Settings → Proxy Pool → Deploy Relay**, the
+deploy flow stores the relay's auth token in the proxy `notes` JSON field:
+
+- If `STORAGE_ENCRYPTION_KEY` is set, the token is written as `relayAuthEnc`
+  (AES-encrypted at rest).
+- Otherwise it is written as plaintext `relayAuth`.
+
+At request time `extractRelayAuth(notes)` returns whichever form is present,
+so the relay keeps working across restarts.
+
+## Failure mode 1 — undecryptable token after key rotation
+
+**Symptom:** relays that previously worked now return upstream `401`/auth
+errors after an environment or secret-manager rotation of
+`STORAGE_ENCRYPTION_KEY`. The stored `relayAuthEnc` blob can no longer be
+decrypted, so `extractRelayAuth` returns the empty string and the relay sends
+no auth.
+
+**Recovery — repair in place (no redeploy):**
+
+1. Open **Settings → Proxy Pool**.
+2. Relay rows whose auth is missing show a yellow `auth missing` badge and a
+   **Repair** button.
+3. Click **Repair**. OmniRoute calls
+   `POST /api/settings/proxies/[id]/repair-relay`, which:
+   - decrypts `relayAuthEnc` with the **current** key,
+   - writes the plaintext `relayAuth` back into `notes`,
+   - returns `{ repaired: true, mode: "recovered" }`.
+
+The relay resumes serving without re-entering any deploy credentials.
+
+This only works if the current `STORAGE_ENCRYPTION_KEY` can still decrypt the
+blob. If you rotated the key **without** a migration, the blob is
+unrecoverable.
+
+## Failure mode 2 — unrecoverable token (key rotated away)
+
+**Symptom:** you clicked **Repair** and got
+`{ repaired: false, mode: "redeploy", status: 409 }`.
+
+**Recovery — redeploy:**
+
+The stored token cannot be recovered with the current key. Re-deploy the relay
+from the same modal you used originally (**Deploy Relay** menu → Vercel / Deno
+/ Cloudflare). The deploy flow writes a fresh token (encrypted with the current
+key) and the row's `auth missing` badge clears.
+
+In the UI, the **Repair** button itself triggers the redeploy modal when the
+token is unrecoverable, so you never have to hunt for it manually.
+
+## Failure mode 3 — relay reachable but unhealthy
+
+**Symptom:** the proxy test (`speed` button) shows the relay up but requests
+still fail intermittently.
+
+Check the relay awareness headers returned by OmniRoute's auto-test probe
+(see **Settings → Proxy Pool** and the `relayTested` / `relayAlive` counters):
+
+- `x-relay-url` — which relay backend answered.
+- `x-relay-mode` — `ts` | `bifrost` | `auto` for that request.
+- `x-relay-attempts` — how many relay hops were tried before success.
+- `x-relay-fallback` — `true` when the request fell back from the preferred
+  backend to the TypeScript relay.
+
+A high `x-relay-fallback` rate with low `relayAlive` means the sidecar
+backend is unhealthy and you should either fix it or switch the relay backend
+strategy to `ts` (see `RELAY_BACKEND_STRATEGY.md`).
+
+## API reference
+
+| Method | Path                                      | Body                    | Success                                                                                                                             | Failure                                                                           |
+| ------ | ----------------------------------------- | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- |
+| `POST` | `/api/settings/proxies/[id]/repair-relay` | `{ "id": "<proxyId>" }` | `200 { repaired: true, mode: "recovered" }` when re-derived; `200 { repaired: false, mode: "noop" }` when plaintext already present | `409 { mode: "redeploy" }` unrecoverable; `400` not a relay type; `404` not found |
+
+The list route `GET /api/settings/proxies` attaches a secret-free
+`relayInfo: { isRelay, authMissing, repairMode }` to each item so the dashboard
+can render the repair affordance without ever exposing the token.
diff --git a/docs/reference/meta.json b/docs/reference/meta.json
index e7d25ec571..83b8179b0f 100644
--- a/docs/reference/meta.json
+++ b/docs/reference/meta.json
@@ -6,6 +6,7 @@
     "ENVIRONMENT",
     "FEATURE_FLAGS",
     "FREE_TIERS",
+    "FREE_PROXIES_API",
     "PROVIDER_REFERENCE"
   ]
 }
diff --git a/docs/routing/AUTO-COMBO.md b/docs/routing/AUTO-COMBO.md
index 483730569a..a4967b4a08 100644
--- a/docs/routing/AUTO-COMBO.md
+++ b/docs/routing/AUTO-COMBO.md
@@ -148,29 +148,33 @@ Notes:
   - **quality-first** → taskFit 0.37 + stability 0.15 (best model for the task, consistent)
   - **offline-friendly** → quota 0.37 + health 0.28 (max headroom regardless of speed/cost)
 
-### Per-Request Controls (headers) — #6023 / #6024 / #6025
+### Per-Request Controls (headers) — #6023 / #6024 / #6025 / #3470
 
-An `auto` combo can be steered **per request** via two headers, without mutating the
+An `auto` combo can be steered **per request** via three headers, without mutating the
 combo's stored config. These apply only to the `auto` strategy and only for the request
-that carries them; the combo's saved `modePack`/`budgetCap` are used when the header is
-absent.
+that carries them; the combo's saved `modePack`/`budgetCap`/`budgetFallback` are used
+when the header is absent.
 
-| Header               | Accepts                                                                                                                                                                                 | Effect                                                                                                                                                                                              |
-| :------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `X-OmniRoute-Mode`   | a preset alias (`fast`, `balanced`, `quality`, `cheap`, `reliable`, `offline`) or a raw pack name (`ship-fast`, `cost-saver`, `quality-first`, `offline-friendly`, `reliability-first`) | Overrides the scoring weights for this request. `balanced`/`default` force the default weights (no pack). Unknown values are ignored (config preserved).                                            |
-| `X-OmniRoute-Budget` | a positive number (max USD per request)                                                                                                                                                 | Hard cost ceiling: candidates whose estimated cost exceeds it are filtered before selection, falling back to the cheapest healthy candidate if all exceed. Non-positive/garbage values are ignored. |
+| Header                        | Accepts                                                                                                                                                                                 | Effect                                                                                                                                                                                              |
+| :----------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `X-OmniRoute-Mode`            | a preset alias (`fast`, `balanced`, `quality`, `cheap`, `reliable`, `offline`) or a raw pack name (`ship-fast`, `cost-saver`, `quality-first`, `offline-friendly`, `reliability-first`) | Overrides the scoring weights for this request. `balanced`/`default` force the default weights (no pack). Unknown values are ignored (config preserved).                                            |
+| `X-OmniRoute-Budget`          | a positive number (max USD per request)                                                                                                                                                 | Hard cost ceiling: candidates whose estimated cost exceeds it are filtered before selection. What happens when **every** candidate exceeds it is controlled by `X-OmniRoute-Budget-Fallback` below. |
+| `X-OmniRoute-Budget-Fallback` | `cheapest` (default, aliases: `cheapest-viable`, `soft`) or `strict` (aliases: `block`, `hard`)                                                                                        | `cheapest`: falls back to the globally cheapest candidate even though it still exceeds the cap (legacy behavior). `strict`: refuses to select — the request fails fast with `HTTP 402` instead of silently overspending. Unknown values are ignored. |
 
 ```bash
-# Force the fastest profile and cap this request at $0.05
+# Force the fastest profile, cap this request at $0.05, and hard-block instead of overspending
 curl -sS http://localhost:20128/v1/chat/completions \
   -H "Content-Type: application/json" \
   -H "X-OmniRoute-Mode: fast" \
   -H "X-OmniRoute-Budget: 0.05" \
+  -H "X-OmniRoute-Budget-Fallback: strict" \
   -d '{"model":"auto","messages":[{"role":"user","content":"hi"}]}'
 ```
 
 Resolution is a pure function (`open-sse/services/autoCombo/requestControls.ts`); the
-resolved values feed the engine's existing `config.modePack` / `config.budgetCap` inputs.
+resolved values feed the engine's existing `config.modePack` / `config.budgetCap` /
+`config.budgetFallback` inputs. A combo's stored `config.budgetFallback` ("strict" |
+"cheapest") sets the persistent policy; the header overrides it for a single request.
 
 ## All Routing Strategies
 
@@ -602,7 +606,7 @@ See `docs/marketing/TIERS.md` for tier definitions and provider classification.
 
 ### Deterministic routing-decision matrix (`npm run test:combo:matrix`)
 
-`tests/integration/combo-matrix/*.test.ts` proves the routing **decision** of all 17
+`tests/integration/combo-matrix/*.test.ts` proves the routing **decision** of all 18
 public strategies end-to-end through the real combo pipeline with a mocked upstream.
 Coverage includes:
 
diff --git a/docs/security/STEALTH_GUIDE.md b/docs/security/STEALTH_GUIDE.md
index c3415e93c0..9d60d7be59 100644
--- a/docs/security/STEALTH_GUIDE.md
+++ b/docs/security/STEALTH_GUIDE.md
@@ -88,7 +88,7 @@ Applied to: `system` blocks, all `messages[].content`, and `tools[].description`
 
 For third-party Anthropic relays that only accept "real Claude Code" traffic:
 
-- `CLAUDE_CODE_COMPATIBLE_USER_AGENT = "claude-cli/2.1.195 (external, sdk-cli)"`
+- `CLAUDE_CODE_COMPATIBLE_USER_AGENT = "claude-cli/2.1.207 (external, sdk-cli)"`
 - `CLAUDE_CODE_COMPATIBLE_STAINLESS_PACKAGE_VERSION = "0.94.0"`
 - `CLAUDE_CODE_COMPATIBLE_STAINLESS_RUNTIME_VERSION = "v24.3.0"`
 - `anthropic-beta = "claude-code-20250219,interleaved-thinking-2025-05-14,effort-2025-11-24"` by default
@@ -214,7 +214,7 @@ All MITM endpoints require management auth (`requireCliToolsAuth`). The sudo pas
 
 | Variable                 | Default                                                         |
 | ------------------------ | --------------------------------------------------------------- |
-| `CLAUDE_USER_AGENT`      | `claude-cli/2.1.195 (external, cli)`                            |
+| `CLAUDE_USER_AGENT`      | `claude-cli/2.1.207 (external, cli)`                            |
 | `CODEX_USER_AGENT`       | `codex-cli/0.142.0 (Windows 10.0.26200; x64)`                   |
 | `GITHUB_USER_AGENT`      | `GitHubCopilotChat/0.54.0`                                      |
 | `ANTIGRAVITY_USER_AGENT` | `antigravity/2.0.1 linux/arm64 google-api-nodejs-client/10.3.0` |
diff --git a/electron/package.json b/electron/package.json
index 115c459e4d..01810dd50a 100644
--- a/electron/package.json
+++ b/electron/package.json
@@ -1,6 +1,6 @@
 {
   "name": "omniroute-desktop",
-  "version": "3.8.46",
+  "version": "3.8.47",
   "description": "OmniRoute Desktop Application",
   "main": "main.js",
   "author": {
diff --git a/eslint.complexity-ratchets.config.mjs b/eslint.complexity-ratchets.config.mjs
new file mode 100644
index 0000000000..af29755fdf
--- /dev/null
+++ b/eslint.complexity-ratchets.config.mjs
@@ -0,0 +1,76 @@
+// eslint.complexity-ratchets.config.mjs
+// STANDALONE flat config for BOTH complexity ratchets in ONE ESLint walk:
+//   - ESLint core: complexity + max-lines-per-function  (src, open-sse, electron, bin)
+//   - sonarjs/cognitive-complexity                     (src, open-sse only)
+//
+// Existence reason: two independent baselines (complexity-baseline.json +
+// quality-baseline metrics.cognitiveComplexity) must stay isolatable from the
+// main lint warning budget — but they do NOT need two cold tree walks.
+//
+// Counts are taken by ruleId in the check scripts (never file.errorCount), so
+// cognitive violations cannot inflate the cyclomatic/max-lines ratchet.
+import tseslint from "typescript-eslint";
+import sonarjs from "eslint-plugin-sonarjs";
+
+const SHARED_LANGUAGE = {
+  parser: tseslint.parser,
+  parserOptions: {
+    ecmaVersion: 2022,
+    sourceType: "module",
+    ecmaFeatures: { jsx: true },
+  },
+};
+
+const SHARED_LINTER = {
+  noInlineConfig: true,
+  reportUnusedDisableDirectives: "off",
+};
+
+const SHARED_IGNORES = {
+  ignores: [
+    "**/*.test.ts",
+    "**/*.test.tsx",
+    "**/__tests__/**",
+    "**/*.d.ts",
+    "node_modules/**",
+    "electron/node_modules/**",
+    "electron/dist-electron/**",
+    ".next/**",
+    ".build/**",
+    "dist/**",
+    "coverage/**",
+  ],
+};
+
+/** @type {import("eslint").Linter.Config[]} */
+const config = [
+  {
+    files: [
+      "src/**/*.{ts,tsx}",
+      "open-sse/**/*.{ts,tsx}",
+      "electron/**/*.{ts,tsx}",
+      "bin/**/*.{ts,tsx}",
+    ],
+    languageOptions: SHARED_LANGUAGE,
+    linterOptions: SHARED_LINTER,
+    rules: {
+      complexity: ["error", 15],
+      "max-lines-per-function": [
+        "error",
+        { max: 80, skipBlankLines: true, skipComments: true },
+      ],
+    },
+  },
+  {
+    files: ["src/**/*.{ts,tsx}", "open-sse/**/*.{ts,tsx}"],
+    languageOptions: SHARED_LANGUAGE,
+    plugins: { sonarjs },
+    linterOptions: SHARED_LINTER,
+    rules: {
+      "sonarjs/cognitive-complexity": ["error", 15],
+    },
+  },
+  SHARED_IGNORES,
+];
+
+export default config;
diff --git a/examples/plugins/langfuse/README.md b/examples/plugins/langfuse/README.md
new file mode 100644
index 0000000000..f30f4af40a
--- /dev/null
+++ b/examples/plugins/langfuse/README.md
@@ -0,0 +1,63 @@
+# Langfuse Plugin
+
+Emits [Langfuse](https://langfuse.com/) generation traces for every LLM completion routed through OmniRoute.
+
+Records **prompt, response, model, provider, token usage, latency, and error details** to Langfuse cloud (`cloud.langfuse.com` or `us.cloud.langfuse.com`) or a self-hosted Langfuse instance.
+
+## Install
+
+Copy the `examples/plugins/langfuse/` directory to your OmniRoute plugins path, or install directly from the marketplace UI.
+
+## Configuration
+
+Fill these fields in the plugin config panel:
+
+| Key | Required | Default | Notes |
+|---|---|---|---|
+| `publicKey` | Yes | `""` | Langfuse public key (`pk-lf-...`) |
+| `secretKey` | Yes | `""` | Langfuse secret key (`sk-lf-...`) |
+| `host` | No | `https://cloud.langfuse.com` | Also `https://us.cloud.langfuse.com` or self-hosted URL |
+| `enabled` | No | `true` | Set to `false` to make the plugin a no-op without uninstalling |
+| `sampleRate` | No | `1.0` | `0.1` = trace 10% of requests |
+| `flushAt` | No | `15` | Events to buffer before flushing |
+| `flushInterval` | No | `10000` | Max ms between flushes |
+| `redactBody` | No | `false` | Set `true` to strip prompt + completion from traces (metadata still recorded) |
+
+Get keys at [cloud.langfuse.com](https://cloud.langfuse.com) → Settings → API keys.
+
+## What gets traced
+
+Each LLM completion emits one Langfuse `generation` observation inside a per-request trace:
+
+- **Trace:** `omniroute:<model>` with `userId`, `provider`, `requestId` metadata
+- **Generation:** `chat.completion` with:
+  - `model` — full model ID
+  - `modelParameters` — `temperature`, `max_tokens`, `top_p`
+  - `input` — messages array (redacted if `redactBody: true`)
+  - `output` — assistant message (redacted if `redactBody: true`)
+  - `usage.promptTokens`, `usage.completionTokens`, `usage.totalTokens`
+  - `startTime`, `endTime` — for latency
+
+Errors emit a generation with `level: "ERROR"` and `statusMessage`.
+
+## Runtime dependency
+
+The plugin lazy-loads the [`langfuse`](https://www.npmjs.com/package/langfuse) npm SDK on first request. Install it in the plugin's own directory so a broken SDK cannot crash the gateway:
+
+```bash
+cd examples/plugins/langfuse
+npm install langfuse
+```
+
+## Privacy
+
+- Prompts and completions are sent to Langfuse cloud (or your self-host) in cleartext unless `redactBody: true`
+- API keys are stored in the plugin config, encrypted at rest by OmniRoute
+- Set `sampleRate < 1.0` to reduce data volume
+- Set `enabled: false` to disable without removing configuration
+
+## Related
+
+- [Langfuse docs](https://langfuse.com/docs)
+- [Langfuse OpenTelemetry endpoint](https://langfuse.com/docs/opentelemetry/get-started) (alternative path — this plugin uses the native SDK)
+- OmniRoute plugin SDK: `docs/frameworks/PLUGIN_SDK.md`
diff --git a/examples/plugins/langfuse/index.mjs b/examples/plugins/langfuse/index.mjs
new file mode 100644
index 0000000000..e647b5b0c8
--- /dev/null
+++ b/examples/plugins/langfuse/index.mjs
@@ -0,0 +1,158 @@
+/**
+ * Langfuse Plugin — emits generation traces for every LLM completion.
+ *
+ * Records model, provider, prompt, completion, token usage, latency,
+ * and error details to Langfuse cloud or self-hosted.
+ *
+ * @module langfuse
+ */
+
+let langfuseClient = null;
+
+/**
+ * Lazy-init the Langfuse SDK. First trace request creates the client; the SDK
+ * batches events and flushes per config.flushAt / config.flushInterval.
+ */
+async function getClient(config) {
+  if (langfuseClient) return langfuseClient;
+  if (!config.publicKey || !config.secretKey) return null;
+  try {
+    const { Langfuse } = await import("langfuse");
+    langfuseClient = new Langfuse({
+      publicKey: config.publicKey,
+      secretKey: config.secretKey,
+      baseUrl: config.host || "https://cloud.langfuse.com",
+      flushAt: config.flushAt ?? 15,
+      flushInterval: config.flushInterval ?? 10000,
+    });
+    return langfuseClient;
+  } catch (err) {
+    console.error("[langfuse] SDK import failed:", err.message);
+    return null;
+  }
+}
+
+function shouldSample(rate) {
+  if (rate >= 1) return true;
+  if (rate <= 0) return false;
+  return Math.random() < rate;
+}
+
+function truncateBody(body, redact) {
+  if (redact) return "[REDACTED]";
+  if (body === undefined || body === null) return undefined;
+  return body;
+}
+
+/**
+ * onRequest — mark trace start, capture request metadata.
+ */
+export async function onRequest(ctx) {
+  const config = ctx?.config || {};
+  if (config.enabled === false) return;
+  if (!shouldSample(config.sampleRate ?? 1)) return;
+  if (ctx?.metadata) {
+    ctx.metadata.__langfuseStart = Date.now();
+    ctx.metadata.__langfuseSampled = true;
+  }
+}
+
+/**
+ * onResponse — emit a Langfuse generation event with prompt, completion, usage.
+ */
+export async function onResponse(ctx) {
+  const config = ctx?.config || {};
+  if (config.enabled === false) return;
+  if (!ctx?.metadata?.__langfuseSampled) return;
+
+  const client = await getClient(config);
+  if (!client) return;
+
+  const start = ctx.metadata.__langfuseStart || Date.now();
+  const end = Date.now();
+  const body = ctx?.body || {};
+  const response = ctx?.response || {};
+  const usage = response.usage || {};
+
+  try {
+    const trace = client.trace({
+      name: `omniroute:${body.model || "unknown"}`,
+      userId: ctx?.userId,
+      metadata: {
+        provider: ctx?.provider,
+        requestId: ctx?.requestId,
+        omnirouteVersion: ctx?.omnirouteVersion,
+      },
+    });
+    trace.generation({
+      name: "chat.completion",
+      model: body.model || "unknown",
+      modelParameters: {
+        temperature: body.temperature,
+        max_tokens: body.max_tokens,
+        top_p: body.top_p,
+      },
+      input: truncateBody(body.messages, config.redactBody),
+      output: truncateBody(response.choices?.[0]?.message, config.redactBody),
+      usage: {
+        promptTokens: usage.prompt_tokens,
+        completionTokens: usage.completion_tokens,
+        totalTokens: usage.total_tokens,
+      },
+      startTime: new Date(start),
+      endTime: new Date(end),
+    });
+  } catch (err) {
+    console.error("[langfuse] trace emit failed:", err.message);
+  }
+}
+
+/**
+ * onError — emit a failed generation with error details.
+ */
+export async function onError(ctx) {
+  const config = ctx?.config || {};
+  if (config.enabled === false) return;
+  if (!ctx?.metadata?.__langfuseSampled) return;
+
+  const client = await getClient(config);
+  if (!client) return;
+
+  const start = ctx.metadata.__langfuseStart || Date.now();
+  const body = ctx?.body || {};
+  const error = ctx?.error || {};
+
+  try {
+    const trace = client.trace({
+      name: `omniroute:${body.model || "unknown"}`,
+      userId: ctx?.userId,
+      metadata: {
+        provider: ctx?.provider,
+        requestId: ctx?.requestId,
+      },
+    });
+    trace.generation({
+      name: "chat.completion",
+      model: body.model || "unknown",
+      input: truncateBody(body.messages, config.redactBody),
+      level: "ERROR",
+      statusMessage: error.message || String(error),
+      startTime: new Date(start),
+      endTime: new Date(),
+    });
+  } catch (err) {
+    console.error("[langfuse] error trace emit failed:", err.message);
+  }
+}
+
+/**
+ * onShutdown — flush pending events before OmniRoute exits.
+ */
+export async function onShutdown() {
+  if (!langfuseClient) return;
+  try {
+    await langfuseClient.shutdownAsync();
+  } catch (err) {
+    console.error("[langfuse] shutdown failed:", err.message);
+  }
+}
diff --git a/examples/plugins/langfuse/plugin.json b/examples/plugins/langfuse/plugin.json
new file mode 100644
index 0000000000..52c1fd8c45
--- /dev/null
+++ b/examples/plugins/langfuse/plugin.json
@@ -0,0 +1,67 @@
+{
+  "name": "langfuse",
+  "version": "1.0.0",
+  "description": "Emits Langfuse generation traces for every LLM completion. Records prompt, response, model, usage, latency, and error details to Langfuse cloud or self-hosted.",
+  "author": "chirag127",
+  "license": "MIT",
+  "main": "index.mjs",
+  "source": "local",
+  "tags": ["observability", "tracing", "langfuse", "monitoring"],
+  "hooks": {
+    "onRequest": true,
+    "onResponse": true,
+    "onError": true
+  },
+  "requires": {
+    "permissions": []
+  },
+  "enabledByDefault": false,
+  "configSchema": {
+    "publicKey": {
+      "type": "string",
+      "default": "",
+      "description": "Langfuse public key (pk-lf-...)"
+    },
+    "secretKey": {
+      "type": "string",
+      "default": "",
+      "description": "Langfuse secret key (sk-lf-...)"
+    },
+    "host": {
+      "type": "string",
+      "default": "https://cloud.langfuse.com",
+      "description": "Langfuse host (cloud.langfuse.com, us.cloud.langfuse.com, or self-hosted URL)"
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Emit traces when true; act as a no-op when false"
+    },
+    "sampleRate": {
+      "type": "number",
+      "default": 1.0,
+      "min": 0.0,
+      "max": 1.0,
+      "description": "Fraction of requests to trace (1.0 = all, 0.1 = 10%)"
+    },
+    "flushAt": {
+      "type": "number",
+      "default": 15,
+      "min": 1,
+      "max": 100,
+      "description": "Number of events to buffer before flushing to Langfuse"
+    },
+    "flushInterval": {
+      "type": "number",
+      "default": 10000,
+      "min": 1000,
+      "max": 60000,
+      "description": "Max ms between flushes (in-flight events flushed on timer)"
+    },
+    "redactBody": {
+      "type": "boolean",
+      "default": false,
+      "description": "Redact prompt + completion bodies from traces (metadata still recorded)"
+    }
+  }
+}
diff --git a/llm.txt b/llm.txt
index d2995c50a4..9e012ae34d 100644
--- a/llm.txt
+++ b/llm.txt
@@ -1,6 +1,6 @@
 # OmniRoute
 
-> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 177 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (37 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
+> OmniRoute is a free, open-source AI Gateway that acts as a universal API proxy for multi-provider LLMs. It provides smart routing, automatic fallback, load balancing, and format translation across 248 AI providers — all through a single OpenAI-compatible endpoint. Includes a built-in MCP Server (94 tools), A2A v0.3 protocol, Memory/Skills systems, Cloud Agents (codex-cloud, devin, jules), Guardrails framework, and an Electron desktop app.
 
 ## Overview
 
@@ -8,12 +8,12 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 **Key value:** One endpoint (`http://localhost:20128/v1`), unlimited models, zero downtime, minimal cost.
 
-**Current version:** 3.8.8
+**Current version:** 3.8.47
 
 ## Tech Stack
 
-- **Runtime:** Node.js `>=22.22.2 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
-- **Framework:** Next.js 16 (App Router) with TypeScript 5.9
+- **Runtime:** Node.js `>=22.0.0 <23 || >=24.0.0 <27`, ES Modules (`"type": "module"`)
+- **Framework:** Next.js 16 (App Router) with TypeScript 6
 - **Database:** SQLite via better-sqlite3 (local, zero-config, 110+ migrations)
 - **State management:** Zustand (client), SQLite (server persistence)
 - **UI:** React 19, Tailwind CSS 4, Recharts for analytics, @lobehub/icons for 130+ provider SVG icons
@@ -41,7 +41,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │       ├── auto-combo/   # Auto-combo engine dashboard
 │   │   │       ├── cache/        # Cache dashboard (semantic cache stats)
 │   │   │       ├── cli-tools/    # CLI tool configuration (Claude Code, Codex, etc.)
-│   │   │       ├── combos/       # Model combo management (14 strategies + 4 templates)
+│   │   │       ├── combos/       # Model combo management (18 strategies + 4 templates)
 │   │   │       ├── costs/        # Cost tracking per provider/model
 │   │   │       ├── endpoint/     # Unified: Endpoint Proxy, MCP, A2A, API Endpoints tabs
 │   │   │       ├── health/       # System health (uptime, circuit breakers, latency)
@@ -102,7 +102,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   └── streaming.ts      # SSE streaming for A2A
 │   │   ├── acp/                  # Agent Communication Protocol registry and manager
 │   │   ├── compliance/           # Compliance policy engine
-│   │   ├── db/                   # SQLite database layer (95+ modules + migrations)
+│   │   ├── db/                   # SQLite database layer (99 modules + migrations)
 │   │   │   ├── core.ts           # Database initialization, connection, schema
 │   │   │   ├── providers.ts      # Provider connection CRUD
 │   │   │   ├── models.ts         # Model catalog management
@@ -124,7 +124,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   │   ├── secrets.ts        # Secrets management
 │   │   │   ├── stateReset.ts     # State reset utilities
 │   │   │   ├── migrationRunner.ts # Schema migration runner
-│   │   │   └── migrations/       # 110+ versioned SQL migration files
+│   │   │   └── migrations/       # 117 versioned SQL migration files
 │   │   ├── evals/                # Eval runner and scheduler
 │   │   ├── memory/               # Persistent conversational memory
 │   │   │   ├── extraction.ts     # Memory extraction from conversations
@@ -165,7 +165,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   └── manager.ts            # MITM proxy manager
 │   ├── shared/                   # Shared utilities, components, and constants
 │   │   ├── components/           # Reusable UI components (Card, Badge, Button, Modal, Sidebar, ProviderIcon, etc.)
-│   │   ├── constants/            # Provider definitions (160+), model lists, pricing, routing strategies, MCP scopes
+│   │   ├── constants/            # Provider definitions (248), model lists, pricing, routing strategies, MCP scopes
 │   │   ├── contracts/            # Shared API contracts
 │   │   ├── hooks/                # React hooks
 │   │   ├── middleware/           # Shared middleware utilities
@@ -182,7 +182,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 ├── open-sse/                     # Standalone SSE server (npm workspace)
 │   ├── config/                   # Model registries (providerRegistry, embedding, image, audio, video,
 │   │                             #   music, rerank, moderation, search, CLI fingerprints, Ollama models)
-│   ├── executors/                # Provider-specific request executors (31 executors)
+│   ├── executors/                # Provider-specific request executors (78 executor modules)
 │   │   ├── base.ts               # Base executor with shared logic
 │   │   ├── default.ts            # Default OpenAI-compatible executor
 │   │   ├── cursor.ts             # Cursor IDE (protobuf + checksum)
@@ -208,15 +208,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── moderations.ts        # Content moderation
 │   │   ├── rerank.ts             # Reranking API
 │   │   └── search.ts             # Web search API
-│   ├── mcp-server/               # Built-in MCP server (29 tools, 3 transports: stdio/SSE/streamable-HTTP)
+│   ├── mcp-server/               # Built-in MCP server (94 tools, 3 transports: stdio/SSE/streamable-HTTP)
 │   │   ├── server.ts             # MCP server core (tool registration, scope enforcement)
 │   │   ├── tools/                # Tool implementations (advancedTools, memoryTools, skillTools)
 │   │   ├── schemas/              # Zod input schemas (tools, audit, a2a)
-│   │   ├── scopeEnforcement.ts   # Scope-based access control (10 scopes)
+│   │   ├── scopeEnforcement.ts   # Scope-based access control (30 scopes)
 │   │   ├── audit.ts              # Tool call audit logging
 │   │   ├── runtimeHeartbeat.ts   # MCP runtime heartbeat
 │   │   └── httpTransport.ts      # HTTP transport handler
-│   ├── services/                 # 36+ service modules
+│   ├── services/                 # 140+ service modules
 │   │   ├── combo.ts              # Core routing engine
 │   │   ├── usage.ts              # Usage tracking
 │   │   ├── tokenRefresh.ts       # OAuth token refresh
@@ -224,7 +224,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   │   ├── accountFallback.ts    # Multi-account fallback
 │   │   ├── sessionManager.ts     # Session management
 │   │   ├── wildcardRouter.ts     # Wildcard model routing
-│   │   ├── autoCombo/            # Auto-combo engine (6-factor scoring, bandit exploration)
+│   │   ├── autoCombo/            # Auto-combo engine (12-factor scoring, bandit exploration)
 │   │   ├── intentClassifier.ts   # Request intent classification
 │   │   ├── taskAwareRouter.ts    # Task-aware routing
 │   │   ├── thinkingBudget.ts     # Thinking budget management
@@ -253,24 +253,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 │   ├── preload.js                # Preload script (IPC bridge)
 │   └── assets/                   # App icons and assets
 ├── tests/                        # Test suites
-│   ├── unit/                     # 122 unit test files
+│   ├── unit/                     # 2,700+ unit test files
 │   ├── integration/              # Integration tests
 │   ├── e2e/                      # Playwright E2E tests
 │   ├── security/                 # Security tests
 │   ├── translator/               # Translator-specific tests
 │   └── load/                     # Load tests
 ├── docs/                         # Documentation
-│   ├── i18n/                     # 30-language translated docs
-│   ├── ARCHITECTURE.md           # Full architecture documentation
-│   ├── API_REFERENCE.md          # API reference
-│   ├── USER_GUIDE.md             # User guide
-│   ├── CODEBASE_DOCUMENTATION.md # Codebase overview
-│   ├── CLI-TOOLS.md              # CLI tools integration guide
-│   ├── A2A-SERVER.md             # A2A agent protocol documentation
-│   ├── AUTO-COMBO.md             # Auto-combo engine (6-factor scoring)
-│   ├── MCP-SERVER.md             # MCP server (29 tools)
-│   ├── TROUBLESHOOTING.md        # Troubleshooting guide
-│   ├── VM_DEPLOYMENT_GUIDE.md    # VPS deployment guide
+│   ├── i18n/                     # 43-language translated docs
+│   ├── architecture/             # ARCHITECTURE.md, CODEBASE_DOCUMENTATION.md, REPOSITORY_MAP.md, AUTHZ_GUIDE.md, RESILIENCE_GUIDE.md, QUALITY_GATES.md
+│   ├── reference/                # API_REFERENCE.md, PROVIDER_REFERENCE.md, CLI-TOOLS.md
+│   ├── frameworks/               # MCP-SERVER.md (94 tools), A2A-SERVER.md, SKILLS.md, MEMORY.md, CLOUD_AGENT.md, EVALS.md, WEBHOOKS.md
+│   ├── routing/                  # AUTO-COMBO.md (12-factor scoring), REASONING_REPLAY.md
+│   ├── security/                 # GUARDRAILS.md, COMPLIANCE.md, STEALTH_GUIDE.md, PUBLIC_CREDS.md, ERROR_SANITIZATION.md
+│   ├── guides/                   # USER_GUIDE.md, TROUBLESHOOTING.md, ELECTRON_GUIDE.md, I18N.md
+│   ├── ops/                      # RELEASE_CHECKLIST.md, TUNNELS_GUIDE.md, VM deployment
 │   ├── openapi.yaml              # OpenAPI specification
 │   └── screenshots/              # Dashboard screenshots
 ├── bin/                          # CLI entry points (omniroute, reset-password)
@@ -278,15 +275,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 └── .env.example                  # Environment variable template
 ```
 
-## Key Features (v3.8.8)
+## Key Features (v3.8.47)
 
 ### Core Proxy
-- **177 AI providers** with automatic format translation
-- **4 provider categories**: Free (5), OAuth (14), API Key (123+), Self-Hosted (8+), Custom (OpenAI/Anthropic-compatible)
-- **14 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, strict-random, auto, lkgp, context-optimized, context-relay, **reset-aware** (v3.8)
+- **248 AI providers** with automatic format translation
+- **Provider categories**: Free (90+ free tiers), OAuth, API Key, Self-Hosted, Custom (OpenAI/Anthropic-compatible)
+- **18 routing strategies**: priority, weighted, round-robin, fill-first, p2c, random, least-used, cost-optimized, reset-aware, reset-window, headroom, strict-random, auto, lkgp, context-optimized, context-relay, fusion, pipeline
 - **4-tier fallback**: Subscription → API Key → Cheap → Free
 - **Context Relay strategy**: Session handoff summaries on account rotation for continuity
-- **Auto-combo engine**: Self-healing routing optimization with **9-factor scoring** (health/quota/costInv/latencyInv/taskFit/specificityMatch/stability/tierPriority/tierAffinity), bandit exploration, progressive cooldown
+- **Auto-combo engine**: Self-healing routing optimization with **12-factor scoring** (see `docs/routing/AUTO-COMBO.md`), bandit exploration, progressive cooldown
 - **Semantic caching** with cache hit/miss headers
 - **Idempotency** with configurable dedup window
 - **3-layer resilience**: Provider Circuit Breaker / Connection Cooldown / Model Lockout
@@ -299,7 +296,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Guardrails Framework**: Hot-reloadable registry with vision-bridge, pii-masker, prompt-injection (priority-ordered)
 - **MITM Proxy**: Certificate management, DNS handling, and target routing
 - **Cloudflare Tunnels**: Managed tunnel creation for remote access
-- **Coverage gate**: 75% statements/lines/functions, 70% branches (measured ~82%)
+- **Coverage gate**: ratchet vs `quality-baseline.json`; absolute floor 60% statements/lines/functions/branches
 
 ### Security
 - **Data Loss Prevention**: SQLite migration safety bounds abort startup on dangerous massive schema overrides. Pre-migration `VACUUM INTO` backups isolate rollback snapshots.
@@ -315,7 +312,7 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 ### Dashboard Pages (23 sections)
 - **Providers** — OAuth, API key, and free provider management with ProviderIcon SVG icons
-- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 14 strategies
+- **Combos** — Multi-model combo builder with 4 templates (Free Stack, High Availability, Cost Saver, Balanced) + 18 strategies
 - **Auto-Combo** — Auto-combo engine dashboard with scoring metrics
 - **Analytics** — Token consumption, cost, heatmaps, distributions
 - **Health** — Uptime, memory, latency percentiles, circuit breakers
@@ -345,18 +342,21 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 - **Gemini** — `/v1beta/models`, `/v1beta/models/{...path}`
 - **Ollama** — `/v1/api/chat`, `/api/tags`
 - **Search** — `/v1/search` (Perplexity, Serper, Brave, Exa, Tavily)
-- **MCP** — 37-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
+- **MCP** — 94-tool MCP server with scope-based auth (3 transports: stdio, SSE, streamable HTTP)
 - **A2A** — Agent-to-Agent v0.3 protocol (JSON-RPC 2.0, 5 skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report)
 - **ACP** — Agent Communication Protocol registry and manager
 
-### MCP Server (37 Tools)
-| Category   | Tools |
-|------------|-------|
-| Core (30)  | `get_health`, `list_combos`, `get_combo_metrics`, `switch_combo`, `check_quota`, `route_request`, `cost_report`, `list_models_catalog`, `web_search`, `simulate_route`, `set_budget_guard`, `set_routing_strategy`, `set_resilience_profile`, `test_combo`, `get_provider_metrics`, `best_combo_for_task`, `explain_route`, `get_session_snapshot`, `db_health_check`, `sync_pricing`, `cache_stats`, `cache_flush`, and advanced routing/diagnostics tools (see `docs/frameworks/MCP-SERVER.md` for full inventory) |
-| Memory (3) | `memory_search`, `memory_add`, `memory_clear` |
-| Skills (4) | `skills_list`, `skills_enable`, `skills_execute`, `skills_executions` |
+### MCP Server (94 Tools)
 
-**MCP Auth Scopes (~13):** `read:health`, `read:combos`, `write:combos`, `read:quota`, `read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`, `write:resilience`, plus memory/skills scopes — full list in `docs/frameworks/MCP-SERVER.md`.
+94 tools across modules: **34 base** (health, combos, quotas, routing, cost, models, cache,
+diagnostics) plus **memory**, **skill**, **agentSkill**, **pool**, **notion**, **obsidian**,
+**gamification**, and **plugin** modules. Full per-tool inventory:
+`docs/frameworks/MCP-SERVER.md`.
+
+**MCP Auth Scopes (30):** e.g. `read:health`, `read:combos`, `write:combos`, `read:quota`,
+`read:usage`, `read:models`, `execute:completions`, `execute:search`, `write:budget`,
+`write:resilience`, plus memory/skills/pool/plugin scopes — full list in
+`docs/frameworks/MCP-SERVER.md`.
 
 ### Provider Categories
 
@@ -381,17 +381,17 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 3. **Connection-based provider model:** Providers are stored as "connections" in SQLite. Each connection has an `id`, `provider`, `authType` (oauth/apikey/free), `isActive` flag, and credentials. Multiple connections per provider for multi-account rotation.
 
-4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 14 strategies including auto-combo with self-healing and context-relay for session continuity.
+4. **Combo system for fallback:** Users create "combos" — ordered lists of `provider/model` pairs. The proxy tries each in order until one succeeds. Supports 18 strategies including auto-combo with self-healing and context-relay for session continuity.
 
 5. **SSE proxy pipeline:** The proxy pipeline is middleware-based: request → auth resolution → rate limiting → circuit breaker → format translation → upstream call → response translation → SSE streaming back to client.
 
-6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 21 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
+6. **SQLite for persistence:** All state (providers, combos, logs, settings, API keys, memory, skills) stored in a single SQLite database via 99 domain-specific modules. All DB operations go through `src/lib/db/` modules, never raw SQL in routes.
 
 7. **OAuth with PKCE:** OAuth flows use PKCE for security. Token refresh handled by background job (`tokenHealthCheck.ts`).
 
 8. **ProviderIcon component:** Unified icon system using `@lobehub/icons` (130+ SVG) with PNG fallback and generic icon fallback chain. Used on providers, dashboard, and agents pages.
 
-9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 21 `src/lib/db/` modules with 16 SQL migrations.
+9. **DB architecture:** `localDb.ts` is a re-export layer only — real logic lives in 99 `src/lib/db/` modules with 117 SQL migrations.
 
 10. **Upstream headers:** Custom headers merged in executors after default auth; same header name replaces executor value. Forbidden header names in `src/shared/constants/upstreamHeaders.ts`.
 
@@ -435,15 +435,15 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
 
 4. **Environment variables:** All configuration is in `.env` (from `.env.example`). Key vars: `PORT`, `NEXT_PUBLIC_BASE_URL`, `API_KEY`, `ADMIN_PASSWORD`.
 
-5. **Database layer:** Operations go through `src/lib/db/` modules (95+ domain-specific files, 110+ migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
+5. **Database layer:** Operations go through `src/lib/db/` modules (99 domain-specific files, 117 migrations). `localDb.ts` is re-exports only — add new functions to the proper `db/*.ts` module.
 
-6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: 75% statements/lines/functions, 70% branches.
+6. **Tests** use Node.js built-in test runner + Vitest. Run `npm test`. Vitest for MCP/autoCombo (`npm run test:vitest`). Playwright for E2E (`npm run test:e2e`). Coverage gate: ratchet vs `quality-baseline.json`, absolute floor 60% statements/lines/functions/branches.
 
 7. **MCP and A2A pages are embedded as tabs inside `/dashboard/endpoint`**, not standalone routes.
 
 8. **ACP agents** are in `src/lib/acp/registry.ts` with detection cache. Custom agents stored via settings DB.
 
-9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **9-factor scoring** (health 0.22, quota 0.17, costInv 0.17, latencyInv 0.13, taskFit 0.08, specificityMatch 0.08, stability 0.05, tierPriority 0.05, tierAffinity 0.05), 4 mode packs, bandit exploration, progressive cooldown.
+9. **Auto-combo engine** in `open-sse/services/autoCombo/` — **12-factor scoring** (weights and factors in `docs/routing/AUTO-COMBO.md`), 4 mode packs, bandit exploration, progressive cooldown.
 
 10. **Docker:** Dockerfile has two targets: `runner-base` and `runner-cli`. `docker-compose.yml` for dev (3 profiles), `docker-compose.prod.yml` for production (port 20130).
 
@@ -474,21 +474,16 @@ OmniRoute solves the problem of managing multiple AI provider subscriptions, quo
     - **Connection Cooldown** (`src/sse/services/auth.ts::markAccountUnavailable`) — one key/account scope.
     - **Model Lockout** (`open-sse/services/accountFallback.ts`) — provider + connection + model scope.
 
-## v3.8.0 Highlights
+## v3.8.x Highlights
 
-- **Cloud Agents** (Codex Cloud, Devin, Jules) with task lifecycle management and management-auth enforcement
-- **Guardrails framework**: hot-reloadable registry with vision-bridge, pii-masker, prompt-injection
-- **9-factor Auto-Combo scoring** (was 6-factor in earlier versions)
-- **`reset-aware` routing strategy** (14th strategy) — picks the account whose quota will reset soonest
-- **A2A protocol expanded to 5 skills**: smart-routing, quota-management, provider-discovery, cost-analysis, health-report
-- **MCP server expanded to 37 tools** (30 base + 3 memory + 4 skills) across ~13 scopes
-- **OAuth providers expanded to 14**: added Qwen, Kiro, Qoder, Gemini, Windsurf, GitLab Duo
-- **Coverage gate raised to 75/75/75/70** (was 60% across the board) — measured ~82%
-- **Reasoning replay** (`docs/routing/REASONING_REPLAY.md`) — capture and inspect provider reasoning streams
-- **Compliance + Evals + Webhooks** documentation introduced
-- **Stealth guide** (`docs/security/STEALTH_GUIDE.md`) — TLS / CLI fingerprint configuration
-- **Tunnels guide** (`docs/ops/TUNNELS_GUIDE.md`) — Cloudflare tunnel management
-- **Electron guide** (`docs/guides/ELECTRON_GUIDE.md`) — desktop app build + signing
+- **248-provider catalog** with 90+ free tiers, one-click account imports, and bulk key add
+- **18 routing strategies** — including `fusion` (parallel panel + judge synthesis), `pipeline`, `reset-aware`, `reset-window`, `headroom`, and `context-relay`
+- **12-factor Auto-Combo scoring** with bandit exploration and progressive cooldown
+- **MCP server expanded to 94 tools / 30 scopes** (base + memory/skill/agentSkill/pool/notion/obsidian/gamification/plugin modules)
+- **Cloud Agents** (Codex Cloud, Devin, Jules), **Guardrails**, **Evals**, **Webhooks**, **Compliance** frameworks
+- **Embedded services** manager (install/start/stop bundled services from the dashboard)
+- **Prompt compression** (RTK + Caveman codecs) saving up to ~95% tokens on eligible traffic
+- Full changelog: `CHANGELOG.md`
 
 ## Links
 
diff --git a/next.config.mjs b/next.config.mjs
index 7fb83187b5..ac7197503c 100644
--- a/next.config.mjs
+++ b/next.config.mjs
@@ -116,6 +116,24 @@ const nextConfig = {
       ...mitmManagerAliasFor(process.env),
       ...minimalBuildAliases,
     },
+    // src/lib/agentSkills/generator.ts builds its fs base path from a runtime
+    // `outputDir` parameter (`path.join(process.cwd(), outputDir)`), which is
+    // NOT a compile-time literal, so Turbopack's build-time file-tracing
+    // analyzer can't statically narrow the several dynamic readdirSync/rmSync/
+    // readFileSync/writeFileSync call sites a few lines below and falls back
+    // to an "Overly broad patterns... matches N files" warning — once per
+    // Next.js entry point that imports the module (/api/agent-skills/generate,
+    // /api/cli-tools/pi-settings). The fs access is legitimate and bounded
+    // (skills/<id>/SKILL.md, ~48 known IDs), so this is a known-benign,
+    // expected diagnostic — suppress it here rather than fight the analyzer,
+    // mirroring the isNextIntlExtractorDynamicImportWarning precedent below
+    // for the webpack path. (#6582)
+    ignoreIssue: [
+      {
+        path: "**/src/lib/agentSkills/**",
+        description: /Overly broad patterns can lead to build performance issues/,
+      },
+    ],
   },
   output: "standalone",
   compress: true,
@@ -588,6 +606,33 @@ const nextConfig = {
         source: "/v1beta",
         destination: "/api/v1beta",
       },
+      // Issue #6405 follow-up: unknown root-level paths must return JSON 404,
+      // not the dashboard HTML shell. Rewrite the missing prefixes under /api/*
+      // so they hit the /api/[...omnirouteApiCatchAll] route (#6424) — which
+      // returns application/json with error.type === "not_found". Real /api/*
+      // routes take precedence over the catch-all, so any future
+      // /api/anthropic/*, /api/openai/*, /api/metrics, /api/debug endpoints
+      // still match first.
+      {
+        source: "/anthropic/:path*",
+        destination: "/api/anthropic/:path*",
+      },
+      {
+        source: "/openai/:path*",
+        destination: "/api/openai/:path*",
+      },
+      {
+        source: "/metrics",
+        destination: "/api/metrics",
+      },
+      {
+        source: "/debug",
+        destination: "/api/debug",
+      },
+      {
+        source: "/.env",
+        destination: "/api/.env",
+      },
     ];
   },
 };
diff --git a/open-sse/config/anthropicHeaders.ts b/open-sse/config/anthropicHeaders.ts
index d378407e8d..fa8d1e2212 100644
--- a/open-sse/config/anthropicHeaders.ts
+++ b/open-sse/config/anthropicHeaders.ts
@@ -121,7 +121,7 @@ export function normalizeAnthropicHeaderVariants(headers: Record<string, string>
   }
 }
 
-export const CLAUDE_CLI_VERSION = "2.1.195";
+export const CLAUDE_CLI_VERSION = "2.1.207";
 export const CLAUDE_CLI_USER_AGENT = `claude-cli/${CLAUDE_CLI_VERSION} (external, cli)`;
 export const CLAUDE_CLI_STAINLESS_PACKAGE_VERSION = "0.94.0";
 export const CLAUDE_CLI_STAINLESS_RUNTIME_VERSION = "v24.3.0";
diff --git a/open-sse/config/codexClient.ts b/open-sse/config/codexClient.ts
index 1b6afa395f..339886a8e6 100644
--- a/open-sse/config/codexClient.ts
+++ b/open-sse/config/codexClient.ts
@@ -1,4 +1,4 @@
-const DEFAULT_CODEX_CLIENT_VERSION = "0.142.0";
+const DEFAULT_CODEX_CLIENT_VERSION = "0.144.1";
 const DEFAULT_CODEX_USER_AGENT_PLATFORM = "Windows 10.0.26200";
 const DEFAULT_CODEX_USER_AGENT_ARCH = "x64";
 const CODEX_VERSION_OVERRIDE_ENV = "CODEX_CLIENT_VERSION";
diff --git a/open-sse/config/codexIdentity.ts b/open-sse/config/codexIdentity.ts
index 2d336046f6..5f299af02f 100644
--- a/open-sse/config/codexIdentity.ts
+++ b/open-sse/config/codexIdentity.ts
@@ -69,6 +69,37 @@ export function applyCodexClientIdentityHeaders(
   });
 }
 
+/**
+ * #3697: detect the Codex CLI as the request *client* (not the routed provider) from
+ * request headers, so the model-echo shim can fire regardless of which upstream provider
+ * ultimately serves the request (e.g. `codex/gpt-5.5-xhigh` routed through a combo).
+ * Mirrors the `originator`/User-Agent detection proven in `isCodexModelCatalogClient`
+ * (PR #3481, `src/app/api/v1/models/catalogRequest.ts`) — Codex CLI sends an `originator`
+ * header of `codex_exec`/`codex_cli_rs` and a matching `codex_*` User-Agent — but works off
+ * a plain headers bag (`Headers` or a header-name→value record) instead of a `Request`,
+ * since chatCore's `clientRawRequest.headers` is not always a `Request`.
+ */
+export function isCodexOriginatedHeaders(
+  headers: Headers | Record<string, unknown> | null | undefined
+): boolean {
+  const getHeader = (name: string): string => {
+    if (headers instanceof Headers) {
+      return headers.get(name)?.toLowerCase() ?? "";
+    }
+    if (headers && typeof headers === "object") {
+      for (const [key, value] of Object.entries(headers as Record<string, unknown>)) {
+        if (key.toLowerCase() === name && typeof value === "string") {
+          return value.toLowerCase();
+        }
+      }
+    }
+    return "";
+  };
+
+  if (getHeader("originator").startsWith("codex")) return true;
+  return getHeader("user-agent").startsWith("codex");
+}
+
 export function applyCodexClientMetadata(
   body: Record<string, unknown>,
   identity?: CodexClientIdentity | null
diff --git a/open-sse/config/constants.ts b/open-sse/config/constants.ts
index 881ce9fbd2..381dd9fe9b 100644
--- a/open-sse/config/constants.ts
+++ b/open-sse/config/constants.ts
@@ -108,6 +108,7 @@ export const PROVIDER_MAX_TOKENS: Record<string, number> = {
   openai: 16384, // GPT-4/4o standard
   anthropic: 65536, // Claude models
   gemini: 65536, // Gemini Studio
+  sensenova: 65536, // SenseNova Token Plan rejects MaxTokens outside [1, 65536]
 };
 
 export const DEFAULT_PROVIDER_MAX_TOKENS = 32000;
diff --git a/open-sse/config/errorConfig.ts b/open-sse/config/errorConfig.ts
index e685fe60a8..f5ac29fde3 100644
--- a/open-sse/config/errorConfig.ts
+++ b/open-sse/config/errorConfig.ts
@@ -199,3 +199,41 @@ export function matchErrorRuleByStatus(statusCode: number): ErrorRule | null {
 export function findMatchingErrorRule(statusCode: number, message: unknown): ErrorRule | null {
   return matchErrorRuleByText(message) || matchErrorRuleByStatus(statusCode);
 }
+
+export interface ServiceSupervisorCooldown {
+  shouldFallback: true;
+  cooldownMs: number;
+  baseCooldownMs: number;
+  newBackoffLevel: 0;
+  reason: string;
+  skipProviderBreaker: true;
+}
+
+/**
+ * G-02: detect embedded service supervisor failures (X-Omni-Fallback-Hint: connection_cooldown).
+ * These are NOT upstream AI provider failures — they are local supervisor state changes. Returns
+ * a short 5s connection-cooldown decision (no provider circuit-breaker trip), or null when the
+ * status/header don't match.
+ */
+export function serviceSupervisorCooldown(
+  status: number,
+  headers: Headers | Record<string, string> | null
+): ServiceSupervisorCooldown | null {
+  if (status !== 503 || !headers) return null;
+  const hintValue =
+    typeof (headers as Headers).get === "function"
+      ? (headers as Headers).get("x-omni-fallback-hint")
+      : (headers as Record<string, string>)["x-omni-fallback-hint"] ||
+        (headers as Record<string, string>)["X-Omni-Fallback-Hint"];
+  if (typeof hintValue !== "string" || hintValue.toLowerCase() !== "connection_cooldown") {
+    return null;
+  }
+  return {
+    shouldFallback: true,
+    cooldownMs: 5_000,
+    baseCooldownMs: 5_000,
+    newBackoffLevel: 0,
+    reason: "service_not_running",
+    skipProviderBreaker: true,
+  };
+}
diff --git a/open-sse/config/freeModelCatalog.data.ts b/open-sse/config/freeModelCatalog.data.ts
index 81cfb498a7..a9accafb60 100644
--- a/open-sse/config/freeModelCatalog.data.ts
+++ b/open-sse/config/freeModelCatalog.data.ts
@@ -234,7 +234,6 @@ export const FREE_MODEL_BUDGETS: FreeModelBudget[] = [
   { provider: "hyperbolic", modelId: "Qwen/Qwen2.5-Coder-32B-Instruct", displayName: "Qwen 2.5 Coder 32B", monthlyTokens: 0, creditTokens: 5000000, freeType: "one-time-initial", poolKey: "hyperbolic", tos: "ok" },
   { provider: "hyperbolic", modelId: "NousResearch/Hermes-3-Llama-3.1-70B", displayName: "Hermes 3 70B", monthlyTokens: 0, creditTokens: 5000000, freeType: "one-time-initial", poolKey: "hyperbolic", tos: "ok" },
   { provider: "iflytek", modelId: "generalv3.5", displayName: "General V3.5", monthlyTokens: 0, creditTokens: 0, freeType: "keyless", poolKey: "iflytek", tos: "avoid" },
-  { provider: "inclusionai", modelId: "inclusion-model", displayName: "Inclusion Model", monthlyTokens: 15000000, creditTokens: 0, freeType: "recurring-daily", poolKey: "inclusionai", tos: "ambiguous" },
   { provider: "inference-net", modelId: "meta-llama/Llama-3.3-70B-Instruct", displayName: "meta-llama/Llama-3.3-70B-Instruct", monthlyTokens: 0, creditTokens: 0, freeType: "recurring-monthly", poolKey: "inference-net", tos: "caution" },
   { provider: "inference-net", modelId: "deepseek-ai/DeepSeek-R1", displayName: "deepseek-ai/DeepSeek-R1", monthlyTokens: 0, creditTokens: 0, freeType: "recurring-monthly", poolKey: "inference-net", tos: "caution" },
   { provider: "inference-net", modelId: "Qwen/Qwen2.5-72B-Instruct", displayName: "Qwen/Qwen2.5-72B-Instruct", monthlyTokens: 0, creditTokens: 0, freeType: "recurring-monthly", poolKey: "inference-net", tos: "caution" },
diff --git a/open-sse/config/freeTierCatalog.ts b/open-sse/config/freeTierCatalog.ts
index 48a08179fb..5262697625 100644
--- a/open-sse/config/freeTierCatalog.ts
+++ b/open-sse/config/freeTierCatalog.ts
@@ -21,7 +21,6 @@ export const FREE_TIER_BUDGETS: Record<string, number> = {
   "ollama-cloud": 20_000_000,
   "github-models": 18_000_000,
   groq: 15_000_000,
-  inclusionai: 15_000_000,
   bluesminds: 7_200_000,
   sambanova: 6_000_000,
   "arcee-ai": 4_800_000,
diff --git a/open-sse/config/glmProvider.ts b/open-sse/config/glmProvider.ts
index 32bf03e8d2..951e9e550d 100644
--- a/open-sse/config/glmProvider.ts
+++ b/open-sse/config/glmProvider.ts
@@ -150,7 +150,7 @@ export const GLMT_REQUEST_DEFAULTS = Object.freeze({
 });
 
 export const GLM_COUNT_TOKENS_TIMEOUT_MS = 3_000;
-export const GLM_CLAUDE_CODE_USER_AGENT = "claude-cli/2.1.195 (external, sdk-cli)";
+export const GLM_CLAUDE_CODE_USER_AGENT = "claude-cli/2.1.207 (external, sdk-cli)";
 export const GLM_ANTHROPIC_BETA = [
   "claude-code-20250219",
   "interleaved-thinking-2025-05-14",
diff --git a/open-sse/config/imageRegistry.ts b/open-sse/config/imageRegistry.ts
index 330a37c730..41850fe2cf 100644
--- a/open-sse/config/imageRegistry.ts
+++ b/open-sse/config/imageRegistry.ts
@@ -5,6 +5,8 @@
  * Each provider has its own request format and endpoint.
  */
 
+import { LMARENA_DIRECT_IMAGE_MODELS } from "./providers/registry/lmarena/directModels.ts";
+
 interface ImageModelEntry {
   id: string;
   name: string;
@@ -147,7 +149,11 @@ export const IMAGE_PROVIDERS: Record<string, ImageProviderConfig> = {
     authType: "oauth",
     authHeader: "bearer",
     format: "codex-responses",
-    models: [{ id: "gpt-5.5", name: "GPT 5.5 (Codex Image)" }],
+    models: [
+      { id: "gpt-5.6-sol", name: "GPT 5.6 Sol (Codex Image)" },
+      { id: "gpt-5.6-terra", name: "GPT 5.6 Terra (Codex Image)" },
+      { id: "gpt-5.6-luna", name: "GPT 5.6 Luna (Codex Image)" },
+    ],
     supportedSizes: ["1024x1024", "1024x1536", "1536x1024"],
   },
 
@@ -158,7 +164,7 @@ export const IMAGE_PROVIDERS: Record<string, ImageProviderConfig> = {
     authType: "apikey",
     authHeader: "cookie",
     format: "chatgpt-web",
-    models: [{ id: "gpt-5.3-instant", name: "GPT-5.3 Instant (ChatGPT Web Image)" }],
+    models: [{ id: "gpt-5.5", name: "GPT-5.5 Instant (ChatGPT Web Image)" }],
     supportedSizes: ["1024x1024", "1024x1536", "1536x1024"],
   },
 
@@ -576,7 +582,11 @@ export const IMAGE_PROVIDERS: Record<string, ImageProviderConfig> = {
     authHeader: "bearer",
     format: "nvidia-nim",
     models: [
-      { id: "black-forest-labs/flux.1-dev", name: "FLUX.1 Dev", inputModalities: ["text", "image"] },
+      {
+        id: "black-forest-labs/flux.1-dev",
+        name: "FLUX.1 Dev",
+        inputModalities: ["text", "image"],
+      },
       { id: "black-forest-labs/flux.1-schnell", name: "FLUX.1 Schnell" },
       {
         id: "black-forest-labs/flux.1-kontext-dev",
@@ -625,6 +635,20 @@ export const IMAGE_PROVIDERS: Record<string, ImageProviderConfig> = {
     ],
     supportedSizes: ["1024x1024"],
   },
+
+  // Arena (formerly LMArena) Direct-chat Image category (static scrape 2026-07-09).
+  // Not listed in the chat registry — image catalog only. Generation path still
+  // uses cookie session auth via the lmarena provider connection (stable wire id).
+  lmarena: {
+    id: "lmarena",
+    alias: "lma",
+    baseUrl: "https://arena.ai/nextjs-api/stream/create-evaluation",
+    authType: "apikey",
+    authHeader: "cookie",
+    format: "openai",
+    models: LMARENA_DIRECT_IMAGE_MODELS,
+    supportedSizes: ["1024x1024", "1024x1792", "1792x1024"],
+  },
 };
 
 /**
@@ -723,6 +747,19 @@ export function getImageModelAliases() {
   return IMAGE_MODEL_ALIASES;
 }
 
+/**
+ * #6457 — precise provider+modelId membership check against the image registry.
+ * Unlike getImageModelEntry() (which also resolves bare aliases and unprefixed
+ * ids by scanning every provider), this only answers "is `modelId` registered
+ * as an image model under this exact `providerId`?" — used by the chat catalog
+ * builder to keep upstream-discovered models (e.g. HuggingFace's live
+ * `/v1/models`, which returns image/diffusion models with no modality field)
+ * out of the chat listing when they are already known image-only models.
+ */
+export function isRegisteredImageModel(providerId, modelId) {
+  return Boolean(findImageModelConfig(providerId, modelId));
+}
+
 export function getImageModelEntry(modelStr) {
   if (!modelStr) return null;
 
diff --git a/open-sse/config/providerFieldStrips.ts b/open-sse/config/providerFieldStrips.ts
index 5a342cc9c1..b02bb37851 100644
--- a/open-sse/config/providerFieldStrips.ts
+++ b/open-sse/config/providerFieldStrips.ts
@@ -22,6 +22,26 @@ export function findOffendingField(bodyText: string): string | null {
   return null;
 }
 
+/**
+ * Regex to extract an unsupported parameter name from upstream 400 error text.
+ * Matches:
+ *   - "Unsupported parameter(s): thinking"
+ *   - "Unsupported parameter: max_tokens"
+ *   - "Unsupported parameter 'reasoning_budget'"
+ */
+export const UNSUPPORTED_PARAM_RE =
+  /unsupported\s+parameter\w*(?:\s*\(s\))?[:\s]+["'`]?(\w+)["'`]?/i;
+
+/**
+ * Extract a single unsupported parameter name from a 400 error body,
+ * or null if the error does not match the known pattern.
+ */
+export function detectUnsupportedParam(bodyText: string): string | null {
+  if (typeof bodyText !== "string" || !bodyText) return null;
+  const match = UNSUPPORTED_PARAM_RE.exec(bodyText);
+  return match?.[1] ?? null;
+}
+
 /** Immutably drop request fields Groq rejects with a 400. */
 export function stripGroqUnsupportedFields<T extends Record<string, unknown>>(body: T): T {
   if (!body || typeof body !== "object") return body;
diff --git a/open-sse/config/providerRegistry.ts b/open-sse/config/providerRegistry.ts
index 85403fdec9..307afe2a18 100644
--- a/open-sse/config/providerRegistry.ts
+++ b/open-sse/config/providerRegistry.ts
@@ -17,7 +17,6 @@ import {
   ALIBABA_DASHSCOPE_MODELS,
   GPT_5_5_CONTEXT_LENGTH,
   GPT_5_5_CODEX_CAPABILITIES,
-  GPT_5_4_CODEX_CAPABILITIES,
   CHAT_OPENAI_COMPAT_MODELS,
   mapStainlessOs,
   mapStainlessArch,
diff --git a/open-sse/config/providers/index.ts b/open-sse/config/providers/index.ts
index 5e49767b63..ae083ecf34 100644
--- a/open-sse/config/providers/index.ts
+++ b/open-sse/config/providers/index.ts
@@ -16,12 +16,12 @@ import { upstageProvider } from "./registry/upstage/index.ts";
 import { nebiusProvider } from "./registry/nebius/index.ts";
 import { fireworksProvider } from "./registry/fireworks/index.ts";
 import { llamagateProvider } from "./registry/llamagate/index.ts";
-import { inclusionaiProvider } from "./registry/inclusionai/index.ts";
 import { glmProvider } from "./registry/glm/index.ts";
 import { glmtProvider } from "./registry/glm/t/index.ts";
 import { glm_cnProvider } from "./registry/glm/cn/index.ts";
 import { traeProvider } from "./registry/trae/index.ts";
 import { muse_spark_webProvider } from "./registry/muse-spark-web/index.ts";
+import { lmarenaProvider } from "./registry/lmarena/index.ts";
 import { kilocodeProvider } from "./registry/kilocode/index.ts";
 import { github_modelsProvider } from "./registry/github/models/index.ts";
 import { githubProvider } from "./registry/github/index.ts";
@@ -77,6 +77,7 @@ import { chipotleProvider } from "./registry/chipotle/index.ts";
 import { freeaiapikeyProvider } from "./registry/freeaiapikey/index.ts";
 import { qwenProvider } from "./registry/qwen/index.ts";
 import { qwen_webProvider } from "./registry/qwen/web/index.ts";
+import { zai_webProvider } from "./registry/zai-web/index.ts";
 import { modalProvider } from "./registry/modal/index.ts";
 import { zenmuxProvider } from "./registry/zenmux/index.ts";
 import { leonardoProvider } from "./registry/leonardo/index.ts";
@@ -88,7 +89,6 @@ import { sensenovaProvider } from "./registry/sensenova/index.ts";
 import { hyperbolicProvider } from "./registry/hyperbolic/index.ts";
 import { lambda_aiProvider } from "./registry/lambda-ai/index.ts";
 import { t3_webProvider } from "./registry/t3-web/index.ts";
-import { klusterProvider } from "./registry/kluster/index.ts";
 import { iflytekProvider } from "./registry/iflytek/index.ts";
 import { crofProvider } from "./registry/crof/index.ts";
 import { moonshotProvider } from "./registry/moonshot/index.ts";
@@ -105,8 +105,8 @@ import { uncloseaiProvider } from "./registry/uncloseai/index.ts";
 import { nscaleProvider } from "./registry/nscale/index.ts";
 import { chatgpt_webProvider } from "./registry/chatgpt-web/index.ts";
 import { openrouterProvider } from "./registry/openrouter/index.ts";
+import { openvectaProvider } from "./registry/openvecta/index.ts";
 import { orcarouterProvider } from "./registry/orcarouter/index.ts";
-import { glhfProvider } from "./registry/glhf/index.ts";
 import { copilot_webProvider } from "./registry/copilot-web/index.ts";
 import { copilot_m365_webProvider } from "./registry/copilot-m365-web/index.ts";
 import { stepfunProvider } from "./registry/stepfun/index.ts";
@@ -202,12 +202,12 @@ export const REGISTRY: Record<string, RegistryEntry> = {
   nebius: nebiusProvider,
   fireworks: fireworksProvider,
   llamagate: llamagateProvider,
-  inclusionai: inclusionaiProvider,
   glm: glmProvider,
   glmt: glmtProvider,
   "glm-cn": glm_cnProvider,
   trae: traeProvider,
   "muse-spark-web": muse_spark_webProvider,
+  lmarena: lmarenaProvider,
   kilocode: kilocodeProvider,
   "github-models": github_modelsProvider,
   github: githubProvider,
@@ -263,6 +263,7 @@ export const REGISTRY: Record<string, RegistryEntry> = {
   freeaiapikey: freeaiapikeyProvider,
   qwen: qwenProvider,
   "qwen-web": qwen_webProvider,
+  "zai-web": zai_webProvider,
   modal: modalProvider,
   zenmux: zenmuxProvider,
   leonardo: leonardoProvider,
@@ -274,7 +275,6 @@ export const REGISTRY: Record<string, RegistryEntry> = {
   hyperbolic: hyperbolicProvider,
   "lambda-ai": lambda_aiProvider,
   "t3-web": t3_webProvider,
-  kluster: klusterProvider,
   iflytek: iflytekProvider,
   crof: crofProvider,
   moonshot: moonshotProvider,
@@ -291,8 +291,8 @@ export const REGISTRY: Record<string, RegistryEntry> = {
   nscale: nscaleProvider,
   "chatgpt-web": chatgpt_webProvider,
   openrouter: openrouterProvider,
+  openvecta: openvectaProvider,
   orcarouter: orcarouterProvider,
-  glhf: glhfProvider,
   "copilot-web": copilot_webProvider,
   "copilot-m365-web": copilot_m365_webProvider,
   stepfun: stepfunProvider,
diff --git a/open-sse/config/providers/registry/chatgpt-web/index.ts b/open-sse/config/providers/registry/chatgpt-web/index.ts
index 2106b94a0b..6bdaeed9fc 100644
--- a/open-sse/config/providers/registry/chatgpt-web/index.ts
+++ b/open-sse/config/providers/registry/chatgpt-web/index.ts
@@ -9,15 +9,12 @@ export const chatgpt_webProvider: RegistryEntry = {
   authType: "apikey",
   authHeader: "cookie",
   models: [
-    { id: "gpt-5.5-pro", name: "GPT-5.5 Pro" }, // pro tier only, standard effort
+    { id: "gpt-5.6-pro", name: "GPT-5.6 Pro" }, // pro tier only, standard effort
+    { id: "gpt-5.6-thinking", name: "GPT-5.6 Thinking" }, // plus, pro tier
     { id: "gpt-5.5-pro-extended", name: "GPT-5.5 Pro Extended" }, // pro tier only, extended effort
+    { id: "gpt-5.5-pro", name: "GPT-5.5 Pro" }, // pro tier only, standard effort
     { id: "gpt-5.5-thinking", name: "GPT-5.5 Thinking" }, // plus, pro tier
     { id: "gpt-5.5", name: "GPT-5.5 Instant" }, // free, plus, pro tier
-    { id: "gpt-5.4-pro", name: "GPT-5.4 Pro" }, // pro tier only
-    { id: "gpt-5.4-thinking", name: "GPT-5.4 Thinking" }, // plus, pro tier
-    { id: "gpt-5.4-thinking-mini", name: "GPT-5.4 Thinking Mini" }, // free-login only
-    { id: "gpt-5.3", name: "GPT-5.3 Instant" }, // free, free-login, plus, pro tier
-    { id: "gpt-5.3-mini", name: "GPT-5.3 Mini" }, // limit fallback
     { id: "o3", name: "o3" }, // plus ~ tier
   ],
 };
diff --git a/open-sse/config/providers/registry/clinepass/index.ts b/open-sse/config/providers/registry/clinepass/index.ts
index e6d3697a03..12a57c76ff 100644
--- a/open-sse/config/providers/registry/clinepass/index.ts
+++ b/open-sse/config/providers/registry/clinepass/index.ts
@@ -1,22 +1,33 @@
 import type { RegistryEntry } from "../../shared.ts";
 
-// ClinePass — Cline's $9.99/mo BYOK API-key gateway (https://cline.bot). Distinct
-// from the OAuth `cline` provider: same host (api.cline.bot) but a plain Bearer
-// API key and the `cline-pass/*` model namespace. Responses are wrapped in a
-// {success, data} envelope — unwrapped by open-sse/utils/clinepassEnvelope.ts.
+// ClinePass — Cline's $9.99/mo gateway (https://cline.bot). Dual-auth: sign in
+// with a Cline account (OAuth, reusing the `cline` WorkOS flow) OR paste a direct
+// BYOK API key. Same host (api.cline.bot) as the OAuth `cline` provider; the
+// `cline-pass/*` model namespace. Responses are wrapped in a {success, data}
+// envelope — unwrapped by open-sse/utils/clinepassEnvelope.ts.
 export const clinepassProvider: RegistryEntry = {
   id: "clinepass",
-  alias: "clinepass",
+  // MUST match the OAUTH_PROVIDERS catalog alias (src/shared/constants/providers/oauth.ts).
+  // The dashboard sends models as `<catalogAlias>/<modelId>` (e.g. "cp/cline-pass/glm-5.2"),
+  // and routing resolves the prefix via ALIAS_TO_PROVIDER_ID (built from this field). If the
+  // registry alias drifts from the catalog alias, the prefix won't resolve, the executor falls
+  // back to PROVIDERS.openai, and requests hit api.openai.com with the ClinePass key → 401.
+  alias: "cp",
   format: "openai",
   executor: "default",
   // ClinePass shares Cline's streaming-only API — a non-streaming request returns
   // "generateText is not implemented" / an empty body. Force upstream streaming;
   // chatCore accumulates the SSE and converts it back to JSON for stream:false
-  // clients. (Same as the sibling `cline` provider.)
+  // clients. (Same as the sibling `cline` provider. #6165.)
   forceStream: true,
   baseUrl: "https://api.cline.bot/api/v1/chat/completions",
-  authType: "apikey",
+  authType: "oauth",
   authHeader: "bearer",
+  oauth: {
+    tokenUrl: "https://api.cline.bot/api/v1/auth/token",
+    refreshUrl: "https://api.cline.bot/api/v1/auth/refresh",
+    authUrl: "https://api.cline.bot/api/v1/auth/authorize",
+  },
   extraHeaders: {
     "HTTP-Referer": "https://cline.bot",
     "X-Title": "Cline",
diff --git a/open-sse/config/providers/registry/codex/index.ts b/open-sse/config/providers/registry/codex/index.ts
index d739e09829..01a43c71fb 100644
--- a/open-sse/config/providers/registry/codex/index.ts
+++ b/open-sse/config/providers/registry/codex/index.ts
@@ -1,7 +1,7 @@
 import type { RegistryEntry } from "../../shared.ts";
 import {
+  GPT_5_6_CODEX_CAPABILITIES,
   GPT_5_5_CODEX_CAPABILITIES,
-  GPT_5_4_CODEX_CAPABILITIES,
   getCodexDefaultHeaders,
   resolvePublicCred,
 } from "../../shared.ts";
@@ -24,6 +24,106 @@ export const codexProvider: RegistryEntry = {
     tokenUrl: "https://auth.openai.com/oauth/token",
   },
   models: [
+    {
+      id: "gpt-5.6-sol",
+      name: "GPT 5.6 Sol",
+      ...GPT_5_6_CODEX_CAPABILITIES,
+    },
+    {
+      id: "gpt-5.6-sol-ultra",
+      name: "GPT 5.6 Sol (Ultra)",
+      ...GPT_5_6_CODEX_CAPABILITIES,
+    },
+    {
+      id: "gpt-5.6-sol-max",
+      name: "GPT 5.6 Sol (Max)",
+      ...GPT_5_6_CODEX_CAPABILITIES,
+    },
+    {
+      id: "gpt-5.6-sol-xhigh",
+      name: "GPT 5.6 Sol (xHigh)",
+      ...GPT_5_6_CODEX_CAPABILITIES,
+    },
+    {
+      id: "gpt-5.6-sol-high",
+      name: "GPT 5.6 Sol (High)",
+      ...GPT_5_6_CODEX_CAPABILITIES,
+    },
+    {
+      id: "gpt-5.6-sol-medium",
+      name: "GPT 5.6 Sol (Medium)",
+      ...GPT_5_6_CODEX_CAPABILITIES,
+    },
+    {
+      id: "gpt-5.6-sol-low",
+      name: "GPT 5.6 Sol (Low)",
+      ...GPT_5_6_CODEX_CAPABILITIES,
+    },
+    {
+      id: "gpt-5.6-terra",
+      name: "GPT 5.6 Terra",
+      ...GPT_5_6_CODEX_CAPABILITIES,
+    },
+    {
+      id: "gpt-5.6-terra-ultra",
+      name: "GPT 5.6 Terra (Ultra)",
+      ...GPT_5_6_CODEX_CAPABILITIES,
+    },
+    {
+      id: "gpt-5.6-terra-max",
+      name: "GPT 5.6 Terra (Max)",
+      ...GPT_5_6_CODEX_CAPABILITIES,
+    },
+    {
+      id: "gpt-5.6-terra-xhigh",
+      name: "GPT 5.6 Terra (xHigh)",
+      ...GPT_5_6_CODEX_CAPABILITIES,
+    },
+    {
+      id: "gpt-5.6-terra-high",
+      name: "GPT 5.6 Terra (High)",
+      ...GPT_5_6_CODEX_CAPABILITIES,
+    },
+    {
+      id: "gpt-5.6-terra-medium",
+      name: "GPT 5.6 Terra (Medium)",
+      ...GPT_5_6_CODEX_CAPABILITIES,
+    },
+    {
+      id: "gpt-5.6-terra-low",
+      name: "GPT 5.6 Terra (Low)",
+      ...GPT_5_6_CODEX_CAPABILITIES,
+    },
+    {
+      id: "gpt-5.6-luna",
+      name: "GPT 5.6 Luna",
+      ...GPT_5_6_CODEX_CAPABILITIES,
+    },
+    {
+      id: "gpt-5.6-luna-max",
+      name: "GPT 5.6 Luna (Max)",
+      ...GPT_5_6_CODEX_CAPABILITIES,
+    },
+    {
+      id: "gpt-5.6-luna-xhigh",
+      name: "GPT 5.6 Luna (xHigh)",
+      ...GPT_5_6_CODEX_CAPABILITIES,
+    },
+    {
+      id: "gpt-5.6-luna-high",
+      name: "GPT 5.6 Luna (High)",
+      ...GPT_5_6_CODEX_CAPABILITIES,
+    },
+    {
+      id: "gpt-5.6-luna-medium",
+      name: "GPT 5.6 Luna (Medium)",
+      ...GPT_5_6_CODEX_CAPABILITIES,
+    },
+    {
+      id: "gpt-5.6-luna-low",
+      name: "GPT 5.6 Luna (Low)",
+      ...GPT_5_6_CODEX_CAPABILITIES,
+    },
     // gpt-5.5 codex OAuth backend caps context at 400K (not the public-API
     // 1.05M). Public refs : openai/codex#19208, #19319, #19464 ;
     // opencode#24171. max_output_tokens is stripped server-side
@@ -77,39 +177,6 @@ export const codexProvider: RegistryEntry = {
       maxInputTokens: 272000,
       maxOutputTokens: 128000,
     },
-    {
-      id: "gpt-5.4",
-      name: "GPT 5.4",
-      ...GPT_5_4_CODEX_CAPABILITIES,
-    },
-    {
-      id: "gpt-5.4-xhigh",
-      name: "GPT 5.4 (xHigh)",
-      ...GPT_5_4_CODEX_CAPABILITIES,
-    },
-    {
-      id: "gpt-5.4-high",
-      name: "GPT 5.4 (High)",
-      ...GPT_5_4_CODEX_CAPABILITIES,
-    },
-    {
-      id: "gpt-5.4-medium",
-      name: "GPT 5.4 (Medium)",
-      ...GPT_5_4_CODEX_CAPABILITIES,
-    },
-    {
-      id: "gpt-5.4-low",
-      name: "GPT 5.4 (Low)",
-      ...GPT_5_4_CODEX_CAPABILITIES,
-    },
-    { id: "gpt-5.4-mini", name: "GPT 5.4 Mini", targetFormat: "openai-responses" },
     { id: "gpt-5.3-codex-spark", name: "GPT 5.3 Codex Spark" },
-    {
-      id: "gpt-5.3-codex",
-      name: "GPT 5.3 Codex",
-      targetFormat: "openai-responses",
-      supportsReasoning: true,
-      supportsXHighEffort: true,
-    },
   ],
 };
diff --git a/open-sse/config/providers/registry/cursor/index.ts b/open-sse/config/providers/registry/cursor/index.ts
index 945838c20c..ee9054cd0d 100644
--- a/open-sse/config/providers/registry/cursor/index.ts
+++ b/open-sse/config/providers/registry/cursor/index.ts
@@ -75,6 +75,49 @@ export const cursorProvider: RegistryEntry = {
     { id: "gpt-5.2-xhigh", name: "GPT 5.2 XHigh" },
     { id: "gpt-5.2-xhigh-fast", name: "GPT 5.2 XHigh Fast" },
     //
+    { id: "claude-opus-4-8-low", name: "Claude Opus 4.8 Low" },
+    { id: "claude-opus-4-8-low-fast", name: "Claude Opus 4.8 Low Fast" },
+    { id: "claude-opus-4-8-medium", name: "Claude Opus 4.8 Medium" },
+    { id: "claude-opus-4-8-medium-fast", name: "Claude Opus 4.8 Medium Fast" },
+    { id: "claude-opus-4-8-high", name: "Claude Opus 4.8 High" },
+    { id: "claude-opus-4-8-high-fast", name: "Claude Opus 4.8 High Fast" },
+    { id: "claude-opus-4-8-xhigh", name: "Claude Opus 4.8 XHigh" },
+    { id: "claude-opus-4-8-xhigh-fast", name: "Claude Opus 4.8 XHigh Fast" },
+    { id: "claude-opus-4-8-max", name: "Claude Opus 4.8 Max" },
+    { id: "claude-opus-4-8-max-fast", name: "Claude Opus 4.8 Max Fast" },
+    { id: "claude-opus-4-8-thinking-low", name: "Claude Opus 4.8 Thinking Low" },
+    { id: "claude-opus-4-8-thinking-low-fast", name: "Claude Opus 4.8 Thinking Low Fast" },
+    { id: "claude-opus-4-8-thinking-medium", name: "Claude Opus 4.8 Thinking Medium" },
+    { id: "claude-opus-4-8-thinking-medium-fast", name: "Claude Opus 4.8 Thinking Medium Fast" },
+    { id: "claude-opus-4-8-thinking-high", name: "Claude Opus 4.8 Thinking High" },
+    { id: "claude-opus-4-8-thinking-high-fast", name: "Claude Opus 4.8 Thinking High Fast" },
+    { id: "claude-opus-4-8-thinking-xhigh", name: "Claude Opus 4.8 Thinking XHigh" },
+    { id: "claude-opus-4-8-thinking-xhigh-fast", name: "Claude Opus 4.8 Thinking XHigh Fast" },
+    { id: "claude-opus-4-8-thinking-max", name: "Claude Opus 4.8 Thinking Max" },
+    { id: "claude-opus-4-8-thinking-max-fast", name: "Claude Opus 4.8 Thinking Max Fast" },
+    //
+    { id: "claude-fable-5-low", name: "Claude Fable 5 Low" },
+    { id: "claude-fable-5-medium", name: "Claude Fable 5 Medium" },
+    { id: "claude-fable-5-high", name: "Claude Fable 5 High" },
+    { id: "claude-fable-5-xhigh", name: "Claude Fable 5 XHigh" },
+    { id: "claude-fable-5-max", name: "Claude Fable 5 Max" },
+    { id: "claude-fable-5-thinking-low", name: "Claude Fable 5 Thinking Low" },
+    { id: "claude-fable-5-thinking-medium", name: "Claude Fable 5 Thinking Medium" },
+    { id: "claude-fable-5-thinking-high", name: "Claude Fable 5 Thinking High" },
+    { id: "claude-fable-5-thinking-xhigh", name: "Claude Fable 5 Thinking XHigh" },
+    { id: "claude-fable-5-thinking-max", name: "Claude Fable 5 Thinking Max" },
+    //
+    { id: "claude-sonnet-5-low", name: "Claude Sonnet 5 Low" },
+    { id: "claude-sonnet-5-medium", name: "Claude Sonnet 5 Medium" },
+    { id: "claude-sonnet-5-high", name: "Claude Sonnet 5 High" },
+    { id: "claude-sonnet-5-xhigh", name: "Claude Sonnet 5 XHigh" },
+    { id: "claude-sonnet-5-max", name: "Claude Sonnet 5 Max" },
+    { id: "claude-sonnet-5-thinking-low", name: "Claude Sonnet 5 Thinking Low" },
+    { id: "claude-sonnet-5-thinking-medium", name: "Claude Sonnet 5 Thinking Medium" },
+    { id: "claude-sonnet-5-thinking-high", name: "Claude Sonnet 5 Thinking High" },
+    { id: "claude-sonnet-5-thinking-xhigh", name: "Claude Sonnet 5 Thinking XHigh" },
+    { id: "claude-sonnet-5-thinking-max", name: "Claude Sonnet 5 Thinking Max" },
+    //
     { id: "claude-opus-4-7-low", name: "Claude Opus 4.7 Low" },
     { id: "claude-opus-4-7-medium", name: "Claude Opus 4.7 Medium" },
     { id: "claude-opus-4-7-high", name: "Claude Opus 4.7 High" },
@@ -106,6 +149,13 @@ export const cursorProvider: RegistryEntry = {
     //
     { id: "grok-4.3", name: "Grok 4.3" },
     //
+    { id: "grok-4.5-medium", name: "Grok 4.5 Medium" },
+    { id: "grok-4.5-fast-medium", name: "Grok 4.5 Fast Medium" },
+    { id: "grok-4.5-high", name: "Grok 4.5 High" },
+    { id: "grok-4.5-fast-high", name: "Grok 4.5 Fast High" },
+    { id: "grok-4.5-xhigh", name: "Grok 4.5 XHigh" },
+    { id: "grok-4.5-fast-xhigh", name: "Grok 4.5 Fast XHigh" },
+    //
     { id: "kimi-k2.5", name: "Kimi K2.5" },
   ],
 };
diff --git a/open-sse/config/providers/registry/glhf/index.ts b/open-sse/config/providers/registry/glhf/index.ts
deleted file mode 100644
index 845a19dce7..0000000000
--- a/open-sse/config/providers/registry/glhf/index.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-import type { RegistryEntry } from "../../shared.ts";
-
-export const glhfProvider: RegistryEntry = {
-  id: "glhf",
-  alias: "glhf",
-  format: "openai",
-  executor: "default",
-  baseUrl: "https://api.laf.run/v1/chat/completions",
-  authType: "apikey",
-  authHeader: "bearer",
-  models: [{ id: "deepseek-7b-chat", name: "DeepSeek 7B Chat" }],
-};
diff --git a/open-sse/config/providers/registry/inclusionai/index.ts b/open-sse/config/providers/registry/inclusionai/index.ts
deleted file mode 100644
index d7a3919e5a..0000000000
--- a/open-sse/config/providers/registry/inclusionai/index.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-import type { RegistryEntry } from "../../shared.ts";
-
-export const inclusionaiProvider: RegistryEntry = {
-  id: "inclusionai",
-  alias: "inclusionai",
-  format: "openai",
-  executor: "default",
-  baseUrl: "https://api.inclusionai.tech/v1/chat/completions",
-  authType: "apikey",
-  authHeader: "bearer",
-  models: [{ id: "inclusion-model", name: "Inclusion Model" }],
-};
diff --git a/open-sse/config/providers/registry/kluster/index.ts b/open-sse/config/providers/registry/kluster/index.ts
deleted file mode 100644
index 4fae0ec376..0000000000
--- a/open-sse/config/providers/registry/kluster/index.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-import type { RegistryEntry } from "../../shared.ts";
-
-export const klusterProvider: RegistryEntry = {
-  id: "kluster",
-  alias: "kluster",
-  format: "openai",
-  executor: "default",
-  baseUrl: "https://api.kluster.ai/v1/chat/completions",
-  authType: "apikey",
-  authHeader: "bearer",
-  models: [{ id: "auto", name: "Auto" }],
-};
diff --git a/open-sse/config/providers/registry/lmarena/directModels.ts b/open-sse/config/providers/registry/lmarena/directModels.ts
new file mode 100644
index 0000000000..3e75bc7597
--- /dev/null
+++ b/open-sse/config/providers/registry/lmarena/directModels.ts
@@ -0,0 +1,737 @@
+/**
+ * Arena (formerly LMArena) Direct-chat model allowlist (scraped 2026-07-09).
+ * - Text + Search → chat registry (providers/registry/lmarena, wire id unchanged)
+ * - Image → IMAGE_PROVIDERS in imageRegistry.ts (not chat catalog)
+ * Live HTML discovery is disabled. Scrape JSON stays local/desktop only — not shipped.
+ */
+import type { RegistryModel } from "../../shared.ts";
+
+export interface LmarenaDirectModelEntry {
+  catalogId: string;
+  arenaId: string;
+  publicName: string;
+  displayName: string;
+  organization: string;
+  vision: boolean;
+  category: string;
+}
+
+export const LMARENA_DIRECT_MODEL_ENTRIES: readonly LmarenaDirectModelEntry[] = Object.freeze([
+  {
+    catalogId: "amazon.nova-pro-v1:0",
+    arenaId: "a14546b5-d78d-4cf6-bb61-ab5b8510a9d6",
+    publicName: "amazon.nova-pro-v1:0",
+    displayName: "amazon.nova-pro-v1:0",
+    organization: "amazon",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "claude-haiku-4-5-20251001",
+    arenaId: "0199e8e9-01ed-73e0-96ba-cf43b286bf10",
+    publicName: "claude-haiku-4-5-20251001",
+    displayName: "claude-haiku-4-5-20251001",
+    organization: "anthropic",
+    vision: false,
+    category: "Text",
+  },
+  {
+    catalogId: "claude-sonnet-5",
+    arenaId: "019f19f2-41f1-7c6d-9891-48d02fd9952c",
+    publicName: "claude-sonnet-5",
+    displayName: "claude-sonnet-5-high",
+    organization: "anthropic",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "deepseek-v4-pro-thinking",
+    arenaId: "019dc1c1-c62d-7b70-85a1-e0565e29fce1",
+    publicName: "deepseek-v4-pro-thinking",
+    displayName: "deepseek-v4-pro-thinking",
+    organization: "deepseek",
+    vision: false,
+    category: "Text",
+  },
+  {
+    catalogId: "dola-seed-2.0-preview-vision",
+    arenaId: "019c6453-641a-74f8-a689-a8a67175a359",
+    publicName: "dola-seed-2.0-preview-vision",
+    displayName: "dola-seed-2.0-preview-vision",
+    organization: "bytedance",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "ernie-5.0-preview-1220",
+    arenaId: "019d44f1-26da-729f-a4ea-ddddfe7b4eae",
+    publicName: "ernie-5.0-preview-1220",
+    displayName: "ernie-5.0-preview-1220",
+    organization: "baidu",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "gemini-3.1-flash-lite",
+    arenaId: "019f408a-186c-7f3a-9595-4e079e42a613",
+    publicName: "gemini-3.1-flash-lite",
+    displayName: "gemini-3.1-flash-lite",
+    organization: "google",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "gemini-3.1-pro-preview",
+    arenaId: "019c7820-5480-78b6-9fef-04c0d7004054",
+    publicName: "gemini-3.1-pro-preview",
+    displayName: "gemini-3.1-pro-preview",
+    organization: "google",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "gemini-3.5-flash-high",
+    arenaId: "019f406f-fc33-7b9d-9571-7b8443bc7ca0",
+    publicName: "gemini-3.5-flash-high",
+    displayName: "gemini-3.5-flash-high",
+    organization: "google",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "significant-otter",
+    arenaId: "019d2cd3-2641-7628-94bd-67ecb0a7134e",
+    publicName: "significant-otter",
+    displayName: "gemma-4-26b-a4b",
+    organization: "google",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "pteronura",
+    arenaId: "019d2cd2-dd83-75ab-a421-d0ba2e22b1e3",
+    publicName: "pteronura",
+    displayName: "gemma-4-31b",
+    organization: "google",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "glm-5.1",
+    arenaId: "019ebf6a-94d4-7649-b704-1dbbd5eb0942",
+    publicName: "glm-5.1",
+    displayName: "glm-5.2 (max)",
+    organization: "zai",
+    vision: false,
+    category: "Text",
+  },
+  {
+    catalogId: "glm-5v-turbo",
+    arenaId: "019d4a09-9651-78cb-86ea-bb0fa5ec77f4",
+    publicName: "glm-5v-turbo",
+    displayName: "glm-5v-turbo",
+    organization: "zai",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "gpt-oss-120b",
+    arenaId: "6ee9f901-17b5-4fbe-9cc2-13c16497c23b",
+    publicName: "gpt-oss-120b",
+    displayName: "gpt-oss-120b",
+    organization: "openai",
+    vision: false,
+    category: "Text",
+  },
+  {
+    catalogId: "gpt-5.2-high",
+    arenaId: "019b1449-0313-7911-b836-419e2ed79b2e",
+    publicName: "gpt-5.2-high",
+    displayName: "gpt-5.2-high",
+    organization: "openai",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "gpt-5.4-mini-high",
+    arenaId: "019cfcdd-5426-777e-8314-04619cb92cc4",
+    publicName: "gpt-5.4-mini-high",
+    displayName: "gpt-5.4-mini-high",
+    organization: "openai",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "gpt-5.4-nano-high",
+    arenaId: "019cfcdd-0bca-706f-92b5-a4c4cbd022d8",
+    publicName: "gpt-5.4-nano-high",
+    displayName: "gpt-5.4-nano-high",
+    organization: "openai",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "gpt-5.5-instant",
+    arenaId: "019e71ea-1e1d-740f-9c2d-dab5869ff108",
+    publicName: "gpt-5.5-instant",
+    displayName: "gpt-5.5-instant",
+    organization: "openai",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "grok-4.3/text",
+    arenaId: "019f42aa-9c3b-76d1-8bdf-2e883b1ca227",
+    publicName: "grok-4.3",
+    displayName: "grok-4.5",
+    organization: "xai",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "hunyuan-vision-1.5-thinking",
+    arenaId: "6a3a1e04-050e-4cb4-9052-b9ac4bec0c38",
+    publicName: "hunyuan-vision-1.5-thinking",
+    displayName: "hunyuan-vision-1.5-thinking",
+    organization: "tencent",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "hy3",
+    arenaId: "019f3911-ba1c-7e36-b631-01893e557290",
+    publicName: "hy3",
+    displayName: "hy3",
+    organization: "tencent",
+    vision: false,
+    category: "Text",
+  },
+  {
+    catalogId: "kimi-k2.6",
+    arenaId: "019dac54-e8a4-7c54-904a-ff0ecd82af42",
+    publicName: "kimi-k2.6",
+    displayName: "kimi-k2.6",
+    organization: "moonshot",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "ling-2.5-1t",
+    arenaId: "019c6e76-fbbc-7e92-b0ba-784c7ef3ad8b",
+    publicName: "ling-2.5-1t",
+    displayName: "ling-2.5-1t",
+    organization: "ant-group",
+    vision: false,
+    category: "Text",
+  },
+  {
+    catalogId: "longcat-2.0",
+    arenaId: "019f3a0a-bd19-7b19-9eed-a98453759b48",
+    publicName: "longcat-2.0",
+    displayName: "longcat-2.0",
+    organization: "meituan",
+    vision: false,
+    category: "Text",
+  },
+  {
+    catalogId: "mercury-2",
+    arenaId: "019cc65f-c1e3-7574-b332-898ab71c8211",
+    publicName: "mercury-2",
+    displayName: "mercury-2",
+    organization: "inception-ai",
+    vision: false,
+    category: "Text",
+  },
+  {
+    catalogId: "mimo-v2.5",
+    arenaId: "019db651-bd2f-7d80-ab12-d69c6bb623df",
+    publicName: "mimo-v2.5",
+    displayName: "mimo-v2.5",
+    organization: "xiaomi",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "mimo-v2.5-pro",
+    arenaId: "019db650-909d-7dec-8711-1907d7233cd4",
+    publicName: "mimo-v2.5-pro",
+    displayName: "mimo-v2.5-pro",
+    organization: "xiaomi",
+    vision: false,
+    category: "Text",
+  },
+  {
+    catalogId: "minimax-m3",
+    arenaId: "019e809d-f62d-7192-bb7f-1657e066b5f2",
+    publicName: "minimax-m3",
+    displayName: "minimax-m3",
+    organization: "minimax",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "mistral-large-3",
+    arenaId: "019acbac-df7c-73dc-9716-ebe040daaa4e",
+    publicName: "mistral-large-3",
+    displayName: "mistral-large-3",
+    organization: "mistral",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "mistral-medium-3.5",
+    arenaId: "019f30a4-044d-7a14-9d3b-2e7299159e36",
+    publicName: "mistral-medium-3.5",
+    displayName: "mistral-medium-3.5",
+    organization: "mistral",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "mistral-small-2603",
+    arenaId: "019cf983-532b-73fa-a057-7658e1e1c5ee",
+    publicName: "mistral-small-2603",
+    displayName: "mistral-small-2603",
+    organization: "mistral",
+    vision: false,
+    category: "Text",
+  },
+  {
+    catalogId: "nova-2-lite",
+    arenaId: "019ae300-83b7-7717-a1e0-31accd1ff6fa",
+    publicName: "nova-2-lite",
+    displayName: "nova-2-lite",
+    organization: "amazon",
+    vision: false,
+    category: "Text",
+  },
+  {
+    catalogId: "nvidia-nemotron-3-nano-30b-a3b-bf16",
+    arenaId: "019b0aa7-334a-78e8-b2a8-885f31f4fc0c",
+    publicName: "nvidia-nemotron-3-nano-30b-a3b-bf16",
+    displayName: "nvidia-nemotron-3-nano-30b-a3b-bf16",
+    organization: "nvidia",
+    vision: false,
+    category: "Text",
+  },
+  {
+    catalogId: "march26-chatbot1-public",
+    arenaId: "019cd9e3-c3ff-7225-92f2-c392259b1fbe",
+    publicName: "march26-chatbot1-public",
+    displayName: "nvidia-nemotron-3-super-120b-a12b",
+    organization: "nvidia",
+    vision: false,
+    category: "Text",
+  },
+  {
+    catalogId: "may26-chatbot4-public",
+    arenaId: "019e8ea8-2052-7f2e-b1b6-59bd94be5203",
+    publicName: "may26-chatbot4-public",
+    displayName: "nvidia-nemotron-3-ultra-550b-a55b-nvfp4",
+    organization: "nvidia",
+    vision: false,
+    category: "Text",
+  },
+  {
+    catalogId: "o3-2025-04-16",
+    arenaId: "cb0f1e24-e8e9-4745-aabc-b926ffde7475",
+    publicName: "o3-2025-04-16",
+    displayName: "o3-2025-04-16",
+    organization: "openai",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "qwen3.5-397b-a17b",
+    arenaId: "019c6918-1d2a-7e3f-88ec-ada000b6ab16",
+    publicName: "qwen3.5-397b-a17b",
+    displayName: "qwen3.5-397b-a17b",
+    organization: "alibaba",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "qwen3.7-max",
+    arenaId: "019e6530-f140-77b1-b6b8-5c859829d992",
+    publicName: "qwen3.7-max",
+    displayName: "qwen3.7-max",
+    organization: "alibaba",
+    vision: false,
+    category: "Text",
+  },
+  {
+    catalogId: "qwen3.7-plus",
+    arenaId: "019e86fe-167d-77bd-94a8-df7aee4f4551",
+    publicName: "qwen3.7-plus",
+    displayName: "qwen3.7-plus",
+    organization: "alibaba",
+    vision: true,
+    category: "Text",
+  },
+  {
+    catalogId: "ring-2.5-1t",
+    arenaId: "019c6e77-1b9f-7649-9136-43d07566c6c5",
+    publicName: "ring-2.5-1t",
+    displayName: "ring-2.5-1t",
+    organization: "ant-group",
+    vision: false,
+    category: "Text",
+  },
+  {
+    catalogId: "step-3.5-flash",
+    arenaId: "019d22bb-fcf5-7866-9c07-de74fe05c9cc",
+    publicName: "step-3.5-flash",
+    displayName: "step-3.5-flash",
+    organization: "stepfun",
+    vision: false,
+    category: "Text",
+  },
+  {
+    catalogId: "trinity-large-thinking",
+    arenaId: "019d50aa-447d-74d6-8661-405b4b6de5de",
+    publicName: "trinity-large-thinking",
+    displayName: "trinity-large-thinking",
+    organization: "arcee-ai",
+    vision: false,
+    category: "Text",
+  },
+  {
+    catalogId: "cosmos3-super",
+    arenaId: "019f4270-5d10-723c-8a7e-dfd5dd2214e5",
+    publicName: "cosmos3-super",
+    displayName: "cosmos3-super",
+    organization: "nvidia",
+    vision: false,
+    category: "Image",
+  },
+  {
+    catalogId: "cosmos3-super-agentic",
+    arenaId: "019f4270-9eea-79c3-b18f-71303ee41ff8",
+    publicName: "cosmos3-super-agentic",
+    displayName: "cosmos3-super-agentic",
+    organization: "nvidia",
+    vision: false,
+    category: "Image",
+  },
+  {
+    catalogId: "flux-2-dev",
+    arenaId: "019b478d-74ae-7d19-9a8f-6cfde89ab4ca",
+    publicName: "flux-2-dev",
+    displayName: "flux-2-dev",
+    organization: "bfl",
+    vision: true,
+    category: "Image",
+  },
+  {
+    catalogId: "flux-2-pro",
+    arenaId: "019b7541-5e4b-7ff7-a34b-b0255b6ca9aa",
+    publicName: "flux-2-pro",
+    displayName: "flux-2-pro",
+    organization: "bfl",
+    vision: true,
+    category: "Image",
+  },
+  {
+    catalogId: "gemini-2.5-flash-image-preview (nano-banana)",
+    arenaId: "0199ef2a-583f-7088-b704-b75fd169401d",
+    publicName: "gemini-2.5-flash-image-preview (nano-banana)",
+    displayName: "gemini-2.5-flash-image-preview (nano-banana)",
+    organization: "google",
+    vision: true,
+    category: "Image",
+  },
+  {
+    catalogId: "instant-ramen",
+    arenaId: "019ed3b3-c4f8-7e67-b72d-385d740096d0",
+    publicName: "instant-ramen",
+    displayName: "gemini-3.1-flash-lite-image (nano-banana-2-lite)",
+    organization: "google",
+    vision: true,
+    category: "Image",
+  },
+  {
+    catalogId: "gpt-image-1",
+    arenaId: "6e855f13-55d7-4127-8656-9168a9f4dcc0",
+    publicName: "gpt-image-1",
+    displayName: "gpt-image-1",
+    organization: "openai",
+    vision: true,
+    category: "Image",
+  },
+  {
+    catalogId: "blue-crab",
+    arenaId: "019e4271-4717-7dd9-a0e2-90783fbabd25",
+    publicName: "blue-crab",
+    displayName: "grok-imagine-image-quality (20260519)",
+    organization: "xai",
+    vision: true,
+    category: "Image",
+  },
+  {
+    catalogId: "hidream-o1-image",
+    arenaId: "019e1cd7-5cc5-75d2-8b3e-275616dec624",
+    publicName: "hidream-o1-image",
+    displayName: "hidream-o1-image",
+    organization: "hidream",
+    vision: false,
+    category: "Image",
+  },
+  {
+    catalogId: "sungod",
+    arenaId: "019bec2d-e92c-745d-ae46-c7166590237a",
+    publicName: "sungod",
+    displayName: "hunyuan-image-3.0-instruct",
+    organization: "tencent",
+    vision: true,
+    category: "Image",
+  },
+  {
+    catalogId: "ideogram-v3-quality",
+    arenaId: "73378be5-cdba-49e7-b3d0-027949871aa6",
+    publicName: "ideogram-v3-quality",
+    displayName: "ideogram-v3-quality",
+    organization: "Ideogram",
+    vision: false,
+    category: "Image",
+  },
+  {
+    catalogId: "krea-2-large",
+    arenaId: "019e8ebd-6cfb-7492-949c-a2c4a00301aa",
+    publicName: "krea-2-large",
+    displayName: "krea-2-large",
+    organization: "krea",
+    vision: false,
+    category: "Image",
+  },
+  {
+    catalogId: "krea-2-turbo",
+    arenaId: "019f049d-7de4-7fae-8237-1c2103b9e730",
+    publicName: "krea-2-turbo",
+    displayName: "krea-2-turbo",
+    organization: "krea",
+    vision: false,
+    category: "Image",
+  },
+  {
+    catalogId: "lucid-origin",
+    arenaId: "5a3b3520-c87d-481f-953c-1364687b6e8f",
+    publicName: "lucid-origin",
+    displayName: "lucid-origin",
+    organization: "leonardo-ai",
+    vision: false,
+    category: "Image",
+  },
+  {
+    catalogId: "kakarot-v2",
+    arenaId: "019e80aa-37bf-7e89-8a28-41e4ab72ed9f",
+    publicName: "kakarot-v2",
+    displayName: "mai-image-2.5 (image-edit)",
+    organization: "microsoft-ai",
+    vision: true,
+    category: "Image",
+  },
+  {
+    catalogId: "baryonyx",
+    arenaId: "019e530d-2a50-75e3-95d1-a5ef41d4c24c",
+    publicName: "baryonyx",
+    displayName: "mai-image-2.5 (text-to-image)",
+    organization: "microsoft-ai",
+    vision: false,
+    category: "Image",
+  },
+  {
+    catalogId: "iron-bloom",
+    arenaId: "019ef780-25ef-7878-8b91-307f8f879d42",
+    publicName: "iron-bloom",
+    displayName: "muse-image",
+    organization: "meta",
+    vision: true,
+    category: "Image",
+  },
+  {
+    catalogId: "photon",
+    arenaId: "e7c9fa2d-6f5d-40eb-8305-0980b11c7cab",
+    publicName: "photon",
+    displayName: "photon",
+    organization: "luma-ai",
+    vision: false,
+    category: "Image",
+  },
+  {
+    catalogId: "qwen-image-2.0",
+    arenaId: "019d287c-4906-7f9c-8b78-8a2a86cf00a5",
+    publicName: "qwen-image-2.0",
+    displayName: "qwen-image-2.0",
+    organization: "alibaba",
+    vision: true,
+    category: "Image",
+  },
+  {
+    catalogId: "qwen-image-2.0-pro",
+    arenaId: "019d287b-b718-7daa-ad65-502596d0813d",
+    publicName: "qwen-image-2.0-pro",
+    displayName: "qwen-image-2.0-pro",
+    organization: "alibaba",
+    vision: true,
+    category: "Image",
+  },
+  {
+    catalogId: "recraft-v4",
+    arenaId: "019c6e76-a7c0-7b05-8dce-bbe3d52c8f4e",
+    publicName: "recraft-v4",
+    displayName: "recraft-v4",
+    organization: "Recraft",
+    vision: false,
+    category: "Image",
+  },
+  {
+    catalogId: "avalon",
+    arenaId: "019e7091-f73f-7338-b5e2-4ab5fba37dc2",
+    publicName: "avalon",
+    displayName: "reve-2.0 (image-edit)",
+    organization: "reve",
+    vision: true,
+    category: "Image",
+  },
+  {
+    catalogId: "babylon",
+    arenaId: "019e86c6-a3dc-73ac-9adc-8c5f304dc2fb",
+    publicName: "babylon",
+    displayName: "reve-2.0 (text-to-image)",
+    organization: "reve",
+    vision: false,
+    category: "Image",
+  },
+  {
+    catalogId: "seedream-5.0-pro",
+    arenaId: "019f42b5-8c52-7793-9be8-de35eecf7ea9",
+    publicName: "seedream-5.0-pro",
+    displayName: "seedream-5.0-pro",
+    organization: "bytedance",
+    vision: true,
+    category: "Image",
+  },
+  {
+    catalogId: "uni-1.1-max",
+    arenaId: "019ed208-69ca-7f3f-85ee-182d5f0ea08b",
+    publicName: "uni-1.1-max",
+    displayName: "uni-1.1-max",
+    organization: "luma-ai",
+    vision: true,
+    category: "Image",
+  },
+  {
+    catalogId: "wan2.7-image-pro",
+    arenaId: "019db3f0-b024-7478-bd4d-55ea1ec1d421",
+    publicName: "wan2.7-image-pro",
+    displayName: "wan2.7-image-pro",
+    organization: "wan",
+    vision: true,
+    category: "Image",
+  },
+  {
+    catalogId: "zen-bear-v3",
+    arenaId: "019f38c2-002d-7f0f-a391-db6df024b734",
+    publicName: "zen-bear-v3",
+    displayName: "zen-bear-v3",
+    organization: "alibaba",
+    vision: false,
+    category: "Image",
+  },
+  {
+    catalogId: "claude-sonnet-5-search",
+    arenaId: "019f1a07-de72-7fbe-8d82-56dbd7348360",
+    publicName: "claude-sonnet-5-search",
+    displayName: "claude-sonnet-5-search",
+    organization: "anthropic",
+    vision: false,
+    category: "Search",
+  },
+  {
+    catalogId: "gemini-2.5-pro-grounding",
+    arenaId: "b222be23-bd55-4b20-930b-a30cc84d3afd",
+    publicName: "gemini-2.5-pro-grounding",
+    displayName: "gemini-2.5-pro-grounding",
+    organization: "google",
+    vision: false,
+    category: "Search",
+  },
+  {
+    catalogId: "gemini-3-flash-grounding",
+    arenaId: "019bda1f-3abc-783f-aac0-1ee102b247ba",
+    publicName: "gemini-3-flash-grounding",
+    displayName: "gemini-3-flash-grounding",
+    organization: "google",
+    vision: false,
+    category: "Search",
+  },
+  {
+    catalogId: "gpt-5.2-search",
+    arenaId: "019b1448-f74a-72de-b25d-8666618f8c5a",
+    publicName: "gpt-5.2-search",
+    displayName: "gpt-5.2-search",
+    organization: "openai",
+    vision: false,
+    category: "Search",
+  },
+  {
+    catalogId: "grok-4.3/search",
+    arenaId: "019de22d-1445-7296-9c88-a5877bc66ef8",
+    publicName: "grok-4.3",
+    displayName: "grok-4.3",
+    organization: "xai",
+    vision: false,
+    category: "Search",
+  },
+  {
+    catalogId: "o3-search",
+    arenaId: "fbe08e9a-3805-4f9f-a085-7bc38e4b51d1",
+    publicName: "o3-search",
+    displayName: "o3-search",
+    organization: "openai",
+    vision: false,
+    category: "Search",
+  },
+] as LmarenaDirectModelEntry[]);
+
+/** Chat-completions catalog (Text + Search). Image rows are excluded. */
+export const LMARENA_DIRECT_CHAT_ENTRIES: readonly LmarenaDirectModelEntry[] =
+  LMARENA_DIRECT_MODEL_ENTRIES.filter((m) => m.category === "Text" || m.category === "Search");
+
+/** Image-generation catalog rows (IMAGE_PROVIDERS). */
+export const LMARENA_DIRECT_IMAGE_ENTRIES: readonly LmarenaDirectModelEntry[] =
+  LMARENA_DIRECT_MODEL_ENTRIES.filter((m) => m.category === "Image");
+
+export const LMARENA_DIRECT_MODELS: RegistryModel[] = LMARENA_DIRECT_CHAT_ENTRIES.map((m) => ({
+  id: m.catalogId,
+  name: m.displayName,
+  ...(m.vision ? { supportsVision: true as const } : {}),
+}));
+
+export const LMARENA_DIRECT_IMAGE_MODELS: Array<{
+  id: string;
+  name: string;
+  inputModalities?: string[];
+}> = LMARENA_DIRECT_IMAGE_ENTRIES.map((m) => ({
+  id: m.catalogId,
+  name: m.displayName,
+  inputModalities: m.vision ? ["text", "image"] : ["text"],
+}));
+
+export function resolveLmarenaArenaId(catalogOrArenaId: string): string | null {
+  const raw = catalogOrArenaId.replace(/^(?:lmarena|lma|arena)\//i, "").trim();
+  if (!raw) return null;
+  const uuidRe = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  if (uuidRe.test(raw)) return raw;
+  const lower = raw.toLowerCase();
+  const hit = LMARENA_DIRECT_MODEL_ENTRIES.find(
+    (m) =>
+      m.catalogId === raw ||
+      m.publicName === raw ||
+      m.displayName === raw ||
+      m.catalogId.toLowerCase() === lower ||
+      m.publicName.toLowerCase() === lower ||
+      m.displayName.toLowerCase() === lower
+  );
+  return hit?.arenaId ?? null;
+}
diff --git a/open-sse/config/providers/registry/lmarena/index.ts b/open-sse/config/providers/registry/lmarena/index.ts
new file mode 100644
index 0000000000..ab91a6a9e5
--- /dev/null
+++ b/open-sse/config/providers/registry/lmarena/index.ts
@@ -0,0 +1,18 @@
+import type { RegistryEntry } from "../../shared.ts";
+import { LMARENA_DIRECT_MODELS } from "./directModels.ts";
+
+/**
+ * Arena (formerly LMArena) web-session provider — arena.ai.
+ * Wire id remains `lmarena`. Model list is a static Direct-chat allowlist
+ * (no live arena.ai HTML scrape).
+ */
+export const lmarenaProvider: RegistryEntry = {
+  id: "lmarena",
+  alias: "lma",
+  format: "openai",
+  executor: "lmarena",
+  baseUrl: "https://arena.ai/nextjs-api/stream/create-evaluation",
+  authType: "apikey",
+  authHeader: "cookie",
+  models: LMARENA_DIRECT_MODELS,
+};
diff --git a/open-sse/config/providers/registry/nvidia/index.ts b/open-sse/config/providers/registry/nvidia/index.ts
index c42f8da703..dd2516a4a1 100644
--- a/open-sse/config/providers/registry/nvidia/index.ts
+++ b/open-sse/config/providers/registry/nvidia/index.ts
@@ -8,6 +8,13 @@ export const nvidiaProvider: RegistryEntry = {
   baseUrl: "https://integrate.api.nvidia.com/v1/chat/completions",
   authType: "apikey",
   authHeader: "bearer",
+  // #6773: nvidia multiplexes 17 models from 9 different upstream vendors
+  // (z-ai/, minimaxai/, deepseek-ai/, qwen/, mistralai/, stepfun-ai/,
+  // moonshotai/, openai/, nvidia/) behind ONE connection — mark it passthrough
+  // so a single stale/renamed model's 404 locks out only that model instead
+  // of cooling down the whole connection (see accountFallback.ts
+  // hasPerModelQuota doc comment; matches modelscope/synthetic/kilo-gateway).
+  passthroughModels: true,
   models: [
     // #6108: z-ai/glm-5.1 EOL'd 2026-07-02 (direct probe returns 410) — dropped.
     { id: "z-ai/glm-5.2", name: "GLM 5.2" },
diff --git a/open-sse/config/providers/registry/openai/index.ts b/open-sse/config/providers/registry/openai/index.ts
index fcd291d254..63b6a30fa3 100644
--- a/open-sse/config/providers/registry/openai/index.ts
+++ b/open-sse/config/providers/registry/openai/index.ts
@@ -1,5 +1,5 @@
 import type { RegistryEntry } from "../../shared.ts";
-import { REASONING_UNSUPPORTED } from "../../shared.ts";
+import { GPT_5_6_API_CAPABILITIES, REASONING_UNSUPPORTED } from "../../shared.ts";
 
 export const openaiProvider: RegistryEntry = {
   id: "openai",
@@ -11,6 +11,10 @@ export const openaiProvider: RegistryEntry = {
   authHeader: "bearer",
   defaultContextLength: 128000,
   models: [
+    { id: "gpt-5.6", name: "GPT-5.6", ...GPT_5_6_API_CAPABILITIES },
+    { id: "gpt-5.6-sol", name: "GPT-5.6 Sol", ...GPT_5_6_API_CAPABILITIES },
+    { id: "gpt-5.6-terra", name: "GPT-5.6 Terra", ...GPT_5_6_API_CAPABILITIES },
+    { id: "gpt-5.6-luna", name: "GPT-5.6 Luna", ...GPT_5_6_API_CAPABILITIES },
     { id: "gpt-5.5", name: "GPT-5.5", contextLength: 1050000 },
     // #5842: *-pro reasoning models are responses-only upstream — /v1/chat/completions
     // 404s ("only supported in v1/responses"). targetFormat routes them natively.
@@ -37,7 +41,17 @@ export const openaiProvider: RegistryEntry = {
     { id: "gpt-4o", name: "GPT-4o", contextLength: 128000 },
     { id: "gpt-4o-mini", name: "GPT-4o Mini", contextLength: 128000 },
     { id: "o3", name: "O3", contextLength: 200000, unsupportedParams: REASONING_UNSUPPORTED },
-    { id: "o3-mini", name: "O3 Mini", contextLength: 200000, unsupportedParams: REASONING_UNSUPPORTED },
-    { id: "o4-mini", name: "O4 Mini", contextLength: 200000, unsupportedParams: REASONING_UNSUPPORTED },
+    {
+      id: "o3-mini",
+      name: "O3 Mini",
+      contextLength: 200000,
+      unsupportedParams: REASONING_UNSUPPORTED,
+    },
+    {
+      id: "o4-mini",
+      name: "O4 Mini",
+      contextLength: 200000,
+      unsupportedParams: REASONING_UNSUPPORTED,
+    },
   ],
 };
diff --git a/open-sse/config/providers/registry/openvecta/index.ts b/open-sse/config/providers/registry/openvecta/index.ts
new file mode 100644
index 0000000000..25753438b5
--- /dev/null
+++ b/open-sse/config/providers/registry/openvecta/index.ts
@@ -0,0 +1,30 @@
+import type { RegistryEntry } from "../../shared.ts";
+import { buildOpenAiCompatibleRegistryEntry } from "../../shared.ts";
+
+/**
+ * OpenVecta — OpenAI-compatible AI inference gateway (https://openvecta.com/).
+ *
+ * `GET /v1/models` returns the live catalog (LLMs + text-embedding-* models) and
+ * is the source of truth at runtime via NAMED_OPENAI_STYLE_PROVIDERS. The seed
+ * models below cover the most-used LLMs as the offline fallback when the live
+ * fetch fails (network/auth) — same pattern as Together AI / Cerebras / NVIDIA NIM.
+ *
+ * `contextLength` is taken from the upstream `context_length` field per model
+ * (verified live via the OpenVecta /v1/models endpoint, 2026-07-11).
+ */
+export const openvectaProvider: RegistryEntry = buildOpenAiCompatibleRegistryEntry({
+  id: "openvecta",
+  alias: "openvecta",
+  baseUrl: "https://api.openvecta.com/v1/chat/completions",
+  models: [
+    { id: "glm-4.7-flash", name: "GLM 4.7 Flash", contextLength: 131072 },
+    { id: "claude-sonnet-4.6", name: "Claude Sonnet 4.6", contextLength: 1000000 },
+    { id: "deepseek-v4-flash", name: "DeepSeek V4 Flash", contextLength: 131072 },
+    { id: "gpt-oss-120b", name: "GPT OSS 120B", contextLength: 131072 },
+    { id: "gemma-4-31b", name: "Gemma 4 31B", contextLength: 262144 },
+    { id: "kimi-k2.6", name: "Kimi K2.6", contextLength: 200000 },
+    { id: "llama-3.3-70b-instruct", name: "Llama 3.3 70B Instruct", contextLength: 131072 },
+    { id: "llama-4-maverick", name: "Llama 4 Maverick", contextLength: 1048576 },
+    { id: "nemotron-3-super-120b", name: "Nemotron 3 Super 120B", contextLength: 262144 },
+  ],
+});
\ No newline at end of file
diff --git a/open-sse/config/providers/registry/sensenova/index.ts b/open-sse/config/providers/registry/sensenova/index.ts
index 9407e4ef29..37e95acc32 100644
--- a/open-sse/config/providers/registry/sensenova/index.ts
+++ b/open-sse/config/providers/registry/sensenova/index.ts
@@ -5,23 +5,37 @@ export const sensenovaProvider: RegistryEntry = {
   alias: "sensenova",
   format: "openai",
   executor: "default",
-  baseUrl: "https://api.sensenova.cn/v1/chat/completions",
+  baseUrl: "https://token.sensenova.cn/v1/chat/completions",
   authType: "apikey",
   authHeader: "bearer",
-  // Sweep 2026-06-19: refreshed against the official SenseCore compatible-mode catalog.
-  // V6.5-Pro is the heavyweight flagship; the 6.7 generation so far ships only flash-lite.
-  // Note the casing split: V6.5 models are PascalCase-dotted, 6.7 is lowercase-dotted.
+  // SenseNova Token Plan (validated 2026-07-06): the Token Plan endpoint is
+  // OpenAI-compatible but enforces max_tokens in [1, 65536]. Its /models list
+  // also currently advertises sensenova-u1-fast, but chat completions return
+  // 404 "model is not found" for that model; U1 Fast belongs to image flows.
   models: [
-    { id: "SenseNova-V6.5-Pro", name: "SenseNova V6.5 Pro", contextLength: 131072 },
-    { id: "SenseNova-V6.5-Turbo", name: "SenseNova V6.5 Turbo", contextLength: 131072 },
-    { id: "sensenova-6.7-flash-lite", name: "SenseNova 6.7 Flash-Lite" },
-    // DeepSeek V4 Flash is served on SenseNova's free Token Plan (9router#2233).
-    { id: "deepseek-v4-flash", name: "DeepSeek V4 Flash" },
-    { id: "SenseChat-5", name: "SenseChat 5", contextLength: 131072 },
-    { id: "SenseChat-5-Cantonese", name: "SenseChat 5 Cantonese", contextLength: 32768 },
-    { id: "SenseChat-Turbo", name: "SenseChat Turbo", contextLength: 4096 },
-    { id: "SenseChat-Vision", name: "SenseChat Vision", contextLength: 4096 },
-    { id: "SenseChat-Character", name: "SenseChat Character", contextLength: 8192 },
-    { id: "sensechat", name: "SenseChat" },
+    {
+      id: "sensenova-6.7-flash-lite",
+      name: "SenseNova 6.7 Flash-Lite",
+      contextLength: 262144,
+      maxOutputTokens: 65536,
+      supportsVision: true,
+      toolCalling: true,
+    },
+    {
+      id: "deepseek-v4-flash",
+      name: "DeepSeek V4 Flash",
+      contextLength: 1048576,
+      maxOutputTokens: 65536,
+      supportsReasoning: true,
+      interleavedField: "reasoning_content",
+    },
+    {
+      id: "glm-5.2",
+      name: "GLM 5.2",
+      contextLength: 1048576,
+      maxOutputTokens: 65536,
+      supportsReasoning: true,
+      interleavedField: "reasoning_content",
+    },
   ],
 };
diff --git a/open-sse/config/providers/registry/synthetic/index.ts b/open-sse/config/providers/registry/synthetic/index.ts
index 611676ebed..cc9ab28e8f 100644
--- a/open-sse/config/providers/registry/synthetic/index.ts
+++ b/open-sse/config/providers/registry/synthetic/index.ts
@@ -10,12 +10,72 @@ export const syntheticProvider: RegistryEntry = {
   authType: "apikey",
   authHeader: "bearer",
   models: [
-    { id: "hf:nvidia/Kimi-K2.5-NVFP4", name: "Kimi K2.5 (NVFP4)" },
-    { id: "hf:MiniMaxAI/MiniMax-M2.5", name: "MiniMax M2.5" },
-    { id: "hf:zai-org/GLM-4.7-Flash", name: "GLM 4.7 Flash" },
-    { id: "hf:zai-org/GLM-4.7", name: "GLM 4.7" },
-    { id: "hf:moonshotai/Kimi-K2.5", name: "Kimi K2.5" },
-    { id: "hf:deepseek-ai/DeepSeek-V3.2", name: "DeepSeek V3.2" },
+    {
+      id: "hf:openai/gpt-oss-120b",
+      name: "openai/gpt-oss-120b",
+      aliases: ["syn:gpt-oss-120b"],
+      contextLength: 131072,
+      maxOutputTokens: 65536,
+      toolCalling: true,
+      supportsReasoning: true,
+    },
+    {
+      id: "hf:zai-org/GLM-5.2",
+      name: "zai-org/GLM-5.2",
+      aliases: ["syn:large:text"],
+      contextLength: 524288,
+      maxOutputTokens: 65536,
+      toolCalling: true,
+      supportsReasoning: true,
+    },
+    {
+      id: "hf:moonshotai/Kimi-K2.7-Code",
+      name: "moonshotai/Kimi-K2.7-Code",
+      aliases: ["syn:large:vision"],
+      contextLength: 262144,
+      maxOutputTokens: 65536,
+      toolCalling: true,
+      supportsReasoning: true,
+      supportsVision: true,
+    },
+    {
+      id: "hf:Qwen/Qwen3.6-27B",
+      name: "Qwen/Qwen3.6-27B",
+      aliases: ["syn:small:vision"],
+      contextLength: 262144,
+      maxOutputTokens: 65536,
+      toolCalling: true,
+      supportsReasoning: true,
+      supportsVision: true,
+    },
+    {
+      id: "hf:MiniMaxAI/MiniMax-M3",
+      name: "MiniMaxAI/MiniMax-M3",
+      aliases: ["syn:minimax-m3"],
+      contextLength: 262144,
+      maxOutputTokens: 65536,
+      toolCalling: true,
+      supportsReasoning: true,
+      supportsVision: true,
+    },
+    {
+      id: "hf:zai-org/GLM-4.7-Flash",
+      name: "zai-org/GLM-4.7-Flash",
+      aliases: ["syn:small:text"],
+      contextLength: 196608,
+      maxOutputTokens: 65536,
+      toolCalling: true,
+      supportsReasoning: true,
+    },
+    {
+      id: "hf:nvidia/NVIDIA-Nemotron-3-Super-120B-A12B-NVFP4",
+      name: "nvidia/NVIDIA-Nemotron-3-Super-120B-A12B-NVFP4",
+      aliases: ["syn:nemotron-3-super"],
+      contextLength: 262144,
+      maxOutputTokens: 65536,
+      toolCalling: true,
+      supportsReasoning: true,
+    },
   ],
   passthroughModels: true,
 };
diff --git a/open-sse/config/providers/registry/xai/index.ts b/open-sse/config/providers/registry/xai/index.ts
index 501fa4fcbf..f33e247080 100644
--- a/open-sse/config/providers/registry/xai/index.ts
+++ b/open-sse/config/providers/registry/xai/index.ts
@@ -6,12 +6,23 @@ export const xaiProvider: RegistryEntry = {
   format: "openai",
   executor: "xai",
   baseUrl: "https://api.x.ai/v1/chat/completions",
+  // Port of decolua/9router#2439 (author: @ryanngit): xAI ships a native
+  // `/v1/responses` endpoint alongside `/v1/chat/completions`. Consumed by
+  // XaiExecutor.buildUrl (open-sse/executors/xai.ts) for models tagged
+  // targetFormat: "openai-responses" below.
+  responsesBaseUrl: "https://api.x.ai/v1/responses",
   authType: "apikey",
   authHeader: "bearer",
   models: [
     { id: "grok-4.3", name: "Grok 4.3" },
     { id: "grok-build-0.1", name: "Grok Build 0.1", contextLength: 256000 },
-    { id: "grok-4.20-multi-agent-0309", name: "Grok 4.20 Multi Agent" },
+    // Responses-only per upstream 9router#2439: xAI serves this id exclusively
+    // over its native /v1/responses endpoint.
+    {
+      id: "grok-4.20-multi-agent-0309",
+      name: "Grok 4.20 Multi Agent",
+      targetFormat: "openai-responses",
+    },
     { id: "grok-4.20-0309-reasoning", name: "Grok 4.20 Reasoning" },
     { id: "grok-4.20-0309-non-reasoning", name: "Grok 4.20" },
   ],
diff --git a/open-sse/config/providers/registry/zai-web/index.ts b/open-sse/config/providers/registry/zai-web/index.ts
new file mode 100644
index 0000000000..47ad4d5b2f
--- /dev/null
+++ b/open-sse/config/providers/registry/zai-web/index.ts
@@ -0,0 +1,19 @@
+import type { RegistryEntry } from "../../shared.ts";
+
+export const zai_webProvider: RegistryEntry = {
+  id: "zai-web",
+  alias: "zw",
+  format: "openai",
+  executor: "zai-web",
+  // Free consumer web chat at chat.z.ai (Zhipu AI) — see
+  // `open-sse/executors/zai-web.ts` for the cookie/session wire format.
+  // Distinct from the API-key `zai`/`glm` providers (api.z.ai).
+  baseUrl: "https://chat.z.ai",
+  authType: "apikey",
+  authHeader: "cookie",
+  models: [
+    { id: "glm-4.6", name: "GLM-4.6" },
+    { id: "glm-4.5", name: "GLM-4.5" },
+    { id: "glm-4.5v", name: "GLM-4.5V (Vision)" },
+  ],
+};
diff --git a/open-sse/config/providers/shared.ts b/open-sse/config/providers/shared.ts
index 4059673697..acf510ecf9 100644
--- a/open-sse/config/providers/shared.ts
+++ b/open-sse/config/providers/shared.ts
@@ -46,6 +46,7 @@ import { buildGitLabOAuthEndpoints, GITLAB_DUO_DEFAULT_BASE_URL } from "@/lib/oa
 export interface RegistryModel {
   id: string;
   name: string;
+  aliases?: readonly string[];
   toolCalling?: boolean;
   supportsReasoning?: boolean;
   supportsVision?: boolean;
@@ -283,13 +284,27 @@ export const GPT_5_5_CODEX_CAPABILITIES = {
   contextLength: GPT_5_5_CONTEXT_LENGTH,
 } as const;
 
-export const GPT_5_4_CODEX_CAPABILITIES = {
+// Public OpenAI API limits. These differ from the Codex OAuth catalog limits below.
+export const GPT_5_6_API_CAPABILITIES = {
+  toolCalling: true,
+  supportsReasoning: true,
+  supportsVision: true,
+  supportsXHighEffort: true,
+  contextLength: 1050000,
+  maxInputTokens: 922000,
+  maxOutputTokens: 128000,
+} as const;
+
+// Codex's live catalog reports a 372K usable input budget for GPT-5.6.
+// Keep the reserved 128K output budget explicit, matching the GPT-5.5 catalog contract.
+export const GPT_5_6_CODEX_CAPABILITIES = {
   targetFormat: "openai-responses",
   toolCalling: true,
   supportsReasoning: true,
   supportsVision: true,
   supportsXHighEffort: true,
-  contextLength: 200000,
+  contextLength: 500000,
+  maxInputTokens: 372000,
   maxOutputTokens: 128000,
 } as const;
 
diff --git a/open-sse/config/rerankRegistry.ts b/open-sse/config/rerankRegistry.ts
index e44efb16e1..7b8a79801c 100644
--- a/open-sse/config/rerankRegistry.ts
+++ b/open-sse/config/rerankRegistry.ts
@@ -89,6 +89,24 @@ export const RERANK_PROVIDERS = {
     ],
   },
 
+  // OpenRouter exposes a separate, Cohere-compatible POST /api/v1/rerank endpoint
+  // (not surfaced by its live /v1/models feed, which contains 0 rerank ids — confirmed
+  // by direct curl). Model IDs keep their vendor slash (e.g. "cohere/rerank-4-pro");
+  // parseRerankModel splits on the FIRST slash, so 3-segment ids resolve safely, same
+  // as siliconflow above. Seeded by hand and must be maintained here as OpenRouter adds
+  // more rerank models (#6574).
+  openrouter: {
+    id: "openrouter",
+    baseUrl: "https://openrouter.ai/api/v1/rerank",
+    authType: "apikey",
+    authHeader: "bearer",
+    models: [
+      { id: "cohere/rerank-4-pro", name: "Cohere Rerank 4 Pro (via OpenRouter)" },
+      { id: "cohere/rerank-4-fast", name: "Cohere Rerank 4 Fast (via OpenRouter)" },
+      { id: "cohere/rerank-v3.5", name: "Cohere Rerank v3.5 (via OpenRouter)" },
+    ],
+  },
+
   // DeepInfra rerank is NOT Cohere-shaped: POST /v1/inference/<MODEL> with {queries:[q],documents}
   // returning {scores:[…]} (one score per document, positional). The `deepinfra` format adapter in
   // open-sse/handlers/rerank.ts builds the per-model URL and maps scores → Cohere results (#5332).
diff --git a/open-sse/config/toolCloaking.ts b/open-sse/config/toolCloaking.ts
index 22f648eabb..0dab4fc9ac 100644
--- a/open-sse/config/toolCloaking.ts
+++ b/open-sse/config/toolCloaking.ts
@@ -174,6 +174,18 @@ export function cloakAntigravityToolPayload<T extends JsonRecord>(
         ...preservedTools,
         { functionDeclarations: [...cloakedDeclarations, ...decoys] },
       ];
+
+      // The decoy tools mimic real Antigravity IDE built-in agent tools (search_web,
+      // browser_subagent, read_url_content, generate_image), whose names match the
+      // server-side "Built-in tools" categories Gemini 3's Cloud Code backend
+      // recognizes. A genuine Antigravity client always pairs those declarations with
+      // this opt-in flag; without it, mixing them with custom function declarations
+      // gets rejected upstream (#6914).
+      const existingToolConfig = asRecord(nextRequest.toolConfig) ?? {};
+      nextRequest.toolConfig = {
+        ...existingToolConfig,
+        includeServerSideToolInvocations: true,
+      };
       changed = true;
     }
   }
diff --git a/open-sse/executors/antigravity.ts b/open-sse/executors/antigravity.ts
index 5489e9fbb9..494d750836 100644
--- a/open-sse/executors/antigravity.ts
+++ b/open-sse/executors/antigravity.ts
@@ -87,6 +87,9 @@ const ANTIGRAVITY_TRANSIENT_STATUSES = new Set([
   HTTP_STATUS.SERVICE_UNAVAILABLE,
   HTTP_STATUS.GATEWAY_TIMEOUT,
 ]);
+const ANTIGRAVITY_UNSUPPORTED_SAFETY_CATEGORIES = new Set<string>([
+  "HARM_CATEGORY_CIVIC_INTEGRITY",
+]);
 // The upstream API uses plain model IDs (no -high/-low suffix).
 // Tier suffixes were speculative and caused 404 for gemini-3.x models — the
 // bare-Pro→Low normalization was retired (the set stayed empty, making the guard
@@ -440,6 +443,14 @@ function asRecord(value: unknown): Record<string, unknown> | null {
     : null;
 }
 
+function getAntigravitySafetySettings(safetySettings: unknown): unknown[] {
+  const source = Array.isArray(safetySettings) ? safetySettings : DEFAULT_SAFETY_SETTINGS;
+  return source.filter((setting) => {
+    const category = asRecord(setting)?.category;
+    return typeof category !== "string" || !ANTIGRAVITY_UNSUPPORTED_SAFETY_CATEGORIES.has(category);
+  });
+}
+
 function sanitizeAntigravityGeminiRequest(
   request: Record<string, unknown>
 ): Record<string, unknown> {
@@ -687,12 +698,10 @@ export class AntigravityExecutor extends BaseExecutor {
         credentials,
         typeof normalizedRequest?.sessionId === "string" ? normalizedRequest.sessionId : undefined
       ),
-      // #5003: default to all-OFF safety for parity with the native Gemini paths
-      // (claude-to-gemini / openai-to-gemini both default to DEFAULT_SAFETY_SETTINGS).
-      // Previously this was `undefined`, which JSON.stringify drops, so Google Cloud Code
-      // applied its server-side defaults that false-flag benign technical prompts as
-      // `prohibited_content` (HTTP 200 + blocked body → terminal combo failover).
-      safetySettings: normalizedRequest?.safetySettings ?? DEFAULT_SAFETY_SETTINGS,
+      // #5003: send explicit all-OFF safety entries that Cloud Code accepts. Omitting the
+      // field lets Cloud Code apply server-side defaults that false-flag benign technical
+      // prompts as `prohibited_content`.
+      safetySettings: getAntigravitySafetySettings(normalizedRequest?.safetySettings),
       toolConfig:
         Array.isArray(normalizedRequest?.tools) && normalizedRequest.tools.length > 0
           ? { functionCallingConfig: { mode: "VALIDATED" } }
@@ -700,7 +709,9 @@ export class AntigravityExecutor extends BaseExecutor {
     };
 
     const transformedRequest = isClaude
-      ? stripTrailingAntigravityAssistantTurn(sanitizeAntigravityGeminiRequest(rawTransformedRequest))
+      ? stripTrailingAntigravityAssistantTurn(
+          sanitizeAntigravityGeminiRequest(rawTransformedRequest)
+        )
       : rawTransformedRequest;
 
     // Obfuscate sensitive client names in user content (e.g. "OpenCode", "Cursor")
diff --git a/open-sse/executors/auggie.ts b/open-sse/executors/auggie.ts
index a97890f0f1..b4034cbb2d 100644
--- a/open-sse/executors/auggie.ts
+++ b/open-sse/executors/auggie.ts
@@ -77,6 +77,32 @@ function buildAuggieArgs(model: string): string[] {
   return ["--print", "--quiet", "--model", model, "--"];
 }
 
+/**
+ * Spawn options shared by both auggie spawn sites.
+ *
+ * `shell: true` is required on win32: since Node's CVE-2024-27980 fix
+ * (Node >=18.20.2/20.12.2/21.7.3), `spawn()` refuses to launch `.cmd`/`.bat`
+ * targets (e.g. the global-npm `auggie.cmd` shim resolved by
+ * resolveAuggieBin()'s PATH fallback) without shell interpretation, throwing
+ * `spawn EINVAL`. The argv array (built by buildAuggieArgs()) is always a
+ * fixed literal list plus an allowlist-validated `model` — never
+ * interpolated into a shell string — so enabling `shell` here does not
+ * reopen argument-injection: Node still passes argv as discrete array
+ * elements to the shell, it does not concatenate them into a single
+ * command line.
+ */
+export function buildAuggieSpawnOptions(stdio: ["pipe", "pipe", "pipe"]): {
+  env: NodeJS.ProcessEnv;
+  stdio: ["pipe", "pipe", "pipe"];
+  shell: boolean;
+} {
+  return {
+    env: process.env,
+    stdio,
+    shell: process.platform === "win32",
+  };
+}
+
 // ─── Binary discovery ────────────────────────────────────────────────────────
 
 export function resolveAuggieBin(): string {
@@ -267,13 +293,15 @@ export class AuggieExecutor extends BaseExecutor {
   }
 
   private spawnAuggie(auggieBin: string, model: string, promptText: string) {
-    // No `shell` option: argv is passed directly to the OS loader, so no cmd.exe
-    // metacharacter interpretation is possible even on Windows. `model` is already
-    // allowlist-validated by resolveAuggieModel() before reaching here.
-    const child = spawn(auggieBin, buildAuggieArgs(model), {
-      env: process.env,
-      stdio: ["pipe", "pipe", "pipe"],
-    });
+    // `shell: true` on win32 only (see buildAuggieSpawnOptions() for why) — argv
+    // stays a fixed literal array; `model` is already allowlist-validated by
+    // resolveAuggieModel() before reaching here, so no argument-injection surface
+    // is reopened by shell interpretation.
+    const child = spawn(
+      auggieBin,
+      buildAuggieArgs(model),
+      buildAuggieSpawnOptions(["pipe", "pipe", "pipe"])
+    );
     // EPIPE from a fast-exiting CLI arrives ASYNCHRONOUSLY as an 'error' event on
     // stdin (not a sync throw), so the try/catch below cannot swallow it — without
     // this handler the unhandled stream error crashes the process instead of
@@ -368,12 +396,14 @@ export class AuggieExecutor extends BaseExecutor {
 
         let child: ReturnType<typeof spawn>;
         try {
-          // No `shell` option — argv goes straight to the OS loader (no cmd.exe
-          // interpretation). `model` is already allowlist-validated upstream.
-          child = spawn(auggieBin, buildAuggieArgs(model), {
-            env: process.env,
-            stdio: ["pipe", "pipe", "pipe"],
-          });
+          // `shell: true` on win32 only (see buildAuggieSpawnOptions() for why).
+          // `model` is already allowlist-validated upstream, so shell interpretation
+          // does not reopen argument-injection.
+          child = spawn(
+            auggieBin,
+            buildAuggieArgs(model),
+            buildAuggieSpawnOptions(["pipe", "pipe", "pipe"])
+          );
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
           emitError(
diff --git a/open-sse/executors/base.ts b/open-sse/executors/base.ts
index 59e64bde69..0058affe32 100644
--- a/open-sse/executors/base.ts
+++ b/open-sse/executors/base.ts
@@ -4,7 +4,16 @@ import {
   normalizeAnthropicHeaderVariants,
 } from "../config/anthropicHeaders.ts";
 import { applyContextEditingToBody } from "../config/contextEditing.ts";
-import { findOffendingField, stripGroqUnsupportedFields } from "../config/providerFieldStrips.ts";
+import {
+  findOffendingField,
+  detectUnsupportedParam,
+  stripGroqUnsupportedFields,
+} from "../config/providerFieldStrips.ts";
+import {
+  getParamFilterConfig,
+  addParamToBlocklist,
+  isAutoLearnGloballyEnabled,
+} from "@/lib/db/paramFilters";
 import { applyFingerprint, isCliCompatEnabled } from "../config/cliFingerprints.ts";
 import { supportsClaudeMaxEffort, supportsXHighEffort } from "../config/providerModels.ts";
 import { getThinkingBudgetConfig, ThinkingMode } from "../services/thinkingBudget.ts";
@@ -1261,6 +1270,39 @@ export class BaseExecutor {
               `Upstream 400 rejected ${offending} on ${url} — retrying without it`
             );
             response = await fetchWithStartTimeout(url, { ...fetchOptions, body: retryBody });
+          } else {
+            // Auto-learn: detect "Unsupported parameter" errors and persist to DB
+            // when the provider config has autoLearn enabled (#6625).
+            const autoLearned = detectUnsupportedParam(errText);
+            if (
+              autoLearned &&
+              !strippedFields.has(autoLearned) &&
+              (transformedBody as Record<string, unknown>)[autoLearned] !== undefined
+            ) {
+              try {
+                const config = getParamFilterConfig(this.provider);
+                const shouldAutoLearn = isAutoLearnGloballyEnabled() || config?.autoLearn === true;
+                if (shouldAutoLearn) {
+                  strippedFields.add(autoLearned);
+                  addParamToBlocklist(this.provider, autoLearned, model);
+                  delete (transformedBody as Record<string, unknown>)[autoLearned];
+                  let retryBody = JSON.stringify(transformedBody);
+                  if (isClaudeCodeCompatible(this.provider) || this.provider === "claude") {
+                    retryBody = await signRequestBody(retryBody);
+                  }
+                  log?.info?.(
+                    "AUTO_LEARN",
+                    `Auto-learned "${autoLearned}" for provider ${this.provider} (model: ${model}) from 400 on ${url} — retrying`
+                  );
+                  response = await fetchWithStartTimeout(url, { ...fetchOptions, body: retryBody });
+                }
+              } catch (learnError) {
+                log?.warn?.(
+                  "AUTO_LEARN",
+                  `Failed to persist auto-learned param "${autoLearned}" for ${this.provider}: ${String(learnError)}`
+                );
+              }
+            }
           }
         }
 
diff --git a/open-sse/executors/chatgpt-web.ts b/open-sse/executors/chatgpt-web.ts
index 17125d4fcb..8be020cf8a 100644
--- a/open-sse/executors/chatgpt-web.ts
+++ b/open-sse/executors/chatgpt-web.ts
@@ -33,6 +33,8 @@ import {
   type ChatGptImageConversationContext,
 } from "../services/chatgptImageCache.ts";
 import { isThinkingCapableModel, resolveChatGptModel } from "./chatgpt-web/models.ts";
+import { cleanChatGptText } from "./chatgpt-web/citations.ts";
+import { resumeChatGptHandoff, type FinalAssistantAnswer } from "./chatgpt-web/handoff.ts";
 
 // ─── Constants ──────────────────────────────────────────────────────────────
 
@@ -83,8 +85,7 @@ function deviceIdFor(cookie: string): string {
 // OmniRoute model ID → ChatGPT internal slug. The public ChatGPT Web catalog
 // keeps OmniRoute's historical dot-form IDs (e.g. "gpt-5.5-pro"), while
 // ChatGPT's backend routes use dash-form slugs (e.g. "gpt-5-5-pro"). The slug
-// catalog comes from /backend-api/models on a logged-in account;
-// "gpt-5-4-t-mini" is ChatGPT's abbreviated slug for "GPT-5.4 Thinking Mini".
+// catalog comes from /backend-api/models on a logged-in account.
 
 // ─── Browser-like default headers ──────────────────────────────────────────
 
@@ -1068,6 +1069,7 @@ interface ChatGptStreamEvent {
   conversation_id?: string;
   error?: string | { message?: string; code?: string };
   type?: string;
+  token?: string;
   v?: unknown;
 }
 
@@ -1165,6 +1167,7 @@ interface ContentChunk {
   answer?: string;
   conversationId?: string;
   messageId?: string;
+  metadata?: Record<string, unknown>;
   error?: string;
   done?: boolean;
   /** Image asset pointers seen on the current message (e.g. file-service://file-abc). */
@@ -1178,6 +1181,8 @@ interface ContentChunk {
   imageGenAsync?: boolean;
   /** True when ChatGPT handed the turn off to a long-running worker. */
   handoff?: boolean;
+  /** Short-lived conduit token used to resume a Temporary Chat handoff. */
+  resumeToken?: string;
 }
 
 interface ImagePointerRef {
@@ -1226,6 +1231,7 @@ async function* extractContent(
   let conversationId: string | null = null;
   let currentId: string | null = null;
   let currentParts = "";
+  let currentMetadata: Record<string, unknown> | undefined;
   let emittedLen = 0;
   let isLive = false;
   // Dedupe pointers across echoes / repeated events. Order-preserving Set.
@@ -1235,6 +1241,7 @@ async function* extractContent(
   // WebSocket / polling — caller handles that.
   let imageGenAsync = false;
   let handoff = false;
+  let resumeToken: string | null = null;
 
   for await (const event of readChatGptSseEvents(eventStream, signal)) {
     if (event.error) {
@@ -1248,11 +1255,17 @@ async function* extractContent(
 
     if (event.conversation_id) conversationId = event.conversation_id;
 
+    if (event.type === "resume_conversation_token") {
+      if (typeof event.token === "string" && event.token) resumeToken = event.token;
+      continue;
+    }
+
     if (event.type === "stream_handoff") {
       handoff = true;
       yield {
         conversationId: conversationId ?? undefined,
         handoff: true,
+        resumeToken: resumeToken ?? undefined,
       };
       continue;
     }
@@ -1295,10 +1308,15 @@ async function* extractContent(
     if (id && id !== currentId) {
       currentId = id;
       currentParts = "";
+      currentMetadata = undefined;
       emittedLen = 0;
       isLive = false;
     }
 
+    if (m.metadata && typeof m.metadata === "object") {
+      currentMetadata = m.metadata;
+    }
+
     if (status === "in_progress") {
       isLive = true;
     }
@@ -1337,6 +1355,7 @@ async function* extractContent(
         answer: currentParts,
         conversationId: conversationId ?? undefined,
         messageId: currentId ?? undefined,
+        metadata: currentMetadata,
       };
     }
   }
@@ -1350,6 +1369,7 @@ async function* extractContent(
       answer: currentParts,
       conversationId: conversationId ?? undefined,
       messageId: currentId ?? undefined,
+      metadata: currentMetadata,
     };
   }
 
@@ -1358,9 +1378,11 @@ async function* extractContent(
     answer: currentParts,
     conversationId: conversationId ?? undefined,
     messageId: currentId ?? undefined,
+    metadata: currentMetadata,
     imagePointers: imagePointers.size > 0 ? Array.from(imagePointers.values()) : undefined,
     imageGenAsync,
     handoff,
+    resumeToken: resumeToken ?? undefined,
     done: true,
   };
 }
@@ -1386,12 +1408,6 @@ interface ChatGptConversationDetail {
   mapping?: Record<string, { message?: ChatGptDetailMessage | null }>;
 }
 
-interface FinalAssistantAnswer {
-  text: string;
-  messageId?: string;
-  finished: boolean;
-}
-
 function textFromContentPart(part: unknown): string {
   if (typeof part === "string") return part;
   if (!part || typeof part !== "object") return "";
@@ -1433,12 +1449,17 @@ function extractFinalAssistantAnswer(
       (finished && (!best.finished || sort >= best.sort)) ||
       (!finished && !best.finished && sort >= best.sort)
     ) {
-      best = { text, messageId: message.id, finished, sort };
+      best = { text, messageId: message.id, metadata: message.metadata, finished, sort };
     }
   }
 
   if (!best) return null;
-  return { text: best.text, messageId: best.messageId, finished: best.finished };
+  return {
+    text: best.text,
+    messageId: best.messageId,
+    metadata: best.metadata,
+    finished: best.finished,
+  };
 }
 
 function delayWithAbort(ms: number, signal?: AbortSignal | null): Promise<void> {
@@ -1587,10 +1608,7 @@ type ImageResolver = (
  * "no image was produced". Escalated mesh report: image visible in the ChatGPT
  * chat but returned to OmniRoute as a bare "completed without image markdown".
  */
-export function detectImageResolutionFailure(
-  pointerCount: number,
-  resolvedCount: number
-): boolean {
+export function detectImageResolutionFailure(pointerCount: number, resolvedCount: number): boolean {
   return pointerCount > 0 && resolvedCount === 0;
 }
 
@@ -1640,10 +1658,11 @@ function buildStreamingResponse(
   // stream finishes without an image_asset_pointer. The executor passes a
   // closure here that knows how to poll the conversation endpoint.
   pollAsyncImage: ((conversationId: string) => Promise<ImagePointerRef[]>) | null,
-  // Optional poller for GPT-5.5 Pro's stream_handoff path. Inline text keeps
-  // streaming as-is; once ChatGPT hands off, we append the final assistant
-  // answer fetched from the conversation detail endpoint. Text requests stay
-  // in Temporary Chat, so these polls should not create sidebar/history items.
+  // Native Temporary Chat handoff continuation. ChatGPT provides a short-lived
+  // conduit token, which resumes the turn without saving it to chat history.
+  resumeFinalAnswer:
+    ((conversationId: string, resumeToken: string) => Promise<FinalAssistantAnswer | null>) | null,
+  // Legacy fallback for handoffs that omit the conduit token.
   pollFinalAnswer: ((conversationId: string) => Promise<FinalAssistantAnswer | null>) | null,
   log: { warn?: (tag: string, msg: string) => void } | null,
   signal?: AbortSignal | null
@@ -1673,14 +1692,14 @@ function buildStreamingResponse(
           let imagePointers: ImagePointerRef[] | undefined;
           let imageGenAsync = false;
           let handoff = false;
+          let resumeToken: string | null = null;
           let emittedText = "";
-          let polledFinalAnswer = "";
+          let polledFinalAnswer: FinalAssistantAnswer | null = null;
           let parentCandidateMessageId: string | null = null;
 
-          const emitTextDelta = (content: string): void => {
-            const cleaned = cleanChatGptText(content);
-            if (!cleaned) return;
-            emittedText += cleaned;
+          const emitRenderedDelta = (content: string): void => {
+            if (!content) return;
+            emittedText += content;
             controller.enqueue(
               encoder.encode(
                 sseChunk({
@@ -1692,7 +1711,7 @@ function buildStreamingResponse(
                   choices: [
                     {
                       index: 0,
-                      delta: { content: cleaned },
+                      delta: { content },
                       finish_reason: null,
                       logprobs: null,
                     },
@@ -1702,14 +1721,29 @@ function buildStreamingResponse(
             );
           };
 
-          const appendFinalAnswer = (text: string): void => {
-            const cleaned = cleanChatGptText(text);
+          const emitRenderedAnswer = (
+            rawText: string,
+            metadata?: Record<string, unknown>
+          ): void => {
+            const rendered = cleanChatGptText(rawText, metadata);
+            if (!rendered || rendered.length <= emittedText.length) return;
+            if (!rendered.startsWith(emittedText)) {
+              // We cannot retract bytes already streamed. This should be rare;
+              // it mainly protects clients if ChatGPT rewrites earlier text.
+              const common = commonPrefixLength(rendered, emittedText);
+              if (common < emittedText.length) return;
+            }
+            emitRenderedDelta(rendered.slice(emittedText.length));
+          };
+
+          const appendFinalAnswer = (text: string, metadata?: Record<string, unknown>): void => {
+            const cleaned = cleanChatGptText(text, metadata);
             const finalTrimmed = cleaned.trim();
             if (!finalTrimmed) return;
             const emittedTrimmed = emittedText.trim();
             if (emittedTrimmed === finalTrimmed || emittedTrimmed.endsWith(finalTrimmed)) return;
             const prefix = emittedTrimmed && !emittedText.endsWith("\n") ? "\n\n" : "";
-            emitTextDelta(`${prefix}${cleaned}`);
+            emitRenderedDelta(`${prefix}${cleaned}`);
           };
 
           // Heartbeat: long async work (Pro polling, WebSocket image-gen,
@@ -1745,6 +1779,7 @@ function buildStreamingResponse(
             if (chunk.conversationId) conversationId = chunk.conversationId;
             if (chunk.messageId) parentCandidateMessageId = chunk.messageId;
             if (chunk.handoff) handoff = true;
+            if (chunk.resumeToken) resumeToken = chunk.resumeToken;
             if (chunk.error) {
               controller.enqueue(
                 encoder.encode(
@@ -1772,21 +1807,35 @@ function buildStreamingResponse(
               imagePointers = chunk.imagePointers;
               imageGenAsync = chunk.imageGenAsync ?? false;
               handoff = handoff || (chunk.handoff ?? false);
+              if (chunk.resumeToken) resumeToken = chunk.resumeToken;
               if (chunk.messageId) parentCandidateMessageId = chunk.messageId;
               break;
             }
 
-            if (chunk.delta) {
-              emitTextDelta(chunk.delta);
+            if (chunk.answer) {
+              emitRenderedAnswer(chunk.answer, chunk.metadata);
             }
           }
 
-          if (pollFinalAnswer && conversationId && handoff) {
+          if (resumeFinalAnswer && conversationId && handoff && resumeToken) {
+            const stopHb = startHeartbeat();
+            try {
+              const resumed = await resumeFinalAnswer(conversationId, resumeToken);
+              if (resumed?.text) {
+                polledFinalAnswer = resumed;
+                if (resumed.messageId) parentCandidateMessageId = resumed.messageId;
+              }
+            } finally {
+              stopHb();
+            }
+          }
+
+          if (!polledFinalAnswer && pollFinalAnswer && conversationId && handoff) {
             const stopHb = startHeartbeat();
             try {
               const polled = await pollFinalAnswer(conversationId);
               if (polled?.text) {
-                polledFinalAnswer = polled.text;
+                polledFinalAnswer = polled;
                 if (polled.messageId) parentCandidateMessageId = polled.messageId;
               }
             } finally {
@@ -1795,7 +1844,7 @@ function buildStreamingResponse(
           }
 
           if (polledFinalAnswer) {
-            appendFinalAnswer(polledFinalAnswer);
+            appendFinalAnswer(polledFinalAnswer.text, polledFinalAnswer.metadata);
           }
 
           // Async image_gen ends the SSE with a "Processing image..."
@@ -1962,6 +2011,8 @@ async function buildNonStreamingResponse(
   currentMsg: string,
   resolver: ImageResolver | null,
   pollAsyncImage: ((conversationId: string) => Promise<ImagePointerRef[]>) | null,
+  resumeFinalAnswer:
+    ((conversationId: string, resumeToken: string) => Promise<FinalAssistantAnswer | null>) | null,
   pollFinalAnswer: ((conversationId: string) => Promise<FinalAssistantAnswer | null>) | null,
   log: { warn?: (tag: string, msg: string) => void } | null,
   signal?: AbortSignal | null
@@ -1971,12 +2022,15 @@ async function buildNonStreamingResponse(
   let imagePointers: ImagePointerRef[] | undefined;
   let imageGenAsync = false;
   let handoff = false;
+  let resumeToken: string | null = null;
+  let answerMetadata: Record<string, unknown> | undefined;
   let parentCandidateMessageId: string | null = null;
 
   for await (const chunk of extractContent(eventStream, signal)) {
     if (chunk.conversationId) conversationId = chunk.conversationId;
     if (chunk.messageId) parentCandidateMessageId = chunk.messageId;
     if (chunk.handoff) handoff = true;
+    if (chunk.resumeToken) resumeToken = chunk.resumeToken;
     if (chunk.error) {
       return new Response(
         JSON.stringify({
@@ -1987,24 +2041,45 @@ async function buildNonStreamingResponse(
     }
     if (chunk.done) {
       fullAnswer = chunk.answer || fullAnswer;
+      answerMetadata = chunk.metadata ?? answerMetadata;
       imagePointers = chunk.imagePointers;
       imageGenAsync = chunk.imageGenAsync ?? false;
       handoff = handoff || (chunk.handoff ?? false);
+      if (chunk.resumeToken) resumeToken = chunk.resumeToken;
       if (chunk.messageId) parentCandidateMessageId = chunk.messageId;
       break;
     }
-    if (chunk.answer) fullAnswer = chunk.answer;
+    if (chunk.answer) {
+      fullAnswer = chunk.answer;
+      answerMetadata = chunk.metadata ?? answerMetadata;
+    }
   }
 
-  if (pollFinalAnswer && conversationId && (handoff || !fullAnswer.trim())) {
+  let resumedAnswer: FinalAssistantAnswer | null = null;
+  if (resumeFinalAnswer && conversationId && handoff && resumeToken) {
+    resumedAnswer = await resumeFinalAnswer(conversationId, resumeToken);
+    if (resumedAnswer?.text) {
+      fullAnswer = resumedAnswer.text;
+      answerMetadata = resumedAnswer.metadata ?? answerMetadata;
+      if (resumedAnswer.messageId) parentCandidateMessageId = resumedAnswer.messageId;
+    }
+  }
+
+  if (
+    !resumedAnswer?.text &&
+    pollFinalAnswer &&
+    conversationId &&
+    (handoff || !fullAnswer.trim())
+  ) {
     const polled = await pollFinalAnswer(conversationId);
     if (polled?.text) {
       fullAnswer = polled.text;
+      answerMetadata = polled.metadata ?? answerMetadata;
       if (polled.messageId) parentCandidateMessageId = polled.messageId;
     }
   }
 
-  fullAnswer = cleanChatGptText(fullAnswer);
+  fullAnswer = cleanChatGptText(fullAnswer, answerMetadata);
 
   // Async image gen: SSE ended with "Processing image..." — poll for the
   // final pointer the same way the streaming path does.
@@ -2783,6 +2858,7 @@ export class ChatGptWebExecutor extends BaseExecutor {
     // browser does on page load. Failures here are non-fatal; the worst case
     // is Sentinel still escalates to Turnstile.
     const sessionId = randomUUID();
+    const turnTraceId = randomUUID();
     const deviceId = deviceIdFor(cookie);
     await runSessionWarmup(
       tokenEntry.accessToken,
@@ -2927,6 +3003,7 @@ export class ChatGptWebExecutor extends BaseExecutor {
       Accept: "text/event-stream",
       Authorization: `Bearer ${tokenEntry.accessToken}`,
       Cookie: buildSessionCookieHeader(cookie),
+      "x-oai-turn-trace-id": turnTraceId,
     };
     if (tokenEntry.accountId) headers["chatgpt-account-id"] = tokenEntry.accountId;
     if (reqs.token) headers["openai-sentinel-chat-requirements-token"] = reqs.token;
@@ -3019,6 +3096,16 @@ export class ChatGptWebExecutor extends BaseExecutor {
     const imageResolver = makeImageResolver(resolverCtx);
     const pollAsyncImage = (conversationId: string) =>
       pollForAsyncImage(conversationId, resolverCtx);
+    const resumeFinalAnswer = (conversationId: string, resumeToken: string) =>
+      resumeChatGptHandoff({
+        conversationId,
+        resumeToken,
+        headers,
+        timeoutMs: configuredProPollTimeoutMs(),
+        signal,
+        log,
+        readContent: extractContent,
+      });
     const pollFinalAnswer = resolvedModel.isPro
       ? (conversationId: string) => pollForFinalAssistantAnswer(conversationId, resolverCtx)
       : null;
@@ -3035,6 +3122,7 @@ export class ChatGptWebExecutor extends BaseExecutor {
         created,
         imageResolver,
         pollAsyncImage,
+        resumeFinalAnswer,
         pollFinalAnswer,
         log,
         signal
@@ -3056,6 +3144,7 @@ export class ChatGptWebExecutor extends BaseExecutor {
         parsed.currentMsg,
         imageResolver,
         pollAsyncImage,
+        resumeFinalAnswer,
         pollFinalAnswer,
         log,
         signal
@@ -3073,15 +3162,11 @@ export class ChatGptWebExecutor extends BaseExecutor {
   }
 }
 
-// Strip ChatGPT's internal entity markup. The browser renders these as proper
-// inline citations / chips via JS; for a plain text completion we just want
-// the human-readable form.
-//   entity["city","Paris","capital of France"]  →  Paris
-//   entity["…","value", …]                       →  value
-const ENTITY_RE = /entity\["[^"]*","([^"]*)"[^\]]*\]/g;
-
-function cleanChatGptText(text: string): string {
-  return text.replace(ENTITY_RE, "$1");
+function commonPrefixLength(a: string, b: string): number {
+  const n = Math.min(a.length, b.length);
+  let i = 0;
+  while (i < n && a.charCodeAt(i) === b.charCodeAt(i)) i++;
+  return i;
 }
 
 function stringToStream(text: string): ReadableStream<Uint8Array> {
diff --git a/open-sse/executors/chatgpt-web/citations.ts b/open-sse/executors/chatgpt-web/citations.ts
new file mode 100644
index 0000000000..2f61830ad8
--- /dev/null
+++ b/open-sse/executors/chatgpt-web/citations.ts
@@ -0,0 +1,395 @@
+// Pure ChatGPT-web citation-marker parsing/rendering, extracted verbatim from
+// chatgpt-web.ts (no module state — safe to unit test in isolation).
+//
+// Strip ChatGPT's internal entity/citation markup. The browser renders these
+// private-use markers (for example `citeturn0search0`) with metadata from
+// `message.metadata.content_references`; API clients need plain Markdown with
+// real links instead of raw ChatGPT UI tokens.
+//   entity["city","Paris","capital of France"]  →  Paris
+//   entity["…","value", …]                       →  value
+const ENTITY_RE = /entity\["[^"]*","([^"]*)"[^\]]*\]/g;
+const CHATGPT_MARKER_START = "\uE200";
+const CHATGPT_MARKER_SEP = "\uE202";
+const CHATGPT_MARKER_END = "\uE201";
+const CHATGPT_REF_TOKEN_RE = /turn\d+(?:search|product|news|image|webpage)\d+/g;
+
+type ChatGptCitationSource = {
+  title: string;
+  url: string;
+  attribution: string;
+};
+
+type ChatGptCitationMention = {
+  start?: number;
+  end?: number;
+  markerText?: string;
+  replacement: string;
+};
+
+type ChatGptCitationData = {
+  sources: ChatGptCitationSource[];
+  mentions: ChatGptCitationMention[];
+  refTokenToSourceNumber: Map<string, number>;
+};
+
+function asRecord(value: unknown): Record<string, unknown> | null {
+  return value && typeof value === "object" ? (value as Record<string, unknown>) : null;
+}
+
+function asString(value: unknown): string | null {
+  return typeof value === "string" && value.trim() ? value : null;
+}
+
+function asNumber(value: unknown): number | null {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+
+function asArray(value: unknown): unknown[] {
+  return Array.isArray(value) ? value : [];
+}
+
+function markdownLinkText(value: string): string {
+  // Escape the backslash first — otherwise a label ending in (or containing) a
+  // backslash leaks past the `[…]` escaping and breaks the generated link, e.g.
+  // `[Path C:\](url)` where the trailing `\` escapes the closing bracket.
+  return value
+    .replace(/\\/g, "\\\\")
+    .replace(/\[/g, "\\[")
+    .replace(/\]/g, "\\]")
+    .replace(/\n/g, " ")
+    .trim();
+}
+
+function markdownUrl(value: string): string {
+  return value.replace(/\(/g, "%28").replace(/\)/g, "%29");
+}
+
+function canonicalCitationUrl(value: string): string {
+  try {
+    const url = new URL(value);
+    url.searchParams.delete("utm_source");
+    return url.toString();
+  } catch {
+    return value;
+  }
+}
+
+function referenceUrls(ref: Record<string, unknown>): string[] {
+  const urls: string[] = [];
+  for (const key of ["url", "safe_url", "link"]) {
+    const url = asString(ref[key]);
+    if (url) urls.push(url);
+  }
+  for (const url of asArray(ref.safe_urls)) {
+    if (typeof url === "string" && url.trim()) urls.push(url);
+  }
+  return [...new Set(urls)];
+}
+
+function refTokenFromStructuredRef(ref: Record<string, unknown>): string | null {
+  const turn = asNumber(ref.turn_index);
+  const refType = asString(ref.ref_type);
+  const refIndex = asNumber(ref.ref_index);
+  if (turn == null || refIndex == null || !refType) return null;
+  return `turn${turn}${refType}${refIndex}`;
+}
+
+function mapStructuredRefs(
+  refs: unknown,
+  sourceNumber: number,
+  refTokenToSourceNumber: Map<string, number>
+): void {
+  for (const refValue of asArray(refs)) {
+    const ref = asRecord(refValue);
+    if (!ref) continue;
+    const token = refTokenFromStructuredRef(ref);
+    if (token && !refTokenToSourceNumber.has(token)) {
+      refTokenToSourceNumber.set(token, sourceNumber);
+    }
+  }
+}
+
+function formatCitationLinks(numbers: number[], sources: ChatGptCitationSource[]): string {
+  return [...new Set(numbers)]
+    .sort((a, b) => a - b)
+    .map((num) => {
+      const source = sources[num - 1];
+      return source ? `[${num}](${markdownUrl(source.url)})` : "";
+    })
+    .filter(Boolean)
+    .join("");
+}
+
+function urlMarkerLabel(markerText?: string | null): string | null {
+  if (!markerText) return null;
+  const privateMatch = markerText.match(/\uE200url\uE202([^\uE201\uE202]+)/u);
+  if (privateMatch?.[1]) return privateMatch[1].trim();
+  const plainMatch = markerText.match(/^url[:\s]+(.+)$/i);
+  return plainMatch?.[1]?.trim() || null;
+}
+
+function citationMarkerCandidates(markerText?: string): string[] {
+  if (!markerText) return [];
+  const candidates = [markerText];
+  const tokens = markerText.match(CHATGPT_REF_TOKEN_RE) ?? [];
+  if (tokens.length > 0 && markerText.includes("cite")) {
+    candidates.push(
+      `${CHATGPT_MARKER_START}cite${tokens.map((token) => CHATGPT_MARKER_SEP + token).join("")}${CHATGPT_MARKER_END}`
+    );
+  }
+  return [...new Set(candidates)];
+}
+
+type AddCitationSourceFn = (
+  titleValue: unknown,
+  urlValue: unknown,
+  attributionValue?: unknown
+) => number;
+type AddCitationMentionFn = (ref: Record<string, unknown>, replacement: string) => void;
+
+/** Supporting-website sources nested under one `grouped_webpages` item. */
+function collectSupportingWebsiteNumbers(
+  item: Record<string, unknown>,
+  addSource: AddCitationSourceFn,
+  refTokenToSourceNumber: Map<string, number>
+): number[] {
+  const numbers: number[] = [];
+  for (const supportingValue of asArray(item.supporting_websites)) {
+    const supporting = asRecord(supportingValue);
+    if (!supporting) continue;
+    const supportingNumber = addSource(supporting.title, supporting.url, supporting.attribution);
+    if (supportingNumber) {
+      numbers.push(supportingNumber);
+      mapStructuredRefs(supporting.refs, supportingNumber, refTokenToSourceNumber);
+    }
+  }
+  return numbers;
+}
+
+/** One `grouped_webpages` item — its own primary source plus any supporting-website
+ * sources nested under it. */
+function collectGroupedWebpageItemNumbers(
+  itemValue: unknown,
+  addSource: AddCitationSourceFn,
+  refTokenToSourceNumber: Map<string, number>
+): number[] {
+  const item = asRecord(itemValue);
+  if (!item) return [];
+  const numbers: number[] = [];
+  const mainNumber = addSource(item.title, item.url, item.attribution);
+  if (mainNumber) {
+    numbers.push(mainNumber);
+    mapStructuredRefs(item.refs, mainNumber, refTokenToSourceNumber);
+  }
+  numbers.push(...collectSupportingWebsiteNumbers(item, addSource, refTokenToSourceNumber));
+  return numbers;
+}
+
+/** Fallback when no `grouped_webpages` item yielded a usable source — fall back to
+ * the ref's own URLs directly. */
+function collectGroupedWebpagesFallbackNumbers(
+  ref: Record<string, unknown>,
+  addSource: AddCitationSourceFn
+): number[] {
+  const numbers: number[] = [];
+  for (const url of referenceUrls(ref)) {
+    const fallbackNumber = addSource(ref.title, url, ref.attribution);
+    if (fallbackNumber) numbers.push(fallbackNumber);
+  }
+  return numbers;
+}
+
+/** `content_references[].type === "grouped_webpages"` — a primary source per item,
+ * each optionally paired with supporting-website sources; falls back to the ref's
+ * own URLs when no item yielded a usable source. */
+function collectGroupedWebpagesRef(
+  ref: Record<string, unknown>,
+  sources: ChatGptCitationSource[],
+  addSource: AddCitationSourceFn,
+  addMention: AddCitationMentionFn,
+  refTokenToSourceNumber: Map<string, number>
+): void {
+  let numbers: number[] = [];
+  for (const itemValue of asArray(ref.items)) {
+    numbers.push(...collectGroupedWebpageItemNumbers(itemValue, addSource, refTokenToSourceNumber));
+  }
+
+  if (numbers.length === 0) {
+    numbers = collectGroupedWebpagesFallbackNumbers(ref, addSource);
+  }
+
+  addMention(ref, formatCitationLinks(numbers, sources));
+}
+
+/** `content_references[].type === "sources_footnote"` — a flat list of sources with
+ * no inline mention to replace (the footnote itself carries no marker text). */
+function collectSourcesFootnoteRef(
+  ref: Record<string, unknown>,
+  addSource: AddCitationSourceFn
+): void {
+  for (const sourceValue of asArray(ref.sources)) {
+    const source = asRecord(sourceValue);
+    if (source) addSource(source.title, source.url, source.attribution);
+  }
+}
+
+/** Any other reference type — a direct `webpage`/`url` marker with an inline label
+ * renders as `[label](url)`; everything else falls back to numbered source links. */
+function collectDefaultRef(
+  ref: Record<string, unknown>,
+  type: string,
+  sources: ChatGptCitationSource[],
+  addSource: AddCitationSourceFn,
+  addMention: AddCitationMentionFn,
+  refTokenToSourceNumber: Map<string, number>
+): void {
+  const urls = referenceUrls(ref);
+  const label = urlMarkerLabel(asString(ref.matched_text));
+  if ((type === "webpage" || type === "url") && label && urls[0]) {
+    addMention(ref, `[${markdownLinkText(label)}](${markdownUrl(urls[0])})`);
+    return;
+  }
+
+  const numbers = urls
+    .map((url) => addSource(ref.title ?? ref.alt, url, ref.attribution))
+    .filter((num) => num > 0);
+  if (numbers.length === 0) return;
+
+  mapStructuredRefs(ref.refs, numbers[0], refTokenToSourceNumber);
+  addMention(ref, formatCitationLinks(numbers, sources));
+}
+
+function collectChatGptCitationData(metadata?: Record<string, unknown>): ChatGptCitationData {
+  const refs = asArray(metadata?.content_references);
+  const sources: ChatGptCitationSource[] = [];
+  const mentions: ChatGptCitationMention[] = [];
+  const sourceIndexByCanonicalUrl = new Map<string, number>();
+  const refTokenToSourceNumber = new Map<string, number>();
+
+  const addSource: AddCitationSourceFn = (titleValue, urlValue, attributionValue) => {
+    const url = asString(urlValue);
+    if (!url) return 0;
+    const canonical = canonicalCitationUrl(url);
+    const existing = sourceIndexByCanonicalUrl.get(canonical);
+    if (existing) return existing;
+
+    const title = asString(titleValue) ?? url;
+    const attribution = asString(attributionValue) ?? "";
+    const idx = sources.length + 1;
+    sources.push({ title: title.replace(/\n/g, " ").trim(), url, attribution });
+    sourceIndexByCanonicalUrl.set(canonical, idx);
+    return idx;
+  };
+
+  const addMention: AddCitationMentionFn = (ref, replacement) => {
+    if (!replacement) return;
+    const start = asNumber(ref.start_idx);
+    const end = asNumber(ref.end_idx);
+    const markerText = asString(ref.matched_text) ?? undefined;
+    if (markerText || (start != null && end != null)) {
+      mentions.push({
+        ...(start != null ? { start } : {}),
+        ...(end != null ? { end } : {}),
+        ...(markerText ? { markerText } : {}),
+        replacement,
+      });
+    }
+  };
+
+  for (const refValue of refs) {
+    const ref = asRecord(refValue);
+    if (!ref) continue;
+    const type = asString(ref.type) ?? "";
+
+    if (type === "grouped_webpages") {
+      collectGroupedWebpagesRef(ref, sources, addSource, addMention, refTokenToSourceNumber);
+      continue;
+    }
+    if (type === "sources_footnote") {
+      collectSourcesFootnoteRef(ref, addSource);
+      continue;
+    }
+    collectDefaultRef(ref, type, sources, addSource, addMention, refTokenToSourceNumber);
+  }
+
+  return { sources, mentions, refTokenToSourceNumber };
+}
+
+function replacePrivateCitationMarkers(text: string, citationData: ChatGptCitationData): string {
+  const replaceTokens = (tokens: string[]): string => {
+    const numbers = tokens
+      .map((token) => citationData.refTokenToSourceNumber.get(token))
+      .filter((num): num is number => typeof num === "number");
+    return numbers.length > 0 ? formatCitationLinks(numbers, citationData.sources) : "";
+  };
+
+  return text
+    .replace(/\uE200cite((?:\uE202[^\uE201\uE202]+)+)\uE201/gu, (_all, body: string) => {
+      const tokens = [...body.matchAll(/\uE202([^\uE201\uE202]+)/gu)].map((match) => match[1]);
+      return replaceTokens(tokens);
+    })
+    .replace(
+      /\bcite((?:turn\d+(?:search|product|news|image|webpage)\d+)+)\b/g,
+      (_all, body: string) => {
+        return replaceTokens(body.match(CHATGPT_REF_TOKEN_RE) ?? []);
+      }
+    );
+}
+
+function stripDanglingChatGptMarkers(text: string, citationData: ChatGptCitationData): string {
+  return replacePrivateCitationMarkers(text, citationData)
+    .replace(
+      /\uE200url\uE202([^\uE201\uE202]+)\uE202(https?:\/\/[^\uE201]+)\uE201/gu,
+      (_all, label: string, url: string) => {
+        return `[${markdownLinkText(label)}](${markdownUrl(url)})`;
+      }
+    )
+    .replace(
+      /\uE200url\uE202([^\uE201\uE202]+)\uE202(?:[^\uE201]*\uE201)?/gu,
+      (_all, label: string) => {
+        return label.trim();
+      }
+    )
+    .replace(/\uE200cite(?:\uE202[^\uE201\uE202]*)*$/gu, "")
+    .replace(/\uE200[a-z_]+(?:\uE202[^\uE201\uE202]*)*\uE201/giu, "")
+    .replace(/\uE200[a-z_]+(?:\uE202[^\uE201\uE202]*)*$/giu, "")
+    .replace(/\uE202?turn\d+(?:search|product|news|image|webpage)\d+\uE201?/gu, "")
+    .replace(/[\uE200\uE201\uE202]/gu, "");
+}
+
+function applyChatGptCitations(text: string, metadata?: Record<string, unknown>): string {
+  const citationData = collectChatGptCitationData(metadata);
+  let rendered = text;
+
+  for (const mention of [...citationData.mentions].sort(
+    (a, b) => (b.start ?? -1) - (a.start ?? -1)
+  )) {
+    let replaced = false;
+    for (const markerText of citationMarkerCandidates(mention.markerText)) {
+      const limit =
+        mention.start != null
+          ? Math.min(rendered.length, mention.start + markerText.length)
+          : rendered.length;
+      let pos = rendered.lastIndexOf(markerText, limit);
+      if (pos < 0) pos = rendered.indexOf(markerText);
+      if (pos >= 0) {
+        rendered =
+          rendered.slice(0, pos) + mention.replacement + rendered.slice(pos + markerText.length);
+        replaced = true;
+        break;
+      }
+    }
+
+    if (!replaced && mention.start != null && mention.end != null) {
+      const start = Math.max(0, Math.min(mention.start, rendered.length));
+      const end = Math.max(start, Math.min(mention.end, rendered.length));
+      rendered = rendered.slice(0, start) + mention.replacement + rendered.slice(end);
+    }
+  }
+
+  return stripDanglingChatGptMarkers(rendered, citationData);
+}
+
+export function cleanChatGptText(text: string, metadata?: Record<string, unknown>): string {
+  return applyChatGptCitations(text.replace(ENTITY_RE, "$1"), metadata);
+}
diff --git a/open-sse/executors/chatgpt-web/handoff.ts b/open-sse/executors/chatgpt-web/handoff.ts
new file mode 100644
index 0000000000..c0f66b5092
--- /dev/null
+++ b/open-sse/executors/chatgpt-web/handoff.ts
@@ -0,0 +1,154 @@
+import { tlsFetchChatGpt } from "../../services/chatgptTlsClient.ts";
+
+const CONVERSATION_RESUME_URL = "https://chatgpt.com/backend-api/f/conversation/resume";
+const RESUME_OFFSETS = [0, 1, 2] as const;
+
+export interface FinalAssistantAnswer {
+  text: string;
+  messageId?: string;
+  metadata?: Record<string, unknown>;
+  finished: boolean;
+}
+
+interface HandoffContentChunk {
+  answer?: string;
+  messageId?: string;
+  metadata?: Record<string, unknown>;
+  error?: string;
+}
+
+type HandoffContentReader = (
+  eventStream: ReadableStream<Uint8Array>,
+  signal?: AbortSignal | null
+) => AsyncIterable<HandoffContentChunk>;
+
+interface ResumeHandoffOptions {
+  conversationId: string;
+  resumeToken: string;
+  headers: Record<string, string>;
+  timeoutMs: number;
+  signal?: AbortSignal | null;
+  log?: { warn?: (tag: string, message: string) => void } | null;
+  readContent: HandoffContentReader;
+}
+
+interface ResumeAttemptOptions extends Pick<
+  ResumeHandoffOptions,
+  "conversationId" | "timeoutMs" | "signal" | "log" | "readContent"
+> {
+  offset: (typeof RESUME_OFFSETS)[number];
+  resumeHeaders: Record<string, string>;
+}
+
+interface ResumeAttemptResult {
+  answer: FinalAssistantAnswer | null;
+  shouldRetry: boolean;
+}
+
+function stringToStream(text: string): ReadableStream<Uint8Array> {
+  const bytes = new TextEncoder().encode(text);
+  return new ReadableStream<Uint8Array>({
+    start(controller) {
+      controller.enqueue(bytes);
+      controller.close();
+    },
+  });
+}
+
+async function readFinalAssistantAnswer(
+  eventStream: ReadableStream<Uint8Array>,
+  signal: AbortSignal | null | undefined,
+  readContent: HandoffContentReader
+): Promise<FinalAssistantAnswer | null> {
+  let text = "";
+  let messageId: string | undefined;
+  let metadata: Record<string, unknown> | undefined;
+
+  for await (const chunk of readContent(eventStream, signal)) {
+    if (chunk.error) return null;
+    if (chunk.answer) text = chunk.answer;
+    if (chunk.messageId) messageId = chunk.messageId;
+    if (chunk.metadata) metadata = chunk.metadata;
+  }
+
+  if (!text.trim()) return null;
+  return { text, messageId, metadata, finished: true };
+}
+
+async function attemptResumeOffset({
+  conversationId,
+  offset,
+  resumeHeaders,
+  timeoutMs,
+  signal,
+  log,
+  readContent,
+}: ResumeAttemptOptions): Promise<ResumeAttemptResult> {
+  try {
+    const response = await tlsFetchChatGpt(CONVERSATION_RESUME_URL, {
+      method: "POST",
+      headers: resumeHeaders,
+      body: JSON.stringify({ conversation_id: conversationId, offset }),
+      timeoutMs,
+      signal,
+      stream: true,
+    });
+
+    if (response.status === 404) return { answer: null, shouldRetry: true };
+    if (response.status >= 400) {
+      log?.warn?.(
+        "CGPT-WEB",
+        `conversation resume ${response.status}: ${(response.text || "").slice(0, 300)}`
+      );
+      return { answer: null, shouldRetry: false };
+    }
+
+    const eventStream = response.body ?? (response.text ? stringToStream(response.text) : null);
+    if (!eventStream) return { answer: null, shouldRetry: true };
+
+    const answer = await readFinalAssistantAnswer(eventStream, signal, readContent);
+    return { answer, shouldRetry: !answer };
+  } catch (error) {
+    log?.warn?.(
+      "CGPT-WEB",
+      `conversation resume failed: ${error instanceof Error ? error.message : String(error)}`
+    );
+    return { answer: null, shouldRetry: false };
+  }
+}
+
+export async function resumeChatGptHandoff({
+  conversationId,
+  resumeToken,
+  headers,
+  timeoutMs,
+  signal,
+  log,
+  readContent,
+}: ResumeHandoffOptions): Promise<FinalAssistantAnswer | null> {
+  const resumeHeaders = {
+    ...headers,
+    Accept: "text/event-stream",
+    "Content-Type": "application/json",
+    "x-conduit-token": resumeToken,
+    "X-OpenAI-Target-Path": "/backend-api/f/conversation/resume",
+    "X-OpenAI-Target-Route": "/backend-api/f/conversation/resume",
+  };
+
+  for (const offset of RESUME_OFFSETS) {
+    const attempt = await attemptResumeOffset({
+      conversationId,
+      resumeHeaders,
+      offset,
+      timeoutMs,
+      signal,
+      log,
+      readContent,
+    });
+    if (attempt.answer) return attempt.answer;
+    if (!attempt.shouldRetry) return null;
+  }
+
+  log?.warn?.("CGPT-WEB", `conversation resume returned no assistant text for ${conversationId}`);
+  return null;
+}
diff --git a/open-sse/executors/chatgpt-web/models.ts b/open-sse/executors/chatgpt-web/models.ts
index 72738f43b0..b0f905d783 100644
--- a/open-sse/executors/chatgpt-web/models.ts
+++ b/open-sse/executors/chatgpt-web/models.ts
@@ -3,24 +3,22 @@
 
 export const MODEL_MAP: Record<string, string> = {
   // ChatGPT backend slugs are also accepted directly for power users / tests.
+  "gpt-5-6-pro": "gpt-5-6-pro",
+  "gpt-5-6-thinking": "gpt-5-6-thinking",
   "gpt-5-5-pro": "gpt-5-5-pro",
   "gpt-5-5-pro-extended": "gpt-5-5-pro",
   "gpt-5-5-thinking": "gpt-5-5-thinking",
   "gpt-5-5": "gpt-5-5",
-  "gpt-5-4-pro": "gpt-5-4-pro",
-  "gpt-5-4-thinking": "gpt-5-4-thinking",
-  "gpt-5-4-t-mini": "gpt-5-4-t-mini",
   "gpt-5-3": "gpt-5-3",
   "gpt-5-3-mini": "gpt-5-3-mini",
 
   // Public OmniRoute dot-form ids exposed by the provider catalog.
+  "gpt-5.6-pro": "gpt-5-6-pro",
+  "gpt-5.6-thinking": "gpt-5-6-thinking",
   "gpt-5.5-pro": "gpt-5-5-pro",
   "gpt-5.5-pro-extended": "gpt-5-5-pro",
   "gpt-5.5-thinking": "gpt-5-5-thinking",
   "gpt-5.5": "gpt-5-5",
-  "gpt-5.4-pro": "gpt-5-4-pro",
-  "gpt-5.4-thinking": "gpt-5-4-thinking",
-  "gpt-5.4-thinking-mini": "gpt-5-4-t-mini",
   "gpt-5.3-instant": "gpt-5-3-instant",
   "gpt-5.3": "gpt-5-3",
   "gpt-5.3-mini": "gpt-5-3-mini",
@@ -28,6 +26,8 @@ export const MODEL_MAP: Record<string, string> = {
 };
 
 export const MODEL_FORCED_EFFORT: Record<string, "standard" | "extended"> = {
+  "gpt-5-6-pro": "standard",
+  "gpt-5.6-pro": "standard",
   "gpt-5-5-pro": "standard",
   "gpt-5-5-pro-extended": "extended",
   "gpt-5.5-pro": "standard",
@@ -36,9 +36,7 @@ export const MODEL_FORCED_EFFORT: Record<string, "standard" | "extended"> = {
 
 /** Set of chatgpt.com slugs that the user_last_used_model_config endpoint
  * accepts a `thinking_effort` value for, derived from MODEL_MAP so adding a
- * new thinking entry there automatically extends this set. Includes the
- * abbreviated slug `gpt-5-4-t-mini` (no literal "thinking" substring) — the
- * reason this set exists at all rather than a substring match.
+ * new thinking entry there automatically extends this set.
  *
  * Derived from MODEL_MAP keys (always dot-form) that contain "thinking" or
  * are the `o3` reasoning model; the values are the chatgpt.com-side slugs. */
@@ -52,18 +50,8 @@ export const THINKING_CAPABLE_SLUGS: ReadonlySet<string> = new Set(
  * models and the o-series. PATCHing for a non-thinking surface is a no-op
  * (the server accepts it but the routing-time read picks the wrong knob).
  *
- * Three branches because the input can arrive in three shapes:
- *   1. OmniRoute dot-form id (`gpt-5.4-thinking-mini`) — every thinking
- *      variant carries the literal "thinking" substring here.
- *   2. Resolved chatgpt.com slug containing "thinking" (`gpt-5-5-thinking`).
- *   3. Resolved chatgpt.com slug that drops the substring under abbreviation
- *      (`gpt-5-4-t-mini`). Looked up via THINKING_CAPABLE_SLUGS, which is
- *      derived from MODEL_MAP itself so adding a new abbreviated thinking
- *      mapping automatically extends the check.
- *
- * Branch 3 also catches the case where a caller passes the chatgpt.com slug
- * directly as the `model` field (no MODEL_MAP translation needed), which
- * would otherwise silently bypass the PATCH. */
+ * The lookup also catches callers that pass a chatgpt.com slug directly as
+ * the `model` field without MODEL_MAP translation. */
 export function isThinkingCapableModel(modelId: string, slug: string): boolean {
   return (
     modelId.includes("thinking") ||
@@ -128,6 +116,6 @@ export function resolveChatGptModel(
   const slug = MODEL_MAP[model] ?? model;
   const forcedEffort = MODEL_FORCED_EFFORT[model] ?? null;
   const effort = forcedEffort ?? resolveThinkingEffort(body, providerSpecificData);
-  const isPro = slug === "gpt-5-5-pro";
+  const isPro = slug === "gpt-5-6-pro" || slug === "gpt-5-5-pro";
   return { slug, effort, isPro };
 }
diff --git a/open-sse/executors/claude-web.ts b/open-sse/executors/claude-web.ts
index 599814d072..7e26777339 100644
--- a/open-sse/executors/claude-web.ts
+++ b/open-sse/executors/claude-web.ts
@@ -319,14 +319,36 @@ async function buildClaudeStreamingResponse(
             try {
               const parsed = JSON.parse(jsonStr) as Record<string, unknown>;
 
-              // Content block delta — contains the actual text.
-              if (parsed.type === "content_block_delta") {
+              // Content block start — signals the beginning of a thinking
+              // block. Emit an empty reasoning_content chunk so clients that
+              // key off the field's presence (not just its text) see the
+              // thinking panel open immediately, mirroring the real-Anthropic
+              // translator's content_block_start handling (#6662).
+              if (parsed.type === "content_block_start") {
+                const block = parsed.content_block as Record<string, unknown> | undefined;
+                if (block?.type === "thinking") {
+                  const chunk = transformFromClaude("", model, undefined, "reasoning");
+                  const out = `data: ${JSON.stringify(chunk)}\n\n`;
+                  controller.enqueue(new TextEncoder().encode(out));
+                }
+              }
+              // Content block delta — contains the actual text, or (for a
+              // thinking block) the extended-thinking text. Claude's real SSE
+              // shape uses `delta.text` for text_delta and `delta.thinking`
+              // for thinking_delta — never both — so a plain field check is
+              // enough to route each to the right OpenAI delta field.
+              else if (parsed.type === "content_block_delta") {
                 const delta = parsed.delta as Record<string, unknown> | undefined;
                 const text = delta?.text as string | undefined;
+                const thinking = delta?.thinking as string | undefined;
                 if (text) {
                   const chunk = transformFromClaude(text, model);
                   const out = `data: ${JSON.stringify(chunk)}\n\n`;
                   controller.enqueue(new TextEncoder().encode(out));
+                } else if (thinking) {
+                  const chunk = transformFromClaude(thinking, model, undefined, "reasoning");
+                  const out = `data: ${JSON.stringify(chunk)}\n\n`;
+                  controller.enqueue(new TextEncoder().encode(out));
                 }
               }
               // message_stop — final event from Claude.
@@ -362,11 +384,17 @@ async function buildClaudeStreamingResponse(
               if (parsed.type === "content_block_delta") {
                 const delta = parsed.delta as Record<string, unknown> | undefined;
                 const text = delta?.text as string | undefined;
+                const thinking = delta?.thinking as string | undefined;
                 if (text) {
                   const chunk = transformFromClaude(text, model);
                   controller.enqueue(
                     new TextEncoder().encode(`data: ${JSON.stringify(chunk)}\n\n`)
                   );
+                } else if (thinking) {
+                  const chunk = transformFromClaude(thinking, model, undefined, "reasoning");
+                  controller.enqueue(
+                    new TextEncoder().encode(`data: ${JSON.stringify(chunk)}\n\n`)
+                  );
                 }
               }
             } catch {
diff --git a/open-sse/executors/claude-web/payload.ts b/open-sse/executors/claude-web/payload.ts
index cc0dcc3787..fb1e873e64 100644
--- a/open-sse/executors/claude-web/payload.ts
+++ b/open-sse/executors/claude-web/payload.ts
@@ -152,6 +152,36 @@ export function getDefaultPersonalizedStyle(): ClaudeWebRequestPayload["personal
   ];
 }
 
+/**
+ * Detect whether an OpenAI-shape request body signals a desire for
+ * reasoning / extended thinking — a top-level `reasoning_effort` string,
+ * a Responses-API-style `reasoning.effort`, or a native Claude
+ * `thinking: { type: "enabled" }` passthrough. Mirrors the same
+ * effort-extraction shape used by `sanitizeReasoningEffortForProvider`
+ * (open-sse/executors/base/reasoningEffort.ts) so a client already setting
+ * reasoning_effort for other providers gets the same signal here.
+ *
+ * Before this, `transformToClaude` hardcoded `thinking_mode: "off"` —
+ * Claude Web could never be asked for extended thinking, and any
+ * `thinking_delta` reasoning the upstream might otherwise emit was moot
+ * because it was never requested in the first place (#6662).
+ */
+export function wantsExtendedThinking(body: Record<string, unknown>): boolean {
+  const reasoning =
+    body.reasoning && typeof body.reasoning === "object" && !Array.isArray(body.reasoning)
+      ? (body.reasoning as Record<string, unknown>)
+      : null;
+  const effort = body.reasoning_effort ?? reasoning?.effort;
+  if (typeof effort === "string" && effort.trim() && effort.toLowerCase() !== "none") {
+    return true;
+  }
+  const thinking = body.thinking;
+  if (thinking && typeof thinking === "object" && !Array.isArray(thinking)) {
+    if ((thinking as Record<string, unknown>).type === "enabled") return true;
+  }
+  return false;
+}
+
 /**
  * Transform OpenAI format to Claude Web format
  */
@@ -189,7 +219,7 @@ export function transformToClaude(
     files: [],
     sync_sources: [],
     rendering_mode: "messages",
-    thinking_mode: "off",
+    thinking_mode: wantsExtendedThinking(body) ? "on" : "off",
     create_conversation_params: {
       name: "",
       model: model || DEFAULT_CLAUDE_MODEL,
@@ -204,13 +234,24 @@ export function transformToClaude(
 }
 
 /**
- * Transform Claude Web response to OpenAI format
+ * Transform Claude Web response to OpenAI format.
+ *
+ * `kind` selects which delta field carries `claudeContent`: `"content"`
+ * (default, preserves the original call sites) or `"reasoning"` — the
+ * latter maps Claude's `thinking_delta` text onto `delta.reasoning_content`,
+ * the same field the real-Anthropic-API translator uses
+ * (open-sse/translator/response/claude-to-openai.ts) so downstream clients
+ * (Claude Code, Cursor, etc.) render it as the thinking panel instead of
+ * silently dropping it (#6662).
  */
 export function transformFromClaude(
   claudeContent: string,
   model: string,
-  stopReason?: string
+  stopReason?: string,
+  kind: "content" | "reasoning" = "content"
 ): Record<string, unknown> {
+  const delta: Record<string, string> =
+    kind === "reasoning" ? { reasoning_content: claudeContent } : { content: claudeContent };
   return {
     id: `chatcmpl-${Date.now()}`,
     object: "chat.completion.chunk",
@@ -219,9 +260,7 @@ export function transformFromClaude(
     choices: [
       {
         index: 0,
-        delta: {
-          content: claudeContent,
-        },
+        delta,
         finish_reason: stopReason === "end_turn" ? "stop" : null,
         logprobs: null,
       },
diff --git a/open-sse/executors/claudeIdentity.ts b/open-sse/executors/claudeIdentity.ts
index a5c276687a..f8a94a32ce 100644
--- a/open-sse/executors/claudeIdentity.ts
+++ b/open-sse/executors/claudeIdentity.ts
@@ -12,7 +12,7 @@ import { createHash, randomBytes, randomUUID } from "node:crypto";
 
 // ---------- Versions ------------------------------------------------------
 
-export const CLAUDE_CODE_VERSION = "2.1.195";
+export const CLAUDE_CODE_VERSION = "2.1.207";
 /** Bundled @anthropic-ai/sdk version for the pinned CLI release. */
 export const CLAUDE_CODE_STAINLESS_VERSION = "0.94.0";
 
diff --git a/open-sse/executors/cloudflare-ai.ts b/open-sse/executors/cloudflare-ai.ts
index cd1b184f8c..c6173488df 100644
--- a/open-sse/executors/cloudflare-ai.ts
+++ b/open-sse/executors/cloudflare-ai.ts
@@ -75,13 +75,24 @@ export class CloudflareAIExecutor extends BaseExecutor {
     // shape (`[{ type:"text", text }]`) with HTTP 400 (#2539). Flatten text parts to a string.
     if (!Array.isArray(body.messages)) return body;
 
+    // #6390: the endpoint has no way to carry image/non-text parts once flattened to a
+    // string, so previously any non-text part (e.g. image_url) was silently mapped to ""
+    // and the image quietly disappeared from the outgoing request. Refuse instead of
+    // silently dropping data — this throws a plain Error which the caller (chatCore.ts)
+    // already routes through buildErrorBody()/sanitizeErrorMessage() before it reaches
+    // the client, matching the existing buildUrl() missing-accountId error above.
     const flattenContent = (content: unknown): unknown => {
       if (typeof content === "string" || !Array.isArray(content)) return content;
       return content
         .map((part) => {
           if (!part || typeof part !== "object") return "";
           const p = part as Record<string, unknown>;
-          return p.type === "text" && typeof p.text === "string" ? p.text : "";
+          if (p.type === "text" && typeof p.text === "string") return p.text;
+          throw new Error(
+            "Cloudflare Workers AI chat endpoint does not accept image/non-text content parts " +
+              `(got type "${typeof p.type === "string" ? p.type : "unknown"}"). ` +
+              "Remove image/file attachments or route this request to a vision-capable provider."
+          );
         })
         .join("");
     };
diff --git a/open-sse/executors/codex.ts b/open-sse/executors/codex.ts
index 6bca470eb5..d5a81b5e69 100644
--- a/open-sse/executors/codex.ts
+++ b/open-sse/executors/codex.ts
@@ -17,7 +17,7 @@ import {
   CODEX_CHAT_DEFAULT_INSTRUCTIONS,
   CODEX_DEFAULT_INSTRUCTIONS,
 } from "../config/codexInstructions.ts";
-import { PROVIDERS } from "../config/constants.ts";
+import { HTTP_STATUS, PROVIDERS } from "../config/constants.ts";
 import {
   getCodexClientVersion,
   getCodexUserAgent,
@@ -34,6 +34,7 @@ import { sanitizeResponsesInputItems } from "../services/responsesInputSanitizer
 import { normalizeCodexVerbosity } from "../services/codexVerbosity.ts";
 import { getThinkingBudgetConfig, ThinkingMode } from "../services/thinkingBudget.ts";
 import { CORS_HEADERS } from "../utils/cors.ts";
+import { errorResponse } from "../utils/error.ts";
 import { normalizeCodexResponsesInput } from "../utils/responsesInputNormalization.ts";
 import * as prl from "../utils/providerRequestLogging.ts";
 import { createRequire } from "module";
@@ -116,8 +117,11 @@ function codexWebSocketUnavailableResponse(): Response {
 export { getCodexModelScope, getCodexRateLimitKey, type CodexQuotaScope };
 
 // Ordered list of effort levels from lowest to highest
-const EFFORT_ORDER = ["none", "low", "medium", "high", "xhigh"] as const;
+const EFFORT_ORDER = ["none", "low", "medium", "high", "xhigh", "max", "ultra"] as const;
 type EffortLevel = (typeof EFFORT_ORDER)[number];
+const STANDARD_EFFORT_SUFFIXES = ["none", "low", "medium", "high", "xhigh"] as const;
+const GPT_5_6_MAX_ALIAS_MODELS = new Set(["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"]);
+const GPT_5_6_ULTRA_ALIAS_MODELS = new Set(["gpt-5.6-sol", "gpt-5.6-terra"]);
 const CODEX_FAST_WIRE_VALUE = "priority";
 const CODEX_RESPONSES_WS_URL = "wss://chatgpt.com/backend-api/codex/responses";
 
@@ -126,7 +130,17 @@ function splitCodexReasoningSuffix(model: unknown): {
   effort: EffortLevel | null;
 } {
   const modelId = typeof model === "string" ? model : "";
-  for (const level of EFFORT_ORDER) {
+  const gpt56AliasMatch = /^(gpt-5\.6-(?:sol|terra|luna))-(max|ultra)$/.exec(modelId);
+  if (gpt56AliasMatch) {
+    const [, baseModel, alias] = gpt56AliasMatch;
+    const supportedModels =
+      alias === "ultra" ? GPT_5_6_ULTRA_ALIAS_MODELS : GPT_5_6_MAX_ALIAS_MODELS;
+    if (supportedModels.has(baseModel)) {
+      return { baseModel, effort: alias as EffortLevel };
+    }
+  }
+
+  for (const level of STANDARD_EFFORT_SUFFIXES) {
     if (modelId.endsWith(`-${level}`)) {
       return {
         baseModel: modelId.slice(0, -`-${level}`.length),
@@ -337,10 +351,13 @@ function normalizeServiceTierValue(value: unknown): string | undefined {
 
 /**
  * Maximum reasoning effort allowed per Codex model.
- * Models not listed here default to "xhigh" (unrestricted).
+ * Models not listed here retain the legacy xhigh cap.
  * Update this table when Codex releases new models with different caps.
  */
 const MAX_EFFORT_BY_MODEL: Record<string, EffortLevel> = {
+  "gpt-5.6-sol": "ultra",
+  "gpt-5.6-terra": "ultra",
+  "gpt-5.6-luna": "max",
   "gpt-5.3-codex": "xhigh",
   "gpt-5.1-codex-max": "xhigh",
   "gpt-5-mini": "high",
@@ -369,7 +386,6 @@ const CODEX_DEFAULT_REASONING_SUMMARY = "auto";
 function normalizeEffortValue(value: unknown): string | undefined {
   if (typeof value !== "string") return undefined;
   const normalized = value.trim().toLowerCase();
-  if (normalized === "max") return "xhigh";
   return normalized || undefined;
 }
 
@@ -550,6 +566,144 @@ export function filterNonstandardCodexSse(response: Response): Response {
   });
 }
 
+// ─── Sub-bug #3 of upstream decolua/9router#2452 (@ryanngit) ─────────────────
+// Codex sometimes answers with HTTP 200 and a text/event-stream body whose
+// payload carries a transient "model at capacity" / overloaded error mid-stream,
+// e.g. { "error": { "message": "Selected model is at capacity..." } },
+// server_is_overloaded, or service_unavailable_error. Left as a 200, this looks
+// like a successful response to every caller — no retry, no circuit breaker, no
+// combo/account fallback engages (open-sse/services/accountFallback.ts never
+// sees a failure status). Peek the first few SSE bytes; when a transient-error
+// signature is found, convert the response into a real 503 so account rotation
+// kicks in. Otherwise re-assemble the stream from the peeked prefix + the
+// remaining upstream body so the passthrough stays byte-identical.
+const CODEX_SSE_TRANSIENT_ERROR_PATTERNS = [
+  "selected model is at capacity",
+  "server_is_overloaded",
+  "service_unavailable_error",
+] as const;
+// A capacity/overloaded rejection is delivered as the very first SSE event, so a
+// small peek window is enough — this bounds how much of a legitimate response we
+// buffer before giving up and passing the stream through unchanged.
+const CODEX_SSE_PEEK_MAX_BYTES = 8192;
+
+/**
+ * Best-effort extraction of the human-readable error message from a peeked SSE
+ * chunk, so the resulting 503 body carries something more useful than the raw
+ * pattern that matched. Falls back to the matched pattern when no structured
+ * `data:` payload could be parsed.
+ */
+function extractCodexSseErrorMessage(text: string, fallback: string): string {
+  for (const line of text.split(/\r?\n/)) {
+    if (!line.startsWith("data:")) continue;
+    const data = line.slice("data:".length).trim();
+    if (!data || data === "[DONE]") continue;
+    try {
+      const parsed = JSON.parse(data) as Record<string, unknown>;
+      const directError = parsed.error as Record<string, unknown> | undefined;
+      const nestedError = (parsed.response as Record<string, unknown> | undefined)?.error as
+        Record<string, unknown> | undefined;
+      const message =
+        (typeof directError?.message === "string" && directError.message) ||
+        (typeof nestedError?.message === "string" && nestedError.message) ||
+        (typeof parsed.message === "string" && parsed.message);
+      if (message) return message;
+    } catch {
+      // Non-JSON SSE data line — keep scanning subsequent lines.
+    }
+  }
+  return fallback;
+}
+
+type CodexSseTransientErrorPeek =
+  | { matched: string; message: string; replacementBody: null }
+  | { matched: null; message: null; replacementBody: ReadableStream<Uint8Array> | null };
+
+/**
+ * Peek the first bytes of a Codex SSE response body looking for a transient
+ * error embedded in an otherwise 200-OK stream. Exported for unit testing.
+ */
+export async function peekCodexSseTransientError(
+  response: Response
+): Promise<CodexSseTransientErrorPeek> {
+  const contentType = response.headers.get("content-type") || "";
+  if (!response.ok || !response.body || !contentType.includes("text/event-stream")) {
+    return { matched: null, message: null, replacementBody: null };
+  }
+
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  const chunks: Uint8Array[] = [];
+  let text = "";
+  let matched: string | null = null;
+
+  try {
+    while (text.length < CODEX_SSE_PEEK_MAX_BYTES) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      chunks.push(value);
+      text += decoder.decode(value, { stream: true });
+      const lower = text.toLowerCase();
+      const hit = CODEX_SSE_TRANSIENT_ERROR_PATTERNS.find((pattern) => lower.includes(pattern));
+      if (hit) {
+        matched = hit;
+        break;
+      }
+      // A real content/completion event this early means the response is
+      // healthy — stop peeking so we do not needlessly buffer a long stream.
+      if (
+        lower.includes('"type":"response.output_text.delta"') ||
+        lower.includes('"type":"response.completed"')
+      ) {
+        break;
+      }
+    }
+  } catch (err) {
+    console.warn(
+      `[codex] peekCodexSseTransientError: read error, passing stream through: ${
+        err instanceof Error ? err.message : String(err)
+      }`
+    );
+  }
+
+  if (matched) {
+    try {
+      await reader.cancel();
+    } catch {
+      // Upstream socket may already be closing; nothing to clean up.
+    }
+    return { matched, message: extractCodexSseErrorMessage(text, matched), replacementBody: null };
+  }
+
+  reader.releaseLock();
+
+  // Re-assemble the stream: peeked prefix chunks, then continue draining the
+  // same underlying body so bytes downstream of the peek window are untouched.
+  const upstreamReader = response.body.getReader();
+  const replacementBody = new ReadableStream<Uint8Array>({
+    start(controller) {
+      for (const chunk of chunks) controller.enqueue(chunk);
+    },
+    async pull(controller) {
+      const { done, value } = await upstreamReader.read();
+      if (done) {
+        controller.close();
+        return;
+      }
+      controller.enqueue(value);
+    },
+    cancel(reason) {
+      try {
+        upstreamReader.cancel(reason);
+      } catch {
+        // noop — upstream socket may already be closing.
+      }
+    },
+  });
+
+  return { matched: null, message: null, replacementBody };
+}
+
 export function encodeResponseSseEvent(raw: string): { sse: string; terminal: boolean } {
   let eventType = "message";
   let payload = raw;
@@ -664,6 +818,26 @@ export class CodexExecutor extends BaseExecutor {
           (httpResult as { response: Response }).response = filterNonstandardCodexSse(resp);
         }
       }
+      const resp = (httpResult as { response?: Response }).response;
+      if (resp) {
+        const peek = await peekCodexSseTransientError(resp);
+        if (peek.matched) {
+          input.log?.warn?.(
+            "RETRY",
+            `CODEX | 200-OK SSE carried transient error "${peek.matched}" — converting to 503 for account fallback`
+          );
+          (httpResult as { response: Response }).response = errorResponse(
+            HTTP_STATUS.SERVICE_UNAVAILABLE,
+            peek.message
+          );
+        } else if (peek.replacementBody) {
+          (httpResult as { response: Response }).response = new Response(peek.replacementBody, {
+            status: resp.status,
+            statusText: resp.statusText,
+            headers: resp.headers,
+          });
+        }
+      }
       return httpResult;
     }
 
@@ -1001,6 +1175,7 @@ export class CodexExecutor extends BaseExecutor {
       delete body.stream;
       delete body.stream_options;
       delete body.client_metadata;
+      delete body.include;
     } else {
       body.stream = true;
     }
@@ -1129,7 +1304,10 @@ export class CodexExecutor extends BaseExecutor {
     // Cursor may include custom tools (e.g. ApplyPatch) that work locally but are
     // invalid upstream, and translation bugs can leave orphaned/empty tool_choice names.
     normalizeCodexTools(body, {
-      dropImageGeneration: isCodexFreePlan(credentials?.providerSpecificData),
+      // gpt-5.3-codex-spark (and other Spark-scope models) reject image_generation
+      // upstream even on paid-plan accounts, so drop it independent of plan (#6651).
+      dropImageGeneration:
+        isCodexFreePlan(credentials?.providerSpecificData) || getCodexModelScope(model) === "spark",
       preserveCustomTools: nativeCodexPassthrough,
     });
 
@@ -1168,12 +1346,17 @@ export class CodexExecutor extends BaseExecutor {
       modelEffort || explicitReasoning || requestReasoningEffort || fallbackReasoningEffort;
 
     if (rawEffort) {
+      const clampedEffort = clampEffort(cleanModel, rawEffort);
       body.reasoning = {
         ...(reasoningRecord || {}),
-        effort: clampEffort(cleanModel, rawEffort),
+        // Ultra coordinates delegation in Codex clients; the upstream wire effort is Max.
+        effort: clampedEffort === "ultra" ? "max" : clampedEffort,
       };
     }
     ensureCodexReasoningSummary(body);
+    if (isCompactRequest) {
+      delete body.include;
+    }
     delete body.reasoning_effort;
 
     // Remove unsupported token limit parameters BEFORE the passthrough return.
diff --git a/open-sse/executors/commandCode.ts b/open-sse/executors/commandCode.ts
index afd9811dd4..bebe6ebd21 100644
--- a/open-sse/executors/commandCode.ts
+++ b/open-sse/executors/commandCode.ts
@@ -61,7 +61,7 @@ function normalizeContentText(content: unknown): string {
  * capability per the official CC model registry, but are NOT caught
  * by the shared {@link isVisionModelId} heuristic. Kept as a local
  * set because these are CC-specific model IDs (vendor-prefix shapes
- * like "moonshotai/Kimi-K2.6" or CC aliases like "gpt-5.4-mini").
+ * like "moonshotai/Kimi-K2.6" or CC aliases like "gpt-5.6-luna").
  *
  * Source: Command Code /alpha/generate model registry (docs).
  */
@@ -73,7 +73,7 @@ const CC_VISION_MODEL_PATTERNS: readonly RegExp[] = [
   // Anthropic
   /claude-fable/i, // claude-fable-5 (not covered by claude-opus/sonnet/haiku-4)
   // OpenAI
-  /gpt-5/i, // gpt-5.5, gpt-5.4, gpt-5.3-codex, gpt-5.4-mini
+  /gpt-5/i, // gpt-5.6, gpt-5.5, gpt-5.3-codex
   // Sakana
   /fugu/i, // sakana/fugu-ultra
 ];
diff --git a/open-sse/executors/cursor.ts b/open-sse/executors/cursor.ts
index ad7a9b68a6..d05d3b5ee5 100644
--- a/open-sse/executors/cursor.ts
+++ b/open-sse/executors/cursor.ts
@@ -44,7 +44,10 @@ import {
   estimateOutputTokens,
   addBufferToUsage,
 } from "../utils/usageTracking.ts";
-import { getCursorVersion } from "../utils/cursorVersionDetector.ts";
+import {
+  formatCursorAgentClientVersion,
+  getCursorAgentCliVersion,
+} from "../utils/cursorAgentCliVersion.ts";
 import { sanitizeErrorMessage } from "../utils/error.ts";
 import { generateToolCallId } from "../translator/helpers/toolCallHelper.ts";
 import {
@@ -647,7 +650,7 @@ export class CursorExecutor extends BaseExecutor {
       traceparent: traceParent,
       "user-agent": "connect-es/1.6.1",
       "x-cursor-client-type": "cli",
-      "x-cursor-client-version": `cli-${getCursorVersion()}`,
+      "x-cursor-client-version": formatCursorAgentClientVersion(getCursorAgentCliVersion()),
       "x-ghost-mode": ghostMode ? "true" : "false",
       "x-original-request-id": requestId,
       "x-request-id": requestId,
diff --git a/open-sse/executors/deepseek-web-done-terminator.ts b/open-sse/executors/deepseek-web-done-terminator.ts
new file mode 100644
index 0000000000..1303cc4b39
--- /dev/null
+++ b/open-sse/executors/deepseek-web-done-terminator.ts
@@ -0,0 +1,68 @@
+// ── DeepSeek Web SSE "done terminator" helpers ──────────────────────────
+//
+// Extracted from deepseek-web.ts (frozen line-count) so the drain/guard
+// state machine used to close the OpenAI-compatible SSE after DeepSeek's
+// `response/status=FINISHED` event can grow without touching the frozen
+// file. See #6777: upstreams that leave the HTTP body open hang OpenAI SDK
+// clients that wait for `data: [DONE]` after `finish_reason: stop`.
+
+/** How long to wait after DeepSeek `response/status=FINISHED` for trailing
+ * search_results before closing the OpenAI-compatible SSE. */
+export const DEEPSEEK_FINISHED_DRAIN_MS = 750;
+
+/** Wraps a stream-finishing callback so it runs at most once and never
+ * throws past a controller that the client already cancelled/closed. */
+export function createFinishOnceGuard(finish: () => void): {
+  finishOnce: () => void;
+  hasFinished: () => boolean;
+} {
+  let streamFinished = false;
+  return {
+    finishOnce: () => {
+      if (streamFinished) return;
+      streamFinished = true;
+      try {
+        finish();
+      } catch {
+        // Controller may already be closed if the client cancelled.
+      }
+    },
+    hasFinished: () => streamFinished,
+  };
+}
+
+/** Schedules `finishStream` after a short drain window following
+ * `response/status=FINISHED`, so late `search_results` payloads still get
+ * captured, while guaranteeing the stream always closes even if the
+ * upstream body stays open past that window. */
+export function createFinishedDrainScheduler(
+  finishStream: () => void,
+  drainMs: number = DEEPSEEK_FINISHED_DRAIN_MS
+): {
+  scheduleFinishAfterDrain: () => void;
+  clearFinishedDrain: () => void;
+  isDrainPending: () => boolean;
+} {
+  let finishedDrainTimer: ReturnType<typeof setTimeout> | null = null;
+
+  const clearFinishedDrain = () => {
+    if (finishedDrainTimer) {
+      clearTimeout(finishedDrainTimer);
+      finishedDrainTimer = null;
+    }
+  };
+
+  const scheduleFinishAfterDrain = () => {
+    clearFinishedDrain();
+    finishedDrainTimer = setTimeout(() => {
+      finishedDrainTimer = null;
+      finishStream();
+    }, drainMs);
+  };
+
+  return {
+    scheduleFinishAfterDrain,
+    clearFinishedDrain,
+    isDrainPending: () => finishedDrainTimer !== null,
+  };
+}
diff --git a/open-sse/executors/deepseek-web.ts b/open-sse/executors/deepseek-web.ts
index 7b6e5e0167..99fda068af 100644
--- a/open-sse/executors/deepseek-web.ts
+++ b/open-sse/executors/deepseek-web.ts
@@ -14,6 +14,10 @@ import {
   appendSearchCitations,
   type DeepSeekSearchResult,
 } from "./deepseek-web/stream-format.ts";
+import {
+  createFinishOnceGuard,
+  createFinishedDrainScheduler,
+} from "./deepseek-web-done-terminator.ts";
 
 export const DEEPSEEK_WEB_BASE = "https://chat.deepseek.com";
 const DEEPSEEK_API_BASE = `${DEEPSEEK_WEB_BASE}/api`;
@@ -198,7 +202,7 @@ function transformSSE(deepseekStream: ReadableStream, model: string): ReadableSt
           }
         };
 
-        const finishStream = () => {
+        const { finishOnce: finishStream, hasFinished } = createFinishOnceGuard(() => {
           const citations = appendSearchCitations(searchResults, streamModel);
           if (citations) {
             ensureRole();
@@ -206,9 +210,16 @@ function transformSSE(deepseekStream: ReadableStream, model: string): ReadableSt
           }
           ensureRole();
           chunk({}, "stop");
+          // OpenAI-compatible clients (SDK, OpenCode) hang without this terminator.
           controller.enqueue(encoder.encode("data: [DONE]\n\n"));
           controller.close();
-        };
+        });
+
+        // Do not close *immediately* on FINISHED — DeepSeek may still send
+        // search_results afterward. Drain briefly, then always emit
+        // stop + [DONE] so clients do not hang if the upstream body stays open.
+        const { scheduleFinishAfterDrain, clearFinishedDrain, isDrainPending } =
+          createFinishedDrainScheduler(finishStream);
 
         const sendByPath = (raw: string) => {
           const text = formatStreamContent(raw, streamModel);
@@ -324,19 +335,32 @@ function transformSSE(deepseekStream: ReadableStream, model: string): ReadableSt
                 }
               }
 
-              // Do not close on FINISHED — DeepSeek may still send search_results afterward.
               if (p === "response/status" && v === "FINISHED") {
+                scheduleFinishAfterDrain();
                 continue;
               }
+
+              // Any other post-FINISHED payload extends the drain window so we
+              // still capture late search_results before closing.
+              if (isDrainPending()) {
+                scheduleFinishAfterDrain();
+              }
             }
           }
         } catch (err) {
-          controller.error(err);
+          clearFinishedDrain();
+          if (!hasFinished()) {
+            controller.error(err);
+          }
           return;
         }
 
         finishStream();
       },
+      cancel() {
+        // Best-effort: cancel upstream reader if the client aborts mid-stream.
+        // finishStream is not required here — the controller is already cancelled.
+      },
     },
     { highWaterMark: 16384 }
   );
diff --git a/open-sse/executors/default.ts b/open-sse/executors/default.ts
index b2697a349e..f3bd3930c8 100644
--- a/open-sse/executors/default.ts
+++ b/open-sse/executors/default.ts
@@ -44,7 +44,7 @@ import { buildMaritalkChatUrl } from "../config/maritalk.ts";
 import { LOCAL_PROVIDERS } from "@/shared/constants/providers";
 import { isForbiddenCustomHeaderName } from "@/shared/constants/upstreamHeaders";
 import { getClaudeCodeCompatibleRequestDefaults } from "@/lib/providers/requestDefaults";
-import { buildClineHeaders } from "@/shared/utils/clineAuth";
+import { buildClineHeaders, buildClinepassHeaders } from "@/shared/utils/clineAuth";
 import {
   normalizeHerokuChatUrl,
   normalizeDatabricksChatUrl,
@@ -369,6 +369,9 @@ export class DefaultExecutor extends BaseExecutor {
       case "glm-coding-apikey":
         headers["x-api-key"] = effectiveKey || credentials.accessToken;
         break;
+      case "clinepass": // dual-auth (OAuth or BYOK) — see buildClinepassHeaders()
+        Object.assign(headers, buildClinepassHeaders(credentials, effectiveKey));
+        break;
       case "cline":
         // Cline's API requires the bearer token prefixed with `workos:` plus a
         // set of Cline client-identification headers; plain `Bearer <token>`
diff --git a/open-sse/executors/grok-cli.ts b/open-sse/executors/grok-cli.ts
index 67aa8255d3..ced0ac1465 100644
--- a/open-sse/executors/grok-cli.ts
+++ b/open-sse/executors/grok-cli.ts
@@ -240,8 +240,17 @@ export class GrokCliExecutor extends BaseExecutor {
     }
     transformed.stream = !!stream;
 
-    // Grok Build rejects unsupported parameters with 400.
-    const UNSUPPORTED = ["presencePenalty", "frequencyPenalty", "logprobs", "topLogprobs"];
+    // Grok Build rejects unsupported parameters with 400. `reasoning_effort`/`reasoning`
+    // are sent by clients like Claude Code (routing the Opus slot) but are not accepted
+    // by Grok Build's upstream chat-proxy endpoint — see #6288.
+    const UNSUPPORTED = [
+      "presencePenalty",
+      "frequencyPenalty",
+      "logprobs",
+      "topLogprobs",
+      "reasoning_effort",
+      "reasoning",
+    ];
     for (const param of UNSUPPORTED) {
       if (param in transformed) {
         delete transformed[param];
diff --git a/open-sse/executors/index.ts b/open-sse/executors/index.ts
index a922247c8c..039e7fa637 100644
--- a/open-sse/executors/index.ts
+++ b/open-sse/executors/index.ts
@@ -49,6 +49,7 @@ import { V0VercelWebExecutor } from "./v0-vercel-web.ts";
 import { KimiWebExecutor } from "./kimi-web.ts";
 import { DoubaoWebExecutor } from "./doubao-web.ts";
 import { QwenWebExecutor } from "./qwen-web.ts";
+import { ZaiWebExecutor } from "./zai-web.ts";
 import { KimiExecutor } from "./kimi.ts";
 import { TheOldLlmExecutor } from "./theoldllm.ts";
 import { ChipotleExecutor } from "./chipotle.ts";
@@ -147,6 +148,8 @@ const executors = {
   db: new DoubaoWebExecutor(), // Alias
   "qwen-web": new QwenWebExecutor(),
   qw: new QwenWebExecutor(), // Alias
+  "zai-web": new ZaiWebExecutor(),
+  zw: new ZaiWebExecutor(), // Alias
   theoldllm: new TheOldLlmExecutor(),
   tllm: new TheOldLlmExecutor(), // Alias
   chipotle: new ChipotleExecutor(),
diff --git a/open-sse/executors/kimi-web.ts b/open-sse/executors/kimi-web.ts
index cf4ff4bdbe..a2fe1e6df1 100644
--- a/open-sse/executors/kimi-web.ts
+++ b/open-sse/executors/kimi-web.ts
@@ -26,7 +26,10 @@
  * session; the upstream returns the same response either way.
  */
 import { BaseExecutor, type ExecuteInput } from "./base.ts";
-import { makeExecutorErrorResult as makeErrorResult, sanitizeErrorMessage } from "../utils/error.ts";
+import {
+  makeExecutorErrorResult as makeErrorResult,
+  sanitizeErrorMessage,
+} from "../utils/error.ts";
 import { extractKimiJwt } from "@/lib/providers/webCookieAuth";
 
 export { extractKimiJwt };
@@ -93,7 +96,10 @@ const MAX_FRAME_LEN = 8 * 1024 * 1024;
  *     (caller must treat this as a stream-fatal protocol error)
  *   - `consumed: N` + the parsed frame otherwise
  */
-export function decodeConnectFrame(buf: Uint8Array, byteOffset: number): { consumed: number; frame: ConnectFrame | null } {
+export function decodeConnectFrame(
+  buf: Uint8Array,
+  byteOffset: number
+): { consumed: number; frame: ConnectFrame | null } {
   if (byteOffset + 5 > buf.length) return { consumed: 0, frame: null };
   const flags = buf[byteOffset];
   const len =
@@ -130,7 +136,9 @@ type DeltaKind = "text" | "think" | null;
  * Anything else (heartbeats, chat/message metadata, stage transitions) is
  * suppressed; we only surface text to the client.
  */
-export function extractDelta(msg: Record<string, unknown> | null): { kind: DeltaKind; text: string } | null {
+export function extractDelta(
+  msg: Record<string, unknown> | null
+): { kind: DeltaKind; text: string } | null {
   if (!msg) return null;
   const op = String(msg.op ?? "");
   const mask = String(msg.mask ?? "");
@@ -167,7 +175,11 @@ export function isEndOfStream(msg: Record<string, unknown> | null): boolean {
   if (!msg) return false;
   // Assistant message flipped to COMPLETED.
   const message = (msg.message ?? null) as Record<string, unknown> | null;
-  if (message && String(message.status ?? "") === "MESSAGE_STATUS_COMPLETED" && String(message.role ?? "") === "assistant") {
+  if (
+    message &&
+    String(message.status ?? "") === "MESSAGE_STATUS_COMPLETED" &&
+    String(message.role ?? "") === "assistant"
+  ) {
     return true;
   }
   return false;
@@ -252,7 +264,7 @@ export class KimiWebExecutor extends BaseExecutor {
     }
 
     const messages = (bodyObj.messages as Array<{ role: string; content: unknown }>) || [];
-    const modelId = (bodyObj.model as string) || "kimi-default";
+    const modelId = (bodyObj.model as string) || "k2d6";
     // Resolve scenario + default thinking flag from the model id (catalog truth),
     // then honour an explicit `reasoning_effort: "none"` override from the caller.
     const modelConfig = resolveModelConfig(modelId);
@@ -285,7 +297,12 @@ export class KimiWebExecutor extends BaseExecutor {
 
     if (!upstream.ok) {
       const errText = await upstream.text().catch(() => "");
-      return makeErrorResult(upstream.status, `Kimi error: ${sanitizeErrorMessage(errText)}`, body, CHAT_URL);
+      return makeErrorResult(
+        upstream.status,
+        `Kimi error: ${sanitizeErrorMessage(errText)}`,
+        body,
+        CHAT_URL
+      );
     }
 
     const encoder = new TextEncoder();
diff --git a/open-sse/executors/kiro.ts b/open-sse/executors/kiro.ts
index 7def296e39..3dab64c395 100644
--- a/open-sse/executors/kiro.ts
+++ b/open-sse/executors/kiro.ts
@@ -8,12 +8,18 @@ import {
 import { PROVIDERS } from "../config/constants.ts";
 import { v4 as uuidv4 } from "uuid";
 import { refreshKiroToken } from "../services/tokenRefresh.ts";
+import {
+  isExternalIdpAuthMethod,
+  KIRO_EXTERNAL_IDP_TOKEN_TYPE_HEADER,
+  KIRO_EXTERNAL_IDP_TOKEN_TYPE_VALUE,
+} from "../services/kiroExternalIdp.ts";
 import {
   splitInlineThinking,
   flushPendingThinking,
   type KiroThinkingState,
 } from "./kiroThinking.ts";
 import { ByteQueue, TEXT_ENCODER, parseEventFrame } from "./kiro/eventstream.ts";
+import { kiroRuntimeHost, resolveKiroRuntimeRegion } from "../services/kiroRegion.ts";
 
 type JsonRecord = Record<string, unknown>;
 
@@ -147,35 +153,28 @@ function ensureKiroUsage(state: KiroStreamState) {
 }
 
 /**
- * Resolve the AWS region for a Kiro/CodeWhisperer connection. Enterprise AWS IAM Identity
- * Center accounts are region-bound: the access token, the Q Developer profile ARN and the
- * runtime endpoint must all match the region the IdC instance lives in (e.g. eu-central-1).
- * A request signed for one region is rejected by another ("bearer token is invalid"), and a
- * regional profileArn sent to us-east-1 fails with "Improperly formed request". Falls back to
- * the region embedded in the profileArn, then us-east-1 (the AWS Builder ID default).
+ * Resolve the RUNTIME AWS region for a Kiro/CodeWhisperer connection.
+ *
+ * The runtime region is the region of the Amazon Q Developer profile (embedded in the
+ * profileArn — always us-east-1 or eu-central-1), NOT the IAM Identity Center / OIDC token
+ * region. An enterprise IdC instance may live in eu-north-1 (or any region), but the Q Developer
+ * profile that serves generateAssistantResponse only exists in us-east-1 / eu-central-1, so a
+ * runtime call must target the profileArn's region — routing to q.{idcRegion}.amazonaws.com
+ * (a host that does not exist) is what caused "no limits + 502 on every request". Delegates to
+ * the shared resolver (profileArn region → valid stored profile region → us-east-1). The IdC
+ * token region is used only for oidc.{region} token mint/refresh, elsewhere.
  */
 export function resolveKiroRegion(
   credentials: { providerSpecificData?: unknown } | null | undefined
 ): string {
-  const psd = (credentials?.providerSpecificData || {}) as Record<string, unknown>;
-  const region = typeof psd.region === "string" ? psd.region.trim().toLowerCase() : "";
-  if (region) return region;
-  const arn = typeof psd.profileArn === "string" ? psd.profileArn.toLowerCase() : "";
-  const match = arn.match(/^arn:aws:codewhisperer:([a-z0-9-]+):/);
-  return match ? match[1] : "us-east-1";
+  return resolveKiroRuntimeRegion(
+    (credentials?.providerSpecificData || {}) as { region?: unknown; profileArn?: unknown }
+  );
 }
 
-/**
- * CodeWhisperer/Amazon Q runtime host for a region. us-east-1 keeps the legacy
- * codewhisperer.us-east-1 host (AWS Builder ID); other regions use the regional Amazon Q
- * endpoint q.{region}.amazonaws.com — codewhisperer.{region}.amazonaws.com does not resolve
- * for non-us-east-1 regions.
- */
-export function kiroRuntimeHost(region: string): string {
-  return region === "us-east-1"
-    ? "https://codewhisperer.us-east-1.amazonaws.com"
-    : `https://q.${region}.amazonaws.com`;
-}
+// Re-exported from the shared region module so existing importers (and tests) that pull
+// kiroRuntimeHost from this executor keep working.
+export { kiroRuntimeHost };
 
 /**
  * KiroExecutor - Executor for Kiro AI (AWS CodeWhisperer)
@@ -196,8 +195,29 @@ export class KiroExecutor extends BaseExecutor {
       "anthropic-beta": "prompt-caching-2024-07-31",
     };
 
-    if (credentials.accessToken) {
-      headers["Authorization"] = `Bearer ${credentials.accessToken}`;
+    const authMethod =
+      typeof credentials.providerSpecificData?.authMethod === "string"
+        ? credentials.providerSpecificData.authMethod
+        : undefined;
+    const isApiKey = authMethod === "api_key";
+    const token = isApiKey
+      ? credentials.apiKey || credentials.accessToken
+      : credentials.accessToken;
+
+    if (token) {
+      headers["Authorization"] = `Bearer ${token}`;
+      // Long-lived Kiro/CodeWhisperer API keys authenticate with `tokentype: API_KEY`.
+      if (isApiKey) headers["tokentype"] = "API_KEY";
+
+      // Enterprise / Microsoft Entra "Your organization" (external_idp) logins send an
+      // org-IdP-issued access token. CodeWhisperer only binds it to the Amazon Q Developer
+      // profile when the request carries `TokenType: EXTERNAL_IDP`; without it every call
+      // returns `ValidationException: Invalid ARN <clientId>` (the service falls back to the
+      // token's client id as the resource ARN). AWS SSO (Builder ID / IDC) and social tokens
+      // must NOT send this header, so it is gated on the persisted authMethod.
+      if (isExternalIdpAuthMethod(authMethod)) {
+        headers[KIRO_EXTERNAL_IDP_TOKEN_TYPE_HEADER] = KIRO_EXTERNAL_IDP_TOKEN_TYPE_VALUE;
+      }
     }
 
     return headers;
@@ -780,6 +800,7 @@ export class KiroExecutor extends BaseExecutor {
   }
 
   async refreshCredentials(credentials: ProviderCredentials, log?: ExecutorLog | null) {
+    if (credentials.providerSpecificData?.authMethod === "api_key") return null;
     if (!credentials.refreshToken) return null;
 
     try {
diff --git a/open-sse/executors/lmarena.ts b/open-sse/executors/lmarena.ts
index 2f78d278db..3f28acf848 100644
--- a/open-sse/executors/lmarena.ts
+++ b/open-sse/executors/lmarena.ts
@@ -1,177 +1,71 @@
 /**
- * LMArenaExecutor — LMArena Web Session Provider
+ * LMArenaExecutor — Arena (formerly LMArena) web-session provider.
  *
- * Routes requests through LMArena's web API using session credentials.
- * LMArena is a model comparison platform with 100+ models (GPT, Claude, Gemini, Llama).
+ * Routes requests through arena.ai create-evaluation with session cookies.
+ * Upstream sits behind Cloudflare; traffic goes through tls-client-node Chrome
+ * impersonation (see services/lmarenaTlsClient.ts).
  *
- * API Structure:
- *   Endpoint: https://arena.ai/nextjs-api/stream
- *   Method: POST
- *   Content-Type: application/json
- *   Accept: text/event-stream
- *
- * Auth pipeline (per request):
- *   1. Extract session cookie from credentials
- *   2. Build request with model and messages
- *   3. Make authenticated POST request to LMArena API
- *   4. Handle SSE response stream with custom prefixes (a0:, ag:, a3:, ae:, ad:)
- *
- * SSE Format:
- *   a0: - Text content (concatenate)
- *   ag: - Thinking/reasoning content
- *   a2: - Heartbeat (ignore)
- *   a3: - Model error
- *   ae: - Platform error
- *   ad: - Done marker
+ * Helpers: open-sse/executors/lmarena/{cookie,models,stream,response}.ts
  */
+import { v7 as uuidv7 } from "uuid";
 import { BaseExecutor, type ExecuteInput } from "./base.ts";
-import { sanitizeErrorMessage } from "../utils/error.ts";
+import { tlsFetchLMArena, TlsClientUnavailableError } from "../services/lmarenaTlsClient.ts";
+import { readLMArenaCookie, reconstructLMArenaCookie } from "./lmarena/cookie.ts";
+import {
+  LMARENA_STREAM_URL,
+  LMARENA_USER_AGENT,
+  buildLmarenaBrowserHeaders,
+  markLMArenaCatalogModelDead,
+  normalizeLMArenaModelsForCatalog,
+  parseLMArenaInitialModels,
+  pickLMArenaModelId,
+  resolveLMArenaModelId,
+  type LMArenaModelMetadata,
+} from "./lmarena/models.ts";
+import { formatArenaPrompt, parseArenaSSE } from "./lmarena/stream.ts";
+import {
+  buildArenaUpstreamHttpResponse,
+  createOpenAIArenaStream,
+  handleNonStreamingArenaResponse,
+  mapFailedTlsResult,
+  mapNetworkError,
+  mapTlsUnavailable,
+  missingCookieResult,
+} from "./lmarena/response.ts";
 
-const LMARENA_API_BASE = "https://arena.ai";
-const LMARENA_STREAM_URL = `${LMARENA_API_BASE}/nextjs-api/stream`;
+export {
+  reconstructLMArenaCookie,
+  normalizeLMArenaModelsForCatalog,
+  parseLMArenaInitialModels,
+  pickLMArenaModelId,
+  parseArenaSSE,
+  markLMArenaCatalogModelDead,
+  LMARENA_USER_AGENT,
+};
+export { clearLMArenaDeadCatalogModels } from "./lmarena/models.ts";
+export type { LMArenaModelMetadata };
 
-const LMARENA_USER_AGENT =
-  "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36";
-
-const LMARENA_AUTH_COOKIE = "arena-auth-prod-v1";
-
-interface ParsedCookie {
-  name: string;
-  value: string;
+interface OpenAIMessage {
+  role?: string;
+  content?: unknown;
 }
 
-/**
- * Parse a raw `Cookie:`-style blob (`name=value; name2=value2; …`) into an
- * ordered list of name/value pairs. Whitespace around names is trimmed; values
- * are kept verbatim (they may legitimately contain `=`, e.g. base64 padding).
- */
-function parseCookieBlob(blob: string): ParsedCookie[] {
-  const pairs: ParsedCookie[] = [];
-  for (const part of blob.split(";")) {
-    const eq = part.indexOf("=");
-    if (eq < 0) continue;
-    const name = part.slice(0, eq).trim();
-    if (!name) continue;
-    const value = part.slice(eq + 1).trim();
-    pairs.push({ name, value });
-  }
-  return pairs;
-}
-
-/**
- * Reconstruct LMArena's single `arena-auth-prod-v1` auth cookie from the
- * Supabase SSR chunked form.
- *
- * LMArena migrated to `@supabase/ssr`, which splits a large auth cookie across
- * `arena-auth-prod-v1.0`, `arena-auth-prod-v1.1`, … (ascending). The single
- * `arena-auth-prod-v1` cookie is then left empty. Following `@supabase/ssr`'s
- * `combineChunks`, we read chunks in ascending numeric order until one is
- * missing and `join("")` their raw values — NO base64-decode, NO JSON-parse.
- * The joined value typically starts with the literal `base64-` prefix; we keep
- * it verbatim (the upstream expects it).
- *
- * - If the blob already carries a non-empty `arena-auth-prod-v1=<value>`, it is
- *   returned unchanged (back-compat with the pre-migration single cookie).
- * - Otherwise the reconstructed `arena-auth-prod-v1=<joined>` is injected while
- *   every other cookie in the pasted jar is preserved.
- * - If neither the single cookie nor any `.N` chunk has a value, the blob is
- *   returned as-is so the existing missing-cookie path still fires.
- */
-export function reconstructLMArenaCookie(rawCookie: string): string {
-  if (!rawCookie || !rawCookie.trim()) return rawCookie;
-
-  const pairs = parseCookieBlob(rawCookie);
-
-  // Back-compat: a non-empty single cookie is already usable — forward verbatim.
-  const existing = pairs.find((p) => p.name === LMARENA_AUTH_COOKIE);
-  if (existing && existing.value) return rawCookie;
-
-  // Collect chunk values keyed by their numeric index (`arena-auth-prod-v1.<N>`).
-  const chunkPrefix = `${LMARENA_AUTH_COOKIE}.`;
-  const chunks = new Map<number, string>();
-  for (const { name, value } of pairs) {
-    if (!name.startsWith(chunkPrefix)) continue;
-    const idxRaw = name.slice(chunkPrefix.length);
-    if (!/^\d+$/.test(idxRaw)) continue;
-    chunks.set(Number(idxRaw), value);
-  }
-
-  // Join in ascending order until a chunk is missing (combineChunks semantics).
-  const joinedParts: string[] = [];
-  for (let i = 0; chunks.has(i); i++) {
-    joinedParts.push(chunks.get(i) ?? "");
-  }
-  const joined = joinedParts.join("");
-
-  // No usable session anywhere → return as-is so the missing-cookie path fires.
-  if (!joined) return rawCookie;
-
-  // Inject the reconstructed single cookie while preserving the rest of the jar
-  // (drop the empty base cookie and the now-redundant chunks).
-  const preserved = pairs.filter(
-    (p) => p.name !== LMARENA_AUTH_COOKIE && !p.name.startsWith(chunkPrefix)
-  );
-  const rebuilt = [
-    `${LMARENA_AUTH_COOKIE}=${joined}`,
-    ...preserved.map((p) => `${p.name}=${p.value}`),
-  ];
-  return rebuilt.join("; ");
-}
-
-function readLMArenaCookie(credentials: unknown): string {
-  if (!credentials || typeof credentials !== "object") return "";
-  const c = credentials as Record<string, unknown>;
-  const direct = typeof c.cookie === "string" ? c.cookie : "";
-  if (direct.trim()) return reconstructLMArenaCookie(direct);
-  const apiKey = typeof c.apiKey === "string" ? c.apiKey : "";
-  if (apiKey.trim()) return reconstructLMArenaCookie(apiKey);
-  const psd = c.providerSpecificData;
-  if (psd && typeof psd === "object") {
-    const nested = (psd as Record<string, unknown>).cookie;
-    if (typeof nested === "string" && nested.trim()) return reconstructLMArenaCookie(nested);
-  }
-  return "";
-}
-
-interface ArenaSSEEvent {
-  type: "text" | "thinking" | "error" | "done" | "heartbeat";
-  content?: string;
-}
-
-export function parseArenaSSE(line: string): ArenaSSEEvent | null {
-  if (line.startsWith("a0:")) {
-    try {
-      const content = JSON.parse(line.substring(3));
-      return { type: "text", content: typeof content === "string" ? content : content.text || "" };
-    } catch {
-      return null;
+/** Optional browser-issued reCAPTCHA v3 token (operator-supplied). */
+function readRecaptchaToken(credentials: unknown, body: unknown): string | null {
+  const fromObj = (v: unknown): string | null => {
+    if (!v || typeof v !== "object") return null;
+    const rec = v as Record<string, unknown>;
+    const direct = rec.recaptchaV3Token ?? rec.recaptchaToken;
+    if (typeof direct === "string" && direct.trim()) return direct.trim();
+    const psd = rec.providerSpecificData;
+    if (psd && typeof psd === "object") {
+      const nested = psd as Record<string, unknown>;
+      const t = nested.recaptchaV3Token ?? nested.recaptchaToken;
+      if (typeof t === "string" && t.trim()) return t.trim();
     }
-  } else if (line.startsWith("ag:")) {
-    try {
-      const content = JSON.parse(line.substring(3));
-      return {
-        type: "thinking",
-        content: typeof content === "string" ? content : content.thinking || "",
-      };
-    } catch {
-      return null;
-    }
-  } else if (line.startsWith("a3:") || line.startsWith("ae:")) {
-    try {
-      const content = JSON.parse(line.substring(3));
-      return {
-        type: "error",
-        content: typeof content === "string" ? content : content.error || JSON.stringify(content),
-      };
-    } catch {
-      return { type: "error", content: line.substring(3) };
-    }
-  } else if (line.startsWith("ad:")) {
-    return { type: "done" };
-  } else if (line.startsWith("a2:")) {
-    return { type: "heartbeat" };
-  }
-  return null;
+    return null;
+  };
+  return fromObj(credentials) ?? fromObj(body);
 }
 
 export class LMArenaExecutor extends BaseExecutor {
@@ -189,242 +83,135 @@ export class LMArenaExecutor extends BaseExecutor {
     _body: unknown
   ): Record<string, string> {
     const cookie = readLMArenaCookie(credentials);
-    const headers: Record<string, string> = {
+    const headers = buildLmarenaBrowserHeaders({
       "Content-Type": "application/json",
       Accept: "text/event-stream",
-      "User-Agent": LMARENA_USER_AGENT,
-      Origin: LMARENA_API_BASE,
-      Referer: `${LMARENA_API_BASE}/`,
-    };
-
-    if (cookie) {
-      headers.Cookie = cookie;
-    }
-
+    });
+    if (cookie) headers.Cookie = cookie;
     return headers;
   }
 
-  protected transformRequest(body: unknown, model: string): unknown {
-    const openaiBody = body as Record<string, unknown>;
-    const messages = openaiBody.messages as Array<{ role: string; content: string }>;
-
+  protected transformRequest(body: unknown, model: string, credentials?: unknown): unknown {
+    const openaiBody = body && typeof body === "object" ? (body as Record<string, unknown>) : {};
+    const messages = Array.isArray(openaiBody.messages)
+      ? (openaiBody.messages as OpenAIMessage[])
+      : [];
     return {
-      messages: messages.map((m) => ({
-        role: m.role,
-        content: m.content,
-      })),
-      model,
-      stream: openaiBody.stream || false,
+      id: uuidv7(),
+      mode: "direct-battle",
+      modelAId: model,
+      userMessageId: uuidv7(),
+      modelAMessageId: uuidv7(),
+      userMessage: {
+        content: formatArenaPrompt(messages),
+        experimental_attachments: [],
+        metadata: {},
+      },
+      modality: "chat",
+      recaptchaV3Token: readRecaptchaToken(credentials, body),
     };
   }
 
   async execute(input: ExecuteInput) {
     const { model, body, stream, credentials, signal, log } = input;
-
     const url = this.buildUrl(model, credentials);
     const headers = this.buildHeaders(model, credentials, body);
-    const transformedBody = this.transformRequest(body, model);
-
     const cookie = readLMArenaCookie(credentials);
+
     if (!cookie) {
-      return {
-        response: new Response(
-          JSON.stringify({
-            error: {
-              message: "LMArena requires a session cookie. Please provide cookie in credentials.",
-              type: "authentication_error",
-              code: "missing_cookie",
-            },
-          }),
-          { status: 401, headers: { "Content-Type": "application/json" } }
-        ),
-        url,
-        headers,
-        transformedBody,
-      };
+      return missingCookieResult(url, headers, this.transformRequest(body, model, credentials));
     }
 
-    log?.info?.("LMArenaExecutor", `Executing request for model: ${model}`);
+    const arenaModelId = await resolveLMArenaModelId(model, log);
+    const transformedBody = this.transformRequest(body, arenaModelId, credentials) as Record<
+      string,
+      unknown
+    >;
+
+    log?.info?.(
+      "LMArenaExecutor",
+      arenaModelId === model
+        ? `Executing request for model: ${model}`
+        : `Executing request for model: ${model} (${arenaModelId})`
+    );
 
     try {
-      const response = await fetch(url, {
-        method: "POST",
-        headers,
-        body: JSON.stringify(transformedBody),
+      return await this.dispatchTls(url, headers, transformedBody, {
+        model,
+        arenaModelId,
+        stream: !!stream,
         signal,
+        log,
       });
-
-      if (!response.ok) {
-        const errorText = await response.text();
-        let errorMessage = `LMArena API error: ${response.status}`;
-        try {
-          const errorJson = JSON.parse(errorText);
-          errorMessage = errorJson.error?.message || errorJson.message || errorMessage;
-        } catch {
-          errorMessage = errorText || errorMessage;
-        }
-
-        return {
-          response: new Response(
-            JSON.stringify({
-              error: {
-                message: sanitizeErrorMessage(errorMessage),
-                type: "api_error",
-                code: String(response.status),
-              },
-            }),
-            { status: response.status, headers: { "Content-Type": "application/json" } }
-          ),
-          url,
-          headers,
-          transformedBody,
-        };
-      }
-
-      const upstreamResponse = stream
-        ? await this.handleStreamingResponse(response, model, log)
-        : await this.handleNonStreamingResponse(response, model, log);
-
-      return { response: upstreamResponse, url, headers, transformedBody };
     } catch (error) {
+      if (error instanceof TlsClientUnavailableError) {
+        log?.error?.("LMArenaExecutor", `TLS client unavailable: ${error.message}`);
+        return mapTlsUnavailable(error, url, headers, transformedBody);
+      }
       const message = error instanceof Error ? error.message : String(error);
       log?.error?.("LMArenaExecutor", `Request failed: ${message}`);
-
-      return {
-        response: new Response(
-          JSON.stringify({
-            error: {
-              message: sanitizeErrorMessage(message),
-              type: "network_error",
-              code: "request_failed",
-            },
-          }),
-          { status: 502, headers: { "Content-Type": "application/json" } }
-        ),
-        url,
-        headers,
-        transformedBody,
-      };
+      return mapNetworkError(message, url, headers, transformedBody);
     }
   }
 
+  private async dispatchTls(
+    url: string,
+    headers: Record<string, string>,
+    transformedBody: Record<string, unknown>,
+    ctx: {
+      model: string;
+      arenaModelId: string;
+      stream: boolean;
+      signal?: AbortSignal;
+      log?: ExecuteInput["log"];
+    }
+  ) {
+    const tlsResult = await tlsFetchLMArena(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(transformedBody),
+      signal: ctx.signal,
+      stream: ctx.stream,
+      streamEofSymbol: "__OMNIROUTE_LMARENA_EOF_NEVER__",
+    });
+
+    const failed = mapFailedTlsResult({
+      status: tlsResult.status,
+      text: tlsResult.text,
+      hasRecaptcha: transformedBody.recaptchaV3Token != null,
+      model: ctx.model,
+      arenaModelId: ctx.arenaModelId,
+      url,
+      headers,
+      transformedBody,
+    });
+    if (failed) return failed;
+
+    const upstream = buildArenaUpstreamHttpResponse({
+      stream: ctx.stream,
+      status: tlsResult.status,
+      text: tlsResult.text,
+      body: tlsResult.body,
+    });
+
+    const response = ctx.stream
+      ? await this.handleStreamingResponse(upstream, ctx.model, ctx.signal, ctx.log)
+      : await handleNonStreamingArenaResponse(upstream, ctx.model);
+
+    return { response, url, headers, transformedBody };
+  }
+
   private async handleStreamingResponse(
     response: Response,
     model: string,
+    signal?: AbortSignal,
     log?: ExecuteInput["log"]
   ): Promise<Response> {
     const reader = response.body?.getReader();
-    if (!reader) {
-      throw new Error("No response body for streaming");
-    }
+    if (!reader) throw new Error("No response body for streaming");
 
-    const decoder = new TextDecoder();
-    let buffer = "";
-    let fullText = "";
-    let fullThinking = "";
-
-    const stream = new ReadableStream({
-      async start(controller) {
-        try {
-          while (true) {
-            const { done, value } = await reader.read();
-            if (done) break;
-
-            buffer += decoder.decode(value, { stream: true });
-            const lines = buffer.split("\n");
-            buffer = lines.pop() || "";
-
-            for (const line of lines) {
-              if (!line.trim()) continue;
-
-              const sseLine = line.startsWith("data: ") ? line.substring(6) : line;
-              const event = parseArenaSSE(sseLine);
-
-              if (!event) continue;
-
-              if (event.type === "text" && event.content) {
-                fullText += event.content;
-                const chunk = {
-                  id: `chatcmpl-${Date.now()}`,
-                  object: "chat.completion.chunk",
-                  created: Math.floor(Date.now() / 1000),
-                  model,
-                  choices: [
-                    {
-                      index: 0,
-                      delta: { content: event.content },
-                      finish_reason: null,
-                    },
-                  ],
-                };
-                controller.enqueue(`data: ${JSON.stringify(chunk)}\n\n`);
-              } else if (event.type === "thinking" && event.content) {
-                fullThinking += event.content;
-              } else if (event.type === "error") {
-                const errorChunk = {
-                  id: `chatcmpl-${Date.now()}`,
-                  object: "chat.completion.chunk",
-                  created: Math.floor(Date.now() / 1000),
-                  model,
-                  choices: [
-                    {
-                      index: 0,
-                      delta: {},
-                      finish_reason: "stop",
-                    },
-                  ],
-                  error: { message: event.content },
-                };
-                controller.enqueue(`data: ${JSON.stringify(errorChunk)}\n\n`);
-                controller.close();
-                return;
-              } else if (event.type === "done") {
-                const finalChunk = {
-                  id: `chatcmpl-${Date.now()}`,
-                  object: "chat.completion.chunk",
-                  created: Math.floor(Date.now() / 1000),
-                  model,
-                  choices: [
-                    {
-                      index: 0,
-                      delta: {},
-                      finish_reason: "stop",
-                    },
-                  ],
-                };
-                controller.enqueue(`data: ${JSON.stringify(finalChunk)}\n\n`);
-                controller.enqueue("data: [DONE]\n\n");
-                controller.close();
-                return;
-              }
-            }
-          }
-
-          const finalChunk = {
-            id: `chatcmpl-${Date.now()}`,
-            object: "chat.completion.chunk",
-            created: Math.floor(Date.now() / 1000),
-            model,
-            choices: [
-              {
-                index: 0,
-                delta: {},
-                finish_reason: "stop",
-              },
-            ],
-          };
-          controller.enqueue(`data: ${JSON.stringify(finalChunk)}\n\n`);
-          controller.enqueue("data: [DONE]\n\n");
-          controller.close();
-        } catch (error) {
-          const message = error instanceof Error ? error.message : String(error);
-          log?.error?.("LMArenaExecutor", `Streaming error: ${message}`);
-          controller.error(error);
-        }
-      },
-    });
-
-    return new Response(stream, {
+    const out = createOpenAIArenaStream({ reader, model, signal, log });
+    return new Response(out, {
       status: 200,
       headers: {
         "Content-Type": "text/event-stream",
@@ -433,79 +220,4 @@ export class LMArenaExecutor extends BaseExecutor {
       },
     });
   }
-
-  private async handleNonStreamingResponse(
-    response: Response,
-    model: string,
-    log?: ExecuteInput["log"]
-  ): Promise<Response> {
-    const text = await response.text();
-    const lines = text.split("\n");
-    let fullText = "";
-    let fullThinking = "";
-    let error: string | null = null;
-
-    for (const line of lines) {
-      if (!line.trim()) continue;
-
-      const sseLine = line.startsWith("data: ") ? line.substring(6) : line;
-      const event = parseArenaSSE(sseLine);
-
-      if (!event) continue;
-
-      if (event.type === "text" && event.content) {
-        fullText += event.content;
-      } else if (event.type === "thinking" && event.content) {
-        fullThinking += event.content;
-      } else if (event.type === "error") {
-        error = event.content || "Unknown error";
-        break;
-      } else if (event.type === "done") {
-        break;
-      }
-    }
-
-    if (error) {
-      return new Response(
-        JSON.stringify({
-          error: {
-            message: sanitizeErrorMessage(error),
-            type: "api_error",
-            code: "lmarena_error",
-          },
-        }),
-        {
-          status: 502,
-          headers: { "Content-Type": "application/json" },
-        }
-      );
-    }
-
-    const result = {
-      id: `chatcmpl-${Date.now()}`,
-      object: "chat.completion",
-      created: Math.floor(Date.now() / 1000),
-      model,
-      choices: [
-        {
-          index: 0,
-          message: {
-            role: "assistant",
-            content: fullText,
-          },
-          finish_reason: "stop",
-        },
-      ],
-      usage: {
-        prompt_tokens: 0,
-        completion_tokens: 0,
-        total_tokens: 0,
-      },
-    };
-
-    return new Response(JSON.stringify(result), {
-      status: 200,
-      headers: { "Content-Type": "application/json" },
-    });
-  }
 }
diff --git a/open-sse/executors/lmarena/cookie.ts b/open-sse/executors/lmarena/cookie.ts
new file mode 100644
index 0000000000..c1e62529a3
--- /dev/null
+++ b/open-sse/executors/lmarena/cookie.ts
@@ -0,0 +1,103 @@
+/**
+ * LMArena / arena.ai session cookie reconstruction.
+ * Supabase SSR splits `arena-auth-prod-v1` across `.0`, `.1`, … chunks.
+ */
+
+export const LMARENA_AUTH_COOKIE = "arena-auth-prod-v1";
+
+interface ParsedCookie {
+  name: string;
+  value: string;
+}
+
+/**
+ * Parse a raw `Cookie:`-style blob (`name=value; name2=value2; …`) into an
+ * ordered list of name/value pairs. Whitespace around names is trimmed; values
+ * are kept verbatim (they may legitimately contain `=`, e.g. base64 padding).
+ */
+function parseCookieBlob(blob: string): ParsedCookie[] {
+  const pairs: ParsedCookie[] = [];
+  for (const part of blob.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq < 0) continue;
+    const name = part.slice(0, eq).trim();
+    if (!name) continue;
+    const value = part.slice(eq + 1).trim();
+    pairs.push({ name, value });
+  }
+  return pairs;
+}
+
+/**
+ * Reconstruct LMArena's single `arena-auth-prod-v1` auth cookie from the
+ * Supabase SSR chunked form.
+ *
+ * - Non-empty single cookie → returned unchanged (pre-migration back-compat).
+ * - Otherwise join ascending `.N` chunks (no base64-decode / no JSON-parse).
+ * - Neither single nor chunks → raw blob returned for the missing-cookie path.
+ */
+export function reconstructLMArenaCookie(rawCookie: string): string {
+  if (!rawCookie || !rawCookie.trim()) return rawCookie;
+
+  const pairs = parseCookieBlob(rawCookie);
+
+  const existing = pairs.find((p) => p.name === LMARENA_AUTH_COOKIE);
+  if (existing && existing.value) return rawCookie;
+
+  const chunkPrefix = `${LMARENA_AUTH_COOKIE}.`;
+  const chunks = new Map<number, string>();
+  for (const { name, value } of pairs) {
+    if (!name.startsWith(chunkPrefix)) continue;
+    const idxRaw = name.slice(chunkPrefix.length);
+    if (!/^\d+$/.test(idxRaw)) continue;
+    chunks.set(Number(idxRaw), value);
+  }
+
+  const joinedParts: string[] = [];
+  for (let i = 0; chunks.has(i); i++) {
+    joinedParts.push(chunks.get(i) ?? "");
+  }
+  const joined = joinedParts.join("");
+  if (!joined) return rawCookie;
+
+  const preserved = pairs.filter(
+    (p) => p.name !== LMARENA_AUTH_COOKIE && !p.name.startsWith(chunkPrefix)
+  );
+  return [`${LMARENA_AUTH_COOKIE}=${joined}`, ...preserved.map((p) => `${p.name}=${p.value}`)].join(
+    "; "
+  );
+}
+
+function buildLMArenaCookieFromStoredFields(data: Record<string, unknown>): string {
+  const pairs: string[] = [];
+  for (const [name, value] of Object.entries(data)) {
+    if (name !== LMARENA_AUTH_COOKIE && !name.startsWith(`${LMARENA_AUTH_COOKIE}.`)) {
+      continue;
+    }
+    if (typeof value !== "string" || !value.trim()) continue;
+    pairs.push(`${name}=${value.trim()}`);
+  }
+
+  if (pairs.length === 0) return "";
+  return reconstructLMArenaCookie(pairs.join("; "));
+}
+
+export function readLMArenaCookie(credentials: unknown): string {
+  if (!credentials || typeof credentials !== "object") return "";
+  const c = credentials as Record<string, unknown>;
+  const direct = typeof c.cookie === "string" ? c.cookie : "";
+  if (direct.trim()) return reconstructLMArenaCookie(direct);
+  const apiKey = typeof c.apiKey === "string" ? c.apiKey : "";
+  if (apiKey.trim()) return reconstructLMArenaCookie(apiKey);
+  const topLevelChunks = buildLMArenaCookieFromStoredFields(c);
+  if (topLevelChunks) return topLevelChunks;
+  const psd = c.providerSpecificData;
+  if (psd && typeof psd === "object") {
+    const nestedData = psd as Record<string, unknown>;
+    const nested = nestedData.cookie;
+    if (typeof nested === "string" && nested.trim()) return reconstructLMArenaCookie(nested);
+    const nestedChunks = buildLMArenaCookieFromStoredFields(nestedData);
+    if (nestedChunks) return nestedChunks;
+  }
+  return "";
+}
diff --git a/open-sse/executors/lmarena/models.ts b/open-sse/executors/lmarena/models.ts
new file mode 100644
index 0000000000..fbfe277809
--- /dev/null
+++ b/open-sse/executors/lmarena/models.ts
@@ -0,0 +1,307 @@
+/**
+ * LMArena live model list parsing, catalog normalization, and name→UUID resolution.
+ */
+
+export const LMARENA_API_BASE = "https://arena.ai";
+export const LMARENA_STREAM_URL = `${LMARENA_API_BASE}/nextjs-api/stream/create-evaluation`;
+/**
+ * Current Chrome stable UA (header surface).
+ * TLS JA3 profile is separate: tls-client-node tops out at chrome_146 — see
+ * LMARENA_PROFILE in lmarenaTlsClient.ts. Headers track the live browser string;
+ * fingerprint stays at the newest native profile we can actually impersonate.
+ */
+export const LMARENA_USER_AGENT =
+  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36";
+export const LMARENA_MODEL_ID_RE =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/** Browser-like CORS headers for arena.ai same-origin API calls. */
+export function buildLmarenaBrowserHeaders(extra?: Record<string, string>): Record<string, string> {
+  return {
+    Accept: "text/event-stream, application/json, text/plain, */*",
+    "Accept-Language": "en-US,en;q=0.9",
+    "Cache-Control": "no-cache",
+    Pragma: "no-cache",
+    Origin: LMARENA_API_BASE,
+    Referer: `${LMARENA_API_BASE}/`,
+    "Sec-Ch-Ua": '"Chromium";v="150", "Google Chrome";v="150", "Not-A.Brand";v="24"',
+    "Sec-Ch-Ua-Mobile": "?0",
+    "Sec-Ch-Ua-Platform": '"Windows"',
+    "Sec-Fetch-Dest": "empty",
+    "Sec-Fetch-Mode": "cors",
+    "Sec-Fetch-Site": "same-origin",
+    "User-Agent": LMARENA_USER_AGENT,
+    ...extra,
+  };
+}
+
+export interface LMArenaModelMetadata {
+  id?: string;
+  publicName?: string;
+  name?: string;
+  displayName?: string;
+  organization?: string;
+  provider?: string;
+  userSelectable?: boolean;
+  rank?: number;
+  rankByModality?: Record<string, number>;
+  capabilities?: {
+    inputCapabilities?: Record<string, boolean>;
+    outputCapabilities?: Record<string, boolean>;
+  };
+}
+
+// Live arena.ai HTML discovery is intentionally disabled. Catalog + UUID map
+// come from the Direct-chat scrape seed (registry/lmarena/directModels.ts).
+
+function stripLMArenaModelPrefix(model: string): string {
+  return model.replace(/^(?:lmarena|lma|arena)\//i, "").trim();
+}
+
+function normalizeModelName(model: string): string {
+  return model.trim().toLowerCase();
+}
+
+function hasLMArenaCapability(
+  entry: LMArenaModelMetadata,
+  direction: "input" | "output",
+  key: string
+): boolean {
+  const capabilities =
+    direction === "input"
+      ? entry.capabilities?.inputCapabilities
+      : entry.capabilities?.outputCapabilities;
+  return capabilities?.[key] === true;
+}
+
+/**
+ * Arena ships hundreds of initialModels rows; many are webdev-only, hidden,
+ * unranked sentinels (chat rank = MAX_SAFE_INTEGER), or UUID twins that 404 on
+ * create-evaluation. Keep the catalog to chat-usable, ranked, selectable rows.
+ */
+const LMARENA_MAX_REASONABLE_CHAT_RANK = 100_000;
+/** Soft cap after dedupe — Arena UI only surfaces ~100–130 chat models. */
+export const LMARENA_CATALOG_SOFT_CAP = 120;
+
+const deadCatalogKeys = new Map<string, number>();
+const DEAD_CATALOG_TTL_MS = 6 * 60 * 60 * 1000;
+
+function deadKey(value: string): string {
+  return value.trim().toLowerCase();
+}
+
+/** Remember a model id/publicName that 404/502'd so the next catalog import drops it. */
+export function markLMArenaCatalogModelDead(idOrPublicName: string): void {
+  if (!idOrPublicName?.trim()) return;
+  deadCatalogKeys.set(deadKey(idOrPublicName), Date.now() + DEAD_CATALOG_TTL_MS);
+}
+
+export function clearLMArenaDeadCatalogModels(): void {
+  deadCatalogKeys.clear();
+}
+
+function isMarkedDead(entry: LMArenaModelMetadata, publicId: string): boolean {
+  const now = Date.now();
+  for (const key of [publicId, entry.id, entry.publicName, entry.name, entry.displayName]) {
+    if (!key) continue;
+    const exp = deadCatalogKeys.get(deadKey(key));
+    if (exp === undefined) continue;
+    if (exp <= now) {
+      deadCatalogKeys.delete(deadKey(key));
+      continue;
+    }
+    return true;
+  }
+  return false;
+}
+
+function isLMArenaChatCatalogModel(entry: LMArenaModelMetadata): boolean {
+  if (entry.userSelectable === false) return false;
+  // Must resolve to a real Arena UUID for create-evaluation.
+  if (typeof entry.id !== "string" || !LMARENA_MODEL_ID_RE.test(entry.id)) return false;
+
+  const chatRank = entry.rankByModality?.chat;
+  if (typeof chatRank !== "number" || !Number.isFinite(chatRank)) return false;
+  // Unranked / placeholder rows use huge sentinels and commonly 404 when probed.
+  if (chatRank >= LMARENA_MAX_REASONABLE_CHAT_RANK) return false;
+
+  if (!hasLMArenaCapability(entry, "input", "text")) return false;
+  if (!hasLMArenaCapability(entry, "output", "text")) return false;
+
+  // Prefer rows with a stable human slug (not bare UUID as the only label).
+  const publicId = getLMArenaPublicModelId(entry).trim();
+  if (!publicId) return false;
+  if (LMARENA_MODEL_ID_RE.test(publicId) && !entry.publicName && !entry.name) return false;
+
+  return true;
+}
+
+function lmarenaModelResolutionScore(entry: LMArenaModelMetadata): number {
+  let score = 0;
+  if (entry.userSelectable === false) score += 1_000_000;
+  if (!hasLMArenaCapability(entry, "input", "text")) score += 100_000;
+  if (!hasLMArenaCapability(entry, "output", "text")) score += 50_000;
+
+  const chatRank = entry.rankByModality?.chat;
+  if (typeof chatRank === "number" && Number.isFinite(chatRank)) {
+    score += chatRank;
+  } else if (typeof entry.rank === "number" && Number.isFinite(entry.rank)) {
+    score += 10_000 + entry.rank;
+  } else {
+    score += 20_000;
+  }
+
+  if (!entry.name) score += 500;
+  if (!entry.organization && !entry.provider) score += 100;
+
+  return score;
+}
+
+function getLMArenaPublicModelId(entry: LMArenaModelMetadata): string {
+  return entry.publicName || entry.displayName || entry.name || entry.id || "";
+}
+
+export function normalizeLMArenaModelsForCatalog(models: LMArenaModelMetadata[]): Array<{
+  id: string;
+  name: string;
+  owned_by: string;
+  supportsVision?: boolean;
+  apiFormat: "chat-completions";
+  supportedEndpoints: ["chat"];
+}> {
+  const bestByPublicId = new Map<string, { entry: LMArenaModelMetadata; index: number }>();
+
+  models.forEach((entry, index) => {
+    if (!isLMArenaChatCatalogModel(entry)) return;
+    const publicId = getLMArenaPublicModelId(entry).trim();
+    if (!publicId) return;
+    if (isMarkedDead(entry, publicId)) return;
+
+    const previous = bestByPublicId.get(publicId);
+    if (
+      !previous ||
+      lmarenaModelResolutionScore(entry) < lmarenaModelResolutionScore(previous.entry)
+    ) {
+      bestByPublicId.set(publicId, { entry, index });
+    }
+  });
+
+  return Array.from(bestByPublicId.entries())
+    .sort(
+      ([, a], [, b]) =>
+        lmarenaModelResolutionScore(a.entry) - lmarenaModelResolutionScore(b.entry) ||
+        a.index - b.index
+    )
+    .slice(0, LMARENA_CATALOG_SOFT_CAP)
+    .map(([id, { entry }]) => ({
+      id,
+      name: entry.displayName || entry.publicName || entry.name || id,
+      owned_by: entry.organization || entry.provider || "lmarena",
+      ...(hasLMArenaCapability(entry, "input", "image") ? { supportsVision: true } : {}),
+      apiFormat: "chat-completions" as const,
+      supportedEndpoints: ["chat"] as const,
+    }));
+}
+
+export function pickLMArenaModelId(model: string, models: LMArenaModelMetadata[]): string {
+  const requested = stripLMArenaModelPrefix(model);
+  if (LMARENA_MODEL_ID_RE.test(requested)) return requested;
+
+  const normalized = normalizeModelName(requested);
+  const matches = models
+    .map((entry, index) => ({ entry, index }))
+    // Only map onto chat-catalog-quality rows — avoids binding a public name to a
+    // webdev-only / unranked twin UUID that 404s on create-evaluation.
+    .filter(({ entry }) => isLMArenaChatCatalogModel(entry))
+    .filter(({ entry }) =>
+      [entry.id, entry.publicName, entry.name, entry.displayName].some(
+        (candidate) => typeof candidate === "string" && normalizeModelName(candidate) === normalized
+      )
+    );
+  const match = matches.sort(
+    (a, b) =>
+      lmarenaModelResolutionScore(a.entry) - lmarenaModelResolutionScore(b.entry) ||
+      a.index - b.index
+  )[0]?.entry;
+
+  return match?.id || requested;
+}
+
+export function parseLMArenaInitialModels(html: string): LMArenaModelMetadata[] {
+  const escapedMarker = '\\"initialModels\\":[';
+  const plainMarker = '"initialModels":[';
+  const marker = html.includes(escapedMarker) ? escapedMarker : plainMarker;
+  const markerIndex = html.indexOf(marker);
+  if (markerIndex < 0) return [];
+
+  const arrayStart = markerIndex + marker.length - 1;
+  const escapedEnd = '],\\"initialModelAId\\"';
+  const plainEnd = '],"initialModelAId"';
+  const arrayEnd = html.indexOf(escapedEnd, arrayStart);
+  const fallbackEnd = html.indexOf(plainEnd, arrayStart);
+  const endIndex = arrayEnd >= 0 ? arrayEnd : fallbackEnd;
+  if (endIndex < 0 || endIndex < arrayStart) return [];
+
+  const rawArray = html.slice(arrayStart, endIndex + 1).replace(/\\"/g, '"');
+  try {
+    const parsed = JSON.parse(rawArray);
+    return Array.isArray(parsed) ? (parsed as LMArenaModelMetadata[]) : [];
+  } catch {
+    return [];
+  }
+}
+
+type LogFn = {
+  debug?: (scope: string, msg: string) => void;
+  warn?: (scope: string, msg: string) => void;
+};
+
+/** Static Direct-chat allowlist only — no arena.ai network call. */
+export async function getLMArenaModels(log?: LogFn): Promise<LMArenaModelMetadata[]> {
+  const { LMARENA_DIRECT_MODEL_ENTRIES } =
+    await import("../../config/providers/registry/lmarena/directModels.ts");
+  // Chat path only — Image rows live in IMAGE_PROVIDERS (imageRegistry).
+  const models: LMArenaModelMetadata[] = LMARENA_DIRECT_MODEL_ENTRIES.filter(
+    (m) => m.category === "Text" || m.category === "Search"
+  ).map((m) => ({
+    id: m.arenaId,
+    publicName: m.catalogId,
+    name: m.publicName,
+    displayName: m.displayName,
+    organization: m.organization,
+    userSelectable: true,
+    capabilities: {
+      inputCapabilities: { text: true, ...(m.vision ? { image: true } : {}) },
+      outputCapabilities: {
+        text: true,
+        ...(m.category === "Search" ? { web: true } : {}),
+      },
+    },
+    rankByModality: { chat: 1 },
+  }));
+  log?.debug?.(
+    "LMArenaExecutor",
+    `Using static Direct-chat catalog (${models.length} Text/Search models; Image in imageRegistry)`
+  );
+  return models;
+}
+
+export async function resolveLMArenaModelId(model: string, log?: LogFn): Promise<string> {
+  const requested = stripLMArenaModelPrefix(model);
+  if (LMARENA_MODEL_ID_RE.test(requested)) return requested;
+
+  try {
+    const { resolveLmarenaArenaId } =
+      await import("../../config/providers/registry/lmarena/directModels.ts");
+    const fromSeed = resolveLmarenaArenaId(requested);
+    if (fromSeed) return fromSeed;
+    return pickLMArenaModelId(requested, await getLMArenaModels(log));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    log?.warn?.(
+      "LMArenaExecutor",
+      `Using raw model id after static catalog lookup failed: ${message}`
+    );
+    return requested;
+  }
+}
diff --git a/open-sse/executors/lmarena/response.ts b/open-sse/executors/lmarena/response.ts
new file mode 100644
index 0000000000..64aef907c9
--- /dev/null
+++ b/open-sse/executors/lmarena/response.ts
@@ -0,0 +1,305 @@
+/**
+ * Response mapping helpers for the Arena (lmarena) executor — kept small so
+ * the executor methods stay under complexity / max-lines gates.
+ */
+import { sanitizeErrorMessage } from "../../utils/error.ts";
+import { isCloudflareChallenge } from "../../services/lmarenaTlsClient.ts";
+import { markLMArenaCatalogModelDead } from "./models.ts";
+import { parseArenaSSE } from "./stream.ts";
+
+export function errorResponse(
+  status: number,
+  message: string,
+  type: string,
+  code: string
+): Response {
+  return new Response(
+    JSON.stringify({
+      error: { message: sanitizeErrorMessage(message), type, code },
+    }),
+    { status, headers: { "Content-Type": "application/json" } }
+  );
+}
+
+export function missingCookieResult(
+  url: string,
+  headers: Record<string, string>,
+  transformedBody: unknown
+) {
+  return {
+    response: errorResponse(
+      401,
+      "Arena requires a session cookie. Paste the full Cookie header from arena.ai (include arena-auth-prod-v1.* chunks and ideally cf_clearance).",
+      "authentication_error",
+      "missing_cookie"
+    ),
+    url,
+    headers,
+    transformedBody,
+  };
+}
+
+function parseArenaErrorBody(text: string | null | undefined, status: number): string {
+  const fallback = `Arena API error: ${status}`;
+  if (!text) return fallback;
+  try {
+    const errorJson = JSON.parse(text) as { error?: { message?: string }; message?: string };
+    return errorJson.error?.message || errorJson.message || fallback;
+  } catch {
+    return text.slice(0, 500) || fallback;
+  }
+}
+
+function isBotOrChallenge(status: number, text: string | null | undefined): boolean {
+  if (status === 403) return true;
+  if (isCloudflareChallenge(text)) return true;
+  return Boolean(text && text.trimStart().startsWith("<!DOCTYPE"));
+}
+
+function botBlockMessage(text: string | null | undefined, hasRecaptcha: boolean, status: number) {
+  if (isCloudflareChallenge(text)) {
+    return "Arena blocked by Cloudflare bot management. Use a residential/browser-grade network if needed, paste a fresh full Cookie header (include cf_clearance / __cf_bm when present), and optionally set providerSpecificData.recaptchaV3Token from a live browser session.";
+  }
+  if (hasRecaptcha) return `Arena API error: ${status}`;
+  return `Arena API error: ${status}. If this persists, supply a browser reCAPTCHA v3 token via credentials.providerSpecificData.recaptchaV3Token (in addition to the session cookie).`;
+}
+
+/** Map non-2xx / CF TLS results to an executor failure payload, or null if OK. */
+export function mapFailedTlsResult(opts: {
+  status: number;
+  text: string | null | undefined;
+  hasRecaptcha: boolean;
+  model: string;
+  arenaModelId: string;
+  url: string;
+  headers: Record<string, string>;
+  transformedBody: unknown;
+}) {
+  const { status, text, hasRecaptcha, model, arenaModelId, url, headers, transformedBody } = opts;
+  if (isBotOrChallenge(status, text)) {
+    return {
+      response: errorResponse(
+        status || 403,
+        botBlockMessage(text, hasRecaptcha, status),
+        "api_error",
+        "cloudflare_or_bot"
+      ),
+      url,
+      headers,
+      transformedBody,
+    };
+  }
+  if (status >= 200 && status < 300) return null;
+
+  if (status === 404 || status === 410 || status === 502) {
+    markLMArenaCatalogModelDead(model);
+    markLMArenaCatalogModelDead(arenaModelId);
+  }
+  return {
+    response: errorResponse(status, parseArenaErrorBody(text, status), "api_error", String(status)),
+    url,
+    headers,
+    transformedBody,
+  };
+}
+
+export function mapTlsUnavailable(
+  error: Error,
+  url: string,
+  headers: Record<string, string>,
+  transformedBody: unknown
+) {
+  return {
+    response: errorResponse(
+      502,
+      `Arena TLS impersonation unavailable: ${error.message}. Install/repair tls-client-node native binary.`,
+      "upstream_error",
+      "TLS_CLIENT_UNAVAILABLE"
+    ),
+    url,
+    headers,
+    transformedBody,
+  };
+}
+
+export function mapNetworkError(
+  message: string,
+  url: string,
+  headers: Record<string, string>,
+  transformedBody: unknown
+) {
+  return {
+    response: errorResponse(502, message, "network_error", "request_failed"),
+    url,
+    headers,
+    transformedBody,
+  };
+}
+
+export function buildArenaUpstreamHttpResponse(opts: {
+  stream: boolean;
+  status: number;
+  text: string | null;
+  body: ReadableStream<Uint8Array> | null;
+}): Response {
+  const { stream, status, text, body } = opts;
+  if (stream && body) {
+    return new Response(body, {
+      status,
+      headers: { "Content-Type": "text/event-stream" },
+    });
+  }
+  return new Response(text ?? "", {
+    status,
+    headers: { "Content-Type": "text/event-stream" },
+  });
+}
+
+function baseChunk(model: string) {
+  return {
+    id: `chatcmpl-${Date.now()}`,
+    object: "chat.completion.chunk",
+    created: Math.floor(Date.now() / 1000),
+    model,
+  };
+}
+
+function enqueueSse(controller: ReadableStreamDefaultController, chunk: Record<string, unknown>) {
+  controller.enqueue(`data: ${JSON.stringify(chunk)}\n\n`);
+}
+
+function emitStopAndDone(controller: ReadableStreamDefaultController, model: string) {
+  enqueueSse(controller, {
+    ...baseChunk(model),
+    choices: [{ index: 0, delta: {}, finish_reason: "stop" }],
+  });
+  controller.enqueue("data: [DONE]\n\n");
+  controller.close();
+}
+
+/** Process one Arena SSE line into OpenAI chunk writes. Returns true if stream should end. */
+function handleArenaEventLine(
+  sseLine: string,
+  model: string,
+  controller: ReadableStreamDefaultController
+): boolean {
+  const event = parseArenaSSE(sseLine);
+  if (!event) return false;
+  if (event.type === "text" && event.content) {
+    enqueueSse(controller, {
+      ...baseChunk(model),
+      choices: [{ index: 0, delta: { content: event.content }, finish_reason: null }],
+    });
+    return false;
+  }
+  if (event.type === "error") {
+    enqueueSse(controller, {
+      ...baseChunk(model),
+      choices: [{ index: 0, delta: {}, finish_reason: "stop" }],
+      error: { message: sanitizeErrorMessage(event.content || "Unknown error") },
+    });
+    controller.close();
+    return true;
+  }
+  if (event.type === "done") {
+    emitStopAndDone(controller, model);
+    return true;
+  }
+  return false;
+}
+
+export function createOpenAIArenaStream(opts: {
+  reader: ReadableStreamDefaultReader<Uint8Array>;
+  model: string;
+  signal?: AbortSignal;
+  log?: { error?: (scope: string, msg: string) => void };
+}): ReadableStream<Uint8Array | string> {
+  const { reader, model, signal, log } = opts;
+  const decoder = new TextDecoder();
+  let buffer = "";
+
+  const onAbort = () => {
+    void reader.cancel().catch(() => undefined);
+  };
+  if (signal) {
+    if (signal.aborted) onAbort();
+    else signal.addEventListener("abort", onAbort, { once: true });
+  }
+
+  return new ReadableStream({
+    async start(controller) {
+      try {
+        while (true) {
+          if (signal?.aborted) {
+            await reader.cancel().catch(() => undefined);
+            controller.close();
+            return;
+          }
+          const { done, value } = await reader.read();
+          if (done) break;
+
+          buffer += decoder.decode(value, { stream: true });
+          const lines = buffer.split("\n");
+          buffer = lines.pop() || "";
+          for (const line of lines) {
+            if (!line.trim()) continue;
+            const sseLine = line.startsWith("data: ") ? line.substring(6) : line;
+            if (handleArenaEventLine(sseLine, model, controller)) return;
+          }
+        }
+        emitStopAndDone(controller, model);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        log?.error?.("LMArenaExecutor", `Streaming error: ${message}`);
+        controller.error(error);
+      } finally {
+        if (signal) signal.removeEventListener("abort", onAbort);
+      }
+    },
+    cancel() {
+      void reader.cancel().catch(() => undefined);
+      if (signal) signal.removeEventListener("abort", onAbort);
+    },
+  });
+}
+
+export async function handleNonStreamingArenaResponse(
+  response: Response,
+  model: string
+): Promise<Response> {
+  const text = await response.text();
+  let fullText = "";
+  let error: string | null = null;
+
+  for (const line of text.split("\n")) {
+    if (!line.trim()) continue;
+    const sseLine = line.startsWith("data: ") ? line.substring(6) : line;
+    const event = parseArenaSSE(sseLine);
+    if (!event) continue;
+    if (event.type === "text" && event.content) fullText += event.content;
+    else if (event.type === "error") {
+      error = event.content || "Unknown error";
+      break;
+    } else if (event.type === "done") break;
+  }
+
+  if (error) return errorResponse(502, error, "api_error", "lmarena_error");
+
+  return new Response(
+    JSON.stringify({
+      id: `chatcmpl-${Date.now()}`,
+      object: "chat.completion",
+      created: Math.floor(Date.now() / 1000),
+      model,
+      choices: [
+        {
+          index: 0,
+          message: { role: "assistant", content: fullText },
+          finish_reason: "stop",
+        },
+      ],
+      usage: { prompt_tokens: 0, completion_tokens: 0, total_tokens: 0 },
+    }),
+    { status: 200, headers: { "Content-Type": "application/json" } }
+  );
+}
diff --git a/open-sse/executors/lmarena/stream.ts b/open-sse/executors/lmarena/stream.ts
new file mode 100644
index 0000000000..0f30482e4e
--- /dev/null
+++ b/open-sse/executors/lmarena/stream.ts
@@ -0,0 +1,132 @@
+/**
+ * Arena/AI-SDK SSE line parsing and OpenAI message → Arena prompt formatting.
+ */
+
+export interface ArenaSSEEvent {
+  type: "text" | "thinking" | "error" | "done" | "heartbeat";
+  content?: string;
+}
+
+function parseJsonValue(raw: string): unknown {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return raw;
+  }
+}
+
+function pickString(value: unknown, keys: string[]): string {
+  if (typeof value === "string") return value;
+  if (!value || typeof value !== "object") return "";
+  const data = value as Record<string, unknown>;
+  for (const key of keys) {
+    const candidate = data[key];
+    if (typeof candidate === "string") return candidate;
+  }
+  return JSON.stringify(value);
+}
+
+function normalizeArenaSSELine(payload: string): string {
+  const participantPrefixed = payload.match(/^[ab]([023dfg]):(.*)$/);
+  if (!participantPrefixed) return payload;
+  return `${participantPrefixed[1]}:${participantPrefixed[2]}`;
+}
+
+export function parseArenaSSE(line: string): ArenaSSEEvent | null {
+  const trimmed = line.trim();
+  const payload = trimmed.startsWith("data: ") ? trimmed.substring(6).trim() : trimmed;
+  if (!payload) return null;
+
+  // Historical Arena platform errors used `ae:`. Current AI SDK `e:` is
+  // finish_step and not terminal, so only treat it as an error when it carries
+  // an obvious error payload.
+  const legacyError = payload.match(/^[ab]e:(.*)$/);
+  if (legacyError) {
+    const value = parseJsonValue(legacyError[1] ?? "");
+    const content = pickString(value, ["error", "message"]);
+    return content ? { type: "error", content } : null;
+  }
+
+  const normalized = normalizeArenaSSELine(payload);
+  const separator = normalized.indexOf(":");
+  if (separator < 0) return null;
+
+  const code = normalized.slice(0, separator);
+  const rawValue = normalized.slice(separator + 1);
+  const value = parseJsonValue(rawValue);
+
+  switch (code) {
+    case "0":
+      return { type: "text", content: pickString(value, ["text", "textDelta"]) };
+    case "g":
+      return { type: "thinking", content: pickString(value, ["thinking", "text", "textDelta"]) };
+    case "2":
+      return { type: "heartbeat" };
+    case "3":
+      return { type: "error", content: pickString(value, ["error", "message"]) };
+    case "d": {
+      if (
+        value &&
+        typeof value === "object" &&
+        (value as Record<string, unknown>).finishReason === "error"
+      ) {
+        return { type: "error", content: "Arena stream finished with an error" };
+      }
+      return { type: "done" };
+    }
+    default:
+      return null;
+  }
+}
+
+interface OpenAIMessage {
+  role?: string;
+  content?: unknown;
+}
+
+function contentToText(content: unknown): string {
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    return content
+      .map((part) => {
+        if (typeof part === "string") return part;
+        if (!part || typeof part !== "object") return "";
+        const data = part as Record<string, unknown>;
+        if (typeof data.text === "string") return data.text;
+        if (data.type === "image_url") return "[image]";
+        return "";
+      })
+      .filter(Boolean)
+      .join("\n");
+  }
+  if (content && typeof content === "object") {
+    const data = content as Record<string, unknown>;
+    if (typeof data.text === "string") return data.text;
+  }
+  return content == null ? "" : String(content);
+}
+
+export function formatArenaPrompt(messages: OpenAIMessage[]): string {
+  const rendered = messages
+    .map((message) => {
+      const text = contentToText(message.content).trim();
+      if (!text) return "";
+      const role = typeof message.role === "string" ? message.role : "user";
+      const label =
+        role === "system"
+          ? "System"
+          : role === "assistant"
+            ? "Assistant"
+            : role === "developer"
+              ? "Developer"
+              : "User";
+      return `${label}: ${text}`;
+    })
+    .filter(Boolean);
+
+  if (rendered.length === 1 && messages[0]?.role === "user") {
+    return contentToText(messages[0].content).trim();
+  }
+
+  return rendered.join("\n\n");
+}
diff --git a/open-sse/executors/mimocode.ts b/open-sse/executors/mimocode.ts
index 45a061bae3..1313a1d2ab 100644
--- a/open-sse/executors/mimocode.ts
+++ b/open-sse/executors/mimocode.ts
@@ -12,13 +12,20 @@
  *
  * Only the "mimo-auto" model is supported (1M context, 128K output).
  * Supports multiple accounts: N fingerprints → N JWTs → round-robin with cooldown.
- * On 429, account enters cooldown (exponential backoff). On 401/403, JWT is re-bootstrapped.
+ * On 429 — or a 400 carrying MiMoCode's rate-limit text — account enters cooldown
+ * (exponential backoff) and the next account is tried. On 401/403, JWT is
+ * re-bootstrapped. Any other 400 is a genuinely malformed request (#2101): it fails
+ * fast on the current account instead of being retried identically on every
+ * account, which would waste N round-trips, cooldown every account, and hide the
+ * real upstream diagnostic behind a generic "all accounts exhausted" error (#4976).
  */
 
 import * as crypto from "node:crypto";
 import * as os from "node:os";
 import { BaseExecutor, type ExecuteInput, type ProviderCredentials } from "./base.ts";
 import { createProxyDispatcher } from "../utils/proxyDispatcher.ts";
+import { RATE_LIMIT_TEXT_PATTERNS } from "../services/accountFallback.ts";
+import { buildErrorBody, sanitizeErrorMessage } from "../utils/error.ts";
 import { fetch as undiciFetch, type Dispatcher } from "undici";
 
 const BOOTSTRAP_PATH = "/api/free-ai/bootstrap";
@@ -350,6 +357,127 @@ export class MimocodeExecutor extends BaseExecutor {
     account.consecutiveFails = 0;
   }
 
+  /**
+   * POST the request with the account's JWT; on auth failure (401/403), re-bootstrap
+   * the account's JWT and retry once. Mutates `headers`' Authorization in place.
+   */
+  private async fetchWithAuthRetry(
+    url: string,
+    headers: Record<string, string>,
+    reqBody: unknown,
+    signal: AbortSignal | null | undefined,
+    account: AccountState,
+    log: ExecuteInput["log"]
+  ): Promise<Response> {
+    const jwt = await this.getJwtForAccount(account, signal);
+    headers["Authorization"] = `Bearer ${jwt}`;
+
+    const resp = await this.fetchWithProxy(
+      url,
+      {
+        method: "POST",
+        headers,
+        body: JSON.stringify(reqBody),
+        signal: signal ?? undefined,
+      },
+      account.fingerprint
+    );
+    if (resp.status !== 401 && resp.status !== 403) return resp;
+
+    // On auth failure, re-bootstrap this account and retry once
+    log?.warn?.(
+      "MIMOCODE",
+      `Auth failed (${resp.status}) on account ${account.fingerprint.slice(0, 8)}…`
+    );
+    account.jwt = "";
+    account.expiresAt = 0;
+    account.consecutiveFails = 0;
+    const freshJwt = await this.getJwtForAccount(account, signal);
+    headers["Authorization"] = `Bearer ${freshJwt}`;
+    return this.fetchWithProxy(
+      url,
+      {
+        method: "POST",
+        headers,
+        body: JSON.stringify(reqBody),
+        signal: signal ?? undefined,
+      },
+      account.fingerprint
+    );
+  }
+
+  /**
+   * Gate 429/400 statuses before the success path: a 429 — or a 400 carrying
+   * MiMoCode's rate-limit text — puts the account on cooldown and rotates; any other
+   * 400 fails fast with the sanitized upstream error (#2101/#4976, see
+   * handleBadRequest). Returns "rotate", a fail-fast Response, or null to proceed.
+   */
+  private async gateRetryableStatus(
+    resp: Response,
+    account: AccountState,
+    log: ExecuteInput["log"]
+  ): Promise<"rotate" | Response | null> {
+    if (resp.status === 429) {
+      this.markCooldown(account);
+      log?.warn?.(
+        "MIMOCODE",
+        `Rate limited on account ${account.fingerprint.slice(0, 8)}, trying next…`
+      );
+      return "rotate";
+    }
+    if (resp.status !== 400) return null;
+    return (await this.handleBadRequest(resp, account, log)) ?? "rotate";
+  }
+
+  /**
+   * Classify a 400 response body (#2101/#4976).
+   *
+   * #4976: MiMoCode signals throttling via a non-standard 400 whose body carries
+   * rate-limit semantics (e.g. "Detected high-frequency non-compliant requests from
+   * you.") instead of a 429 — same RATE_LIMIT_TEXT_PATTERNS as accountFallback.ts's
+   * checkFallbackError(), so the two call sites never disagree on what counts as
+   * throttling. That case puts the account on cooldown and returns `null` (rotate).
+   *
+   * #2101: any other 400 is a genuinely malformed request that fails identically on
+   * every account — rotating would waste N round-trips, cooldown every account (a
+   * provider-wide outage for parallel requests), and hide the real diagnostic behind
+   * a generic exhaustion error. That case returns a fail-fast 400 Response carrying
+   * the sanitized upstream message, without touching cooldown/success state.
+   */
+  private async handleBadRequest(
+    resp: Response,
+    account: AccountState,
+    log: ExecuteInput["log"]
+  ): Promise<Response | null> {
+    const bodyText = await resp.text().catch(() => "");
+
+    if (RATE_LIMIT_TEXT_PATTERNS.some((p) => p.test(bodyText))) {
+      this.markCooldown(account);
+      log?.warn?.(
+        "MIMOCODE",
+        `Rate-limit-style 400 on account ${account.fingerprint.slice(0, 8)}, trying next…`
+      );
+      return null;
+    }
+
+    log?.warn?.(
+      "MIMOCODE",
+      `Malformed request (400) on account ${account.fingerprint.slice(0, 8)}, not retrying`
+    );
+    let upstreamMessage = bodyText;
+    try {
+      const parsed = JSON.parse(bodyText) as { error?: { message?: string } };
+      if (parsed?.error?.message) upstreamMessage = parsed.error.message;
+    } catch {
+      /* body wasn't JSON — use raw text */
+    }
+    const errorBody = buildErrorBody(400, sanitizeErrorMessage(upstreamMessage || "Bad request"));
+    return new Response(MimocodeExecutor.encoder.encode(JSON.stringify(errorBody)), {
+      status: 400,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
   buildUrl(
     _model: string,
     _stream: boolean,
@@ -457,51 +585,19 @@ export class MimocodeExecutor extends BaseExecutor {
     for (let attempt = 0; attempt < this.accounts.length; attempt++) {
       const account = this.pickAccount();
       try {
-        const jwt = await this.getJwtForAccount(account, signal);
         const headers = this.buildHeaders(input.credentials, stream);
-        headers["Authorization"] = `Bearer ${jwt}`;
+        const resp = await this.fetchWithAuthRetry(url, headers, reqBody, signal, account, log);
 
-        let resp = await this.fetchWithProxy(
-          url,
-          {
-            method: "POST",
-            headers,
-            body: JSON.stringify(reqBody),
-            signal: signal ?? undefined,
-          },
-          account.fingerprint
-        );
-
-        // On auth failure, re-bootstrap this account and retry once
-        if (resp.status === 401 || resp.status === 403) {
-          log?.warn?.(
-            "MIMOCODE",
-            `Auth failed (${resp.status}) on account ${account.fingerprint.slice(0, 8)}…`
-          );
-          account.jwt = "";
-          account.expiresAt = 0;
-          account.consecutiveFails = 0;
-          const freshJwt = await this.getJwtForAccount(account, signal);
-          headers["Authorization"] = `Bearer ${freshJwt}`;
-          resp = await this.fetchWithProxy(
+        // 429/400 gating (#2101/#4976): cooldown+rotate, fail fast, or proceed.
+        const gate = await this.gateRetryableStatus(resp, account, log);
+        if (gate === "rotate") continue;
+        if (gate) {
+          return {
+            response: gate,
             url,
-            {
-              method: "POST",
-              headers,
-              body: JSON.stringify(reqBody),
-              signal: signal ?? undefined,
-            },
-            account.fingerprint
-          );
-        }
-
-        if (resp.status === 429) {
-          this.markCooldown(account);
-          log?.warn?.(
-            "MIMOCODE",
-            `Rate limited on account ${account.fingerprint.slice(0, 8)}, trying next…`
-          );
-          continue;
+            headers: this.buildHeaders(input.credentials, stream),
+            transformedBody: reqBody,
+          };
         }
 
         this.markSuccess(account);
diff --git a/open-sse/executors/muse-spark-web.ts b/open-sse/executors/muse-spark-web.ts
index 106c28fb9d..d1fab6bf7a 100644
--- a/open-sse/executors/muse-spark-web.ts
+++ b/open-sse/executors/muse-spark-web.ts
@@ -336,7 +336,11 @@ function buildMetaAiRequestBody(prompt: string, model: string, conversation: Con
     doc_id: META_AI_SEND_MESSAGE_DOC_ID,
     variables: {
       assistantMessageId: crypto.randomUUID(),
-      attachments: null,
+      // `attachments` was removed from Meta's GraphQL schema (the
+      // AttachmentInput type is gone), so sending it — even as null —
+      // makes the server reject the persisted query with
+      // `Unknown type "AttachmentInput"`. Omit it entirely; GraphQL
+      // input fields are nullable-by-omission by default.
       clientLatitude: null,
       clientLongitude: null,
       clientTimezone:
diff --git a/open-sse/executors/qwen-web.ts b/open-sse/executors/qwen-web.ts
index 485eb93758..bb812a10e7 100644
--- a/open-sse/executors/qwen-web.ts
+++ b/open-sse/executors/qwen-web.ts
@@ -255,11 +255,32 @@ export class QwenWebExecutor extends BaseExecutor {
     };
   }
 
+  /** Flatten OpenAI-style content (string | Array<{type,text}>) into plain text.
+   *  A bare String() on an array of content parts yields "[object Object]" — the
+   *  serialization bug reported on the support mesh. */
+  private contentToText(content: unknown): string {
+    if (typeof content === "string") return content;
+    if (Array.isArray(content)) {
+      return content
+        .map((part) => {
+          if (typeof part === "string") return part;
+          if (part && typeof part === "object") {
+            const p = part as { type?: unknown; text?: unknown };
+            if (typeof p.text === "string") return p.text;
+          }
+          return "";
+        })
+        .filter(Boolean)
+        .join("\n");
+    }
+    return content == null ? "" : String(content);
+  }
+
   private foldMessages(messages: Array<{ role: string; content: unknown }>): string {
     let systemContent = "";
     let userContent = "";
     for (const m of messages) {
-      const text = String(m.content ?? "");
+      const text = this.contentToText(m.content);
       if (m.role === "system") {
         systemContent += (systemContent ? "\n\n" : "") + text;
       } else if (m.role === "user") {
diff --git a/open-sse/executors/trae.ts b/open-sse/executors/trae.ts
index e5a75ebb51..d779fd77a2 100644
--- a/open-sse/executors/trae.ts
+++ b/open-sse/executors/trae.ts
@@ -19,6 +19,7 @@
 import { BaseExecutor, mergeUpstreamExtraHeaders } from "./base.ts";
 import { PROVIDERS } from "../config/constants.ts";
 import { sanitizeErrorMessage } from "../utils/error.ts";
+import { resolvePublicCred } from "../utils/publicCreds.ts";
 
 type JsonRecord = Record<string, unknown>;
 type ChatMessage = { role?: string; content?: unknown };
@@ -438,7 +439,8 @@ export class TraeExecutor extends BaseExecutor {
     const refreshToken = credentials?.refreshToken as string | undefined;
     if (!refreshToken) return null;
     const host = ((psd.host as string) || "https://api-us-east.trae.ai").replace(/\/$/, "");
-    const clientId = (psd.clientId as string) || "en1oxy7wnw8j9n";
+    const clientId =
+      (psd.clientId as string) || resolvePublicCred("trae_id", "TRAE_OAUTH_CLIENT_ID");
     const url = `${host}/cloudide/api/v3/trae/oauth/ExchangeToken`;
     const body = { ClientID: clientId, RefreshToken: refreshToken, ClientSecret: "-", UserID: "" };
 
diff --git a/open-sse/executors/v0-vercel-web.ts b/open-sse/executors/v0-vercel-web.ts
index eb6d276b00..1e97108716 100644
--- a/open-sse/executors/v0-vercel-web.ts
+++ b/open-sse/executors/v0-vercel-web.ts
@@ -67,10 +67,13 @@ export class V0VercelWebExecutor extends BaseExecutor {
 
     if (!wantStream) {
       const data = (await upstream.json()) as Record<string, unknown>;
-      const content =
-        (data?.choices as Array<{ message?: { content?: string } }>)?.[0]?.message?.content ||
-        (data?.content as string) ||
-        "";
+      const message = (data?.choices as Array<{ message?: Record<string, unknown> }>)?.[0]
+        ?.message;
+      const content = (message?.content as string) || (data?.content as string) || "";
+      const reasoningContent =
+        (message?.reasoning_content as string) || (data?.reasoning_content as string) || "";
+      const responseMessage: Record<string, unknown> = { role: "assistant", content };
+      if (reasoningContent) responseMessage.reasoning_content = reasoningContent;
       return {
         response: new Response(
           JSON.stringify({
@@ -81,7 +84,7 @@ export class V0VercelWebExecutor extends BaseExecutor {
             choices: [
               {
                 index: 0,
-                message: { role: "assistant", content },
+                message: responseMessage,
                 finish_reason: "stop",
               },
             ],
@@ -123,14 +126,19 @@ export class V0VercelWebExecutor extends BaseExecutor {
               }
               try {
                 const parsed = JSON.parse(data);
-                const text = parsed.choices?.[0]?.delta?.content || "";
-                if (text) {
+                const delta = parsed.choices?.[0]?.delta || {};
+                const text = delta.content || "";
+                const reasoningText = delta.reasoning_content || "";
+                if (text || reasoningText) {
+                  const outDelta: Record<string, string> = {};
+                  if (reasoningText) outDelta.reasoning_content = reasoningText;
+                  if (text) outDelta.content = text;
                   const chunk = {
                     id: `chatcmpl-v0-${Date.now()}`,
                     object: "chat.completion.chunk",
                     created: Math.floor(Date.now() / 1000),
                     model: modelId,
-                    choices: [{ index: 0, delta: { content: text }, finish_reason: null }],
+                    choices: [{ index: 0, delta: outDelta, finish_reason: null }],
                   };
                   controller.enqueue(encoder.encode(`data: ${JSON.stringify(chunk)}\n\n`));
                 }
diff --git a/open-sse/executors/xai.ts b/open-sse/executors/xai.ts
index 9f806e2c5a..e5de5c037a 100644
--- a/open-sse/executors/xai.ts
+++ b/open-sse/executors/xai.ts
@@ -1,5 +1,6 @@
 import { BaseExecutor, type ProviderCredentials } from "./base.ts";
 import { PROVIDERS } from "../config/constants.ts";
+import { getModelTargetFormat } from "../config/providerModels.ts";
 
 type JsonRecord = Record<string, unknown>;
 
@@ -51,6 +52,24 @@ export class XaiExecutor extends BaseExecutor {
     super("xai", PROVIDERS.xai);
   }
 
+  /**
+   * Port of decolua/9router#2439 (author: @ryanngit): xAI ships a native
+   * `/v1/responses` endpoint alongside `/v1/chat/completions`. Models tagged
+   * `targetFormat: "openai-responses"` in the registry (currently
+   * grok-4.20-multi-agent-0309, per upstream) resolve to that endpoint instead
+   * of the default chat-completions bridge. The per-model registry tag is the
+   * single source of truth — it also drives chatCore's body translation — so
+   * the URL stays in lockstep with the translated body, mirroring the gh
+   * executor's targetFormat-driven routing (9router#102) and the "openai"
+   * -pro heuristic in open-sse/executors/default.ts.
+   */
+  buildUrl(model: string, _stream: boolean, _urlIndex = 0) {
+    if (getModelTargetFormat("xai", model) === "openai-responses") {
+      return this.config.responsesBaseUrl || this.config.baseUrl;
+    }
+    return this.config.baseUrl;
+  }
+
   transformRequest(
     model: string,
     body: unknown,
diff --git a/open-sse/executors/zai-web.ts b/open-sse/executors/zai-web.ts
new file mode 100644
index 0000000000..bd61a83ffd
--- /dev/null
+++ b/open-sse/executors/zai-web.ts
@@ -0,0 +1,396 @@
+/**
+ * ZaiWebExecutor — Z.ai Web Chat (chat.z.ai, free web-session/cookie auth)
+ *
+ * Distinct from the existing API-key `zai`/`glm`/`glm-cn`/`glmt` providers
+ * (Anthropic/OpenAI-compatible `api.z.ai`, see `providers/apikey/regional.ts`).
+ * This executor targets the *consumer chat* frontend at chat.z.ai — the same
+ * product family as `chatglm.cn` (Zhipu AI), but the international domain —
+ * so users without an API key can drive it for free via their browser session,
+ * modeled on the `chatglm-web` credential entry (#4056) and the `doubao-web` /
+ * `venice-web` cookie executors.
+ *
+ * Endpoint: POST https://chat.z.ai/api/chat/completions
+ * Auth:     full Cookie header from chat.z.ai (must contain the `token` JWT).
+ *           Sent both as `Cookie` and as `Authorization: Bearer <token>` —
+ *           the SPA's own fetch client sets both, and stripping either one
+ *           has been reported (upstream repos) to 401 the request.
+ * Response: SSE. Frames are z.ai's internal envelope
+ *           `{"type":"chat:completion","data":{"delta_content":"...","phase":"answer","done":false}}`
+ *           — mirrored from the shared Zhipu chatglm.cn/chat.z.ai frontend
+ *           protocol. Some deployments/models pass through an already
+ *           OpenAI-shaped `{"choices":[{"delta":{"content":"..."}}]}` frame
+ *           instead, so the parser accepts both shapes defensively.
+ */
+import { BaseExecutor, type ExecuteInput } from "./base.ts";
+import {
+  makeExecutorErrorResult as makeErrorResult,
+  normalizeCookie,
+  sanitizeErrorMessage,
+} from "../utils/error.ts";
+
+const BASE_URL = "https://chat.z.ai";
+const CHAT_URL = `${BASE_URL}/api/chat/completions`;
+const USER_AGENT =
+  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36";
+
+/** Extract the `token` cookie value (JWT) from a full Cookie header string. */
+export function extractZaiToken(rawCookie: string): string {
+  const cookie = normalizeCookie(rawCookie.trim());
+  if (!cookie) return "";
+  const match = cookie.match(/(?:^|;\s*)token=([^;]+)/);
+  if (match) return match[1].trim();
+  // Users may paste the bare JWT with no `token=` prefix.
+  return cookie.includes(";") || cookie.includes("=") ? "" : cookie;
+}
+
+/**
+ * One parsed delta out of a z.ai SSE frame: either a content/reasoning chunk
+ * or a signal that the stream has finished.
+ */
+export interface ZaiDelta {
+  content: string;
+  reasoning: string;
+  done: boolean;
+}
+
+/** Parse an already OpenAI-shaped `{choices:[{delta}]}` pass-through frame. */
+function parseOpenAiShapedFrame(choices: Array<Record<string, unknown>>): ZaiDelta {
+  const delta = (choices[0]?.delta ?? {}) as Record<string, unknown>;
+  const finishReason = choices[0]?.finish_reason;
+  return {
+    content: typeof delta.content === "string" ? delta.content : "",
+    reasoning: typeof delta.reasoning_content === "string" ? delta.reasoning_content : "",
+    done: finishReason != null,
+  };
+}
+
+/** Parse the z.ai / chatglm internal `{data:{delta_content,phase,done}}` envelope. */
+function parseInternalEnvelopeFrame(
+  frame: Record<string, unknown>,
+  data: Record<string, unknown>
+): ZaiDelta | null {
+  const phase = String(data.phase ?? "");
+  const deltaContent = data.delta_content ?? data.edit_content ?? data.content;
+  const done =
+    data.done === true ||
+    phase === "done" ||
+    phase === "finish" ||
+    String(frame.type ?? "") === "chat:completion:finish";
+
+  if (typeof deltaContent === "string" && deltaContent) {
+    const isThinking = phase === "thinking";
+    return {
+      content: isThinking ? "" : deltaContent,
+      reasoning: isThinking ? deltaContent : "",
+      done,
+    };
+  }
+  if (done) return { content: "", reasoning: "", done: true };
+  return null;
+}
+
+/**
+ * Parse a single decoded z.ai SSE `data:` JSON payload into a normalized
+ * delta. Handles both the internal `{data:{delta_content,phase,done}}`
+ * envelope and a pass-through OpenAI-shaped `{choices:[{delta}]}` frame.
+ */
+export function parseZaiFrame(raw: unknown): ZaiDelta | null {
+  if (!raw || typeof raw !== "object") return null;
+  const frame = raw as Record<string, unknown>;
+
+  const choices = frame.choices as Array<Record<string, unknown>> | undefined;
+  if (Array.isArray(choices) && choices.length > 0) {
+    return parseOpenAiShapedFrame(choices);
+  }
+
+  const data = (frame.data ?? frame) as Record<string, unknown>;
+  return parseInternalEnvelopeFrame(frame, data);
+}
+
+export function foldMessages(
+  messages: Array<{ role: string; content: unknown }>
+): Array<{ role: string; content: string }> {
+  return messages.map((m) => ({
+    role: m.role,
+    content: typeof m.content === "string" ? m.content : JSON.stringify(m.content ?? ""),
+  }));
+}
+
+/** Split a chunk of decoded SSE text into complete `data:` payload strings. */
+function extractSseDataPayloads(buffer: { text: string }, incoming: string): string[] {
+  buffer.text += incoming;
+  const lines = buffer.text.split("\n");
+  buffer.text = lines.pop() || "";
+  const payloads: string[] = [];
+  for (const line of lines) {
+    if (!line.startsWith("data:")) continue;
+    const data = line.slice(5).trim();
+    if (!data || data === "[DONE]") continue;
+    payloads.push(data);
+  }
+  return payloads;
+}
+
+/** Parse a raw SSE payload string into a normalized delta, or null if unusable. */
+function parseSsePayload(data: string): ZaiDelta | null {
+  try {
+    return parseZaiFrame(JSON.parse(data));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Read the upstream SSE body to completion, invoking `onDelta` for every
+ * parsed delta. Returns true when `onDelta` signalled the stream ended
+ * (returned true), false when the body was exhausted without a done delta.
+ */
+async function drainSseDeltas(
+  sourceBody: ReadableStream<Uint8Array>,
+  onDelta: (delta: ZaiDelta) => boolean
+): Promise<boolean> {
+  const decoder = new TextDecoder();
+  const reader = sourceBody.getReader();
+  const buffer = { text: "" };
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) return false;
+    const payloads = extractSseDataPayloads(buffer, decoder.decode(value, { stream: true }));
+    for (const raw of payloads) {
+      const delta = parseSsePayload(raw);
+      if (delta && onDelta(delta)) return true;
+    }
+  }
+}
+
+type ChunkEmitter = (
+  controller: ReadableStreamDefaultController,
+  delta: Record<string, unknown>,
+  finish?: string | null
+) => void;
+
+/** Emit role/reasoning/content/stop chunks for one delta. Returns true when the stream ended. */
+function emitDeltaChunks(
+  controller: ReadableStreamDefaultController,
+  delta: ZaiDelta,
+  emitChunk: ChunkEmitter,
+  roleState: { emitted: boolean }
+): boolean {
+  if (!roleState.emitted && (delta.content || delta.reasoning)) {
+    roleState.emitted = true;
+    emitChunk(controller, { role: "assistant", content: "" });
+  }
+  if (delta.reasoning) emitChunk(controller, { reasoning_content: delta.reasoning });
+  if (delta.content) emitChunk(controller, { content: delta.content });
+  if (delta.done) {
+    emitChunk(controller, {}, "stop");
+    controller.enqueue(new TextEncoder().encode("data: [DONE]\n\n"));
+    controller.close();
+    return true;
+  }
+  return false;
+}
+
+export class ZaiWebExecutor extends BaseExecutor {
+  constructor() {
+    super("zai-web", { id: "zai-web", baseUrl: BASE_URL });
+  }
+
+  private buildZaiHeaders(rawCookie: string, token: string): Record<string, string> {
+    const headers: Record<string, string> = {
+      "Content-Type": "application/json",
+      Accept: "text/event-stream",
+      "User-Agent": USER_AGENT,
+      Origin: BASE_URL,
+      Referer: `${BASE_URL}/`,
+    };
+    if (rawCookie) headers.Cookie = rawCookie;
+    if (token) headers.Authorization = `Bearer ${token}`;
+    return headers;
+  }
+
+  private buildRequestBody(
+    messages: Array<{ role: string; content: unknown }>,
+    modelId: string
+  ): Record<string, unknown> {
+    return {
+      stream: true,
+      model: modelId,
+      messages: foldMessages(messages),
+      params: {},
+      features: {
+        image_generation: false,
+        web_search: false,
+        auto_web_search: false,
+      },
+    };
+  }
+
+  /** Drain the streaming response body into an OpenAI-shaped SSE ReadableStream. */
+  private buildStreamingBody(
+    sourceBody: ReadableStream<Uint8Array>,
+    modelId: string,
+    emitChunk: ChunkEmitter,
+    signal: AbortSignal | null | undefined
+  ): ReadableStream {
+    return new ReadableStream({
+      async start(controller) {
+        const roleState = { emitted: false };
+        try {
+          const ended = await drainSseDeltas(sourceBody, (delta) =>
+            emitDeltaChunks(controller, delta, emitChunk, roleState)
+          );
+          if (ended) return; // emitDeltaChunks already sent [DONE] and closed
+          if (!roleState.emitted) emitChunk(controller, { role: "assistant", content: "" });
+          emitChunk(controller, {}, "stop");
+          controller.enqueue(new TextEncoder().encode("data: [DONE]\n\n"));
+          controller.close();
+        } catch (err) {
+          if (!signal?.aborted) {
+            try {
+              controller.error(err);
+            } catch {
+              /* controller already closed */
+            }
+          }
+        }
+      },
+    });
+  }
+
+  /** Drain the response body and aggregate all deltas into a single answer/reasoning pair. */
+  private async collectNonStreaming(
+    sourceBody: ReadableStream<Uint8Array>
+  ): Promise<{ answer: string; reasoning: string }> {
+    let answer = "";
+    let reasoning = "";
+    try {
+      await drainSseDeltas(sourceBody, (delta) => {
+        if (delta.reasoning) reasoning += delta.reasoning;
+        if (delta.content) answer += delta.content;
+        return delta.done;
+      });
+    } catch {
+      /* best-effort — return what we have */
+    }
+    return { answer, reasoning };
+  }
+
+  /** POST the chat request upstream. Returns either the upstream Response or an error result. */
+  private async fetchUpstream(
+    reqHeaders: Record<string, string>,
+    reqBody: Record<string, unknown>,
+    body: unknown,
+    signal: AbortSignal | null | undefined
+  ): Promise<{ upstream: Response } | { errorResult: ReturnType<typeof makeErrorResult> }> {
+    let upstream: Response;
+    try {
+      upstream = await fetch(CHAT_URL, {
+        method: "POST",
+        headers: reqHeaders,
+        body: JSON.stringify(reqBody),
+        signal,
+      });
+    } catch (err) {
+      return {
+        errorResult: makeErrorResult(
+          502,
+          `Z.ai fetch failed: ${err instanceof Error ? err.message : "unknown"}`,
+          body,
+          CHAT_URL
+        ),
+      };
+    }
+
+    if (!upstream.ok) {
+      const errText = await upstream.text().catch(() => "");
+      return {
+        errorResult: makeErrorResult(
+          upstream.status,
+          `Z.ai error: ${sanitizeErrorMessage(errText)}`,
+          body,
+          CHAT_URL
+        ),
+      };
+    }
+    return { upstream };
+  }
+
+  private makeChunkEmitter(id: string, created: number, modelId: string): ChunkEmitter {
+    return (controller, delta, finish = null) => {
+      const chunk = {
+        id,
+        object: "chat.completion.chunk",
+        created,
+        model: modelId,
+        choices: [{ index: 0, delta, finish_reason: finish }],
+      };
+      controller.enqueue(new TextEncoder().encode(`data: ${JSON.stringify(chunk)}\n\n`));
+    };
+  }
+
+  async execute(input: ExecuteInput) {
+    const { body, credentials, signal, stream: wantStream } = input;
+    const bodyObj = (body || {}) as Record<string, unknown>;
+
+    const rawCookie = normalizeCookie(String(credentials?.apiKey ?? "").trim());
+    const token = extractZaiToken(rawCookie);
+    if (!rawCookie && !token) {
+      return makeErrorResult(
+        400,
+        "Missing Z.ai session — paste the full Cookie header from chat.z.ai (must contain token=<JWT>).",
+        body,
+        CHAT_URL
+      );
+    }
+
+    const messages = (bodyObj.messages as Array<{ role: string; content: unknown }>) || [];
+    const modelId = (bodyObj.model as string) || "glm-4.6";
+    const reqBody = this.buildRequestBody(messages, modelId);
+    const reqHeaders = this.buildZaiHeaders(rawCookie, token);
+
+    const fetched = await this.fetchUpstream(reqHeaders, reqBody, body, signal);
+    if ("errorResult" in fetched) return fetched.errorResult;
+    const { upstream } = fetched;
+
+    const id = `chatcmpl-zai-${Date.now()}`;
+    const created = Math.floor(Date.now() / 1000);
+    const sourceBody = upstream.body ?? new ReadableStream({ start: (c) => c.close() });
+    const emitChunk = this.makeChunkEmitter(id, created, modelId);
+
+    if (wantStream) {
+      const outStream = this.buildStreamingBody(sourceBody, modelId, emitChunk, signal);
+      return {
+        response: new Response(outStream, {
+          headers: {
+            "Content-Type": "text/event-stream",
+            "Cache-Control": "no-cache",
+            Connection: "keep-alive",
+          },
+        }),
+        url: CHAT_URL,
+        headers: reqHeaders,
+        transformedBody: reqBody,
+      };
+    }
+
+    const { answer, reasoning } = await this.collectNonStreaming(sourceBody);
+    const message: Record<string, unknown> = { role: "assistant", content: answer };
+    if (reasoning) message.reasoning_content = reasoning;
+    const completion = {
+      id,
+      object: "chat.completion",
+      created,
+      model: modelId,
+      choices: [{ index: 0, message, finish_reason: "stop" }],
+    };
+    return {
+      response: new Response(JSON.stringify(completion), {
+        headers: { "Content-Type": "application/json" },
+      }),
+      url: CHAT_URL,
+      headers: reqHeaders,
+      transformedBody: reqBody,
+    };
+  }
+}
diff --git a/open-sse/handlers/chatCore.ts b/open-sse/handlers/chatCore.ts
index 8d5bc29e04..e134a744f8 100644
--- a/open-sse/handlers/chatCore.ts
+++ b/open-sse/handlers/chatCore.ts
@@ -26,6 +26,7 @@ import {
   isStripReasoningRequested,
 } from "./chatCore/headers.ts";
 import { markCodexScopeRateLimited } from "./chatCore/codexFailover.ts";
+import { isCodexOriginatedHeaders } from "../config/codexIdentity.ts";
 import { trackDevice, extractIpFromHeaders } from "../services/deviceTracker.ts";
 import { getCombosCached } from "./chatCore/comboContextCache.ts";
 export { clearCombosCache, clearUpstreamProxyConfigCache } from "./chatCore/comboContextCache.ts";
@@ -113,6 +114,7 @@ import { stripGpt5SamplingWhenReasoning } from "../services/gpt5SamplingGuard.ts
 import { getUnsupportedParams, REGISTRY } from "../config/providerRegistry.ts";
 import { supportsMaxTokens } from "@/lib/modelCapabilities.ts";
 import { normalizeThinkingForModel } from "@/shared/constants/modelSpecs.ts";
+import { isVisionModelId } from "@/shared/constants/visionModels.ts";
 import {
   buildErrorBody,
   createErrorResult,
@@ -295,6 +297,7 @@ import {
 import { resolveBackgroundTaskRedirect } from "./chatCore/backgroundRedirect.ts";
 import type { CompressionConfig, CompressionPipelineStep } from "../services/compression/types.ts";
 import { prepareWebSearchFallbackBody } from "../services/webSearchFallback.ts";
+import { resolveInterceptSearch } from "@/lib/db/interceptionRules";
 import {
   resolveExplicitStreamAlias,
   resolveStreamFlag,
@@ -562,6 +565,10 @@ export async function handleChatCore({
     clientRawRequest,
     provider,
     model,
+    // NEXA fusion-idempotency fix: body.messages feeds the key digest so combo-internal
+    // sub-requests (fusion panel + judge re-enter chatCore sharing the client's headers)
+    // can never collide on the raw Idempotency-Key/x-request-id header key.
+    body,
     effectiveServiceTier,
     startTime,
     log,
@@ -726,12 +733,17 @@ export async function handleChatCore({
   // Initialize rate limit settings from persisted DB (once, lazy)
   await initializeRateLimits();
 
+  // #3384: per-model interception rule (src/lib/db/interceptionRules.ts) overrides the
+  // native-bypass defaults below when the operator explicitly configured it for this
+  // provider/model pair; undefined falls through to the existing bypass logic.
+  const interceptSearchOverride = resolveInterceptSearch(provider, effectiveModel);
   const { body: bodyWithWebSearchFallback, fallback: webSearchFallbackPlan } =
     prepareWebSearchFallbackBody(body as Record<string, unknown>, {
       provider,
       sourceFormat,
       targetFormat,
       nativeCodexPassthrough,
+      interceptSearchOverride,
     });
   if (webSearchFallbackPlan.enabled) {
     body = bodyWithWebSearchFallback as typeof body;
@@ -752,8 +764,18 @@ export async function handleChatCore({
   // #1311 (opt-in): echo the client-requested alias/combo name in the response `model`
   // field instead of the upstream model, so strict clients (Claude Desktop) that validate
   // response.model === request.model stop rejecting alias/combo requests with a 401.
+  // #3697: always echo it for Codex CLI clients on the Responses API — regardless of the
+  // opt-in setting — since the Codex CLI status line/model button reads `response.model`
+  // to display the active model + reasoning effort (e.g. `gpt-5.5-xhigh`). Detection is by
+  // request headers (originator/User-Agent), not by the routed provider, so it still fires
+  // when `codex/gpt-5.5-xhigh` is routed through a combo to a non-codex upstream.
+  const isCodexResponsesEcho =
+    (isResponsesEndpoint || sourceFormat === FORMATS.OPENAI_RESPONSES) &&
+    isCodexOriginatedHeaders(clientRawRequest?.headers);
   const echoModel =
-    settings.echoRequestedModelName === true && typeof requestedModel === "string" && requestedModel
+    (settings.echoRequestedModelName === true || isCodexResponsesEcho) &&
+    typeof requestedModel === "string" &&
+    requestedModel
       ? requestedModel
       : null;
   const detailedLoggingEnabled =
@@ -1204,7 +1226,7 @@ export async function handleChatCore({
       // Phase 4A: unified output styles (supersedes cavemanOutputMode via the back-compat shim).
       let outputStyleResult:
         import("../services/compression/outputStyles/apply.ts").OutputStylesResult | null = null;
-      if (config.enabled) {
+      if (config.enabled && compressionHeader?.trim().toLowerCase() !== "off") {
         try {
           const { resolveOutputStyleSelection } =
             await import("../services/compression/outputStyles/backCompat.ts");
@@ -1305,6 +1327,10 @@ export async function handleChatCore({
         const compressionConfig = resolveCacheAwareConfig(config, compressionInputBody, cacheCtx);
         const result = await applyCompressionAsync(compressionInputBody, mode, {
           model: effectiveModel,
+          supportsVision: isVisionModelId(effectiveModel),
+          // Rota direta oficial ('anthropic') vs agregadores: o engine omniglyph
+          // exige 'direct' — agregadores redimensionam imagens (medido 2026-07-06).
+          providerTransport: provider === "anthropic" ? "direct" : "aggregator",
           config: compressionConfig,
           cachingContext: cacheCtx,
           principalId: apiKeyInfo?.id ? String(apiKeyInfo.id) : undefined,
@@ -2073,6 +2099,16 @@ export async function handleChatCore({
       delete translatedBody.max_tokens;
       log?.debug?.("PARAMS", `Renamed max_tokens to max_completion_tokens for ${model}`);
     }
+  } else if (translatedBody.max_completion_tokens !== undefined) {
+    // Symmetric case (#6912): some providers/models (e.g. Volcengine Ark /
+    // DeepSeek) only document the legacy `max_tokens` field and silently
+    // ignore an unrecognized `max_completion_tokens`, so a client sending the
+    // newer field alone would have it dropped upstream with no cap applied.
+    if (translatedBody.max_tokens === undefined) {
+      translatedBody.max_tokens = translatedBody.max_completion_tokens;
+    }
+    delete translatedBody.max_completion_tokens;
+    log?.debug?.("PARAMS", `Renamed max_completion_tokens to max_tokens for ${model}`);
   }
 
   // OpenAI's `store` parameter is not supported by most compatible providers and breaks them
@@ -3297,6 +3333,16 @@ export async function handleChatCore({
           console.warn(
             `[provider] Node ${errorConnectionId} project routing error (${statusCode}) — not banning`
           );
+        } else if (errorType === PROVIDER_ERROR_TYPES.MODEL_NOT_FOUND) {
+          // 404 — model/endpoint does not exist upstream. Lock the model so the
+          // retry/backoff loop stops hammering the dead endpoint (which would
+          // otherwise degenerate into a 429 rate-limit storm). Connection stays
+          // active since only the specific model is unavailable. (#6827)
+          const notFoundCooldownMs = COOLDOWN_MS.notFound;
+          lockModel(provider, errorConnectionId, currentModel, "model_not_found", notFoundCooldownMs);
+          console.warn(
+            `[provider] Node ${errorConnectionId} model not found (${statusCode}) for ${currentModel} - locking model for ${Math.ceil(notFoundCooldownMs / 1000)}s (connection stays active)`
+          );
         }
       } catch {
         // Best-effort state update; request flow should continue with fallback handling.
diff --git a/open-sse/handlers/chatCore/cliproxyModelMapping.ts b/open-sse/handlers/chatCore/cliproxyModelMapping.ts
new file mode 100644
index 0000000000..99914e2f01
--- /dev/null
+++ b/open-sse/handlers/chatCore/cliproxyModelMapping.ts
@@ -0,0 +1,69 @@
+/**
+ * CLIProxyAPI model-mapping application (#6876).
+ *
+ * The dashboard persists `cliproxyapiModelMapping` per provider
+ * (`upstream_proxy_config.cliproxyapi_model_mapping`) but nothing at
+ * request-dispatch time ever consulted it — the configured alias was
+ * silently dropped and the original model was forwarded verbatim to
+ * CLIProxyAPI. This module applies the mapping exactly once, at the
+ * executor boundary, so it only affects requests that actually reach
+ * CLIProxyAPI (the `cliproxyapi` passthrough leg and the CLIProxyAPI retry
+ * leg of `fallback` mode) and never the native leg of `fallback` mode.
+ */
+
+type ExecutorInput = {
+  model: string;
+  body: unknown;
+  [key: string]: unknown;
+};
+
+type ExecutorLike = {
+  execute: (input: ExecutorInput) => Promise<unknown>;
+  [key: string]: unknown;
+};
+
+export type CliproxyapiModelMapping = Record<string, unknown> | null | undefined;
+
+function resolveMappedModel(model: string, mapping: CliproxyapiModelMapping): string | null {
+  if (!mapping || typeof mapping !== "object") return null;
+  const mapped = (mapping as Record<string, unknown>)[model];
+  return typeof mapped === "string" && mapped.trim() ? mapped : null;
+}
+
+/**
+ * Rewrites `input.model` (and `input.body.model` when body is a plain
+ * object) to the mapped model, if one is configured for `input.model`.
+ * Returns the original input unchanged when no mapping applies.
+ */
+export function applyCliproxyapiModelMapping(
+  input: ExecutorInput,
+  mapping: CliproxyapiModelMapping
+): ExecutorInput {
+  const mappedModel = resolveMappedModel(input.model, mapping);
+  if (!mappedModel) return input;
+
+  const body =
+    input.body && typeof input.body === "object" && !Array.isArray(input.body)
+      ? { ...(input.body as Record<string, unknown>), model: mappedModel }
+      : input.body;
+
+  return { ...input, model: mappedModel, body };
+}
+
+/**
+ * Wraps an executor so every `execute()` call has the CLIProxyAPI model
+ * mapping applied first. Returns the executor unchanged when no mapping is
+ * configured (empty/absent mapping is a no-op, matching prior behavior).
+ */
+export function wrapExecutorWithCliproxyapiModelMapping<T extends ExecutorLike>(
+  executor: T,
+  mapping: CliproxyapiModelMapping
+): T {
+  if (!mapping || typeof mapping !== "object" || Object.keys(mapping).length === 0) {
+    return executor;
+  }
+  const wrapped = Object.create(executor) as T;
+  wrapped.execute = (input: ExecutorInput) =>
+    executor.execute(applyCliproxyapiModelMapping(input, mapping));
+  return wrapped;
+}
diff --git a/open-sse/handlers/chatCore/comboContextCache.ts b/open-sse/handlers/chatCore/comboContextCache.ts
index fc7df58fef..da2c3d3c15 100644
--- a/open-sse/handlers/chatCore/comboContextCache.ts
+++ b/open-sse/handlers/chatCore/comboContextCache.ts
@@ -4,7 +4,14 @@ import { getUpstreamProxyConfig } from "@/lib/localDb";
  * Module-level cache for upstream proxy config (shared across all requests).
  * 10s TTL prevents per-request DB lookups while staying fresh enough for setting changes.
  */
-const _proxyConfigCache = new Map<string, { mode: string; enabled: boolean; ts: number }>();
+type UpstreamProxyConfigCacheEntry = {
+  mode: string;
+  enabled: boolean;
+  cliproxyapiModelMapping: Record<string, unknown> | null;
+  ts: number;
+};
+
+const _proxyConfigCache = new Map<string, UpstreamProxyConfigCacheEntry>();
 const PROXY_CONFIG_CACHE_TTL = 10_000;
 
 /**
@@ -55,9 +62,14 @@ export async function getUpstreamProxyConfigCached(providerId: string) {
   const cached = _proxyConfigCache.get(providerId);
   if (cached && Date.now() - cached.ts < PROXY_CONFIG_CACHE_TTL) return cached;
   const cfg = await getUpstreamProxyConfig(providerId).catch(() => null);
-  const result = cfg
-    ? { mode: cfg.mode, enabled: cfg.enabled, ts: Date.now() }
-    : { mode: "native" as const, enabled: false, ts: Date.now() };
+  const result: UpstreamProxyConfigCacheEntry = cfg
+    ? {
+        mode: cfg.mode,
+        enabled: cfg.enabled,
+        cliproxyapiModelMapping: cfg.cliproxyapiModelMapping ?? null,
+        ts: Date.now(),
+      }
+    : { mode: "native" as const, enabled: false, cliproxyapiModelMapping: null, ts: Date.now() };
   _proxyConfigCache.set(providerId, result);
   return result;
 }
diff --git a/open-sse/handlers/chatCore/executorProxy.ts b/open-sse/handlers/chatCore/executorProxy.ts
index 4f0ea2a784..870c1bf00d 100644
--- a/open-sse/handlers/chatCore/executorProxy.ts
+++ b/open-sse/handlers/chatCore/executorProxy.ts
@@ -13,6 +13,7 @@ import { getExecutor } from "../../executors/index.ts";
 import { isCliproxyapiDeepModeEnabled } from "../../executors/cliproxyapi.ts";
 import { getCachedSettings } from "@/lib/db/readCache";
 import { getUpstreamProxyConfigCached } from "./comboContextCache.ts";
+import { wrapExecutorWithCliproxyapiModelMapping } from "./cliproxyModelMapping.ts";
 
 type LoggerLike =
   | {
@@ -47,12 +48,20 @@ export async function resolveExecutorWithProxy(
 
   if (cfg.mode === "cliproxyapi") {
     log?.info?.("UPSTREAM_PROXY", `${prov} routed through CLIProxyAPI (passthrough)`);
-    return getExecutor("cliproxyapi");
+    return wrapExecutorWithCliproxyapiModelMapping(
+      getExecutor("cliproxyapi"),
+      cfg.cliproxyapiModelMapping
+    );
   }
 
-  // mode === "fallback": try native first, retry via CLIProxyAPI on specific failures
+  // mode === "fallback": try native first, retry via CLIProxyAPI on specific failures.
+  // The model mapping applies only to the CLIProxyAPI retry leg (proxyExec) — the
+  // native leg must keep seeing the original, unmapped model.
   const nativeExec = getExecutor(prov);
-  const proxyExec = getExecutor("cliproxyapi");
+  const proxyExec = wrapExecutorWithCliproxyapiModelMapping(
+    getExecutor("cliproxyapi"),
+    cfg.cliproxyapiModelMapping
+  );
 
   // Read custom fallback codes from settings. Default: 5xx + 429 + network errors.
   let fallbackCodes: number[] = [429, 500, 502, 503, 504];
diff --git a/open-sse/handlers/chatCore/idempotency.ts b/open-sse/handlers/chatCore/idempotency.ts
index 7fdc45d7e0..205856d41a 100644
--- a/open-sse/handlers/chatCore/idempotency.ts
+++ b/open-sse/handlers/chatCore/idempotency.ts
@@ -1,7 +1,45 @@
+import { createHash } from "node:crypto";
 import { getIdempotencyKey, checkIdempotency } from "@/lib/idempotencyLayer";
 import { calculateCost } from "@/lib/usage/costCalculator";
 import { attachOmniRouteMetaHeaders } from "@/domain/omnirouteResponseMeta";
 
+/**
+ * NEXA fusion-idempotency fix: compose the effective idempotency key from the raw
+ * header key + target provider/model + a digest of the request messages.
+ *
+ * Why: combo-internal sub-requests (fusion panel members AND the judge) re-enter
+ * chatCore SHARING the client's headers, so the raw `Idempotency-Key`/`x-request-id`
+ * key was identical for all of them. A panel answer saved under the key and the
+ * judge's check (~1ms later, well inside the 5s window) replayed it — the client
+ * received a panel member's answer instead of the judge synthesis. Namespacing by
+ * model separates panel members; the messages digest separates the judge even when
+ * it reuses a panel member's model (the judge body appends the judge directive
+ * turn). A genuine client retry (same key, same model, same body) still replays.
+ */
+export function composeIdempotencyKey({
+  rawKey,
+  provider,
+  model,
+  messages,
+}: {
+  rawKey: string | null | undefined;
+  provider: string;
+  model: string;
+  messages: unknown;
+}): string | null {
+  if (!rawKey) return null;
+  let digest = "";
+  try {
+    digest = createHash("sha256")
+      .update(JSON.stringify(messages ?? ""))
+      .digest("hex")
+      .slice(0, 16);
+  } catch {
+    digest = "nodigest";
+  }
+  return `${rawKey}|${provider}|${model}|${digest}`;
+}
+
 /**
  * Resolve the request's idempotency key once and check the idempotency store. Returns the
  * resolved `idempotencyKey` alongside the cache `hit` so the caller can reuse the SAME key
@@ -12,6 +50,7 @@ export async function checkIdempotencyCache({
   clientRawRequest,
   provider,
   model,
+  body,
   effectiveServiceTier,
   startTime,
   log,
@@ -19,19 +58,26 @@ export async function checkIdempotencyCache({
   clientRawRequest: unknown;
   provider: string;
   model: string;
+  body?: unknown;
   effectiveServiceTier: unknown;
   startTime: number;
   log: unknown;
-}): Promise<{ hit: { success: true; response: Response } | null; idempotencyKey: string }> {
-  const idempotencyKey = getIdempotencyKey(clientRawRequest?.headers);
+}): Promise<{ hit: { success: true; response: Response } | null; idempotencyKey: string | null }> {
+  // NEXA fusion-idempotency fix: namespace the raw header key (see composeIdempotencyKey).
+  const rawIdempotencyKey = getIdempotencyKey(clientRawRequest?.headers);
+  const idempotencyKey = composeIdempotencyKey({
+    rawKey: rawIdempotencyKey,
+    provider,
+    model,
+    messages: (body as { messages?: unknown } | undefined)?.messages,
+  });
   const cachedIdemp = checkIdempotency(idempotencyKey);
   if (cachedIdemp) {
     log?.debug?.("IDEMPOTENCY", `Hit for key=${idempotencyKey?.slice(0, 12)}...`);
     const idempotentUsage =
       cachedIdemp.response && typeof cachedIdemp.response === "object"
         ? ((cachedIdemp.response as Record<string, unknown>).usage as
-            | Record<string, unknown>
-            | undefined)
+            Record<string, unknown> | undefined)
         : undefined;
     const idempotentCost = idempotentUsage
       ? await calculateCost(provider, model, idempotentUsage as Record<string, number>, {
diff --git a/open-sse/handlers/chatCore/telemetryHelpers.ts b/open-sse/handlers/chatCore/telemetryHelpers.ts
index c6b92e683c..805acbbd8c 100644
--- a/open-sse/handlers/chatCore/telemetryHelpers.ts
+++ b/open-sse/handlers/chatCore/telemetryHelpers.ts
@@ -2,7 +2,7 @@ import { fetchLiveProviderLimits } from "@/lib/usage/providerLimits";
 import { isClaudeExtraUsageBlockEnabled } from "@/lib/providers/claudeExtraUsage";
 
 // #4604 — Lazy backoff for the best-effort live-WS sidecar bridge. In single-port
-// deployments the sidecar (port 20129) is not running, so every compression event
+// deployments the sidecar (port 20132) is not running, so every compression event
 // POST failed with ECONNREFUSED; because the global fetch is proxyFetch, each
 // failure logged a "[ProxyFetch] Undici dispatcher failed" warning (272× in 42min).
 // After a few consecutive failures we stop attempting for a cooldown window (then
@@ -28,7 +28,7 @@ export async function forwardDashboardEventToLiveWs(
   // Skip while the bridge is in a cooldown window after repeated failures.
   if (liveWsDisabledUntil > now()) return;
 
-  const port = process.env.LIVE_WS_PORT || "20129";
+  const port = process.env.LIVE_WS_PORT || "20132";
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), 1_500);
   try {
diff --git a/open-sse/handlers/responseTranslator.ts b/open-sse/handlers/responseTranslator.ts
index 93f6bc1784..faaf50d84b 100644
--- a/open-sse/handlers/responseTranslator.ts
+++ b/open-sse/handlers/responseTranslator.ts
@@ -560,6 +560,31 @@ export function translateNonStreamingResponse(
   return intermediateOpenAI;
 }
 
+/**
+ * Resolve reasoning/thinking text off a non-streaming OpenAI-format message object.
+ * Checks DeepSeek-style `reasoning_content`, then the OpenRouter/StepFun aliases
+ * `reasoning` and `reasoning_details[]` (array of { text | content }), mirroring the
+ * streaming translator's fallback chain in open-sse/translator/response/openai-to-claude.ts.
+ */
+function resolveReasoningText(messageObj: JsonRecord): string {
+  if (messageObj.reasoning_content) {
+    return toString(messageObj.reasoning_content);
+  }
+  if (typeof messageObj.reasoning === "string" && messageObj.reasoning) {
+    return messageObj.reasoning;
+  }
+  if (Array.isArray(messageObj.reasoning_details)) {
+    const parts: string[] = [];
+    for (const detail of messageObj.reasoning_details) {
+      const detailObj = toRecord(detail);
+      const text = detailObj.text ?? detailObj.content;
+      if (typeof text === "string" && text) parts.push(text);
+    }
+    return parts.join("");
+  }
+  return "";
+}
+
 /**
  * Helper to convert an OpenAI chat.completion JSON object to Claude format for non-streaming.
  */
@@ -578,11 +603,12 @@ function convertOpenAINonStreamingToClaude(openaiResponse: JsonRecord): JsonReco
 
   let hasTextOrReasoning = false;
 
-  if (messageObj.reasoning_content) {
+  const reasoningText = resolveReasoningText(messageObj);
+  if (reasoningText) {
     hasTextOrReasoning = true;
     content.push({
       type: "thinking",
-      thinking: toString(messageObj.reasoning_content),
+      thinking: reasoningText,
     });
   }
 
diff --git a/open-sse/handlers/usageExtractor.ts b/open-sse/handlers/usageExtractor.ts
index 92affd1c39..114ccefa50 100644
--- a/open-sse/handlers/usageExtractor.ts
+++ b/open-sse/handlers/usageExtractor.ts
@@ -31,6 +31,15 @@ export function extractUsageFromResponse(responseBody, provider) {
         responseBody.usage.completion_tokens_details?.reasoning_tokens ??
         responseBody.usage.output_tokens_details?.reasoning_tokens ??
         responseBody.usage.reasoning_tokens,
+      // xAI's exact provider-reported cost (port of decolua/9router#2453, capability A —
+      // @ryanngit). Only set the key when present so non-xAI OpenAI-shaped usage
+      // (Codex, DeepSeek, etc.) is unaffected. Ticks → USD conversion happens in
+      // costCalculator.ts, not here.
+      ...(typeof responseBody.usage.cost_in_usd_ticks === "number" &&
+      Number.isFinite(responseBody.usage.cost_in_usd_ticks) &&
+      responseBody.usage.cost_in_usd_ticks >= 0
+        ? { cost_in_usd_ticks: responseBody.usage.cost_in_usd_ticks }
+        : {}),
     };
   }
 
diff --git a/open-sse/mcp-server/__tests__/audit.test.ts b/open-sse/mcp-server/__tests__/audit.test.ts
index d51541f17f..19f69ffb8d 100644
--- a/open-sse/mcp-server/__tests__/audit.test.ts
+++ b/open-sse/mcp-server/__tests__/audit.test.ts
@@ -37,31 +37,39 @@ describe("MCP audit shutdown", () => {
     vi.restoreAllMocks();
   });
 
-  it("checkpoints and closes the audit database during shutdown", async () => {
-    const mockDb: MockAuditDb = {
-      prepare: vi.fn(() => createStatementMock()),
-      pragma: vi.fn(),
-      close: vi.fn(),
-      open: true,
-    };
-    const MockDatabase = vi.fn(function MockDatabase() {
-      return mockDb;
-    });
+  it(
+    "checkpoints and closes the audit database during shutdown",
+    async () => {
+      const mockDb: MockAuditDb = {
+        prepare: vi.fn(() => createStatementMock()),
+        pragma: vi.fn(),
+        close: vi.fn(),
+        open: true,
+      };
+      const MockDatabase = vi.fn(function MockDatabase() {
+        return mockDb;
+      });
 
-    vi.doMock("better-sqlite3", () => ({
-      default: MockDatabase,
-    }));
+      vi.doMock("better-sqlite3", () => ({
+        default: MockDatabase,
+      }));
 
-    const audit = await import("../audit.ts");
+      const audit = await import("../audit.ts");
 
-    await audit.logToolCall("omniroute_get_health", { ok: true }, { ok: true }, 12, true);
-    expect(mockDb.prepare).toHaveBeenCalledTimes(1);
+      await audit.logToolCall("omniroute_get_health", { ok: true }, { ok: true }, 12, true);
+      expect(mockDb.prepare).toHaveBeenCalledTimes(1);
 
-    expect(audit.closeAuditDb()).toBe(true);
-    expect(mockDb.pragma).toHaveBeenCalledWith("wal_checkpoint(TRUNCATE)");
-    expect(mockDb.close).toHaveBeenCalledTimes(1);
-    expect(audit.closeAuditDb()).toBe(false);
-  });
+      expect(audit.closeAuditDb()).toBe(true);
+      expect(mockDb.pragma).toHaveBeenCalledWith("wal_checkpoint(TRUNCATE)");
+      expect(mockDb.close).toHaveBeenCalledTimes(1);
+      expect(audit.closeAuditDb()).toBe(false);
+    },
+    // Explicit generous timeout (vitest default is 5000ms): under contended
+    // CI-runner load, vi.resetModules() + a fresh dynamic import + mocked DB
+    // calls can exceed the default budget though the behavior is correct
+    // (issue #6803).
+    30000
+  );
 
   it("still closes the audit database when checkpoint fails", async () => {
     const mockDb: MockAuditDb = {
diff --git a/open-sse/mcp-server/schemas/tools.ts b/open-sse/mcp-server/schemas/tools.ts
index a2a3e76964..c6fc990822 100644
--- a/open-sse/mcp-server/schemas/tools.ts
+++ b/open-sse/mcp-server/schemas/tools.ts
@@ -1093,11 +1093,11 @@ export const compressionStatusTool: McpToolDefinition<
 export const compressionConfigureInput = z.object({
   enabled: z.boolean().optional(),
   strategy: z
-    .enum(["off", "lite", "standard", "aggressive", "ultra", "rtk", "stacked"])
+    .enum(["off", "lite", "standard", "aggressive", "ultra", "rtk", "stacked", "omniglyph"])
     .optional()
     .describe("Compression mode"),
   autoTriggerMode: z
-    .enum(["off", "lite", "standard", "aggressive", "ultra", "rtk", "stacked"])
+    .enum(["off", "lite", "standard", "aggressive", "ultra", "rtk", "stacked", "omniglyph"])
     .optional(),
   maxTokens: z
     .number()
diff --git a/open-sse/mcp-server/server.ts b/open-sse/mcp-server/server.ts
index a9428ba310..4d8b7be2de 100644
--- a/open-sse/mcp-server/server.ts
+++ b/open-sse/mcp-server/server.ts
@@ -37,6 +37,7 @@ import {
   oneproxyStatsInput,
 } from "./schemas/tools.ts";
 import { startMcpHeartbeat } from "./runtimeHeartbeat.ts";
+import { countUniqueMcpTools } from "./toolCount.ts";
 import { z } from "zod";
 import { closeAuditDb, logToolCall } from "./audit.ts";
 import {
@@ -98,17 +99,18 @@ const MCP_ALLOWED_SCOPES = new Set(
     .map((s) => s.trim())
     .filter(Boolean)
 );
-const TOTAL_MCP_TOOL_COUNT =
-  MCP_TOOLS.length +
-  Object.keys(memoryTools).length +
-  Object.keys(skillTools).length +
-  Object.keys(agentSkillTools).length +
-  Object.keys(githubSkillTools).length +
-  Object.keys(poolTools).length +
-  gamificationTools.length +
-  pluginTools.length +
-  notionTools.length +
-  obsidianTools.length;
+const TOTAL_MCP_TOOL_COUNT = countUniqueMcpTools({
+  MCP_TOOLS,
+  memoryTools,
+  skillTools,
+  agentSkillTools,
+  githubSkillTools,
+  poolTools,
+  gamificationTools,
+  pluginTools,
+  notionTools,
+  obsidianTools,
+});
 
 type JsonRecord = Record<string, unknown>;
 
diff --git a/open-sse/mcp-server/toolCount.ts b/open-sse/mcp-server/toolCount.ts
new file mode 100644
index 0000000000..068adac6b6
--- /dev/null
+++ b/open-sse/mcp-server/toolCount.ts
@@ -0,0 +1,36 @@
+/**
+ * countUniqueMcpTools — de-duplicated MCP tool count.
+ *
+ * The various tool collections registered by the MCP server (array-shaped, e.g.
+ * `MCP_TOOLS`, and record-shaped, e.g. `memoryTools`) are not guaranteed disjoint by
+ * tool `name` — some tools (e.g. the agent-skills trio) are intentionally defined in
+ * both an array collection and a record collection for registration purposes. Summing
+ * `collection.length` / `Object.keys(collection).length` across all sources therefore
+ * double-counts any name that appears in more than one source.
+ *
+ * This helper unions every collection's tool names into a `Set` and returns the size
+ * of that set, so the reported tool count always reflects distinct, user-visible tool
+ * names regardless of how many internal collections a given tool happens to appear in.
+ */
+
+type NamedTool = { name: string };
+type ToolCollection = readonly NamedTool[] | Readonly<Record<string, NamedTool>>;
+
+function collectionNames(collection: ToolCollection): string[] {
+  const items: NamedTool[] = Array.isArray(collection)
+    ? collection
+    : Object.values(collection as Record<string, NamedTool>);
+  return items.map((item) => item.name);
+}
+
+export function countUniqueMcpTools(
+  collectionsByLabel: Readonly<Record<string, ToolCollection>>
+): number {
+  const uniqueNames = new Set<string>();
+  for (const collection of Object.values(collectionsByLabel)) {
+    for (const name of collectionNames(collection)) {
+      uniqueNames.add(name);
+    }
+  }
+  return uniqueNames.size;
+}
diff --git a/open-sse/mcp-server/tools/githubSkillTools.ts b/open-sse/mcp-server/tools/githubSkillTools.ts
index 2161ec0945..18ef2a853d 100644
--- a/open-sse/mcp-server/tools/githubSkillTools.ts
+++ b/open-sse/mcp-server/tools/githubSkillTools.ts
@@ -77,11 +77,13 @@ async function handleInstall(args: z.infer<typeof GitHubSkillsInstallSchema>) {
     try {
       const dest = resolveInstallPath(target, skillName, args.description);
       // In a real implementation, this would clone the repo and copy files.
-      // For now, we return the planned install path as a dry-run result.
+      // For now, we return the planned install path as a dry-run result — matches
+      // the honest `action: "planned"` the REST route (/api/github-skills POST)
+      // reports for the same operation.
       results.push({
         target,
         ok: true,
-        action: "installed",
+        action: "planned",
         destDir: dest,
       });
     } catch (err) {
diff --git a/open-sse/package.json b/open-sse/package.json
index f1a7c838e6..9fca2fe34d 100644
--- a/open-sse/package.json
+++ b/open-sse/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@omniroute/open-sse",
-  "version": "3.8.46",
+  "version": "3.8.47",
   "description": "Express SSE sidecar for OmniRoute — handles streaming, protocol translation, and provider orchestration",
   "type": "module",
   "main": "index.js",
diff --git a/open-sse/services/accountFallback.ts b/open-sse/services/accountFallback.ts
index 0b2f72e0c3..275ecbab41 100644
--- a/open-sse/services/accountFallback.ts
+++ b/open-sse/services/accountFallback.ts
@@ -11,8 +11,10 @@ import {
   findMatchingErrorRule,
   matchErrorRuleByText,
   matchErrorRuleByStatus,
+  serviceSupervisorCooldown,
 } from "../config/errorConfig.ts";
 import { getProviderErrorRuleMatch } from "../config/providerErrorRules.ts";
+import * as rot from "./rotationConfig.ts";
 import { getPassthroughProviders, getProviderCategory } from "../config/providerRegistry.ts";
 import {
   DEFAULT_RESILIENCE_SETTINGS,
@@ -35,6 +37,12 @@ import { getQuotaScopedModelForProvider } from "./antigravityQuotaFamily.ts";
 import { isRpdExhausted, isRpmExhausted } from "./geminiRateLimitTracker.ts";
 import { setConnectionRateLimitUntil } from "@/lib/db/providers";
 import { parseRetryHintFromJsonBody } from "./retryAfterJson.ts";
+import {
+  isSubscriptionQuotaText,
+  buildSubscriptionQuotaFallback,
+  buildWeeklyQuotaFallback,
+} from "./quotaTextCooldowns.ts";
+import { parseDayGranularityResetMs, shouldPreserveQuotaSignals } from "./quotaResetParsing.ts";
 
 export type ProviderProfile = {
   baseCooldownMs: number;
@@ -181,7 +189,10 @@ export const OAUTH_INVALID_TOKEN_SIGNALS = [
 // Context overflow patterns — the prompt exceeds the model's maximum context length.
 // Different providers phrase this differently. Used to decide whether a 400 error
 // should trigger combo fallback (a different model may have a larger context window).
-const CONTEXT_OVERFLOW_PATTERNS = [
+// Exported so combo.ts's isContextOverflow400() guard (open-sse/services/combo.ts)
+// can reuse this single source of truth instead of maintaining its own,
+// independently-drifting pattern list (see issue #6637).
+export const CONTEXT_OVERFLOW_PATTERNS = [
   /\binput is too long\b/i,
   /\binput too long\b/i,
   /\bcontext.*(too long|exceeded|overflow|limit)/i,
@@ -265,8 +276,8 @@ const MALFORMED_REQUEST_PATTERNS = [
 // non-standard 400 status whose body carries rate-limit semantics instead of a 429
 // (#4976). When detected, the request is fallback-worthy at connection-cooldown scope
 // (NOT a whole-provider breaker) so combo routing can fail over to another free target.
-// Bounded, non-overlapping patterns only (ReDoS-safe — no nested quantifiers).
-const RATE_LIMIT_TEXT_PATTERNS = [
+// Exported: mimocode.ts's executor reuses this list directly (single source of truth).
+export const RATE_LIMIT_TEXT_PATTERNS = [
   /high.?frequency/i,
   /non-compliant/i,
   /too many requests/i,
@@ -364,11 +375,6 @@ export function getProviderProfile(provider: string): ProviderProfile {
   return buildProviderProfile(category);
 }
 
-function shouldPreserveQuotaSignalsFor429(provider: string | null | undefined): boolean {
-  if (!provider) return true;
-  return getProviderCategory(provider) === "oauth";
-}
-
 export async function getRuntimeProviderProfile(provider: string | null | undefined) {
   try {
     const { getCachedSettings } = await import("@/lib/db/readCache");
@@ -676,7 +682,7 @@ export function shouldMarkAccountExhaustedFrom429(
   // without making this one look quota-depleted for 5 minutes.
   if (failureKind === "rate_limit" || failureKind === "transient") return false;
   return (
-    shouldPreserveQuotaSignalsFor429(provider) &&
+    shouldPreserveQuotaSignals(provider) &&
     !hasPerModelQuota(provider, model, connectionPassthroughModels)
   );
 }
@@ -1071,7 +1077,7 @@ export function parseRetryFromErrorText(errorText: unknown): number | null {
     return computeDurationMs(resetsInMatch);
   }
 
-  return null;
+  return parseDayGranularityResetMs(msg, MAX_PROVIDER_COOLDOWN_MS);
 }
 
 /**
@@ -1088,16 +1094,6 @@ function computeDurationMs(match: RegExpMatchArray): number | null {
   return totalMs > 0 ? Math.min(totalMs, MAX_PROVIDER_COOLDOWN_MS) : null;
 }
 
-function isSubscriptionQuotaText(lower: string): boolean {
-  return (
-    lower.includes("usage limit reached") ||
-    lower.includes("usage limit has been") ||
-    lower.includes("claude pro usage limit") ||
-    lower.includes("you've reached your usage limit") ||
-    lower.includes("you have reached your usage limit")
-  );
-}
-
 // ─── Error Classification ───────────────────────────────────────────────────
 
 /**
@@ -1276,7 +1272,8 @@ export function checkFallbackError(
   provider: string | null = null,
   headers: Headers | Record<string, string> | null = null,
   profileOverride: ProviderProfile | null = null,
-  structuredError?: { code?: string | null; type?: string | null } | null
+  structuredError?: { code?: string | null; type?: string | null } | null,
+  rotation?: { account?: unknown } | null
 ): {
   shouldFallback: boolean;
   cooldownMs: number;
@@ -1296,27 +1293,10 @@ export function checkFallbackError(
    * caller can persist an explicit reset window instead of the engine's scaled cooldown. */
   configuredCooldownMs?: number;
 } {
-  // G-02: detect embedded service supervisor failures (X-Omni-Fallback-Hint: connection_cooldown).
-  // These are NOT upstream AI provider failures — they are local supervisor state changes.
-  // Apply a short 5s connection cooldown without tripping the provider circuit breaker.
-  if (status === 503 && headers) {
-    const hintValue =
-      typeof (headers as Headers).get === "function"
-        ? (headers as Headers).get("x-omni-fallback-hint")
-        : (headers as Record<string, string>)["x-omni-fallback-hint"] ||
-          (headers as Record<string, string>)["X-Omni-Fallback-Hint"];
-    if (typeof hintValue === "string" && hintValue.toLowerCase() === "connection_cooldown") {
-      return {
-        shouldFallback: true,
-        cooldownMs: 5_000,
-        baseCooldownMs: 5_000,
-        newBackoffLevel: 0,
-        reason: "service_not_running",
-        skipProviderBreaker: true,
-      };
-    }
-  }
-
+  const svc = serviceSupervisorCooldown(status, headers);
+  if (svc) return svc;
+  const rg = rot.gateFor(status, rotation?.account);
+  if (rg) return rg;
   const errorStr = (errorText || "").toString();
   const profile = profileOverride ?? (provider ? getProviderProfile(provider) : null);
   const maxBackoffSteps = profile?.maxBackoffSteps ?? BACKOFF_CONFIG.maxLevel;
@@ -1405,6 +1385,8 @@ export function checkFallbackError(
       };
     }
 
+    const ro = rot.overrideFor(reason, rotation?.account);
+    if (ro) return ro;
     const scaled = getScaledBaseCooldown(reason, backoffLevel);
     return {
       shouldFallback: true,
@@ -1417,7 +1399,7 @@ export function checkFallbackError(
   }
 
   const isRateLimitStatus = status === HTTP_STATUS.RATE_LIMITED;
-  const preserveQuota429 = shouldPreserveQuotaSignalsFor429(provider);
+  const preserveQuota429 = shouldPreserveQuotaSignals(provider, errorText);
   const shouldUseQuotaSignal = !isRateLimitStatus || preserveQuota429;
 
   // Check error message FIRST - specific patterns take priority over status codes
@@ -1455,37 +1437,23 @@ export function checkFallbackError(
       };
     }
 
-    // Issue #2321: Anthropic OAuth (Claude Pro/Team) returns 429 with
-    // "Usage Limit Reached" for the 5-hour subscription quota. The
-    // pattern-based classifier now flags these as QUOTA_EXHAUSTED, but
-    // without a dedicated branch the request would still fall through to
-    // the generic 429 retry path (~5s base cooldown). Honor upstream
-    // Retry-After / reset hints only when the profile enables them;
-    // otherwise apply a local 1h cooldown so all Pro accounts on the same
-    // subscription tier stop cycling through tight retries without letting
-    // upstream-provided windows bypass the operator setting. (We
-    // deliberately do not use COOLDOWN_MS.paymentRequired here — that
-    // constant is 2 minutes, which is shorter than the recovery time of a
-    // subscription quota.)
-    if (
-      shouldUseQuotaSignal &&
-      !isCreditsExhausted(errorStr) &&
-      !isDailyQuotaExhausted(errorStr) &&
-      isSubscriptionQuotaText(errorStr.toLowerCase())
-    ) {
-      // getUpstreamRetryHintMs() gates both headers and body reset text on
-      // profile.useUpstreamRetryHints.
-      const hintMs = getUpstreamRetryHintMs();
-      const SUBSCRIPTION_QUOTA_COOLDOWN_MS = 60 * 60 * 1000; // 1 hour
-      const bodyHint = parseRetryFromErrorText(errorStr);
-      return {
-        shouldFallback: true,
-        cooldownMs: hintMs ?? SUBSCRIPTION_QUOTA_COOLDOWN_MS,
-        reason: RateLimitReason.QUOTA_EXHAUSTED,
-        usedUpstreamRetryHint: Boolean(hintMs),
-        quotaResetHintMs: bodyHint ?? undefined,
-      };
+    // Issue #2321 (5h subscription quota) + Issue #3709 (ollama-cloud weekly
+    // cap): both classifiers live in quotaTextCooldowns.ts (this file is
+    // frozen at its file-size-baseline cap). The weekly check runs
+    // UNCONDITIONALLY (not gated by shouldUseQuotaSignal) because it targets
+    // apikey-category providers like ollama-cloud, which the oauth-only
+    // shouldUseQuotaSignal gate deliberately excludes from the subscription
+    // check above.
+    if (shouldUseQuotaSignal && !isCreditsExhausted(errorStr) && !isDailyQuotaExhausted(errorStr)) {
+      const subResult = buildSubscriptionQuotaFallback(
+        errorStr,
+        getUpstreamRetryHintMs,
+        parseRetryFromErrorText
+      );
+      if (subResult) return subResult;
     }
+    const weeklyResult = buildWeeklyQuotaFallback(errorStr);
+    if (weeklyResult) return weeklyResult;
 
     const quotaResetHintMs = parseRetryFromErrorText(errorStr);
     if (
@@ -1784,13 +1752,15 @@ export function resetAccountState<T extends AccountState | null | undefined>(
 export function applyErrorState<T extends AccountState | null | undefined>(
   account: T,
   status: number,
-  errorText: string | null,
-  provider: string | null = null
+  errText: string | null,
+  prov: string | null = null
 ): T | AccountState {
   if (!account) return account;
 
-  const backoffLevel = account.backoffLevel || 0;
-  const fallbackDecision = checkFallbackError(status, errorText, backoffLevel, null, provider);
+  const lvl = account.backoffLevel || 0;
+  const fallbackDecision = checkFallbackError(status, errText, lvl, null, prov, null, null, null, {
+    account,
+  });
   const { cooldownMs, reason } = fallbackDecision;
   const newBackoffLevel =
     "newBackoffLevel" in fallbackDecision ? fallbackDecision.newBackoffLevel : undefined;
@@ -1812,8 +1782,8 @@ export function applyErrorState<T extends AccountState | null | undefined>(
   const nextState: T | AccountState = {
     ...account,
     rateLimitedUntil: effectiveCooldownMs > 0 ? getUnavailableUntil(effectiveCooldownMs) : null,
-    backoffLevel: newBackoffLevel ?? backoffLevel,
-    lastError: { status, message: errorText, timestamp: new Date().toISOString(), reason },
+    backoffLevel: newBackoffLevel ?? lvl,
+    lastError: { status, message: errText, timestamp: new Date().toISOString(), reason },
     status: "error",
   };
 
diff --git a/open-sse/services/autoCombo/builtinCatalog.ts b/open-sse/services/autoCombo/builtinCatalog.ts
index cc80184aa5..5b4526dce7 100644
--- a/open-sse/services/autoCombo/builtinCatalog.ts
+++ b/open-sse/services/autoCombo/builtinCatalog.ts
@@ -88,6 +88,28 @@ export function isRecognizedBuiltinAuto(modelStr: string, suffix: string): boole
   );
 }
 
+/**
+ * #6328 (follow-up to #6495 / #6512): recognize built-in `auto/*` ids whose
+ * intent is paid-tier only, so callers can REMOVE — not just hide — them from
+ * advertised catalogs when the operator opts into `hidePaidModels`.
+ *
+ * Two shapes qualify as paid-tier:
+ *   - flat variants prefixed `auto/pro-*` (e.g. `auto/pro-coding`)
+ *   - suffix variants with the `:pro` tier (e.g. `auto/coding:pro`)
+ *
+ * Non-`pro` `auto/*` ids (auto/coding, auto/best-*, auto/coding:free, …) keep
+ * their advertised status; the candidate-pool filter in `virtualFactory` (#6512)
+ * already excludes paid backends from them at request time. `auto/<family>` ids
+ * are unaffected — the family is a backend selector, not a tier.
+ */
+export function isPaidTierAutoId(autoId: string): boolean {
+  if (typeof autoId !== "string" || !autoId.startsWith("auto/")) return false;
+  const suffix = autoId.slice("auto/".length);
+  if (suffix.startsWith("pro-")) return true;
+  const parsed = parseAutoSuffix(suffix);
+  return parsed.valid && parsed.tier === "pro";
+}
+
 export async function createBuiltinAutoCombo(modelStr: string, suffix: string) {
   const { createVirtualAutoCombo } = await import("./virtualFactory.ts");
 
diff --git a/open-sse/services/autoCombo/engine.ts b/open-sse/services/autoCombo/engine.ts
index 870b7c3dc6..6d238fc98f 100644
--- a/open-sse/services/autoCombo/engine.ts
+++ b/open-sse/services/autoCombo/engine.ts
@@ -30,11 +30,39 @@ export interface AutoComboConfig {
   weights: ScoringWeights;
   modePack?: string;
   budgetCap?: number; // max cost per request in USD
+  /**
+   * Policy applied when EVERY candidate exceeds `budgetCap` (#3470):
+   *   - "cheapest" (default): fall back to the globally cheapest candidate, even
+   *     though it still exceeds the cap (existing/legacy behavior).
+   *   - "strict": refuse to select — `selectProvider()` throws `BudgetExceededError`
+   *     so the caller can surface a clear cost-exceeds-budget response instead of
+   *     silently overspending.
+   */
+  budgetFallback?: "cheapest" | "strict";
   explorationRate: number; // 0.05 = 5% exploratory
   /** If set, RouterStrategy name to use for selection ('rules' | 'cost' | 'latency') */
   routerStrategy?: string;
 }
 
+/**
+ * Thrown by `selectProvider()` when `budgetFallback: "strict"` is set and no
+ * candidate (including the cheapest) fits within `budgetCap` (#3470). Callers
+ * should catch this and surface a cost-exceeds-budget response — never let it
+ * propagate as an unhandled 500.
+ */
+export class BudgetExceededError extends Error {
+  constructor(
+    public readonly budgetCap: number,
+    public readonly cheapestCostUsd: number
+  ) {
+    super(
+      `No candidate fits within the configured budget cap of $${budgetCap.toFixed(4)} ` +
+        `(cheapest available candidate costs $${cheapestCostUsd.toFixed(4)})`
+    );
+    this.name = "BudgetExceededError";
+  }
+}
+
 export interface SelectionResult {
   provider: string;
   model: string;
@@ -293,6 +321,9 @@ export function selectProvider(
         const cheapest = [...candidates_].sort(
           (a, b) => estimatedCostFor(a) - estimatedCostFor(b)
         )[0];
+        if (config.budgetFallback === "strict") {
+          throw new BudgetExceededError(config.budgetCap, cheapest ? estimatedCostFor(cheapest) : 0);
+        }
         if (cheapest) selected = cheapest;
       }
     }
diff --git a/open-sse/services/autoCombo/index.ts b/open-sse/services/autoCombo/index.ts
index 062dbccacf..e5dc073899 100644
--- a/open-sse/services/autoCombo/index.ts
+++ b/open-sse/services/autoCombo/index.ts
@@ -15,4 +15,9 @@ export {
 export { getTaskFitness, getTaskTypes } from "./taskFitness";
 export { SelfHealingManager, getSelfHealingManager } from "./selfHealing";
 export { MODE_PACKS, getModePack, getModePackNames } from "./modePacks";
-export { selectProvider, type AutoComboConfig, type SelectionResult } from "./engine";
+export {
+  selectProvider,
+  BudgetExceededError,
+  type AutoComboConfig,
+  type SelectionResult,
+} from "./engine";
diff --git a/open-sse/services/autoCombo/requestControls.ts b/open-sse/services/autoCombo/requestControls.ts
index 5495fb996d..4b4a6a22f9 100644
--- a/open-sse/services/autoCombo/requestControls.ts
+++ b/open-sse/services/autoCombo/requestControls.ts
@@ -1,16 +1,17 @@
 /**
- * Per-request Auto-Combo routing controls (#6023 / #6024 / #6025).
+ * Per-request Auto-Combo routing controls (#6023 / #6024 / #6025 / #3470).
  *
  * These let a caller steer an `auto` combo on a single request via response-safe
  * request headers, without changing the combo's stored config:
  *
- *   X-OmniRoute-Mode:   fast | balanced | quality | <raw mode-pack name>  (#6024/#6025)
- *   X-OmniRoute-Budget: <max USD per request>                             (#6023)
+ *   X-OmniRoute-Mode:            fast | balanced | quality | <raw mode-pack name>  (#6024/#6025)
+ *   X-OmniRoute-Budget:          <max USD per request>                             (#6023)
+ *   X-OmniRoute-Budget-Fallback: cheapest | strict                                 (#3470)
  *
- * Both resolvers are pure so they can be unit-tested and reused by the entry
+ * All resolvers are pure so they can be unit-tested and reused by the entry
  * handler (src/sse/handlers/chat.ts) and the combo router (open-sse/services/combo.ts).
  * The resolved values feed the auto-combo engine's existing `config.modePack` /
- * `config.budgetCap` inputs — no engine changes required.
+ * `config.budgetCap` / `config.budgetFallback` inputs.
  */
 
 import { MODE_PACKS } from "./modePacks";
@@ -78,3 +79,51 @@ export function parseRequestBudgetCap(input: unknown): number | undefined {
   if (!Number.isFinite(n) || n <= 0) return undefined;
   return n;
 }
+
+/** Policy applied when every candidate exceeds `budgetCap` — see `AutoComboConfig.budgetFallback`. */
+export type RequestBudgetFallback = "cheapest" | "strict";
+
+/**
+ * Parse the `X-OmniRoute-Budget-Fallback` header into a budget-fallback policy override.
+ * Unknown/empty/non-string values return `undefined` so the combo's own stored
+ * `config.budgetFallback` (or the engine default of `"cheapest"`) stays in effect.
+ */
+export function parseRequestBudgetFallback(input: unknown): RequestBudgetFallback | undefined {
+  if (typeof input !== "string") return undefined;
+  const key = input.trim().toLowerCase();
+  if (key === "strict" || key === "block" || key === "hard") return "strict";
+  if (key === "cheapest" || key === "cheapest-viable" || key === "soft") return "cheapest";
+  return undefined;
+}
+
+/** Aggregated per-request auto-combo overrides resolved from request headers (#3470). */
+export interface PerRequestAutoControls {
+  mode?: string;
+  budgetCap?: number;
+  budgetFallback?: RequestBudgetFallback;
+}
+
+/**
+ * Resolve all per-request Auto-Combo headers in one pass, returning only the keys
+ * that were actually overridden. Consolidates `resolveRequestModePack()` /
+ * `parseRequestBudgetCap()` / `parseRequestBudgetFallback()` so entry handlers (e.g.
+ * `src/sse/handlers/chat.ts`) can thread a single object into `relayOptions` instead
+ * of repeating the per-header boilerplate for each new control.
+ */
+export function resolveRequestAutoControls(headers: {
+  get(name: string): string | null;
+}): PerRequestAutoControls {
+  const modeHeader = headers.get("x-omniroute-mode")?.trim() || null;
+  const budgetHeader = headers.get("x-omniroute-budget")?.trim() || null;
+  const budgetFallbackHeader = headers.get("x-omniroute-budget-fallback")?.trim() || null;
+
+  const mode = resolveRequestModePack(modeHeader);
+  const budgetCap = parseRequestBudgetCap(budgetHeader);
+  const budgetFallback = parseRequestBudgetFallback(budgetFallbackHeader);
+
+  return {
+    ...(mode.override && modeHeader ? { mode: modeHeader } : {}),
+    ...(budgetCap !== undefined ? { budgetCap } : {}),
+    ...(budgetFallback !== undefined ? { budgetFallback } : {}),
+  };
+}
diff --git a/open-sse/services/autoCombo/virtualFactory.ts b/open-sse/services/autoCombo/virtualFactory.ts
index 716f2843cb..5e48c905e4 100644
--- a/open-sse/services/autoCombo/virtualFactory.ts
+++ b/open-sse/services/autoCombo/virtualFactory.ts
@@ -137,7 +137,8 @@ function isChatAutoComboNoAuthProvider(providerDef: NoAuthProviderDefinition): b
 
 function getNoAuthCandidates(
   excludedProviders: Set<string>,
-  blockedProviders: Set<string>
+  blockedProviders: Set<string>,
+  disabledNoAuthProviders: Set<string>
 ): VirtualAutoComboCandidate[] {
   const registry = getProviderRegistry();
   const candidates: VirtualAutoComboCandidate[] = [];
@@ -152,6 +153,15 @@ function getNoAuthCandidates(
       (typeof providerDef.alias === "string" && blockedProviders.has(providerDef.alias))
     )
       continue;
+    // #6557: a no-auth provider with its OWN provider_connections row explicitly
+    // disabled (isActive=false, the toggle on the main Providers grid card once an
+    // Account/fingerprint exists) must not be routed to, even though it has no
+    // entry in the separate `settings.blockedProviders` list.
+    if (
+      disabledNoAuthProviders.has(providerId) ||
+      (typeof providerDef.alias === "string" && disabledNoAuthProviders.has(providerDef.alias))
+    )
+      continue;
 
     const providerInfo = registry[providerId];
     const registryModels = Array.isArray(providerInfo?.models) ? providerInfo.models : [];
@@ -232,13 +242,24 @@ export async function createVirtualAutoCombo(
   variant: AutoVariant | undefined,
   spec?: AutoComboSpec
 ): Promise<VirtualAutoCombo> {
-  const [connections, settings] = await Promise.all([
+  const [connections, disabledNoAuthConnections, settings] = await Promise.all([
     getProviderConnections({ isActive: true }) as Promise<VirtualFactoryConn[]>,
+    // #6557: no-auth providers (opencode/mimocode/etc.) don't get an isActive
+    // filter applied above since their credential is synthetic, but a real
+    // provider_connections row CAN exist for them (created via "Add Account")
+    // and its own isActive=false must gate the auto-combo pool too — not just
+    // the separate settings.blockedProviders list.
+    getProviderConnections({ isActive: false }) as Promise<VirtualFactoryConn[]>,
     getSettings().catch(() => ({}) as Record<string, unknown>),
   ]);
   const blockedProviders = new Set(
     Array.isArray(settings.blockedProviders) ? (settings.blockedProviders as string[]) : []
   );
+  const disabledNoAuthProviders = new Set(
+    disabledNoAuthConnections
+      .filter((conn) => conn.provider in NOAUTH_PROVIDERS)
+      .map((conn) => conn.provider)
+  );
   const hiddenModelsMap = getHiddenModelsByProvider();
 
   const validConnections = connections.filter(hasUsableConnectionCredential);
@@ -272,7 +293,11 @@ export async function createVirtualAutoCombo(
   }
 
   candidatePool.push(
-    ...getNoAuthCandidates(new Set(validConnections.map((conn) => conn.provider)), blockedProviders)
+    ...getNoAuthCandidates(
+      new Set(validConnections.map((conn) => conn.provider)),
+      blockedProviders,
+      disabledNoAuthProviders
+    )
   );
 
   // #6512 (follow-up to #6328/#6495): when the operator opts into `hidePaidModels`,
diff --git a/open-sse/services/bailianQuotaFetcher.ts b/open-sse/services/bailianQuotaFetcher.ts
index 33a85664fc..921bd34721 100644
--- a/open-sse/services/bailianQuotaFetcher.ts
+++ b/open-sse/services/bailianQuotaFetcher.ts
@@ -21,6 +21,7 @@
 
 import { registerQuotaFetcher, registerQuotaWindows, type QuotaInfo } from "./quotaPreflight.ts";
 import { registerMonitorFetcher } from "./quotaMonitor.ts";
+import { throttleQuotaFetch } from "./quotaFetchThrottle.ts";
 
 // Bailian quota hosts (international / china fallback)
 const BAILIAN_QUOTA_HOSTS = {
@@ -256,6 +257,8 @@ export async function fetchBailianQuota(
 
   try {
     const url = getQuotaUrl();
+    // #6911: space concurrent upstream quota fetches (mirrors codexQuotaFetcher.ts).
+    await throttleQuotaFetch();
     const response = await fetch(url, {
       method: "POST",
       headers,
@@ -273,6 +276,8 @@ export async function fetchBailianQuota(
           ? url
           : `${BAILIAN_QUOTA_HOSTS.china}${BAILIAN_QUOTA_PATH}`;
 
+        // #6911: space this fallback fetch too — it is still a genuine upstream call.
+        await throttleQuotaFetch();
         const retryResponse = await fetch(chinaUrl, {
           method: "POST",
           headers,
diff --git a/open-sse/services/ccBridgeTransforms.ts b/open-sse/services/ccBridgeTransforms.ts
index ae444f97a9..41deb102a4 100644
--- a/open-sse/services/ccBridgeTransforms.ts
+++ b/open-sse/services/ccBridgeTransforms.ts
@@ -96,7 +96,7 @@ export interface InjectBillingHeaderOp {
    *   - static-zero: emit "00000" (relay endpoints don't validate)
    */
   cchAlgo: "sha256-first-user" | "xxhash64-body" | "static-zero";
-  /** Override the embedded `cc_version=` value. Defaults to `2.1.195`. */
+  /** Override the embedded `cc_version=` value. Defaults to `2.1.207`. */
   version?: string;
 }
 
@@ -114,7 +114,7 @@ export const CCH_SALT = "59cf53e54c78";
 /** Character positions sampled from the first user message text. */
 export const CCH_POSITIONS = [4, 7, 20] as const;
 /** Default `cc_version=` value embedded in the billing header. */
-export const DEFAULT_CLAUDE_CODE_VERSION = "2.1.195";
+export const DEFAULT_CLAUDE_CODE_VERSION = "2.1.207";
 /** Identity sentinel prepended for Claude Agent SDK callers. */
 export const CLAUDE_AGENT_SDK_IDENTITY =
   "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
diff --git a/open-sse/services/claudeCodeCompatible.ts b/open-sse/services/claudeCodeCompatible.ts
index eff67c4203..01b021579f 100644
--- a/open-sse/services/claudeCodeCompatible.ts
+++ b/open-sse/services/claudeCodeCompatible.ts
@@ -42,8 +42,8 @@ export {
   CLAUDE_CODE_COMPATIBLE_REDACT_THINKING_BETA,
   resolveClaudeCodeCompatibleAnthropicBeta,
 } from "./claudeCodeCompatibleBeta.ts";
-export const CLAUDE_CODE_COMPATIBLE_VERSION = "2.1.195";
-export const CLAUDE_CODE_COMPATIBLE_USER_AGENT = "claude-cli/2.1.195 (external, sdk-cli)";
+export const CLAUDE_CODE_COMPATIBLE_VERSION = "2.1.207";
+export const CLAUDE_CODE_COMPATIBLE_USER_AGENT = "claude-cli/2.1.207 (external, sdk-cli)";
 export const CLAUDE_CODE_COMPATIBLE_STAINLESS_PACKAGE_VERSION = "0.94.0";
 export const CLAUDE_CODE_COMPATIBLE_STAINLESS_RUNTIME_VERSION = "v24.3.0";
 export const CONTEXT_1M_BETA_HEADER = "context-1m-2025-08-07";
diff --git a/open-sse/services/claudeCodeToolRemapper.ts b/open-sse/services/claudeCodeToolRemapper.ts
index 754ecc978a..1f9bb745cc 100644
--- a/open-sse/services/claudeCodeToolRemapper.ts
+++ b/open-sse/services/claudeCodeToolRemapper.ts
@@ -57,14 +57,41 @@ function trackToolName(
   getRequestToolNameMap(body).set(titleCaseName, originalName);
 }
 
+/**
+ * Names of Anthropic server-side tools declared in this request's tools[].
+ * A server tool's `name` is a reserved literal validated against its `type`
+ * (web_search_20250305 ⇒ "web_search", bash_20250124 ⇒ "bash", …), so every
+ * rewrite below must leave both the declaration AND any history/tool_choice
+ * reference to it untouched — renaming only one side produces
+ * `Tool 'WebSearch' not found in provided tools` (history renamed, tools[]
+ * preserved) or `tools.N.<type>.name: Input should be '<literal>'` (tools[]
+ * renamed).
+ */
+function collectServerToolNames(tools: unknown): Set<string> {
+  const names = new Set<string>();
+  if (!Array.isArray(tools)) return names;
+  for (const tool of tools) {
+    const t = tool as Record<string, unknown> | null;
+    if (t && isAnthropicServerToolType(t.type) && typeof t.name === "string") {
+      names.add(t.name);
+    }
+  }
+  return names;
+}
+
 export function remapToolNamesInRequest(body: Record<string, unknown>): boolean {
   let hasLowercase = false;
   let hasTitleCase = false;
+  const serverToolNames = collectServerToolNames(body.tools);
 
   // Remap tool definitions
   const tools = body.tools as Array<Record<string, unknown>> | undefined;
   if (Array.isArray(tools)) {
     for (const tool of tools) {
+      if (!tool) continue;
+      // Server tools (bash_20250124 / web_search_20250305 / …) keep their
+      // type-bound literal name.
+      if (isAnthropicServerToolType(tool.type)) continue;
       const name = String(tool.name || "");
       if (TOOL_RENAME_MAP[name]) {
         const mapped = TOOL_RENAME_MAP[name];
@@ -85,6 +112,7 @@ export function remapToolNamesInRequest(body: Record<string, unknown>): boolean
       if (!Array.isArray(content)) continue;
       for (const block of content) {
         if (block.type === "tool_use" && typeof block.name === "string") {
+          if (serverToolNames.has(block.name)) continue;
           const mapped = TOOL_RENAME_MAP[block.name];
           if (mapped) {
             const originalName = block.name;
@@ -101,7 +129,11 @@ export function remapToolNamesInRequest(body: Record<string, unknown>): boolean
 
   // Remap tool_choice
   const toolChoice = body.tool_choice as Record<string, unknown> | undefined;
-  if (toolChoice?.type === "tool" && typeof toolChoice.name === "string") {
+  if (
+    toolChoice?.type === "tool" &&
+    typeof toolChoice.name === "string" &&
+    !serverToolNames.has(toolChoice.name)
+  ) {
     const mapped = TOOL_RENAME_MAP[toolChoice.name];
     if (mapped) {
       const originalName = toolChoice.name;
@@ -248,6 +280,11 @@ export function cloakThirdPartyToolNames(
   const shouldCloak = (name: string): boolean =>
     needsThirdPartyCloak(name) && !(options?.skip ? options.skip(name) : false);
   const tools = body.tools as Array<Record<string, unknown>> | undefined;
+  // Reserved literal names of declared server tools — never cloaked, neither
+  // in tools[] (guarded below) nor in message-history / tool_choice references
+  // (renaming only the reference yields "Tool 'WebSearch' not found in
+  // provided tools").
+  const serverToolNames = collectServerToolNames(tools);
 
   const used = new Set<string>();
   if (Array.isArray(tools)) {
@@ -274,7 +311,9 @@ export function cloakThirdPartyToolNames(
     // subagents->SubDispatch, session_status->CheckStatus, webfetch->WebFetch, …
     // Then harness-canonical (read_file->Read), then a generic PascalCase.
     const base =
-      TOOL_RENAME_MAP[original] ?? HARNESS_CANONICAL_MAP[original] ?? toPascalCaseToolName(original);
+      TOOL_RENAME_MAP[original] ??
+      HARNESS_CANONICAL_MAP[original] ??
+      toPascalCaseToolName(original);
     let alias = base;
     let suffix = 2;
     while (alias !== original && used.has(alias)) {
@@ -315,6 +354,7 @@ export function cloakThirdPartyToolNames(
         if (
           block?.type === "tool_use" &&
           typeof block.name === "string" &&
+          !serverToolNames.has(block.name) &&
           shouldCloak(block.name)
         ) {
           changed = true;
@@ -330,6 +370,7 @@ export function cloakThirdPartyToolNames(
   if (
     toolChoice?.type === "tool" &&
     typeof toolChoice.name === "string" &&
+    !serverToolNames.has(toolChoice.name) &&
     shouldCloak(toolChoice.name)
   ) {
     body.tool_choice = { ...toolChoice, name: aliasFor(toolChoice.name) };
diff --git a/open-sse/services/combo.ts b/open-sse/services/combo.ts
index 3b7c274061..21735e31a4 100644
--- a/open-sse/services/combo.ts
+++ b/open-sse/services/combo.ts
@@ -8,6 +8,7 @@
 import {
   checkFallbackError,
   classifyLockoutReason,
+  CONTEXT_OVERFLOW_PATTERNS,
   decayModelFailureCount,
   formatRetryAfter,
   getModelLockoutInfo,
@@ -18,7 +19,12 @@ import {
   recordProviderFailure,
   selectLockoutCooldownMs,
 } from "./accountFallback.ts";
-import { errorResponse, unavailableResponse } from "../utils/error.ts";
+import {
+  errorResponse,
+  unavailableResponse,
+  errorResponseWithComboDiagnostics,
+} from "../utils/error.ts";
+import type { ComboDiagnostics } from "../utils/error.ts";
 import { buildTargetTimeoutRunner } from "./combo/targetTimeoutRunner.ts";
 import { recordComboRequest, recordComboShadowRequest, getComboMetrics } from "./comboMetrics.ts";
 import {
@@ -62,6 +68,8 @@ import { getSessionConnection } from "./sessionManager.ts";
 import {
   applySessionStickiness,
   recordStickyBinding,
+  clearStickyBinding,
+  peekStickyConnectionId,
   resolveDisableSessionStickiness,
 } from "./combo/sessionStickiness.ts";
 import { selectQuotaShareTarget } from "./combo/quotaShareStrategy.ts";
@@ -107,6 +115,7 @@ import {
   recordStickyRoundRobinSuccess,
   getStickyWeightedExecutionKey,
   recordStickyWeightedSuccess,
+  resolveComboStickyRoundRobinLimit,
 } from "./combo/rrState.ts";
 import {
   validateResponseQuality,
@@ -144,6 +153,7 @@ import {
 } from "./combo/providerWildcard.ts";
 import { resolveShadowTargets, scheduleShadowRouting } from "./combo/shadowRouting.ts";
 import { attemptCompatRejectedFallback } from "./combo/comboCompatFallback.ts";
+import { applyContextRequirements } from "./combo/contextRequirements.ts";
 import {
   filterTargetsByRequestCompatibility,
   resolveComboRuntimeUnits,
@@ -199,6 +209,26 @@ export {
   validateComboDAG,
 } from "./combo/comboStructure.ts";
 
+/**
+ * #6692: release a session-stickiness pin the moment its bound connection is
+ * the one that just failed. applySessionStickiness() only re-checks health on
+ * the NEXT turn (lazily) — without this, a terminal/quality-rejected
+ * connection stays pinned until that lazy recheck fires, and a masked
+ * daily-cap 200-body rejection never trips the lazy recheck's DB-backed
+ * testStatus gate at all (the connection row itself isn't marked unhealthy).
+ * Exported for the two failure branches in handleComboChat + handleRoundRobinCombo.
+ * peekStickyConnectionId guards against clearing an unrelated pin when the
+ * failing target isn't actually the currently sticky-bound connection.
+ */
+export function releaseStickyPinOnFailure(
+  messageHash: string | null | undefined,
+  failedConnectionId: string | null | undefined
+): void {
+  if (!messageHash || !failedConnectionId) return;
+  if (peekStickyConnectionId(messageHash) !== failedConnectionId) return;
+  clearStickyBinding(messageHash);
+}
+
 const DEFAULT_MODEL_P95_MS: Record<string, number> = {
   "grok-4-fast-non-reasoning": 1143,
   "grok-4-1-fast-non-reasoning": 1244,
@@ -635,7 +665,12 @@ export function isContextOverflow400(errorText) {
   return (
     /\bcontext.*(?:length_exceeded|too long|overflow|exceeded|window|limit)\b/i.test(errorText) ||
     /exceeds.*context/i.test(errorText) ||
-    /your input exceeds/i.test(errorText)
+    /your input exceeds/i.test(errorText) ||
+    // Reuse accountFallback.ts's CONTEXT_OVERFLOW_PATTERNS (single source of truth)
+    // so wording like Kimi's "exceeded model token limit" — which never says the
+    // literal word "context" — is still recognized as an overflow/fallback-worthy
+    // 400 instead of halting the whole combo (issue #6637).
+    CONTEXT_OVERFLOW_PATTERNS.some((p) => p.test(errorText))
   );
 }
 /** @param {string} errorText */
@@ -770,6 +805,18 @@ export async function handleComboChat({
   // Fusion strategy: parallel panel + judge synthesis. Handled in a separate module
   // because it neither iterates targets in order nor needs the failover/retry/credential
   // gate machinery that follows — it fans out, then synthesizes once.
+  const cfg = config as Record<string, unknown>;
+  const judgeModel = typeof cfg.judgeModel === "string" ? cfg.judgeModel : undefined;
+  const fusionTuning =
+    cfg.fusionTuning && typeof cfg.fusionTuning === "object"
+      ? (cfg.fusionTuning as FusionTuning)
+      : undefined;
+  if (strategy !== "fusion" && (judgeModel || fusionTuning)) {
+    log.warn(
+      "COMBO",
+      `Combo "${combo.name}" sets config.judgeModel/fusionTuning but strategy is "${strategy}" — these fields are only consumed by the fusion strategy and will be ignored (#6455)`
+    );
+  }
   if (strategy === "fusion") {
     const fusionModels = (combo.models || [])
       .map((m) => {
@@ -781,12 +828,6 @@ export async function handleComboChat({
         return null;
       })
       .filter((m): m is string => Boolean(m));
-    const cfg = config as Record<string, unknown>;
-    const judgeModel = typeof cfg.judgeModel === "string" ? cfg.judgeModel : undefined;
-    const tuning =
-      cfg.fusionTuning && typeof cfg.fusionTuning === "object"
-        ? (cfg.fusionTuning as FusionTuning)
-        : undefined;
     return handleFusionChat({
       body,
       models: fusionModels,
@@ -794,7 +835,7 @@ export async function handleComboChat({
       log,
       comboName: combo.name,
       judgeModel,
-      tuning,
+      tuning: fusionTuning,
     });
   }
 
@@ -887,10 +928,9 @@ export async function handleComboChat({
     let runtimeStickyTargets: ResolvedComboUnit[] = runtimeUnits;
     if (strategy === "round-robin") {
       const perComboStickyLimit = (config as Record<string, unknown>).stickyRoundRobinLimit;
-      runtimeStickyLimit = clampStickyRoundRobinTargetLimit(
-        perComboStickyLimit !== undefined && perComboStickyLimit !== null
-          ? perComboStickyLimit
-          : (settings as Record<string, unknown> | null)?.stickyRoundRobinLimit
+      runtimeStickyLimit = resolveComboStickyRoundRobinLimit(
+        perComboStickyLimit,
+        settings as Record<string, unknown> | null
       );
       const { startIndex, counter } = getStickyRoundRobinStartIndex(
         combo.name,
@@ -1172,6 +1212,7 @@ export async function handleComboChat({
   orderedTargets = _sticky.targets;
   orderedTargets = orderTargetsByEvalScores(orderedTargets, config.evalRouting, log);
   orderedTargets = filterTargetsByRequestCompatibility(orderedTargets, body, log);
+  orderedTargets = applyContextRequirements(orderedTargets, config.contextRequirements, log);
 
   // Task-aware reordering: only active for strategies ["smart","task","task-aware","task_aware","auto"].
   // Additive — does not affect any of the other 15 strategies.
@@ -1216,8 +1257,24 @@ export async function handleComboChat({
   // 16 strategies (priority, weighted, etc.) that funnel through executeTarget.
   const quotaCutoffResetWindowConfig = resolveResetWindowConfig(config as Record<string, unknown>);
 
+  // QA P0 diagnostics: record the order in which targets were actually attempted
+  // (provider/model ids only) so a terminal combo failure can report the attempt
+  // sequence alongside pool size + exhaustion reasons. Accumulates across set retries.
+  const comboAttemptOrder: Array<{ provider: string; model: string }> = [];
+
   if (orderedTargets.length === 0) {
-    return comboModelNotFoundResponse("Combo has no executable targets");
+    return errorResponseWithComboDiagnostics(
+      404,
+      "Combo has no executable targets",
+      {
+        poolSize: 0,
+        attempted: 0,
+        excluded: [],
+        attemptOrder: [],
+        terminalReason: "no_executable_targets",
+      },
+      { code: "model_not_found", type: "invalid_request_error" }
+    );
   }
 
   scheduleShadowRouting(
@@ -1300,6 +1357,23 @@ export async function handleComboChat({
       let fallbackCount = 0;
       let recordedAttempts = 0;
 
+      // QA P0: assemble a sanitized diagnostic trace from the state already in scope
+      // (pool size + this set-try's exhausted providers/connections + attempt order +
+      // a terminal-reason code). Never touches keys/tokens — provider/model ids only.
+      const buildComboDiag = (terminalReason: string): ComboDiagnostics => ({
+        poolSize: orderedTargets.length,
+        attempted: recordedAttempts,
+        excluded: [
+          ...[...exhaustedProviders].map((p) => ({ provider: p, reason: "exhausted" })),
+          ...[...exhaustedConnections].map((c) => ({
+            provider: "unknown",
+            reason: `exhausted_connection:${String(c).slice(0, 8)}`,
+          })),
+        ],
+        attemptOrder: comboAttemptOrder,
+        terminalReason,
+      });
+
       let globalResolve: ((res: Response) => void) | null = null;
       const globalPromise = new Promise<Response>((res) => {
         globalResolve = res;
@@ -1436,7 +1510,23 @@ export async function handleComboChat({
               "COMBO",
               `Maximum combo attempts (${MAX_GLOBAL_ATTEMPTS}) exceeded across all targets and fallbacks. Terminating loop to prevent runaway background requests.`
             );
-            return { ok: false, response: errorResponse(503, "Maximum combo retry limit reached") };
+            // Actionable failure instead of an opaque 503 when every candidate
+            // failed the same recoverable way. If the dominant cause was reasoning
+            // models exhausting a too-small max_tokens budget (no content output),
+            // retrying other models can't help — tell the caller to raise max_tokens.
+            const reasoningExhausted = /reasoning consumed \d+\/\d+ tokens/.test(lastError || "");
+            return {
+              ok: false,
+              response: errorResponseWithComboDiagnostics(
+                503,
+                reasoningExhausted
+                  ? "All combo candidates exhausted their token budget on reasoning without producing content. Increase max_tokens — reasoning models need a larger budget to emit content."
+                  : "Maximum combo retry limit reached",
+                buildComboDiag(
+                  reasoningExhausted ? "reasoning_budget_exhausted" : "max_attempts_exceeded"
+                )
+              ),
+            };
           }
 
           // Predictive TTFT Circuit Breaker (skip slow models)
@@ -1494,6 +1584,8 @@ export async function handleComboChat({
             timestamp: Date.now(),
             strategy,
           });
+          // QA P0 diagnostics: capture the attempt order (provider/model ids only).
+          comboAttemptOrder.push({ provider: provider ?? "unknown", model: modelStr });
 
           // Deep clone the body to ensure context preservation and prevent mutations
           // from affecting other targets in the combo. structuredClone avoids the
@@ -1607,6 +1699,10 @@ export async function handleComboChat({
                 "COMBO",
                 `Model ${modelStr} returned 200 but failed quality check: ${quality.reason}`
               );
+              // #6692: a quality-rejected 200 never marks the connection row
+              // unhealthy, so the sticky pin's lazy headroom recheck would never
+              // catch it either — release it here, on the failing response.
+              releaseStickyPinOnFailure(_sticky.messageHash, effectiveConnectionId);
               recordComboRequest(combo.name, modelStr, {
                 success: false,
                 latencyMs: Date.now() - startTime,
@@ -1942,6 +2038,19 @@ export async function handleComboChat({
             structuredError
           );
           const { cooldownMs } = fallbackResult;
+          // #6863: a parsed upstream quota reset (e.g. Antigravity "Resets in 92h27m28s")
+          // arrives in `quotaResetHintMs` — it bypasses the operator-gated
+          // `useUpstreamRetryHints` connection-cooldown setting. Mirror the
+          // single-model path (src/sse/services/auth.ts): when the retry hint was
+          // already honored, `cooldownMs` IS the upstream value; otherwise prefer the
+          // parsed quota reset — even when it is SHORTER than the fallback cooldown
+          // (e.g. subscription-quota 1h default vs a real "resets in 10m").
+          // `selectLockoutCooldownMs` still ignores hints at/below the base cooldown,
+          // so absent/tiny hints keep the #1308 exponential-backoff behavior.
+          const lockoutHintMs =
+            fallbackResult.usedUpstreamRetryHint === true
+              ? cooldownMs
+              : (fallbackResult.quotaResetHintMs ?? 0);
           const selectedConnectionId =
             result.headers?.get("X-OmniRoute-Selected-Connection-Id") ||
             result.headers?.get("x-omniroute-selected-connection-id") ||
@@ -1965,6 +2074,10 @@ export async function handleComboChat({
             exhaustedLogLevel: "info",
             structuredError,
           });
+          // #6692: this connection was just classified as provider/connection-level
+          // exhausted — if it's the currently sticky-bound one, release the pin now
+          // rather than waiting for the next turn's lazy headroom/status recheck.
+          releaseStickyPinOnFailure(_sticky.messageHash, targetWithConnection.connectionId);
 
           // #2101: Prevent infinite fallback loops with 400 Bad Request errors that are genuinely
           // body-specific (malformed JSON, bad format, missing required fields).
@@ -2063,9 +2176,9 @@ export async function handleComboChat({
                   mlSettings.baseCooldownMs,
                   profile,
                   {
-                    // #1308: honor a long upstream reset (e.g. "Resets in 160h") over
+                    // #1308/#6863: honor a long upstream reset (e.g. "Resets in 160h") over
                     // the short base cooldown / exponential backoff when present.
-                    exactCooldownMs: selectLockoutCooldownMs(cooldownMs, mlSettings),
+                    exactCooldownMs: selectLockoutCooldownMs(lockoutHintMs, mlSettings),
                     maxCooldownMs: mlSettings.maxCooldownMs,
                   }
                 );
@@ -2106,8 +2219,8 @@ export async function handleComboChat({
                 mlSettings.baseCooldownMs,
                 profile,
                 {
-                  // #1308: honor a long upstream reset over base/exponential cooldown.
-                  exactCooldownMs: selectLockoutCooldownMs(cooldownMs, mlSettings),
+                  // #1308/#6863: honor a long upstream reset over base/exponential cooldown.
+                  exactCooldownMs: selectLockoutCooldownMs(lockoutHintMs, mlSettings),
                   maxCooldownMs: mlSettings.maxCooldownMs,
                 }
               );
@@ -2238,15 +2351,11 @@ export async function handleComboChat({
           latencyMs,
           fallbackCount,
         });
-        return new Response(
-          JSON.stringify({
-            error: {
-              message: "Service temporarily unavailable: all upstream accounts are inactive",
-              type: "service_unavailable",
-              code: "ALL_ACCOUNTS_INACTIVE",
-            },
-          }),
-          { status: 503, headers: { "Content-Type": "application/json" } }
+        return errorResponseWithComboDiagnostics(
+          503,
+          "Service temporarily unavailable: all upstream accounts are inactive",
+          buildComboDiag("all_accounts_inactive"),
+          { code: "ALL_ACCOUNTS_INACTIVE", type: "service_unavailable" }
         );
       }
 
@@ -2297,10 +2406,11 @@ export async function handleComboChat({
       }
 
       log.warn("COMBO", `All models failed | ${msg}`);
-      return new Response(JSON.stringify({ error: { message: msg } }), {
+      return errorResponseWithComboDiagnostics(
         status,
-        headers: { "Content-Type": "application/json" },
-      });
+        msg,
+        buildComboDiag(lastError ?? "all_models_failed")
+      );
     }
 
     return errorResponse(503, "Combo routing completed without an upstream response");
@@ -2410,9 +2520,7 @@ async function handleRoundRobinCombo({
   // runtime-unavailable, we must reconsider these before returning 503, instead of
   // permanently dropping a compat-rejected-but-healthy provider.
   const compatKeptSet = new Set(filteredTargets);
-  const compatRejectedTargets = evalRankedTargets.filter(
-    (target) => !compatKeptSet.has(target)
-  );
+  const compatRejectedTargets = evalRankedTargets.filter((target) => !compatKeptSet.has(target));
   const modelCount = filteredTargets.length;
   if (modelCount === 0) {
     return comboModelNotFoundResponse("Round-robin combo has no executable targets");
@@ -2436,10 +2544,9 @@ async function handleRoundRobinCombo({
   // sticky batching for both account fallback and combo targets. Values <= 1 preserve
   // the historical one-request-per-target rotation.
   const perComboStickyLimit = (config as Record<string, unknown>).stickyRoundRobinLimit;
-  const stickyLimit = clampStickyRoundRobinTargetLimit(
-    perComboStickyLimit !== undefined && perComboStickyLimit !== null
-      ? perComboStickyLimit
-      : (settings as Record<string, unknown> | null)?.stickyRoundRobinLimit
+  const stickyLimit = resolveComboStickyRoundRobinLimit(
+    perComboStickyLimit,
+    settings as Record<string, unknown> | null
   );
   const stickyRoundRobinEnabled = stickyLimit > 1;
   // Exhaustion-aware sticky: if the currently sticky target is no longer
@@ -2700,6 +2807,19 @@ async function handleRoundRobinCombo({
               "COMBO-RR",
               `${modelStr} returned 200 but failed quality check: ${quality.reason}`
             );
+            // #6692: same rationale as handleComboChat's quality-fail branch —
+            // a quality-rejected 200 never marks the connection row unhealthy,
+            // so release the sticky pin here rather than on the next turn.
+            {
+              const rrSelectedConnectionId =
+                result.headers?.get("X-OmniRoute-Selected-Connection-Id") ||
+                result.headers?.get("x-omniroute-selected-connection-id") ||
+                undefined;
+              releaseStickyPinOnFailure(
+                _rrSessionSticky.messageHash,
+                rrSelectedConnectionId || target.connectionId
+              );
+            }
             recordComboRequest(combo.name, modelStr, {
               success: false,
               latencyMs: Date.now() - startTime,
@@ -2926,6 +3046,8 @@ async function handleRoundRobinCombo({
           exhaustedLogLevel: "debug",
           structuredError,
         });
+        // #6692: mirrors handleComboChat's exhaustion-point release above.
+        releaseStickyPinOnFailure(_rrSessionSticky.messageHash, targetWithConnection.connectionId);
 
         // Transient errors → mark in semaphore so round-robin stops stampeding this target.
         if (
@@ -2973,7 +3095,10 @@ async function handleRoundRobinCombo({
           resilienceSettings.providerCooldown.enabled &&
           provider &&
           provider !== "unknown" &&
-          !(result.status === 500 && hasPerModelQuota(provider, parseModel(modelStr).model || modelStr))
+          !(
+            result.status === 500 &&
+            hasPerModelQuota(provider, parseModel(modelStr).model || modelStr)
+          )
         ) {
           recordProviderCooldown(
             provider,
diff --git a/open-sse/services/combo/autoConfig.ts b/open-sse/services/combo/autoConfig.ts
index c79c9ad032..2815444f25 100644
--- a/open-sse/services/combo/autoConfig.ts
+++ b/open-sse/services/combo/autoConfig.ts
@@ -44,6 +44,12 @@ export function parseAutoConfig(combo: ComboLike, eligibleTargets: ResolvedCombo
   const budgetCap = Number.isFinite(Number(autoConfigSource.budgetCap))
     ? Number(autoConfigSource.budgetCap)
     : undefined;
+  // #3470: persisted fallback policy for when EVERY candidate exceeds budgetCap.
+  // Any other value (including absent) falls through to the engine's "cheapest" default.
+  const budgetFallback: "strict" | "cheapest" | undefined =
+    autoConfigSource.budgetFallback === "strict" || autoConfigSource.budgetFallback === "cheapest"
+      ? (autoConfigSource.budgetFallback as "strict" | "cheapest")
+      : undefined;
   const modePack =
     typeof autoConfigSource.modePack === "string" ? autoConfigSource.modePack : undefined;
   const resetWindowConfig = resolveResetWindowConfig(autoConfigSource);
@@ -55,6 +61,7 @@ export function parseAutoConfig(combo: ComboLike, eligibleTargets: ResolvedCombo
     weights,
     explorationRate,
     budgetCap,
+    budgetFallback,
     modePack,
     resetWindowConfig,
     slaPolicy,
diff --git a/open-sse/services/combo/comboPredicates.ts b/open-sse/services/combo/comboPredicates.ts
index f41c31c559..887709522f 100644
--- a/open-sse/services/combo/comboPredicates.ts
+++ b/open-sse/services/combo/comboPredicates.ts
@@ -6,7 +6,6 @@
  * predicates are re-exported from combo.ts for backward compatibility.
  */
 
-import { isProviderFailureCode } from "../accountFallback.ts";
 import { errorResponse } from "../../utils/error.ts";
 import { parseModel } from "../model.ts";
 import type { ResolvedComboTarget } from "./types.ts";
@@ -116,13 +115,28 @@ export function shouldSkipForPredictedTtft(
   );
 }
 
+/**
+ * Whole-provider circuit-breaker failure statuses for the combo path. Kept byte-identical
+ * to the single-model path's `PROVIDER_BREAKER_FAILURE_STATUSES` (src/sse/handlers/chat.ts:206)
+ * — the source of truth. 429 is deliberately EXCLUDED: a plain rate-limit must not open the
+ * whole-provider breaker (it's connection-cooldown / model-lockout scope). Defined locally
+ * rather than imported to avoid a cross-layer (open-sse → src/sse) import cycle.
+ */
+const PROVIDER_BREAKER_FAILURE_STATUSES = new Set([408, 500, 502, 503, 504]);
+
 /**
  * Decide whether a failed combo target should record a whole-provider circuit-breaker
  * failure (#1731 / #2743 gap-d). This is the consumer side of `skipProviderBreaker`:
  *
  * - Stream-readiness failures (pre-flight zombie/ping probes) never count as provider
  *   failures — they are a connection-readiness signal, not an upstream outage.
- * - Only provider-level failure codes (408/429/5xx — see `isProviderFailureCode`) count.
+ * - Only whole-provider failure statuses (408/500/502/503/504) count. A plain rate-limit
+ *   429 is deliberately EXCLUDED — it belongs to connection cooldown / model lockout scope
+ *   (a genuine quota/token-limit 429 is handled there), NOT the whole-provider breaker. This
+ *   mirrors the single-model path's `PROVIDER_BREAKER_FAILURE_STATUSES` (src/sse/handlers/
+ *   chat.ts:206) — the source of truth — and the documented RESILIENCE_GUIDE policy. NOTE:
+ *   this intentionally differs from `isProviderFailureCode` (accountFallback.ts), which
+ *   INCLUDES 429 for connection-cooldown purposes and must not be changed here.
  * - When the next combo target is on the SAME provider, don't trip the provider breaker:
  *   a different model on that provider may still succeed.
  * - G-02 / #2743: when the fallback result carries `skipProviderBreaker` (an embedded
@@ -139,7 +153,7 @@ export function shouldRecordProviderBreakerFailure(args: {
 }): boolean {
   return (
     !args.isStreamReadinessFailure &&
-    isProviderFailureCode(args.status) &&
+    PROVIDER_BREAKER_FAILURE_STATUSES.has(args.status) &&
     !args.sameProviderNext &&
     !args.skipProviderBreaker
   );
diff --git a/open-sse/services/combo/comboSetup.ts b/open-sse/services/combo/comboSetup.ts
index 4b7e8b56e9..99197743ea 100644
--- a/open-sse/services/combo/comboSetup.ts
+++ b/open-sse/services/combo/comboSetup.ts
@@ -90,9 +90,7 @@ export function phaseComboSetup(ctx: ComboContext): ComboSetup {
 
   const universalHandoffConfig = resolveUniversalHandoffConfig(
     (combo.universal_handoff || combo.universalHandoff) as
-      | Record<string, unknown>
-      | null
-      | undefined,
+      Record<string, unknown> | null | undefined,
     relayOptions?.universalHandoffConfig as Record<string, unknown> | null | undefined
   );
 
diff --git a/open-sse/services/combo/contextRequirements.ts b/open-sse/services/combo/contextRequirements.ts
new file mode 100644
index 0000000000..ca554ba93d
--- /dev/null
+++ b/open-sse/services/combo/contextRequirements.ts
@@ -0,0 +1,105 @@
+/**
+ * Context requirements filtering for combo targets.
+ * Applies minContextWindow, preferLargeContext, and contextFilterMode
+ * from combo config to filter and sort targets by context window size.
+ */
+
+import { getModelContextLimit } from "../../../src/lib/modelCapabilities";
+import type { ComboLogger, ResolvedComboTarget } from "./types.ts";
+
+export interface ContextRequirements {
+  minContextWindow?: number;
+  preferLargeContext?: boolean;
+  contextFilterMode?: "strict" | "lenient";
+}
+
+/**
+ * Get context window size for a target model.
+ * Returns null if unknown.
+ */
+function getTargetContextWindow(target: ResolvedComboTarget): number | null {
+  const limit = getModelContextLimit(target.provider, target.modelStr);
+  return typeof limit === "number" && limit > 0 ? limit : null;
+}
+
+/**
+ * Apply context requirements filtering and sorting to combo targets.
+ *
+ * Filtering logic:
+ * - If minContextWindow is set, filters out models below that threshold
+ * - contextFilterMode determines handling of unknown context limits:
+ *   - "strict": excludes models with unknown context limits
+ *   - "lenient": includes models with unknown context limits
+ *
+ * Sorting logic:
+ * - If preferLargeContext is true, sorts remaining targets by context size (descending)
+ * - Unknown context limits sort to the end
+ *
+ * @param targets - Array of resolved combo targets
+ * @param requirements - Context requirements from combo config
+ * @param log - Combo logger for debug output
+ * @returns Filtered and sorted targets array
+ */
+export function applyContextRequirements(
+  targets: ResolvedComboTarget[],
+  requirements: ContextRequirements | undefined,
+  log: ComboLogger
+): ResolvedComboTarget[] {
+  if (!requirements || targets.length === 0) return targets;
+
+  const { minContextWindow, preferLargeContext, contextFilterMode = "lenient" } = requirements;
+
+  // No requirements specified
+  if (!minContextWindow && !preferLargeContext) return targets;
+
+  let filtered = targets;
+
+  // Apply minContextWindow filtering
+  if (minContextWindow && minContextWindow > 0) {
+    const beforeFilterCount = filtered.length;
+
+    filtered = filtered.filter((target) => {
+      const contextWindow = getTargetContextWindow(target);
+
+      // Unknown context limit handling
+      if (contextWindow === null) {
+        return contextFilterMode === "lenient";
+      }
+
+      // Known context limit - check threshold
+      return contextWindow >= minContextWindow;
+    });
+
+    if (filtered.length < beforeFilterCount) {
+      log.info(
+        "COMBO",
+        `Context requirements: filtered ${beforeFilterCount} → ${filtered.length} targets (minContextWindow: ${minContextWindow}, mode: ${contextFilterMode})`
+      );
+      log.debug?.(
+        "COMBO",
+        `Context requirements: kept models ${filtered.map((t) => t.modelStr).join(", ")}`
+      );
+    }
+  }
+
+  // Apply preferLargeContext sorting
+  if (preferLargeContext && filtered.length > 1) {
+    filtered = [...filtered].sort((a, b) => {
+      const aContext = getTargetContextWindow(a) ?? 0;
+      const bContext = getTargetContextWindow(b) ?? 0;
+      return bContext - aContext; // Descending order
+    });
+
+    log.debug?.(
+      "COMBO",
+      `Context requirements: sorted by context size (descending): ${filtered
+        .map((t) => {
+          const ctx = getTargetContextWindow(t);
+          return `${t.modelStr}(${ctx === null ? "unknown" : ctx})`;
+        })
+        .join(", ")}`
+    );
+  }
+
+  return filtered;
+}
diff --git a/open-sse/services/combo/fingerprintExpansion.ts b/open-sse/services/combo/fingerprintExpansion.ts
index c96bb3ad05..be3d511509 100644
--- a/open-sse/services/combo/fingerprintExpansion.ts
+++ b/open-sse/services/combo/fingerprintExpansion.ts
@@ -17,11 +17,35 @@ import type { ResolvedComboTarget } from "./types.ts";
 /** Providers whose `providerSpecificData.fingerprints` array should be expanded. */
 const FINGERPRINT_PROVIDERS: ReadonlySet<string> = new Set(["mimocode", "mcode", "opencode"]);
 
+/** Separator the combo builder UI uses to encode an account pin (#6087). */
+const FP_PIN_SEPARATOR = "|fp|";
+
 /** Check whether a provider uses fingerprint-based multi-account. */
 export function isFingerprintProvider(provider: string): boolean {
   return FINGERPRINT_PROVIDERS.has(provider);
 }
 
+/**
+ * Split a combo builder "pinned account" connectionId (`${rowId}|fp|${fingerprint}`,
+ * produced by `expandConnectionOptions` in `src/lib/combos/builderOptions.ts`) back
+ * into the real DB connection row id and the pinned fingerprint (#6696).
+ *
+ * Returns `null` when `connectionId` does not carry the pin separator, so callers can
+ * fall through to the unpinned resolution path unchanged.
+ */
+export function splitFingerprintPin(
+  connectionId: string
+): { realConnectionId: string; pinnedFingerprint: string } | null {
+  const separatorIndex = connectionId.indexOf(FP_PIN_SEPARATOR);
+  if (separatorIndex === -1) return null;
+
+  const realConnectionId = connectionId.slice(0, separatorIndex);
+  const pinnedFingerprint = connectionId.slice(separatorIndex + FP_PIN_SEPARATOR.length);
+  if (!realConnectionId || !pinnedFingerprint) return null;
+
+  return { realConnectionId, pinnedFingerprint };
+}
+
 /** Safely extract the fingerprints array from a connection record. */
 export function getConnectionFingerprints(
   connection: Record<string, unknown> | undefined | null
@@ -84,6 +108,27 @@ export function expandTargetsByFingerprints(
       continue;
     }
 
+    // #6696: the combo builder UI pins a specific account by encoding it as
+    // `${rowId}|fp|${fingerprint}`. That composite string never matches a real
+    // DB row id in `connectionById`, so resolve it back to the real
+    // connectionId + the pinned fingerprint here before any other lookup —
+    // otherwise the pin is silently inert and credential resolution can never
+    // find the connection at all.
+    const pin = splitFingerprintPin(connectionId);
+    if (pin) {
+      result.push({
+        ...target,
+        connectionId: pin.realConnectionId,
+        pinnedFingerprint: pin.pinnedFingerprint,
+        executionKey: buildFingerprintExecutionKey(
+          target.executionKey,
+          pin.pinnedFingerprint,
+          false
+        ),
+      });
+      continue;
+    }
+
     const connection = connectionById.get(connectionId);
     const fingerprints = getConnectionFingerprints(connection);
 
diff --git a/open-sse/services/combo/quotaStrategies.ts b/open-sse/services/combo/quotaStrategies.ts
index bb9dd42037..1e80b6e144 100644
--- a/open-sse/services/combo/quotaStrategies.ts
+++ b/open-sse/services/combo/quotaStrategies.ts
@@ -547,7 +547,8 @@ export async function orderTargetsByResetWindow(
 type SaturationFetcher = (
   connectionId: string,
   provider: string,
-  dim: { unit: "percent"; window: "5h" | "weekly" }
+  dim: { unit: "percent"; window: "5h" | "weekly" },
+  connection?: Record<string, unknown>
 ) => Promise<number>;
 
 let _headroomSaturationFetcherOverride: SaturationFetcher | null = null;
@@ -585,7 +586,7 @@ export async function orderTargetsByHeadroom(
   if (targets.length <= 1) return targets;
 
   try {
-    const { expandedTargets } = await expandTargetsByQuotaAwareConnections(
+    const { expandedTargets, connectionById } = await expandTargetsByQuotaAwareConnections(
       targets,
       comboName,
       log,
@@ -607,18 +608,25 @@ export async function orderTargetsByHeadroom(
         if (!target.connectionId) return;
         const key = connKey(target);
         if (satByConnection.has(key)) return;
+        // #6379: thread the loaded connection snapshot (with decrypted
+        // credentials) through to getSaturation so provider-specific fetchers
+        // that need credentials (e.g. Codex's fetchCodexQuota) can actually
+        // read them, instead of failing open to 0 for every candidate and
+        // leaving headroom ranking unable to tell accounts apart.
+        const connection = connectionById.get(target.connectionId);
+        const connectionId = target.connectionId;
+        const provider = target.provider;
         satByConnection.set(
           key,
           (async () => {
             const [util5h, util7d] = await Promise.all([
-              getSaturation(target.connectionId as string, target.provider, {
-                unit: "percent",
-                window: "5h",
-              }),
-              getSaturation(target.connectionId as string, target.provider, {
-                unit: "percent",
-                window: "weekly",
-              }),
+              getSaturation(connectionId, provider, { unit: "percent", window: "5h" }, connection),
+              getSaturation(
+                connectionId,
+                provider,
+                { unit: "percent", window: "weekly" },
+                connection
+              ),
             ]);
             return { util5h, util7d } satisfies HeadroomSaturation;
           })()
diff --git a/open-sse/services/combo/resolveAutoStrategy.ts b/open-sse/services/combo/resolveAutoStrategy.ts
index bd7425723a..ef6082f9af 100644
--- a/open-sse/services/combo/resolveAutoStrategy.ts
+++ b/open-sse/services/combo/resolveAutoStrategy.ts
@@ -1,8 +1,12 @@
-import { unavailableResponse } from "../../utils/error.ts";
-import { selectProvider as selectAutoProvider } from "../autoCombo/engine.ts";
+import { errorResponse, unavailableResponse } from "../../utils/error.ts";
+import {
+  BudgetExceededError,
+  selectProvider as selectAutoProvider,
+} from "../autoCombo/engine.ts";
 import {
   resolveRequestModePack,
   parseRequestBudgetCap,
+  parseRequestBudgetFallback,
 } from "../autoCombo/requestControls.ts";
 import { selectWithStrategy } from "../autoCombo/routerStrategy.ts";
 import { buildComplexityRoutingHint } from "../autoCombo/complexityRouter";
@@ -58,6 +62,8 @@ export interface ResolveAutoStrategyDeps {
     mode?: string | null;
     /** Per-request X-OmniRoute-Budget value in USD (#6023). */
     budgetCap?: number | null;
+    /** Per-request X-OmniRoute-Budget-Fallback value ("cheapest" | "strict") — #3470. */
+    budgetFallback?: "cheapest" | "strict" | null;
   } | null;
   resilienceSettings: ResilienceSettings;
   log: ComboLogger;
@@ -157,25 +163,29 @@ export async function resolveAutoStrategyOrder(
     weights,
     explorationRate,
     budgetCap: configBudgetCap,
+    budgetFallback: configBudgetFallback,
     modePack: configModePack,
     resetWindowConfig,
     slaPolicy,
   } = parseAutoConfig(combo, eligibleTargets);
 
-  // Per-request overrides (#6023 / #6024 / #6025): X-OmniRoute-Budget and
-  // X-OmniRoute-Mode headers (threaded via relayOptions) take precedence over
-  // the combo's stored config for this single request. Unknown/garbage header
-  // values are ignored so the saved config is preserved.
+  // Per-request overrides (#6023 / #6024 / #6025 / #3470): X-OmniRoute-Budget,
+  // X-OmniRoute-Budget-Fallback and X-OmniRoute-Mode headers (threaded via
+  // relayOptions) take precedence over the combo's stored config for this single
+  // request. Unknown/garbage header values are ignored so the saved config is
+  // preserved.
   const requestBudgetCap = parseRequestBudgetCap(relayOptions?.budgetCap);
   const budgetCap = requestBudgetCap ?? configBudgetCap;
+  const requestBudgetFallback = parseRequestBudgetFallback(relayOptions?.budgetFallback);
+  const budgetFallback = requestBudgetFallback ?? configBudgetFallback;
   const requestModePack = resolveRequestModePack(relayOptions?.mode);
   const modePack = requestModePack.override ? requestModePack.modePack : configModePack;
-  if (requestModePack.override || requestBudgetCap !== undefined) {
+  if (requestModePack.override || requestBudgetCap !== undefined || requestBudgetFallback !== undefined) {
     log.debug?.(
       "COMBO",
       `Auto strategy: per-request controls applied (mode=${
         requestModePack.override ? (requestModePack.modePack ?? "balanced") : "—"
-      }, budgetCap=${requestBudgetCap ?? "—"})`
+      }, budgetCap=${requestBudgetCap ?? "—"}, budgetFallback=${requestBudgetFallback ?? "—"})`
     );
   }
 
@@ -256,20 +266,32 @@ export async function resolveAutoStrategyOrder(
     }
 
     if (!selectedProvider || !selectedModel) {
-      const selection = selectAutoProvider(
-        {
-          id: combo.id || combo.name,
-          name: combo.name,
-          type: "auto",
-          candidatePool,
-          weights,
-          modePack,
-          budgetCap,
-          explorationRate,
-        },
-        routableCandidates,
-        taskType
-      );
+      let selection;
+      try {
+        selection = selectAutoProvider(
+          {
+            id: combo.id || combo.name,
+            name: combo.name,
+            type: "auto",
+            candidatePool,
+            weights,
+            modePack,
+            budgetCap,
+            budgetFallback,
+            explorationRate,
+          },
+          routableCandidates,
+          taskType
+        );
+      } catch (err) {
+        // #3470: `budgetFallback: "strict"` refuses to select when every candidate
+        // exceeds `budgetCap` — surface a clear cost-exceeds-budget response
+        // instead of letting it propagate as an unhandled 500.
+        if (err instanceof BudgetExceededError) {
+          return { earlyResponse: errorResponse(402, err.message) };
+        }
+        throw err;
+      }
       selectedProvider = selection.provider;
       selectedModel = selection.model;
       selectionReason = `score=${selection.score.toFixed(3)}${selection.isExploration ? " (exploration)" : ""}`;
diff --git a/open-sse/services/combo/rrState.ts b/open-sse/services/combo/rrState.ts
index 9f2c3c67ef..2e26011f02 100644
--- a/open-sse/services/combo/rrState.ts
+++ b/open-sse/services/combo/rrState.ts
@@ -96,3 +96,22 @@ export function recordStickyWeightedSuccess(
 
   weightedStickyTargets.set(comboName, { executionKey, successCount });
 }
+
+/**
+ * Sticky batch size for round-robin combo targets (9router parity).
+ * Per-combo config → comboStickyRoundRobinLimit → stickyRoundRobinLimit.
+ * Uses clampStickyRoundRobinTargetLimit defined above in this module.
+ */
+export function resolveComboStickyRoundRobinLimit(
+  perComboLimit: unknown,
+  settings: Record<string, unknown> | null | undefined
+): number {
+  if (perComboLimit !== undefined && perComboLimit !== null) {
+    return clampStickyRoundRobinTargetLimit(perComboLimit);
+  }
+  const comboSticky = settings?.comboStickyRoundRobinLimit;
+  if (comboSticky !== undefined && comboSticky !== null) {
+    return clampStickyRoundRobinTargetLimit(comboSticky);
+  }
+  return clampStickyRoundRobinTargetLimit(settings?.stickyRoundRobinLimit);
+}
diff --git a/open-sse/services/combo/sessionStickiness.ts b/open-sse/services/combo/sessionStickiness.ts
index 5bb8779a94..2b9f746133 100644
--- a/open-sse/services/combo/sessionStickiness.ts
+++ b/open-sse/services/combo/sessionStickiness.ts
@@ -27,6 +27,14 @@
  *   orderTargetsByHeadroom (quotaStrategies.ts), so the open-sse leaf has no
  *   static edge into src/lib/quota. For tests the fetcher is injected via
  *   __setStickinessHeadroomFetcherForTests.
+ * • Terminal-status gate (#6692): headroom alone is orthogonal to account
+ *   availability — a credits_exhausted/banned/expired connection (or one still
+ *   inside its rate-limit window) reports perfectly healthy 5h/weekly
+ *   utilization, so the headroom-only gate kept re-promoting a dead connection
+ *   forever. The connection's testStatus/rateLimitedUntil is now resolved via
+ *   the same dynamic-import-with-injectable-override seam (fail-open on lookup
+ *   errors, mirroring resolveSaturation) and gates the pin alongside headroom.
+ *   For tests the fetcher is injected via __setStickinessConnectionFetcherForTests.
  *
  * No barrel import — consistent with the other combo/* helpers.
  *
@@ -79,6 +87,83 @@ export function __setStickinessHeadroomFetcherForTests(fetcher: SaturationFetche
   _fetcherOverride = fetcher;
 }
 
+// ─── Connection terminal-status gate (#6692) ─────────────────────────────────
+
+/** Minimal connection health shape the terminal-status gate needs. */
+export interface StickyConnectionHealth {
+  testStatus?: string | null;
+  rateLimitedUntil?: string | null;
+}
+
+/**
+ * Injectable connection-health fetcher seam (for unit tests).
+ * Returns StickyConnectionHealth or undefined when unknown/lookup failed.
+ */
+export type ConnectionHealthFetcher = (
+  connectionId: string,
+  provider: string
+) => Promise<StickyConnectionHealth | undefined>;
+
+/** Overrides the default connection-health fetcher for tests; null = use production fetcher. */
+let _connectionFetcherOverride: ConnectionHealthFetcher | null = null;
+
+/** Test-only: inject the connection-health fetcher; pass null to restore default. */
+export function __setStickinessConnectionFetcherForTests(
+  fetcher: ConnectionHealthFetcher | null
+): void {
+  _connectionFetcherOverride = fetcher;
+}
+
+/**
+ * Statuses that mean the account is DURABLY dead, not just transiently rate
+ * limited — mirrors TERMINAL_PIN_STATUSES used by the LKGP/context-cache pin
+ * (combo.ts:558). Duplicated here (rather than imported) so this leaf keeps no
+ * static edge into combo.ts, which itself imports this module.
+ */
+const TERMINAL_STICKY_STATUSES = new Set(["credits_exhausted", "banned", "expired"]);
+
+/**
+ * Resolve the sticky-bound connection's health by fetching its provider_connections
+ * row. Uses the same dynamic-import pattern as resolveSaturation so this leaf has
+ * no static dependency on src/lib/db. Fail-open (undefined) on any error.
+ */
+async function resolveConnectionHealth(
+  connectionId: string,
+  provider: string
+): Promise<StickyConnectionHealth | undefined> {
+  if (_connectionFetcherOverride) return _connectionFetcherOverride(connectionId, provider);
+
+  try {
+    const mod = await import("../../../src/lib/db/providers");
+    const getProviderConnections = mod.getProviderConnections as (
+      filter: Record<string, unknown>
+    ) => Promise<StickyConnectionHealth[]>;
+    const connections = (await getProviderConnections({
+      provider,
+      isActive: true,
+    })) as Array<StickyConnectionHealth & { id?: string }>;
+    return connections.find((c) => c.id === connectionId);
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Pure: is the sticky-bound connection durably unhealthy right now? Fail-open
+ * (false) when the connection is unknown — an unresolved lookup must never drop
+ * a healthy pin.
+ */
+export function isStickyConnectionTerminallyUnhealthy(
+  conn: StickyConnectionHealth | undefined,
+  now: number
+): boolean {
+  if (!conn) return false;
+  const status = typeof conn.testStatus === "string" ? conn.testStatus : "";
+  if (TERMINAL_STICKY_STATUSES.has(status)) return true;
+  const rl = conn.rateLimitedUntil ? new Date(String(conn.rateLimitedUntil)).getTime() : 0;
+  return Number.isFinite(rl) && rl > now;
+}
+
 /**
  * Resolve the HeadroomSaturation for a connection by fetching both the 5h and
  * weekly utilisation signals. Uses the same dynamic-import pattern as
@@ -186,6 +271,17 @@ export function clearStickyBinding(messageHash: string): void {
   stickyMap.delete(messageHash);
 }
 
+/**
+ * Read-only peek at the connectionId currently bound to `messageHash`, without
+ * mutating the store or checking TTL/health. Lets combo.ts's failure paths
+ * confirm a just-failed target is the ACTUAL sticky-bound connection before
+ * calling clearStickyBinding (#6692) — clearing on an unrelated target's
+ * failure would drop a still-healthy pin.
+ */
+export function peekStickyConnectionId(messageHash: string): string | null {
+  return stickyMap.get(messageHash)?.connectionId ?? null;
+}
+
 /** Reset the entire store (for testing). */
 export function clearAllStickyBindings(): void {
   stickyMap.clear();
@@ -228,9 +324,10 @@ export interface ApplyStickinessResult {
  * Algorithm:
  * 1. Derive the message hash from the first user message.
  * 2. Look up the sticky binding for that hash.
- * 3. If found, fetch saturation for that connection.
- * 4. If headroom > threshold → move the matching target to index 0.
- *    Otherwise → clear the binding (rebind on next success).
+ * 3. If found, fetch saturation AND connection health for that connection.
+ * 4. If headroom > threshold AND the connection is not durably unhealthy
+ *    (#6692: terminal testStatus / still rate-limited) → move the matching
+ *    target to index 0. Otherwise → clear the binding (rebind on next success).
  * 5. On any error → fall through unchanged (fail-open).
  *
  * In production the saturation fetcher is resolved via dynamic import of
@@ -272,13 +369,22 @@ export async function applySessionStickiness(
       return { targets: orderedTargets, messageHash, stuck: false };
     }
 
-    // Gate: headroom must be above threshold
+    // Gate: headroom must be above threshold AND the connection must not be
+    // durably unhealthy (#6692 — credits_exhausted/banned/expired/rate-limited
+    // accounts report healthy 5h/weekly utilization, so headroom alone never
+    // catches them).
     const stickyTarget = orderedTargets[stickyIdx];
-    const sat = await resolveSaturation(connectionId, stickyTarget.provider);
+    const [sat, connHealth] = await Promise.all([
+      resolveSaturation(connectionId, stickyTarget.provider),
+      resolveConnectionHealth(connectionId, stickyTarget.provider),
+    ]);
     const headroom = computeHeadroom(sat);
 
-    if (headroom <= STICKINESS_HEADROOM_THRESHOLD) {
-      // Connection saturated — rebind on next success
+    if (
+      headroom <= STICKINESS_HEADROOM_THRESHOLD ||
+      isStickyConnectionTerminallyUnhealthy(connHealth, Date.now())
+    ) {
+      // Connection saturated or durably unhealthy — rebind on next success
       clearStickyBinding(messageHash);
       return { targets: orderedTargets, messageHash, stuck: false };
     }
diff --git a/open-sse/services/combo/types.ts b/open-sse/services/combo/types.ts
index 290b0964d7..3e67ce7efa 100644
--- a/open-sse/services/combo/types.ts
+++ b/open-sse/services/combo/types.ts
@@ -70,6 +70,8 @@ export type ComboRelayOptions = {
   mode?: string | null;
   /** Per-request X-OmniRoute-Budget value (hard cost ceiling in USD) — #6023. */
   budgetCap?: number | null;
+  /** Per-request X-OmniRoute-Budget-Fallback value ("cheapest" | "strict") — #3470. */
+  budgetFallback?: "cheapest" | "strict" | null;
   [key: string]: unknown;
 };
 
@@ -151,6 +153,14 @@ export type ResolvedComboTarget = {
   label: string | null;
   failoverBeforeRetry?: unknown;
   trafficType?: "production" | "shadow";
+  /**
+   * Fingerprint-based account pin resolved from a combo builder composite
+   * connectionId (`${rowId}|fp|${fingerprint}`, see
+   * `expandTargetsByFingerprints` in `./fingerprintExpansion.ts`, #6696).
+   * Set only for fingerprint-provider targets (mimocode/mcode/opencode) that
+   * were pinned to one specific account.
+   */
+  pinnedFingerprint?: string;
 };
 
 export type ShadowRoutingConfig = {
diff --git a/open-sse/services/combo/validateQuality.ts b/open-sse/services/combo/validateQuality.ts
index 2bab070a21..2b56146479 100644
--- a/open-sse/services/combo/validateQuality.ts
+++ b/open-sse/services/combo/validateQuality.ts
@@ -22,6 +22,38 @@ export function toRetryAfterDisplayValue(value: ComboRetryAfter): string | Date
   return new Date(value);
 }
 
+// Issue #6427: some providers mask credit/quota exhaustion behind an HTTP 200 —
+// either an OpenAI-shape top-level `error` object, or a known exhaustion phrase
+// living in the error envelope itself (never in assistant prose — see
+// `extractEnvelopeErrorText`). Single-quantifier-per-token-class alternation,
+// no nested/overlapping quantifiers — cannot backtrack catastrophically.
+const EXHAUSTION_MARKER_PATTERN =
+  /\b(insufficient\s+credit|insufficient\s+balance|quota\s+exceeded|out\s+of\s+credits?|credit\s+exhausted)\b/i;
+
+/**
+ * Collect the small set of top-level "error envelope" strings a 200 response may
+ * carry alongside (or instead of) a normal completion: the OpenAI-shape `error`
+ * object's `message`/`code`/`type`, a bare string `error`, or sibling top-level
+ * `message`/`detail` fields some providers use for the same purpose. Deliberately
+ * does NOT look inside `choices[].message.content` — assistant prose that merely
+ * mentions "quota" or "credits" must never be misclassified as an upstream failure.
+ */
+function extractEnvelopeErrorText(json: Record<string, unknown>): string | null {
+  const parts: string[] = [];
+  const err = json.error;
+  if (err && typeof err === "object") {
+    const e = err as Record<string, unknown>;
+    if (typeof e.message === "string") parts.push(e.message);
+    if (typeof e.code === "string") parts.push(e.code);
+    if (typeof e.type === "string") parts.push(e.type);
+  } else if (typeof err === "string" && err.length > 0) {
+    parts.push(err);
+  }
+  if (typeof json.message === "string") parts.push(json.message);
+  if (typeof json.detail === "string") parts.push(json.detail);
+  return parts.length > 0 ? parts.join(" ") : null;
+}
+
 function responsesApiOutputHasContent(output: unknown): boolean {
   return (
     Array.isArray(output) &&
@@ -335,6 +367,32 @@ export async function validateResponseQuality(
     }
   }
 
+  // Issue #6427: a masked 200 — an OpenAI-shape top-level `error` object, or a
+  // known exhaustion phrase in the error envelope — is a failure regardless of
+  // whether `choices`/`output` also look structurally present (some providers
+  // echo a stub completion alongside the error). Checked unconditionally, before
+  // any shape-specific branch, so it can't be shadowed by an otherwise-valid body.
+  const rawError = json?.error;
+  const errorIsMeaningful =
+    (typeof rawError === "string" && rawError.length > 0) ||
+    (!!rawError && typeof rawError === "object" && Object.keys(rawError).length > 0);
+  if (errorIsMeaningful) {
+    const envelopeText = extractEnvelopeErrorText(json);
+    const errMsg =
+      rawError && typeof rawError === "object" && typeof (rawError as Record<string, unknown>).message === "string"
+        ? ((rawError as Record<string, unknown>).message as string)
+        : envelopeText || JSON.stringify(rawError).substring(0, 200);
+    return { valid: false, reason: `upstream error in 200 body: ${errMsg}` };
+  }
+  {
+    const envelopeText = extractEnvelopeErrorText(json);
+    if (envelopeText && EXHAUSTION_MARKER_PATTERN.test(envelopeText)) {
+      const snippet =
+        envelopeText.length > 80 ? `${envelopeText.slice(0, 80)}…` : envelopeText;
+      return { valid: false, reason: `upstream exhaustion marker in 200 body: ${snippet}` };
+    }
+  }
+
   const choices = json?.choices;
   if (json?.object === "response") {
     if (!responsesApiOutputHasContent(json.output))
@@ -354,14 +412,9 @@ export async function validateResponseQuality(
   }
 
   if (!Array.isArray(choices) || choices.length === 0) {
+    // `json?.error` is already handled unconditionally above (#6427); reaching
+    // here means no error envelope was present.
     if (json?.output || json?.result || json?.data || json?.response) return { valid: true };
-    if (json?.error) {
-      const err = json.error as Record<string, unknown>;
-      return {
-        valid: false,
-        reason: `upstream error in 200 body: ${err?.message || JSON.stringify(json.error).substring(0, 200)}`,
-      };
-    }
     return { valid: true };
   }
 
diff --git a/open-sse/services/comboConfig.ts b/open-sse/services/comboConfig.ts
index aa26cd4703..38fb5bcdba 100644
--- a/open-sse/services/comboConfig.ts
+++ b/open-sse/services/comboConfig.ts
@@ -104,6 +104,16 @@ const DEFAULT_COMBO_CONFIG = {
     latencyWeight: 0.15,
     cacheTtlMs: 60000,
   },
+  // Context window requirements for combo target filtering/sorting (undefined by
+  // default — declared here so resolveComboSetupConfig's inferred return type
+  // includes the key; combo.ts reads config.contextRequirements).
+  contextRequirements: undefined as
+    | {
+        minContextWindow?: number;
+        preferLargeContext?: boolean;
+        contextFilterMode?: "strict" | "lenient";
+      }
+    | undefined,
 };
 
 const LEGACY_COMBO_RESILIENCE_KEYS = new Set([
diff --git a/open-sse/services/compression/adaptiveCompression/ladder.ts b/open-sse/services/compression/adaptiveCompression/ladder.ts
index 3f7021b5f7..2302b2c64b 100644
--- a/open-sse/services/compression/adaptiveCompression/ladder.ts
+++ b/open-sse/services/compression/adaptiveCompression/ladder.ts
@@ -7,31 +7,48 @@ import type { LadderStage } from "./types.ts";
  * SLM tier wired through `ultra`); an operator can still add them via ladderOverride.
  */
 export const DEFAULT_LADDER: LadderStage[] = [
-  { engine: "session-dedup" },        // lossless cross-turn dedup (catalog pri 3)
+  { engine: "session-dedup" }, // lossless cross-turn dedup (catalog pri 3)
   { engine: "rtk", intensity: "standard" }, // command-output filtering (pri 10)
-  { engine: "headroom" },             // tabular JSON compaction (pri 15)
-  { engine: "lite" },                 // whitespace/format cleanup (pri 5, but cheap prose pass)
+  { engine: "headroom" }, // tabular JSON compaction (pri 15)
+  { engine: "lite" }, // whitespace/format cleanup (pri 5, but cheap prose pass)
   { engine: "caveman", intensity: "full" }, // rule-based prose (pri 20)
-  { engine: "aggressive" },           // summarize + age old turns (pri 30)
-  { engine: "ultra" },                // heuristic token pruning + optional SLM (pri 40)
+  { engine: "aggressive" }, // summarize + age old turns (pri 30)
+  { engine: "ultra" }, // heuristic token pruning + optional SLM (pri 40)
 ];
 
 /**
  * Aggressiveness rank used to know where a base plan sits so `floor` mode escalates
  * BEYOND it (design §4.2). Keyed by engine id AND by the equivalent CompressionMode name
  * ("standard" === caveman) so a base plan's `mode` string maps cleanly.
+ *
+ * Rescaled ×10 vs the original 7-entry scale (#6533) to make room for the novel catalog
+ * engines that ship in `open-sse/services/compression/engines/index.ts` but are not part
+ * of DEFAULT_LADDER: `ccr` and `llmlingua` are intentionally excluded from the AUTOMATIC
+ * ladder (see DEFAULT_LADDER doc comment) yet must still rank correctly when an operator
+ * adds them via `ladderOverride` — same for `ionizer`, `relevance`, `llm`, and
+ * `read-lifecycle`. Placement follows each engine's documented `stackPriority` in
+ * `engineCatalog.ts` / its own module header, interpolated onto the existing 7-tier scale
+ * (the `lite` exception — ranked after `headroom` despite a lower stackPriority — is a
+ * pre-existing, deliberate design call and is left untouched).
  */
 const AGGRESSIVENESS: Record<string, number> = {
   off: 0,
-  "session-dedup": 1,
-  rtk: 2,
-  headroom: 3,
-  lite: 4,
-  caveman: 5,
-  standard: 5, // mode-name alias for caveman
-  stacked: 5,  // a derived/stacked base plan sits at the prose tier; floor escalates past it
-  aggressive: 6,
-  ultra: 7,
+  "session-dedup": 10, // stackPriority 3 — lossless cross-turn dedup
+  ccr: 15, // stackPriority 4 — reversible retrieval marker, only if it shrinks
+  rtk: 20, // stackPriority 10 — command-output filtering
+  ionizer: 25, // stackPriority 13 — tabular row sampling (lighter than headroom)
+  headroom: 30, // stackPriority 15 — tabular JSON compaction
+  lite: 40, // pri 5, but cheap prose pass (pre-existing reorder, kept as-is)
+  "read-lifecycle": 42, // stackPriority 5 (ties lite) — narrow-scope, opt-in, fully lossy
+  relevance: 45, // stackPriority 18 — extractive sentence scoring, opt-in
+  caveman: 50,
+  standard: 50, // mode-name alias for caveman
+  stacked: 50, // a derived/stacked base plan sits at the prose tier; floor escalates past it
+  aggressive: 60,
+  llmlingua: 65, // stackPriority 35 — semantic pruning (ONNX), after aggressive, before ultra/llm
+  llm: 68, // stackPriority 38 — full LLM-tier compressor, opt-in default-off
+  ultra: 70,
+  omniglyph: 80, // stackPriority 90 — context-as-image (lossy render), runs after every text engine
 };
 
 export function aggressivenessOf(engineOrMode: string): number {
@@ -45,13 +62,20 @@ export function aggressivenessOf(engineOrMode: string): number {
  */
 const REDUCTION_FACTOR: Record<string, number> = {
   "session-dedup": 0.95,
+  ccr: 0.9, // conservative: only replaces a block when the marker is shorter than it
   rtk: 0.85,
+  ionizer: 0.83, // row sampling, lighter than headroom's full tabular compaction
   headroom: 0.8,
   lite: 0.92,
+  "read-lifecycle": 0.88, // scope-limited to stale/superseded Read tool-results
+  relevance: 0.75, // extractive sentence dropping
   caveman: 0.7,
   standard: 0.7,
   aggressive: 0.55,
+  llmlingua: 0.5, // semantic pruning (ONNX)
+  llm: 0.45, // full LLM-tier compressor, stronger than llmlingua
   ultra: 0.4,
+  omniglyph: 0.35, // measured 0.23-0.33 on converted blocks (254->84 tokens); 0.35 stays conservative
 };
 
 export function expectedReductionFactor(engine: string): number {
diff --git a/open-sse/services/compression/deriveDefaultPlan.ts b/open-sse/services/compression/deriveDefaultPlan.ts
index 15ccdbeebc..9fa3d2c55f 100644
--- a/open-sse/services/compression/deriveDefaultPlan.ts
+++ b/open-sse/services/compression/deriveDefaultPlan.ts
@@ -8,6 +8,7 @@ const SINGLE_MODE_OF: Record<string, string> = {
   aggressive: "aggressive",
   ultra: "ultra",
   rtk: "rtk",
+  omniglyph: "omniglyph",
 };
 
 export type CompressionSource =
diff --git a/open-sse/services/compression/engineBreakdown.ts b/open-sse/services/compression/engineBreakdown.ts
index 99d3bfaf16..4f512ab05f 100644
--- a/open-sse/services/compression/engineBreakdown.ts
+++ b/open-sse/services/compression/engineBreakdown.ts
@@ -27,3 +27,40 @@ export function ensureEngineBreakdown(stats: CompressionStats): EngineBreakdownE
     },
   ];
 }
+
+/**
+ * #6488 — Reconcile the single-engine breakdown entry's token counts with the response's
+ * authoritative outer counts.
+ *
+ * The outer `originalTokens`/`compressedTokens` fields (computed by the API route with a real
+ * tiktoken-based counter over the extracted message text) and each `engineBreakdown[]` entry's
+ * `originalTokens`/`compressedTokens` (computed internally by `estimateCompressionTokens`, a
+ * crude `JSON.stringify(requestBody).length / 4` estimate over the whole request-body object)
+ * use two different, unreconciled token-counting methodologies. They diverge most on
+ * small/degenerate inputs where JSON structural overhead (braces, quotes, `role`/`content`
+ * keys) dominates the char count.
+ *
+ * When the breakdown has exactly one entry, that entry represents the *same* before/after
+ * transformation as the overall response (single-engine dispatch, or a 1-step pipeline) — so
+ * its counts are safe to overwrite with the outer, more accurate figures. Multi-step
+ * breakdowns are left untouched: each intermediate step legitimately operates on the previous
+ * step's (already-compressed) output, so its "before" state is not the overall original input
+ * and reconciling it against the overall counts would be incorrect.
+ */
+export function reconcileSingleEngineTokens(
+  breakdown: EngineBreakdownEntry[],
+  outerOriginalTokens: number,
+  outerCompressedTokens: number,
+  outerSavingsPercent: number
+): EngineBreakdownEntry[] {
+  if (breakdown.length !== 1) return breakdown;
+  const [entry] = breakdown;
+  return [
+    {
+      ...entry,
+      originalTokens: outerOriginalTokens,
+      compressedTokens: outerCompressedTokens,
+      savingsPercent: outerSavingsPercent,
+    },
+  ];
+}
diff --git a/open-sse/services/compression/engineCatalog.ts b/open-sse/services/compression/engineCatalog.ts
index 4fc10bf5d3..09ab676720 100644
--- a/open-sse/services/compression/engineCatalog.ts
+++ b/open-sse/services/compression/engineCatalog.ts
@@ -80,6 +80,13 @@ export const ENGINE_CATALOG: Record<string, EngineMeta> = {
     isSingleMode: true,
     description: "Heuristic token pruning (+ optional SLM).",
   },
+  omniglyph: {
+    id: "omniglyph",
+    label: "OmniGlyph",
+    stackPriority: 90,
+    isSingleMode: true,
+    description: "Contexto-como-imagem (Claude Fable 5, rota direta).",
+  },
 };
 
 export const ENGINE_IDS: string[] = Object.values(ENGINE_CATALOG)
diff --git a/open-sse/services/compression/engines/headroom/gcf/decode_generic.ts b/open-sse/services/compression/engines/headroom/gcf/decode_generic.ts
index 67c614d338..9c9a7774d9 100644
--- a/open-sse/services/compression/engines/headroom/gcf/decode_generic.ts
+++ b/open-sse/services/compression/engines/headroom/gcf/decode_generic.ts
@@ -1,6 +1,7 @@
 /**
- * Decode GCF generic profile text into a JS value.
- * Vendored from gcf-typescript — generic profile only (graph profile stripped).
+ * GCF generic-profile decoder (decodeGeneric).
+ * Vendored from gcf-typescript — generic profile only. Current with GCF spec v3.2
+ * (nested object flattening) and the [N]: inline-array quoting fix.
  * https://github.com/blackwell-systems/gcf-typescript
  *
  * SPDX-License-Identifier: MIT
@@ -10,12 +11,13 @@ import {
   parseQuotedString,
   splitRespectingQuotes,
   splitFieldDecl,
+  isBareKey,
   MISSING,
   ATTACHMENT,
 } from "./scalar.ts";
 
 /**
- * Decode GCF generic profile text into a JS value.
+ * Decode GCF generic or graph profile text into a JS value.
  */
 export function decodeGeneric(input: string): any {
   input = input.trimEnd();
@@ -28,10 +30,13 @@ export function decodeGeneric(input: string): any {
 
   const profile = parseHeaderProfile(header);
 
-  if (profile !== "generic")
+  if (profile === "graph") {
     throw new Error(
-      `unsupported_profile: ${profile} (only generic profile is supported in this vendored build)`
+      "graph_profile_unsupported: this vendored build supports the generic profile only"
     );
+  }
+
+  if (profile !== "generic") throw new Error(`unknown_profile: ${profile}`);
 
   // Filter body.
   const contentLines: string[] = [];
@@ -125,7 +130,7 @@ function parseObjectBody(
         const name = parseKeyFromHeader(hdr.slice(0, bi));
         checkDup(out, name);
         const [arr, consumed] = parseArrayFromHeader(lines, i, depth, hdr.slice(bi));
-        out[name] = arr;
+        safeAssign(out, name, arr);
         i += consumed;
         continue;
       }
@@ -134,18 +139,27 @@ function parseObjectBody(
       i++;
       const nested: Record<string, any> = {};
       const consumed = parseObjectBody(lines, i, depth + 1, nested);
-      out[name] = nested;
+      safeAssign(out, name, nested);
       i += consumed;
       continue;
     }
 
-    // Inline array. The bracket must be in the KEY position: an inline-array header is
-    // `name[...]: …`, never `key=value` whose value happens to contain `[..]:` (e.g. a
-    // quoted `note="ERR[404]: Not Found"`). Guard on no `=` before the bracket so such
-    // values fall through to the key=value branch instead of throwing (B-GCF-QUOTE).
+    // Key=value. Check this BEFORE inline array detection so that bracket
+    // patterns inside quoted values (e.g. text="ERR[404]: Not Found") are
+    // not misinterpreted as inline array headers.
+    const eqIdx = findKeyValueSplit(content);
+    if (eqIdx > 0) {
+      const name = parseKeyFromHeader(content.slice(0, eqIdx));
+      checkDup(out, name);
+      safeAssign(out, name, parseScalar(content.slice(eqIdx + 1), false));
+      i++;
+      continue;
+    }
+
+    // Inline array (e.g. items[3]: a,b,c). Only reached if no = found.
     if (!content.startsWith("@") && !content.startsWith("##")) {
       const bracketIdx = content.indexOf("[");
-      if (bracketIdx > 0 && !content.slice(0, bracketIdx).includes("=")) {
+      if (bracketIdx > 0) {
         const rest = content.slice(bracketIdx);
         const closeIdx = rest.indexOf("]");
         if (closeIdx >= 0) {
@@ -154,7 +168,7 @@ function parseObjectBody(
             const name = parseKeyFromHeader(content.slice(0, bracketIdx));
             checkDup(out, name);
             const [arr] = parseArrayFromHeader(lines, i, depth, rest);
-            out[name] = arr;
+            safeAssign(out, name, arr);
             i++;
             continue;
           }
@@ -162,16 +176,6 @@ function parseObjectBody(
       }
     }
 
-    // Key=value.
-    const eqIdx = findKeyValueSplit(content);
-    if (eqIdx > 0) {
-      const name = parseKeyFromHeader(content.slice(0, eqIdx));
-      checkDup(out, name);
-      out[name] = parseScalar(content.slice(eqIdx + 1), false);
-      i++;
-      continue;
-    }
-
     i++;
   }
   return i - start;
@@ -179,6 +183,7 @@ function parseObjectBody(
 
 function findKeyValueSplit(s: string): number {
   if (!s.length) return -1;
+  // Quoted key: "key"=value
   if (s[0] === '"') {
     for (let i = 1; i < s.length; i++) {
       if (s[i] === "\\") {
@@ -189,7 +194,12 @@ function findKeyValueSplit(s: string): number {
     }
     return -1;
   }
-  return s.indexOf("=");
+  // Bare key: find = but only before [ (to avoid matching = inside inline array values)
+  const eqIdx = s.indexOf("=");
+  if (eqIdx < 0) return -1;
+  const bracketIdx = s.indexOf("[");
+  if (bracketIdx >= 0 && bracketIdx < eqIdx) return -1;
+  return eqIdx;
 }
 
 function parseKeyFromHeader(s: string): string {
@@ -199,7 +209,9 @@ function parseKeyFromHeader(s: string): string {
 }
 
 function checkDup(obj: Record<string, any>, key: string): void {
-  if (key in obj) throw new Error(`duplicate_key: ${key}`);
+  // Own-property check only: `key in obj` would spuriously fire on inherited
+  // names like "toString"/"constructor" and mislabel them as duplicates.
+  if (Object.prototype.hasOwnProperty.call(obj, key)) throw new Error(`duplicate_key: ${key}`);
 }
 
 function parseArrayFromHeader(
@@ -274,6 +286,95 @@ function findClosingBrace(s: string): number {
   return -1;
 }
 
+// A path segment that would pollute Object.prototype if written through.
+function isUnsafePathKey(k: string): boolean {
+  return k === "__proto__" || k === "constructor" || k === "prototype";
+}
+
+// Assign a decoded key without ever mutating Object.prototype: a literal
+// "__proto__" key is written as an own data property (matching JSON.parse
+// semantics) instead of reassigning the prototype. All other keys, including
+// "constructor"/"prototype", are ordinary own-property writes and safe.
+function safeAssign(obj: Record<string, unknown>, key: string, value: unknown): void {
+  if (key === "__proto__") {
+    Object.defineProperty(obj, key, {
+      value,
+      writable: true,
+      enumerable: true,
+      configurable: true,
+    });
+  } else {
+    obj[key] = value;
+  }
+}
+
+function unflattenPaths(
+  pathColumns: Map<string, string[]>,
+  flatValues: Map<string, any>,
+  flatAbsent: Set<string>
+): Record<string, any> {
+  // Group by top-level parent.
+  const groups = new Map<string, string[]>();
+  const groupOrder: string[] = [];
+  for (const [fieldName, paths] of pathColumns) {
+    if (paths.length === 0) continue;
+    // Drop any path with a prototype-pollution segment. A conformant encoder
+    // never emits these; their presence means hand-crafted/hostile GCF, so the
+    // safe action is to discard the column rather than write through __proto__.
+    if (paths.some(isUnsafePathKey)) continue;
+    const top = paths[0];
+    if (!groups.has(top)) {
+      groups.set(top, []);
+      groupOrder.push(top);
+    }
+    groups.get(top)!.push(fieldName);
+  }
+
+  const result: Record<string, any> = {};
+
+  for (const top of groupOrder) {
+    const fieldNames = groups.get(top)!;
+    const allAbsent = fieldNames.every((f) => flatAbsent.has(f));
+    const allNull = fieldNames.every((f) => {
+      if (flatAbsent.has(f)) return false;
+      const val = flatValues.get(f);
+      return val === null;
+    });
+
+    if (allAbsent) continue;
+    if (allNull) {
+      result[top] = null;
+      continue;
+    }
+
+    for (const fieldName of fieldNames) {
+      if (flatAbsent.has(fieldName)) continue;
+      const paths = pathColumns.get(fieldName)!;
+      const val = flatValues.has(fieldName) ? flatValues.get(fieldName) : null;
+
+      let current = result;
+      for (let k = 0; k < paths.length - 1; k++) {
+        const segment = paths[k];
+        const existing = current[segment];
+        // Overwrite with a fresh object when the slot is missing OR holds a
+        // non-object (null/primitive), so traversal never dereferences a
+        // non-object on malformed input. Conformant output never hits this.
+        if (
+          !Object.prototype.hasOwnProperty.call(current, segment) ||
+          existing === null ||
+          typeof existing !== "object"
+        ) {
+          current[segment] = {};
+        }
+        current = current[segment];
+      }
+      current[paths[paths.length - 1]] = val;
+    }
+  }
+
+  return result;
+}
+
 function parseTabularBody(
   lines: string[],
   start: number,
@@ -285,6 +386,20 @@ function parseTabularBody(
   const rows: any[] = [];
   let i = start;
 
+  // Detect path columns: fields containing ">".
+  const pathColumnMap = new Map<string, string[]>();
+  for (const f of fields) {
+    if (f.includes(">")) {
+      const parts = f.split(">");
+      // Only treat as a path column if all segments are non-empty.
+      // A literal key like ">" would split into ["", ""].
+      if (parts.every((p) => p.length > 0)) {
+        pathColumnMap.set(f, parts);
+      }
+    }
+  }
+
+  // Track inline schemas and shared array schemas.
   const inlineSchemas = new Map<string, string[]>();
   const sharedArraySchemas = new Map<string, string[]>();
 
@@ -296,10 +411,11 @@ function parseTabularBody(
 
     if (content.length > 0 && content[0] === " ") {
       const trimmed = content.trimStart();
-      if (trimmed.startsWith(".")) break;
+      if (trimmed.startsWith(".")) break; // attachment lines handled below (v2 indented or v3)
       break;
     }
 
+    // Strip @N prefix (must be @digits).
     let rowData = content;
     let rowHasID = false;
     if (rowData.startsWith("@")) {
@@ -317,15 +433,32 @@ function parseTabularBody(
     if (vals.length !== fields.length)
       throw new Error(`row_width_mismatch: expected ${fields.length}, got ${vals.length}`);
 
+    // Parse cells: scalars, traditional attachments, and inline schema attachments.
     const cellValues = new Map<string, any>();
     const traditionalAttFields: string[] = [];
     const inlineAttFields: string[] = [];
     const inlineAttOrder: string[] = [];
     const missingFields = new Set<string>();
 
+    // Collect path column values for unflattening.
+    const flatValues = new Map<string, any>();
+    const flatAbsent = new Set<string>();
+
     for (let j = 0; j < fields.length; j++) {
       const cellVal = vals[j];
 
+      // Path columns: store values for later unflattening.
+      if (pathColumnMap.has(fields[j])) {
+        const parsed = parseScalar(cellVal, true);
+        if (parsed === MISSING) {
+          flatAbsent.add(fields[j]);
+        } else {
+          flatValues.set(fields[j], parsed);
+        }
+        continue;
+      }
+
+      // Check for ^{fields} inline schema declaration.
       if (cellVal.startsWith("^{") && cellVal.endsWith("}")) {
         const schemaStr = cellVal.slice(1);
         const ifs = splitFieldDecl(schemaStr);
@@ -341,6 +474,7 @@ function parseTabularBody(
         continue;
       }
       if (parsed === ATTACHMENT) {
+        // Check if this field has a stored inline schema.
         if (inlineSchemas.has(fields[j])) {
           inlineAttFields.push(fields[j]);
           inlineAttOrder.push(fields[j]);
@@ -349,6 +483,7 @@ function parseTabularBody(
         }
         continue;
       }
+      // Handle inline schema objects returned by parseScalar (for ^{...} that got through).
       if (parsed && typeof parsed === "object" && parsed.__inlineSchema) {
         const ifs = splitFieldDecl(parsed.__inlineSchema);
         inlineSchemas.set(fields[j], ifs);
@@ -360,13 +495,14 @@ function parseTabularBody(
     }
     i++;
 
+    // Parse attachments in line order.
     const allAttFields = [...traditionalAttFields, ...inlineAttFields];
     const attachmentValues = new Map<string, any>();
 
-    if (rowHasID && allAttFields.length > 0) {
+    if (rowHasID) {
       let inlineIdx = 0;
 
-      while (i < lines.length && attachmentValues.size < allAttFields.length) {
+      while (i < lines.length) {
         const aLine = lines[i];
         let aContent: string | null = null;
         if (depth === 0 || aLine.startsWith(ind)) {
@@ -376,14 +512,17 @@ function parseTabularBody(
         }
         if (aContent === null) break;
 
+        // Line starts with ".": traditional or prefixed inline attachment.
+        // Also handle v2-format indented attachments ("  .field ...").
         let attContent = aContent;
         if (!attContent.startsWith(".") && attContent.startsWith("  .")) {
-          attContent = attContent.slice(2);
+          attContent = attContent.slice(2); // strip v2 indent
         }
         if (attContent.startsWith(".")) {
           const rest = attContent.slice(1);
           const [attName, afterName] = parseAttachmentName(rest);
 
+          // Check if this is an inline schema field with pipe-delimited data.
           const ifs = inlineSchemas.get(attName);
           if (
             ifs &&
@@ -407,6 +546,7 @@ function parseTabularBody(
             continue;
           }
 
+          // Traditional attachment.
           const [name, val, consumed, parsedFields] = parseAttachment(
             lines,
             i,
@@ -415,6 +555,7 @@ function parseTabularBody(
             sharedArraySchemas
           );
           if (attachmentValues.has(name)) throw new Error(`duplicate_attachment: ${name}`);
+          // Store shared array schema from first row.
           if (rows.length === 0 && parsedFields) {
             sharedArraySchemas.set(name, parsedFields);
           }
@@ -423,6 +564,7 @@ function parseTabularBody(
           continue;
         }
 
+        // No-prefix line: positional inline data.
         let foundInline = false;
         let nextInlineField = "";
         while (inlineIdx < inlineAttOrder.length) {
@@ -456,6 +598,9 @@ function parseTabularBody(
         if (!attachmentValues.has(f)) throw new Error(`missing_attachment: ${f}`);
       }
 
+      // Check for duplicate attachments: if the next line is also an attachment
+      // line at this depth, it means there's a second attachment for a field
+      // that was already resolved.
       if (i < lines.length) {
         let peekContent: string | null = null;
         if (depth === 0 || lines[i].startsWith(ind)) {
@@ -477,24 +622,30 @@ function parseTabularBody(
       }
     }
 
+    // Build row in field declaration order.
     const row: Record<string, any> = {};
     for (const f of fields) {
       if (missingFields.has(f)) continue;
       if (cellValues.has(f)) {
-        row[f] = cellValues.get(f);
+        safeAssign(row, f, cellValues.get(f));
         continue;
       }
       if (attachmentValues.has(f)) {
-        row[f] = attachmentValues.get(f);
+        safeAssign(row, f, attachmentValues.get(f));
         continue;
       }
     }
 
-    if (!rowHasID || allAttFields.length === 0) {
-      const attIndent = ind + "  ";
-      if (i < lines.length && lines[i].startsWith(attIndent)) {
-        const peek = lines[i].slice(attIndent.length);
-        if (peek.startsWith(".")) throw new Error(`orphan_attachment: ${peek}`);
+    // Also add any orphan attachment values (fields excluded from column list, e.g. ">" fields).
+    for (const [k, v] of attachmentValues) {
+      if (!Object.prototype.hasOwnProperty.call(row, k)) safeAssign(row, k, v);
+    }
+
+    // Unflatten path columns into nested objects.
+    if (pathColumnMap.size > 0) {
+      const nested = unflattenPaths(pathColumnMap, flatValues, flatAbsent);
+      for (const [k, v] of Object.entries(nested)) {
+        safeAssign(row, k, v);
       }
     }
 
@@ -523,6 +674,7 @@ function parseAttachmentName(rest: string): [string, string] {
   return [rest, ""];
 }
 
+/** Attachment parser: returns [name, value, consumed, parsedFields]. parsedFields is set for tabular arrays with explicit {fields}. */
 function parseAttachment(
   lines: string[],
   lineIdx: number,
@@ -544,6 +696,7 @@ function parseAttachment(
     if (closeBracket < 0) throw new Error("invalid_count: missing ]");
     const afterClose = afterName.slice(closeBracket + 1);
 
+    // [N]{fields}: has its own schema.
     if (afterClose.startsWith("{")) {
       const endBrace = findClosingBrace(afterClose);
       let parsedFields: string[] | null = null;
@@ -556,12 +709,15 @@ function parseAttachment(
       return [name, arr, consumed, parsedFields];
     }
 
+    // [N]: values or [N] (check for inline primitive array first).
     const afterCloseForInline = afterName.slice(closeBracket + 1);
     if (afterCloseForInline.startsWith(": ") || afterCloseForInline === ":") {
+      // Inline primitive array: don't use shared schema.
       const [arr, consumed] = parseArrayFromHeader(lines, lineIdx, depth, afterName);
       return [name, arr, consumed, null];
     }
 
+    // [N] without {fields}: check for shared schema.
     if (sharedSchemas.has(name)) {
       const sf = sharedSchemas.get(name)!;
       const countStr = afterName.slice(1, closeBracket);
@@ -575,6 +731,7 @@ function parseAttachment(
       }
       if (count === 0) return [name, [], 1, null];
 
+      // Peek: if next line starts with @, it's expanded, not tabular.
       const nextIdx = lineIdx + 1;
       const ind = "  ".repeat(depth);
       let useShared = true;
@@ -591,10 +748,19 @@ function parseAttachment(
       }
     }
 
+    // No shared schema: standard parsing.
     const [arr, consumed] = parseArrayFromHeader(lines, lineIdx, depth, afterName);
     return [name, arr, consumed, null];
   }
 
+  // Scalar: =value (field names containing ">" excluded from tabular columns).
+  if (afterName.startsWith("=")) {
+    const valStr = afterName.slice(1);
+    const parsed = parseScalar(valStr, true);
+    if (parsed === MISSING) return [name, null, 1, null];
+    return [name, parsed, 1, null];
+  }
+
   throw new Error(`invalid attachment form: ${afterName}`);
 }
 
@@ -658,6 +824,7 @@ function validateSummaryCounts(
   deferredCount: number,
   contentLines: string[]
 ): void {
+  // Parse counts from "##! summary counts=N,M,..."
   const parts = summaryLine.split(/\s+/);
   let countsStr = "";
   for (const p of parts) {
@@ -675,6 +842,7 @@ function validateSummaryCounts(
     );
   }
 
+  // Count actual items per deferred section.
   const actualCounts: number[] = [];
   let inDeferred = false;
   let currentCount = 0;
diff --git a/open-sse/services/compression/engines/headroom/gcf/generic.ts b/open-sse/services/compression/engines/headroom/gcf/generic.ts
index 5ad23c4058..27cb508f24 100644
--- a/open-sse/services/compression/engines/headroom/gcf/generic.ts
+++ b/open-sse/services/compression/engines/headroom/gcf/generic.ts
@@ -1,40 +1,50 @@
 /**
- * Generic encoder: converts any JS value into GCF generic profile.
- * Vendored from gcf-typescript — generic profile only.
+ * GCF generic-profile encoder (encodeGeneric).
+ * Vendored from gcf-typescript — generic profile only. Current with GCF spec v3.2
+ * (nested object flattening) and the [N]: inline-array quoting fix.
  * https://github.com/blackwell-systems/gcf-typescript
  *
  * SPDX-License-Identifier: MIT
  */
-import { formatScalar, formatKey } from "./scalar.ts";
+import { formatScalar, formatKey, ATTACHMENT } from "./scalar.ts";
 
 function indent(depth: number): string {
   return "  ".repeat(depth);
 }
 
-export function encodeGeneric(data: unknown): string {
+/** Options for controlling generic encoding behavior. */
+export interface GenericOptions {
+  /** When true, disables promotion of fixed-shape nested objects to path
+   *  columns (e.g. "customer>name"). Nested objects use attachment syntax
+   *  instead. Open-weight models currently comprehend the expanded form
+   *  better; this gap is expected to close. */
+  noFlatten?: boolean;
+}
+
+export function encodeGeneric(data: unknown, opts?: GenericOptions): string {
   let out = "GCF profile=generic\n";
-  out += encodeRootValue(data);
+  out += encodeRootValue(data, opts);
   return out;
 }
 
-function encodeRootValue(v: unknown): string {
+function encodeRootValue(v: unknown, opts?: GenericOptions): string {
   if (v === null || v === undefined) return "=-\n";
-  if (Array.isArray(v)) return encodeRootArray(v);
-  if (typeof v === "object") return encodeObject(v as Record<string, unknown>, 0);
+  if (Array.isArray(v)) return encodeRootArray(v, opts);
+  if (typeof v === "object") return encodeObject(v as Record<string, unknown>, 0, opts);
   return `=${formatScalar(v, 0)}\n`;
 }
 
-function encodeObject(obj: Record<string, unknown>, depth: number): string {
+function encodeObject(obj: Record<string, unknown>, depth: number, opts?: GenericOptions): string {
   const prefix = indent(depth);
   let out = "";
   for (const key of Object.keys(obj)) {
     const value = obj[key];
     const fk = formatKey(key);
     if (Array.isArray(value)) {
-      out += encodeNamedArray(fk, value, depth);
+      out += encodeNamedArray(fk, value, depth, opts);
     } else if (typeof value === "object" && value !== null) {
       out += `${prefix}## ${fk}\n`;
-      out += encodeObject(value as Record<string, unknown>, depth + 1);
+      out += encodeObject(value as Record<string, unknown>, depth + 1, opts);
     } else {
       out += `${prefix}${fk}=${formatScalar(value, 0)}\n`;
     }
@@ -42,18 +52,23 @@ function encodeObject(obj: Record<string, unknown>, depth: number): string {
   return out;
 }
 
-function encodeRootArray(arr: unknown[]): string {
+function encodeRootArray(arr: unknown[], opts?: GenericOptions): string {
   if (arr.length === 0) return "## [0]\n";
   if (allPrimitives(arr)) {
     const vals = arr.map((v) => formatScalar(v, 0x2c));
     return `## [${arr.length}]: ${vals.join(",")}\n`;
   }
   const fields = tabularFields(arr);
-  if (fields) return encodeTabular("## ", arr, fields, 0);
-  return encodeExpanded("## ", arr, 0);
+  if (fields) return encodeTabular("## ", arr, fields, 0, opts);
+  return encodeExpanded("## ", arr, 0, opts);
 }
 
-function encodeNamedArray(name: string, arr: unknown[], depth: number): string {
+function encodeNamedArray(
+  name: string,
+  arr: unknown[],
+  depth: number,
+  opts?: GenericOptions
+): string {
   const prefix = indent(depth);
   if (arr.length === 0) return `${prefix}## ${name} [0]\n`;
   if (allPrimitives(arr)) {
@@ -61,8 +76,8 @@ function encodeNamedArray(name: string, arr: unknown[], depth: number): string {
     return `${prefix}${name}[${arr.length}]: ${vals.join(",")}\n`;
   }
   const fields = tabularFields(arr);
-  if (fields) return encodeTabular(`${prefix}## ${name} `, arr, fields, depth);
-  return encodeExpanded(`${prefix}## ${name} `, arr, depth);
+  if (fields) return encodeTabular(`${prefix}## ${name} `, arr, fields, depth, opts);
+  return encodeExpanded(`${prefix}## ${name} `, arr, depth, opts);
 }
 
 function tabularFields(arr: unknown[]): string[] | null {
@@ -83,8 +98,9 @@ function tabularFields(arr: unknown[]): string[] | null {
 
 /** Check if a field is eligible for inline schema: all rows have same flat object shape with 3+ keys. */
 function inlineSchemaFields(arr: unknown[], fieldName: string): string[] | null {
+  // First row must have the field.
   const first = arr[0] as Record<string, unknown> | undefined;
-  if (!first || !(fieldName in first)) return null;
+  if (!first || !Object.prototype.hasOwnProperty.call(first, fieldName)) return null;
   const firstVal = first[fieldName];
   if (
     firstVal === null ||
@@ -97,10 +113,11 @@ function inlineSchemaFields(arr: unknown[], fieldName: string): string[] | null
   let canonicalKeys: string[] | null = null;
   for (const item of arr) {
     const obj = item as Record<string, unknown>;
-    if (!(fieldName in obj) || obj[fieldName] === null || obj[fieldName] === undefined) continue;
+    if (!Object.prototype.hasOwnProperty.call(obj, fieldName) || obj[fieldName] === null || obj[fieldName] === undefined) continue;
     const v = obj[fieldName];
     if (typeof v !== "object" || Array.isArray(v)) return null;
     const keys = Object.keys(v as Record<string, unknown>);
+    // All values must be scalars.
     for (const k of keys) {
       const val = (v as Record<string, unknown>)[k];
       if (val !== null && val !== undefined && typeof val === "object") return null;
@@ -118,21 +135,22 @@ function inlineSchemaFields(arr: unknown[], fieldName: string): string[] | null
   return canonicalKeys;
 }
 
-/** Check if array attachment has same tabular schema across all rows. */
+/** Check if array attachment has same tabular schema across all rows (first row must have it). All values must be scalars. */
 function sharedArraySchema(arr: unknown[], fieldName: string): string[] | null {
   const first = arr[0] as Record<string, unknown> | undefined;
-  if (!first || !(fieldName in first)) return null;
+  if (!first || !Object.prototype.hasOwnProperty.call(first, fieldName)) return null;
   const firstVal = first[fieldName];
   if (!Array.isArray(firstVal)) return null;
 
   let canonicalFields: string[] | null = null;
   for (const item of arr) {
     const obj = item as Record<string, unknown>;
-    if (!(fieldName in obj) || obj[fieldName] === null || obj[fieldName] === undefined) continue;
+    if (!Object.prototype.hasOwnProperty.call(obj, fieldName) || obj[fieldName] === null || obj[fieldName] === undefined) continue;
     const v = obj[fieldName];
     if (!Array.isArray(v)) return null;
     const fields = tabularFields(v);
     if (!fields) return null;
+    // All values must be scalars.
     for (const arrItem of v) {
       if (typeof arrItem !== "object" || arrItem === null) return null;
       for (const val of Object.values(arrItem as Record<string, unknown>)) {
@@ -151,25 +169,207 @@ function sharedArraySchema(arr: unknown[], fieldName: string): string[] | null {
   return canonicalFields;
 }
 
+// ── Nested object flattening (v3.2) ──────────────────────────────────────
+
+interface FlatLeaf {
+  path: string; // ">" separated path (e.g. "customer>name")
+  keys: string[]; // key chain to traverse from row object
+}
+
+// Keys that would pollute Object.prototype if used as a flatten path segment.
+// An object carrying one of these is never flattened; it round-trips whole.
+function isUnsafeKey(k: string): boolean {
+  return k === "__proto__" || k === "constructor" || k === "prototype";
+}
+
+function analyzeFlattenable(
+  arr: unknown[],
+  fieldName: string,
+  parentPath: string
+): FlatLeaf[] | null {
+  // Field names containing ">" cannot be flattened (would create ambiguous paths).
+  if (fieldName.includes(">")) return null;
+  let canonicalShape: Record<string, "scalar" | "nested"> | null = null;
+
+  for (const item of arr) {
+    const obj = item as Record<string, unknown>;
+    if (!Object.prototype.hasOwnProperty.call(obj, fieldName) || obj[fieldName] === undefined) continue;
+    if (obj[fieldName] === null) {
+      // A nested (non-top-level) null cannot be flattened losslessly: its leaves would
+      // encode as absent ("~") and unflatten back to a missing key, not null. Bail to
+      // the whole-object (attachment) path. A top-level null is fine: it emits "-" and
+      // reconstructs via the all-null rule, so just skip the row from shape analysis.
+      if (parentPath !== "") return null;
+      continue;
+    }
+    const v = obj[fieldName];
+    if (typeof v !== "object" || Array.isArray(v)) return null;
+
+    const keys = Object.keys(v as Record<string, unknown>);
+
+    if (!canonicalShape) {
+      // Null-prototype map so `k in canonicalShape` below only sees own keys
+      // (a field literally named "toString"/"constructor" must not match the
+      // Object.prototype chain), and reject prototype-pollution keys outright.
+      canonicalShape = Object.create(null) as Record<string, "scalar" | "nested">;
+      for (const k of keys) {
+        if (k.includes(">") || isUnsafeKey(k)) return null;
+        const val = (v as Record<string, unknown>)[k];
+        if (val !== null && val !== undefined && typeof val === "object" && !Array.isArray(val)) {
+          canonicalShape[k] = "nested";
+        } else if (Array.isArray(val)) {
+          return null;
+        } else {
+          canonicalShape[k] = "scalar";
+        }
+      }
+    } else {
+      if (keys.length !== Object.keys(canonicalShape).length) return null;
+      for (const k of keys) {
+        if (!Object.prototype.hasOwnProperty.call(canonicalShape, k)) return null;
+        const val = (v as Record<string, unknown>)[k];
+        const expected = canonicalShape[k];
+        if (expected === "scalar") {
+          if (val !== null && val !== undefined && typeof val === "object") return null;
+        } else if (expected === "nested") {
+          if (val !== null && val !== undefined) {
+            if (typeof val !== "object" || Array.isArray(val)) return null;
+          }
+        }
+      }
+    }
+  }
+
+  if (!canonicalShape) return null;
+
+  const currentPath = parentPath ? parentPath + ">" + fieldName : fieldName;
+  const parentKeys = parentPath ? [...parentPath.split(">"), fieldName] : [fieldName];
+
+  const leaves: FlatLeaf[] = [];
+  for (const k of Object.keys(canonicalShape)) {
+    if (canonicalShape[k] === "scalar") {
+      leaves.push({ path: currentPath + ">" + k, keys: [...parentKeys, k] });
+    } else {
+      const subArr = arr.map((item) => {
+        const obj = item as Record<string, unknown>;
+        if (!Object.prototype.hasOwnProperty.call(obj, fieldName) || obj[fieldName] === null || obj[fieldName] === undefined)
+          return {};
+        return obj[fieldName];
+      });
+      const subLeaves = analyzeFlattenable(subArr as unknown[], k, currentPath);
+      if (!subLeaves || subLeaves.length === 0) return null;
+      leaves.push(...subLeaves);
+    }
+  }
+
+  // Guard: reject if any row has non-null object with all-null leaves.
+  if (leaves.length > 0) {
+    for (const item of arr) {
+      const obj = item as Record<string, unknown>;
+      if (!Object.prototype.hasOwnProperty.call(obj, fieldName) || obj[fieldName] === null || obj[fieldName] === undefined) continue;
+      const allNull = leaves.every((leaf) => {
+        const val = resolveKeyChain(item, leaf.keys);
+        return val.exists && val.value === null;
+      });
+      if (allNull) return null;
+    }
+  }
+
+  return leaves;
+}
+
+function resolveKeyChain(item: unknown, keys: string[]): { value: unknown; exists: boolean } {
+  if (keys.length === 0) return { value: undefined, exists: false };
+  const obj = item as Record<string, unknown>;
+  if (typeof obj !== "object" || obj === null) return { value: undefined, exists: false };
+  if (!Object.prototype.hasOwnProperty.call(obj, keys[0])) return { value: undefined, exists: false };
+  let current: unknown = obj[keys[0]];
+  if (current === null || current === undefined) return { value: current, exists: true };
+  for (let i = 1; i < keys.length; i++) {
+    if (typeof current !== "object" || current === null) return { value: undefined, exists: false };
+    const c = current as Record<string, unknown>;
+    if (!Object.prototype.hasOwnProperty.call(c, keys[i])) return { value: undefined, exists: false };
+    current = c[keys[i]];
+  }
+  return { value: current, exists: true };
+}
+
+// ── End flattening helpers ───────────────────────────────────────────────
+
 function encodeTabular(
   headerPrefix: string,
   arr: unknown[],
   fields: string[],
-  depth: number
+  depth: number,
+  opts?: GenericOptions
 ): string {
   const prefix = indent(depth);
 
+  // Phase 0: Analyze fields for flattening.
+  const flattenMap = new Map<string, FlatLeaf[]>();
+  if (!opts?.noFlatten) {
+    for (const f of fields) {
+      const leaves = analyzeFlattenable(arr, f, "");
+      if (leaves && leaves.length > 0) {
+        flattenMap.set(f, leaves);
+      }
+    }
+  }
+
+  // Fields whose names contain ">" must not appear as tabular columns
+  // because the decoder would interpret them as flattened path columns.
+  // Track them for per-row attachment emission (spec rule 7.4.6.1.4).
+  const gtFields = new Set<string>();
+  for (const f of fields) {
+    if (!flattenMap.has(f) && f.includes(">")) {
+      gtFields.add(f);
+    }
+  }
+
+  // Build expanded column list.
+  type ColType = "flat" | "original";
+  interface FlatColumn {
+    headerName: string;
+    colType: ColType;
+    field: string;
+    keys: string[];
+  }
+  const columns: FlatColumn[] = [];
+  for (const f of fields) {
+    if (gtFields.has(f)) continue;
+    const leaves = flattenMap.get(f);
+    if (leaves) {
+      for (const leaf of leaves) {
+        columns.push({
+          headerName: formatKey(leaf.path),
+          colType: "flat",
+          field: f,
+          keys: leaf.keys,
+        });
+      }
+    } else {
+      columns.push({ headerName: formatKey(f), colType: "original", field: f, keys: [] });
+    }
+  }
+
+  // If all fields were excluded (all contain ">"), fall back to expanded.
+  if (columns.length === 0) {
+    return encodeExpanded(headerPrefix, arr, depth, opts);
+  }
+
+  // Pre-compute inline schemas and shared array schemas (skip flattened fields).
   const inlineSchemas = new Map<string, string[]>();
   const sharedArrSchemas = new Map<string, string[]>();
   for (const f of fields) {
+    if (flattenMap.has(f)) continue;
     const ifs = inlineSchemaFields(arr, f);
     if (ifs) inlineSchemas.set(f, ifs);
     const sas = sharedArraySchema(arr, f);
     if (sas) sharedArrSchemas.set(f, sas);
   }
 
-  const fmtFields = fields.map((f) => formatKey(f));
-  let out = `${headerPrefix}[${arr.length}]{${fmtFields.join(",")}}\n`;
+  const headerFields = columns.map((c) => c.headerName);
+  let out = `${headerPrefix}[${arr.length}]{${headerFields.join(",")}}\n`;
 
   for (let i = 0; i < arr.length; i++) {
     const obj = arr[i] as Record<string, unknown>;
@@ -182,8 +382,33 @@ function encodeTabular(
     }[] = [];
     let rowHasAttachment = false;
 
-    for (const f of fields) {
-      if (!(f in obj)) {
+    for (const col of columns) {
+      if (col.colType === "flat") {
+        // Resolve value via key chain.
+        if (!Object.prototype.hasOwnProperty.call(obj, col.keys[0])) {
+          cells.push("~");
+        } else {
+          // Check if top-level field is null.
+          const topVal = obj[col.keys[0]];
+          if (topVal === null || topVal === undefined) {
+            cells.push(topVal === null ? "-" : "~");
+          } else {
+            const resolved = resolveKeyChain(obj, col.keys);
+            if (!resolved.exists) {
+              cells.push("~");
+            } else if (resolved.value === null || resolved.value === undefined) {
+              cells.push("-");
+            } else {
+              cells.push(formatScalar(resolved.value, 0x7c));
+            }
+          }
+        }
+        continue;
+      }
+
+      // Original (non-flattened) field.
+      const f = col.field;
+      if (!Object.prototype.hasOwnProperty.call(obj, f)) {
         cells.push("~");
         continue;
       }
@@ -212,6 +437,14 @@ function encodeTabular(
       }
     }
 
+    // Emit fields with ">" in their names as per-row attachments.
+    for (const f of fields) {
+      if (!gtFields.has(f)) continue;
+      if (!Object.prototype.hasOwnProperty.call(obj, f)) continue;
+      rowHasAttachment = true;
+      attachments.push({ name: f, value: obj[f], inline: false });
+    }
+
     const row = cells.join("|");
     if (rowHasAttachment) {
       out += `${prefix}@${i} ${row}\n`;
@@ -222,6 +455,7 @@ function encodeTabular(
     for (const att of attachments) {
       const fk = formatKey(att.name);
       if (att.inline && att.inlineFields) {
+        // Inline: single pipe-delimited row, no prefix, no indent.
         const vals = att.inlineFields.map((inf) => {
           const val = (att.value as Record<string, unknown>)[inf];
           if (val === undefined) return "~";
@@ -229,15 +463,30 @@ function encodeTabular(
         });
         out += `${prefix}${vals.join("|")}\n`;
       } else if (Array.isArray(att.value)) {
+        // Shared array schema: omit {fields} on subsequent rows.
         const sas = sharedArrSchemas.get(att.name);
         if (sas && i > 0) {
-          out += encodeAttachmentArrayShared(prefix, fk, att.value as unknown[], depth + 2, sas);
+          out += encodeAttachmentArrayShared(
+            prefix,
+            fk,
+            att.value as unknown[],
+            depth + 2,
+            sas,
+            opts
+          );
         } else {
-          out += encodeAttachmentArray(prefix, fk, att.value as unknown[], depth + 2);
+          out += encodeAttachmentArray(prefix, fk, att.value as unknown[], depth + 2, opts);
         }
-      } else {
+      } else if (typeof att.value === "object" && att.value !== null) {
         out += `${prefix}.${fk} {}\n`;
-        out += encodeObject(att.value as Record<string, unknown>, depth + 2);
+        out += encodeObject(att.value as Record<string, unknown>, depth + 2, opts);
+      } else {
+        // Scalar attachment (e.g. field names containing ">").
+        if (att.value === null || att.value === undefined) {
+          out += `${prefix}.${fk} =-\n`;
+        } else {
+          out += `${prefix}.${fk} =${formatScalar(att.value, 0)}\n`;
+        }
       }
     }
   }
@@ -248,7 +497,8 @@ function encodeAttachmentArray(
   attPrefix: string,
   fk: string,
   arr: unknown[],
-  depth: number
+  depth: number,
+  opts?: GenericOptions
 ): string {
   if (arr.length === 0) return `${attPrefix}.${fk} [0]\n`;
   if (allPrimitives(arr)) {
@@ -256,8 +506,8 @@ function encodeAttachmentArray(
     return `${attPrefix}.${fk} [${arr.length}]: ${vals.join(",")}\n`;
   }
   const fields = tabularFields(arr);
-  if (fields) return encodeTabular(`${attPrefix}.${fk} `, arr, fields, depth);
-  return encodeExpanded(`${attPrefix}.${fk} `, arr, depth);
+  if (fields) return encodeTabular(`${attPrefix}.${fk} `, arr, fields, depth, opts);
+  return encodeExpanded(`${attPrefix}.${fk} `, arr, depth, opts);
 }
 
 function encodeAttachmentArrayShared(
@@ -265,25 +515,28 @@ function encodeAttachmentArrayShared(
   fk: string,
   arr: unknown[],
   depth: number,
-  sharedFields: string[]
+  sharedFields: string[],
+  opts?: GenericOptions
 ): string {
   if (arr.length === 0) return `${attPrefix}.${fk} [0]\n`;
   if (allPrimitives(arr)) {
     const vals = arr.map((v) => formatScalar(v, 0x2c));
     return `${attPrefix}.${fk} [${arr.length}]: ${vals.join(",")}\n`;
   }
+  // Verify fields match shared schema.
   const fields = tabularFields(arr);
   if (
     fields &&
     fields.length === sharedFields.length &&
     fields.every((f, i) => f === sharedFields[i])
   ) {
+    // Omit {fields}, use shared schema.
     const prefix = indent(depth);
     let out = `${attPrefix}.${fk} [${arr.length}]\n`;
     for (const item of arr) {
       const obj = item as Record<string, unknown>;
       const cells = sharedFields.map((f) => {
-        if (!(f in obj)) return "~";
+        if (!Object.prototype.hasOwnProperty.call(obj, f)) return "~";
         if (obj[f] === null || obj[f] === undefined) return "-";
         return formatScalar(obj[f], 0x7c);
       });
@@ -291,19 +544,25 @@ function encodeAttachmentArrayShared(
     }
     return out;
   }
-  return encodeAttachmentArray(attPrefix, fk, arr, depth);
+  // Fields don't match: fall back to full encoding.
+  return encodeAttachmentArray(attPrefix, fk, arr, depth, opts);
 }
 
-function encodeExpanded(headerPrefix: string, arr: unknown[], depth: number): string {
+function encodeExpanded(
+  headerPrefix: string,
+  arr: unknown[],
+  depth: number,
+  opts?: GenericOptions
+): string {
   const prefix = indent(depth);
   let out = `${headerPrefix}[${arr.length}]\n`;
   for (let i = 0; i < arr.length; i++) {
     const item = arr[i];
     if (Array.isArray(item)) {
-      out += encodeExpandedArrayItem(prefix, i, item, depth);
+      out += encodeExpandedArrayItem(prefix, i, item, depth, opts);
     } else if (typeof item === "object" && item !== null) {
       out += `${prefix}@${i} {}\n`;
-      out += encodeObject(item as Record<string, unknown>, depth + 1);
+      out += encodeObject(item as Record<string, unknown>, depth + 1, opts);
     } else {
       out += `${prefix}@${i} =${formatScalar(item, 0)}\n`;
     }
@@ -315,7 +574,8 @@ function encodeExpandedArrayItem(
   prefix: string,
   idx: number,
   arr: unknown[],
-  depth: number
+  depth: number,
+  opts?: GenericOptions
 ): string {
   if (arr.length === 0) return `${prefix}@${idx} [0]\n`;
   if (allPrimitives(arr)) {
@@ -323,8 +583,8 @@ function encodeExpandedArrayItem(
     return `${prefix}@${idx} [${arr.length}]: ${vals.join(",")}\n`;
   }
   const fields = tabularFields(arr);
-  if (fields) return encodeTabular(`${prefix}@${idx} `, arr, fields, depth + 1);
-  return encodeExpanded(`${prefix}@${idx} `, arr, depth + 1);
+  if (fields) return encodeTabular(`${prefix}@${idx} `, arr, fields, depth + 1, opts);
+  return encodeExpanded(`${prefix}@${idx} `, arr, depth + 1, opts);
 }
 
 function allPrimitives(arr: unknown[]): boolean {
diff --git a/open-sse/services/compression/engines/headroom/gcf/index.ts b/open-sse/services/compression/engines/headroom/gcf/index.ts
index cf4870cc04..5671ced952 100644
--- a/open-sse/services/compression/engines/headroom/gcf/index.ts
+++ b/open-sse/services/compression/engines/headroom/gcf/index.ts
@@ -1,6 +1,7 @@
 /**
  * GCF (Graph Compact Format) — generic profile encoder/decoder.
- * Vendored from gcf-typescript for zero-dependency integration.
+ * Vendored from gcf-typescript for zero-dependency integration. Current with
+ * GCF spec v3.2 (nested object flattening) + [N]: inline-array quoting fix.
  * https://github.com/blackwell-systems/gcf-typescript
  *
  * SPDX-License-Identifier: MIT
diff --git a/open-sse/services/compression/engines/headroom/gcf/scalar.ts b/open-sse/services/compression/engines/headroom/gcf/scalar.ts
index fdf28e6060..f7e82d4419 100644
--- a/open-sse/services/compression/engines/headroom/gcf/scalar.ts
+++ b/open-sse/services/compression/engines/headroom/gcf/scalar.ts
@@ -1,6 +1,7 @@
 /**
  * Common scalar grammar for GCF (Graph Compact Format).
- * Vendored from gcf-typescript — generic profile only.
+ * Vendored from gcf-typescript — generic profile only. Current with GCF spec v3.2
+ * (nested object flattening) and the [N]: inline-array quoting fix.
  * https://github.com/blackwell-systems/gcf-typescript
  *
  * SPDX-License-Identifier: MIT
@@ -8,10 +9,7 @@
 
 const JSON_NUMBER_RE = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?$/;
 const NUMERIC_LIKE_RE = /^[+-]\.?\d|^\.\d|^0\d/;
-// SPEC §2.4: a bracket pair immediately followed by `:` (e.g. `ERR[404]: Not Found`,
-// `[Speaker 1]: Hello`). Bare, on a line-level key=value RHS, the decoder re-parses
-// this as an inline-array header → count_mismatch / wrong value (B-GCF-QUOTE).
-const INLINE_ARRAY_RE = /\[[^\]]*\]:/;
+const INLINE_ARRAY_RE = /\[[^\]]*\]\s*:/;
 
 /** Check if a string value must be quoted per Section 2.4. */
 export function needsQuote(s: string): boolean {
@@ -110,7 +108,7 @@ export function formatNumber(f: number): string {
   if (f === 0) return "0";
   const abs = Math.abs(f);
   if (abs >= 1e-6 && abs < 1e21) {
-    return String(f);
+    return toPreciseDecimal(f);
   }
   // Exponent notation.
   let s = f.toExponential();
@@ -119,6 +117,11 @@ export function formatNumber(f: number): string {
   return s;
 }
 
+function toPreciseDecimal(f: number): string {
+  // String(f) produces the shortest representation that round-trips through parseFloat.
+  return String(f);
+}
+
 const BARE_KEY_RE = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 
 /** Check if a key is a valid bare key. */
diff --git a/open-sse/services/compression/engines/index.ts b/open-sse/services/compression/engines/index.ts
index e58cc3d893..02ba4729a4 100644
--- a/open-sse/services/compression/engines/index.ts
+++ b/open-sse/services/compression/engines/index.ts
@@ -9,6 +9,7 @@ import { ionizerEngine } from "./ionizer/index.ts";
 import { relevanceEngine } from "./relevance/index.ts";
 import { llmCompressorEngine } from "./llm/index.ts";
 import { readLifecycleEngine } from "./readLifecycle/index.ts";
+import { omniglyphEngine } from "./omniglyphAdapter.ts";
 
 let registered = false;
 
@@ -34,6 +35,7 @@ export function registerBuiltinCompressionEngines(): void {
     { id: "relevance", engine: relevanceEngine },
     { id: "llm", engine: llmCompressorEngine },
     { id: "read-lifecycle", engine: readLifecycleEngine },
+    { id: "omniglyph", engine: omniglyphEngine },
   ];
 
   for (const { id, engine } of engines) {
diff --git a/open-sse/services/compression/engines/omniglyphAdapter.ts b/open-sse/services/compression/engines/omniglyphAdapter.ts
new file mode 100644
index 0000000000..453fb85bd1
--- /dev/null
+++ b/open-sse/services/compression/engines/omniglyphAdapter.ts
@@ -0,0 +1,116 @@
+/**
+ * OmniGlyph — compressão contexto-como-imagem (Anthropic/Fable 5 apenas).
+ * Renderiza system prompt, tool docs, histórico antigo e tool_results grandes
+ * como páginas PNG densas; o modelo lê as páginas no lugar do texto por ~10×
+ * menos tokens no bloco convertido (59-70% ponta a ponta, medido).
+ *
+ * GATES (todos fail-closed; cada skip vira técnica `skip:<motivo>` nos stats):
+ *  - supportsVision !== true            → skip:no_vision
+ *  - modelo fora da allowlist medida    → skip:model_not_approved
+ *  - providerTransport !== 'direct'     → skip:transport_not_direct
+ *    (agregadores redimensionam imagens e destroem a legibilidade — medido)
+ *  - corpo não é formato Claude nativo  → skip:source_format_not_claude
+ *  - gate de rentabilidade interno do omniglyph decide o resto (patches 28px
+ *    exatos; texto esparso/pequeno passa direto) → skip:not_profitable
+ *
+ * `sampling: true`: perda é INTENCIONAL (byte-exatos viajam no factsheet em
+ * texto) — o fidelity gate pula esta engine por design, não por acidente.
+ */
+import type { CompressionEngine, CompressionEngineApplyOptions } from "./types.ts";
+import type { CompressionResult } from "../types.ts";
+import { createCompressionStats } from "../stats.ts";
+import { transformAnthropicMessages, isOmniGlyphSupportedModel } from "omniglyph";
+
+function skip(body: Record<string, unknown>, reason: string): CompressionResult {
+  try {
+    return {
+      body,
+      compressed: false,
+      stats: createCompressionStats(body, body, "stacked", [`skip:${reason}`]),
+    };
+  } catch {
+    // Fail-open guard: a non-serializable body (e.g. circular reference) makes
+    // createCompressionStats' internal JSON.stringify throw too — stats become
+    // best-effort telemetry, never a reason to propagate the error.
+    return { body, compressed: false, stats: null };
+  }
+}
+
+/** Formato Claude nativo: system no topo, nunca role:"system" dentro de messages. */
+function isClaudeFormat(body: Record<string, unknown>): boolean {
+  const messages = body.messages;
+  if (!Array.isArray(messages)) return false;
+  return !messages.some((m) => (m as { role?: string } | null)?.role === "system");
+}
+
+async function applyOmniglyph(
+  body: Record<string, unknown>,
+  options?: CompressionEngineApplyOptions
+): Promise<CompressionResult> {
+  const model = options?.model ?? (body as { model?: string }).model ?? "";
+  if (options?.supportsVision !== true) return skip(body, "no_vision");
+  if (!isOmniGlyphSupportedModel(model)) return skip(body, "model_not_approved");
+  if (options?.providerTransport !== "direct") return skip(body, "transport_not_direct");
+  if (!isClaudeFormat(body)) return skip(body, "source_format_not_claude");
+
+  const started = Date.now();
+  let outBody: Record<string, unknown>;
+  try {
+    const encoded = new TextEncoder().encode(JSON.stringify(body));
+    const result = await transformAnthropicMessages({ body: encoded, model });
+    if (!result.applied) return skip(body, result.reason ?? "not_profitable");
+    outBody = JSON.parse(new TextDecoder().decode(result.body)) as Record<string, unknown>;
+  } catch {
+    // Fail-open: qualquer erro no encode/transform/decode (ex.: corpo não serializável,
+    // render PNG estourando, JSON decodificado malformado) vira skip, nunca propaga.
+    return skip(body, "transform_error");
+  }
+
+  return {
+    body: outBody,
+    compressed: true,
+    stats: createCompressionStats(
+      body,
+      outBody,
+      "stacked",
+      ["omniglyph:context-as-image"],
+      undefined,
+      Date.now() - started
+    ),
+  };
+}
+
+export const omniglyphEngine: CompressionEngine = {
+  id: "omniglyph",
+  name: "OmniGlyph",
+  description:
+    "Contexto-como-imagem (Anthropic Fable 5, rota direta): system prompt, tool docs e histórico viram páginas PNG densas — ~10× menos tokens no bloco convertido.",
+  icon: "image",
+  targets: ["messages", "tool_results"],
+  stackable: true,
+  stackPriority: 90, // por último: RTK/Caveman limpam texto antes; omniglyph imageia o residual
+  sampling: true, // perda intencional + factsheet → fidelity gate pula por design
+  metadata: {
+    id: "omniglyph",
+    name: "OmniGlyph",
+    description: "Contexto-como-imagem para Claude Fable 5 via rota direta Anthropic.",
+    inputScope: "mixed",
+    targetLatencyMs: 250, // render+encode PNG de páginas grandes
+    supportsPreview: true,
+    stable: false, // P1: preview — promover após o e2e P3 (30/30 via OmniRoute)
+  },
+  // Contrato da interface: engines async-only mantêm apply síncrono como pass-through seguro.
+  apply(body) {
+    return { body, compressed: false, stats: null };
+  },
+  applyAsync: applyOmniglyph,
+  compress(body, config) {
+    return this.apply(body, { stepConfig: config });
+  },
+  getConfigSchema() {
+    return [];
+  },
+  validateConfig() {
+    return { valid: true, errors: [] };
+  },
+};
diff --git a/open-sse/services/compression/engines/omniglyphSingleMode.ts b/open-sse/services/compression/engines/omniglyphSingleMode.ts
new file mode 100644
index 0000000000..90c25450d4
--- /dev/null
+++ b/open-sse/services/compression/engines/omniglyphSingleMode.ts
@@ -0,0 +1,23 @@
+import { registerBuiltinCompressionEngines } from "./index.ts";
+import { getCompressionEngine } from "./registry.ts";
+import type { CompressionEngineApplyOptions } from "./types.ts";
+import type { CompressionResult } from "../types.ts";
+
+/**
+ * Single-mode resolution for the async-only "omniglyph" engine. Selecting the
+ * "omniglyph" mode IS the enable signal — run it alone, same pattern as the
+ * "rtk" single mode. (B-MODE-ENGINE-DECOUPLE)
+ *
+ * Kept out of strategySelector's runCompressionAsync so the dispatcher stays
+ * under the complexity gate; this helper owns the registry lookup + the
+ * fail-safe pass-through when the engine (or its async entry) is unavailable.
+ */
+export async function applyOmniglyphSingleMode(
+  body: Record<string, unknown>,
+  options?: CompressionEngineApplyOptions
+): Promise<CompressionResult> {
+  registerBuiltinCompressionEngines();
+  const engine = getCompressionEngine("omniglyph");
+  if (!engine?.applyAsync) return { body, compressed: false, stats: null };
+  return engine.applyAsync(body, options);
+}
diff --git a/open-sse/services/compression/engines/types.ts b/open-sse/services/compression/engines/types.ts
index dcbca19b96..65454eda0c 100644
--- a/open-sse/services/compression/engines/types.ts
+++ b/open-sse/services/compression/engines/types.ts
@@ -32,6 +32,11 @@ export interface CompressionEngineMetadata {
 export interface CompressionEngineApplyOptions {
   model?: string;
   supportsVision?: boolean | null;
+  /** Como o request chega ao provider: rota direta oficial ('direct') vs
+   *  agregador que pode reprocessar imagens ('aggregator'). O engine omniglyph
+   *  exige 'direct' — medição 2026-07-06: agregadores redimensionam as páginas
+   *  e destroem a legibilidade. undefined = desconhecido = skip (fail-closed). */
+  providerTransport?: "direct" | "aggregator";
   config?: CompressionConfig;
   compressionComboId?: string | null;
   stepConfig?: Record<string, unknown>;
diff --git a/open-sse/services/compression/pipelineGuards.ts b/open-sse/services/compression/pipelineGuards.ts
index 07a712e306..a94ecf84ec 100644
--- a/open-sse/services/compression/pipelineGuards.ts
+++ b/open-sse/services/compression/pipelineGuards.ts
@@ -6,6 +6,8 @@
  * default-off; the inflation guard here is an honest DEFAULT-ON check on the FINAL output.
  */
 
+import type { CompressionResult, CompressionStats } from "./types.ts";
+
 export interface PipelineInflationInput {
   /** The verbatim request body before any engine ran. */
   originalBody: Record<string, unknown>;
@@ -25,9 +27,15 @@ export interface PipelineInflationResult {
 }
 
 /**
- * Honest aggregate inflation guard. If the fully-stacked body did not actually shrink — its token
- * count is `>=` the original — the compressed body is discarded and the verbatim original is
- * returned.
+ * Honest aggregate inflation guard. Only genuine INFLATION — the fully-stacked body is strictly
+ * LARGER than the original (`compressedTokens > originalTokens`) — discards the compressed body and
+ * returns the verbatim original.
+ *
+ * A net-zero result (`compressedTokens === originalTokens`) is a NO-OP, not inflation: a structural
+ * engine (e.g. `ccr`, `session-dedup`) that found no candidate returns the body unchanged, so its
+ * token count equals the original. That is zero savings, not a revert — flagging it as inflation
+ * would emit a misleading "did not shrink; reverted to original" warning for an engine that never
+ * touched the payload. Equality therefore must NOT trip the guard.
  *
  * Safe by construction: the only alternative it ever returns is `originalBody`, the unmodified
  * request, which is always a valid payload. A (rare) false trigger therefore can never corrupt a
@@ -38,8 +46,50 @@ export interface PipelineInflationResult {
  */
 export function guardPipelineInflation(input: PipelineInflationInput): PipelineInflationResult {
   const { originalTokens, compressedTokens } = input;
-  if (originalTokens > 0 && compressedTokens >= originalTokens) {
+  if (originalTokens > 0 && compressedTokens > originalTokens) {
     return { body: input.originalBody, inflated: true };
   }
   return { body: input.compressedBody, inflated: false };
 }
+
+/**
+ * Applies the aggregate inflation guard to a finalized stacked-pipeline `stats` object, honoring
+ * the `compressed` loop-level flag (#6480). If the fully-stacked body did not actually shrink
+ * (its token count is >= the original), discards it and returns the verbatim original — safe by
+ * construction, since the original request body is always a valid payload.
+ *
+ * Only meaningful when some step actually advanced `currentBody` (`compressed === true`). When
+ * no step in the pipeline ever produced/advanced a candidate (e.g. a single no-op engine on an
+ * out-of-charter payload), `currentBody` is still reference-identical to `originalBody`, so
+ * tokens are trivially equal — running the guard in that case would mislabel a genuine no-op as
+ * a "reverted" fallback (`fallbackApplied: true` + a misleading warning) even though nothing was
+ * ever computed to revert.
+ */
+export function applyStackedInflationGuard(
+  originalBody: Record<string, unknown>,
+  currentBody: Record<string, unknown>,
+  compressed: boolean,
+  stats: CompressionStats
+): CompressionResult {
+  if (!compressed) return { body: currentBody, compressed, stats };
+
+  const inflation = guardPipelineInflation({
+    originalBody,
+    compressedBody: currentBody,
+    originalTokens: stats.originalTokens,
+    compressedTokens: stats.compressedTokens,
+  });
+  if (!inflation.inflated) return { body: currentBody, compressed, stats };
+
+  const inflatedTokens = stats.compressedTokens;
+  const warnings = new Set(stats.validationWarnings ?? []);
+  warnings.add(
+    `pipeline-inflation-guard: stacked output (${inflatedTokens} tok) did not shrink input ` +
+      `(${stats.originalTokens} tok); reverted to original`
+  );
+  stats.validationWarnings = Array.from(warnings);
+  stats.fallbackApplied = true;
+  stats.compressedTokens = stats.originalTokens;
+  stats.savingsPercent = 0;
+  return { body: inflation.body, compressed: false, stats };
+}
diff --git a/open-sse/services/compression/resultMemo.ts b/open-sse/services/compression/resultMemo.ts
index 2d6ef21062..283733a31f 100644
--- a/open-sse/services/compression/resultMemo.ts
+++ b/open-sse/services/compression/resultMemo.ts
@@ -10,9 +10,13 @@ const memoMap = new Map<string, CompressionResult>();
 // CCR store (`ccr/index.ts` ccrStore; session-dedup imports storeBlock), so their output
 // depends on prior state → not safe to memoize; `ultra`/`aggressive`/`llmlingua` are
 // model-backed/non-deterministic. Any NEW engine is excluded until explicitly vetted.
+// "omniglyph" is intentionally excluded too (P2 registry-consistency pass): it renders
+// context as an image via a model-backed pipeline, so it is not yet proven deterministic
+// across requests — conservative default (never-wrong) until explicitly vetted.
 const DETERMINISTIC_ENGINES = new Set(["lite", "caveman", "rtk"]);
 
-/** Top-level modes safe to cache (whitelist — any unknown/new mode defaults to false). */
+/** Top-level modes safe to cache (whitelist — any unknown/new mode defaults to false).
+ * "omniglyph" intentionally omitted — see comment on DETERMINISTIC_ENGINES above. */
 const DETERMINISTIC_MODES = new Set<CompressionMode>(["lite", "standard", "rtk"]);
 
 export function isDeterministicMode(mode: CompressionMode, config?: CompressionConfig): boolean {
diff --git a/open-sse/services/compression/stackedStepCore.ts b/open-sse/services/compression/stackedStepCore.ts
index f82413d994..ad15d5100d 100644
--- a/open-sse/services/compression/stackedStepCore.ts
+++ b/open-sse/services/compression/stackedStepCore.ts
@@ -62,13 +62,40 @@ export function decideStep(
   return { advance: true };
 }
 
+/**
+ * A dispatched step whose engine found nothing eligible (e.g. session-dedup with no repeated
+ * blocks, ccr below its min-chars threshold) returns `stats: null` instead of throwing or
+ * advancing. Left unrecorded, that step vanishes from the pipeline's telemetry with zero trace —
+ * no `engineBreakdown` entry, no warning, no error (#6479, #6491). Surface it as a validation
+ * warning so operators can tell "engine ran but had nothing to do" apart from "engine never ran".
+ */
+function recordNullStatsStep(acc: StackAccumulator, engineId: string): void {
+  acc.validationWarnings.add(`${engineId}: skipped (no eligible content)`);
+}
+
 /** Folds one engine result into the accumulator (telemetry + breakdown entry). */
 export function mergeStackStep(
   acc: StackAccumulator,
   engineId: string,
   result: CompressionResult
 ): void {
-  if (!result.stats) return;
+  if (!result.stats) {
+    // No-op engine (e.g. ccr / session-dedup found no candidate): stats is null so there is no
+    // telemetry to fold, but the engine still RAN — record a zero-savings breakdown entry so its
+    // identity survives. Without this the breakdown stays empty and ensureEngineBreakdown
+    // synthesizes a generic "stacked" 0% node, hiding which engine an operator actually asked for.
+    // Also surface a validation warning so operators can tell "engine ran but had nothing to do"
+    // apart from "engine never ran" (#6479, #6491).
+    recordNullStatsStep(acc, engineId);
+    acc.breakdown.push({
+      engine: engineId,
+      originalTokens: 0,
+      compressedTokens: 0,
+      savingsPercent: 0,
+      techniquesUsed: [],
+    });
+    return;
+  }
   result.stats.techniquesUsed.forEach((technique) => acc.techniques.add(technique));
   result.stats.rulesApplied?.forEach((rule) => acc.rules.add(rule));
   result.stats.rtkRawOutputPointers?.forEach((pointer) => acc.rtkRawOutputPointers.push(pointer));
diff --git a/open-sse/services/compression/stats.ts b/open-sse/services/compression/stats.ts
index 8d86f982c7..f2298c7f8a 100644
--- a/open-sse/services/compression/stats.ts
+++ b/open-sse/services/compression/stats.ts
@@ -7,13 +7,134 @@ import {
   DEFAULT_RTK_CONFIG,
   DEFAULT_COMPRESSION_LANGUAGE_CONFIG,
 } from "./types.ts";
+import { anthropicImageTokens, ANTHROPIC_IMAGE_BLOCK_OVERHEAD_TOKENS } from "omniglyph";
 
 const CHARS_PER_TOKEN = 4;
 
+/**
+ * Anthropic image block shape this estimator recognizes:
+ * `{ type: "image", source: { type: "base64", media_type: "image/png", data: "<b64>" } }`.
+ * Only PNG is decoded (the only format omniglyph emits); anything else falls back to
+ * char-counting that block, same as before.
+ */
+interface AnthropicImageBlock {
+  type: "image";
+  source: { type: "base64"; media_type: string; data: string };
+}
+
+function isAnthropicPngImageBlock(value: unknown): value is AnthropicImageBlock {
+  if (!value || typeof value !== "object") return false;
+  const block = value as Record<string, unknown>;
+  if (block.type !== "image") return false;
+  const source = block.source as Record<string, unknown> | undefined;
+  if (!source || typeof source !== "object") return false;
+  return (
+    source.type === "base64" &&
+    source.media_type === "image/png" &&
+    typeof source.data === "string"
+  );
+}
+
+/**
+ * Decode PNG width/height from the IHDR chunk without decoding the whole image.
+ * PNG layout: 8-byte signature, then IHDR chunk `length(4) + "IHDR"(4) + width(4) +
+ * height(4) + ...`. Width/height live at bytes 16..19 / 20..23 (big-endian uint32),
+ * so we need through byte 23 (24 raw bytes). We slice the first 64 base64 chars
+ * → 48 raw bytes, a comfortable margin over the 24 required.
+ * Returns null (never throws) on malformed/non-PNG/truncated input.
+ */
+function decodePngDimensions(base64: string): { width: number; height: number } | null {
+  try {
+    const prefix = base64.slice(0, 64);
+    const bytes = Buffer.from(prefix, "base64");
+    if (bytes.length < 24) return null;
+    // PNG signature check (bytes 0..7): 89 50 4E 47 0D 0A 1A 0A
+    const PNG_SIGNATURE = [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a];
+    for (let i = 0; i < PNG_SIGNATURE.length; i++) {
+      if (bytes[i] !== PNG_SIGNATURE[i]) return null;
+    }
+    const width = bytes.readUInt32BE(16);
+    const height = bytes.readUInt32BE(20);
+    if (!Number.isFinite(width) || !Number.isFinite(height) || width <= 0 || height <= 0) {
+      return null;
+    }
+    return { width, height };
+  } catch {
+    return null;
+  }
+}
+
+/** Char-count fallback for one value (same accounting as the legacy estimator). */
+function charTokensOf(value: unknown): number {
+  if (value === null || value === undefined) return 0;
+  const str = typeof value === "string" ? value : JSON.stringify(value);
+  return Math.ceil(str.length / CHARS_PER_TOKEN);
+}
+
+/**
+ * Walk `messages[].content[]` (and `system` when it is an array) looking for Anthropic
+ * base64 PNG image blocks. For each recognized block: blank its `data` (shallow clone,
+ * so the char-count pass below doesn't double-count the base64) and add its real
+ * image-token cost (`anthropicImageTokens` + per-block overhead). Malformed/undecodable
+ * blocks are left as-is and fall back to char-counting like any other value — never throw.
+ * Tier is fixed to "standard": production resolves every tier to standard today (measured
+ * in the omniglyph billing sweep — see anthropic-vision.ts), so there is no model-specific
+ * signal available here that would change the result.
+ */
+function blankImageBlocksAndSumImageTokens(body: Record<string, unknown>): {
+  clone: Record<string, unknown>;
+  imageTokens: number;
+} {
+  let imageTokens = 0;
+  const clone: Record<string, unknown> = { ...body };
+
+  const processContentArray = (content: unknown): unknown => {
+    if (!Array.isArray(content)) return content;
+    return content.map((block) => {
+      if (!isAnthropicPngImageBlock(block)) return block;
+      const dims = decodePngDimensions(block.source.data);
+      if (!dims) return block; // fall back to char-counting this block as-is
+      imageTokens += anthropicImageTokens(dims.width, dims.height, "standard");
+      imageTokens += ANTHROPIC_IMAGE_BLOCK_OVERHEAD_TOKENS;
+      return { ...block, source: { ...block.source, data: "" } };
+    });
+  };
+
+  if (Array.isArray(clone.messages)) {
+    clone.messages = clone.messages.map((message) => {
+      if (!message || typeof message !== "object") return message;
+      const m = message as Record<string, unknown>;
+      if (!Array.isArray(m.content)) return message;
+      return { ...m, content: processContentArray(m.content) };
+    });
+  }
+
+  if (Array.isArray(clone.system)) {
+    clone.system = processContentArray(clone.system);
+  }
+
+  return { clone, imageTokens };
+}
+
 export function estimateCompressionTokens(text: string | object | null | undefined): number {
   if (!text) return 0;
-  const str = typeof text === "string" ? text : JSON.stringify(text);
-  return Math.ceil(str.length / CHARS_PER_TOKEN);
+  if (typeof text === "string") {
+    return Math.ceil(text.length / CHARS_PER_TOKEN);
+  }
+  try {
+    const { clone, imageTokens } = blankImageBlocksAndSumImageTokens(
+      text as Record<string, unknown>
+    );
+    if (imageTokens === 0) {
+      // No recognized image blocks — byte-identical to the legacy behavior.
+      return Math.ceil(JSON.stringify(text).length / CHARS_PER_TOKEN);
+    }
+    return Math.ceil(JSON.stringify(clone).length / CHARS_PER_TOKEN) + imageTokens;
+  } catch {
+    // Non-serializable/unexpected shape → fall back to the legacy char-count,
+    // never throw out of an estimator.
+    return charTokensOf(text);
+  }
 }
 
 export function createCompressionStats(
diff --git a/open-sse/services/compression/strategySelector.ts b/open-sse/services/compression/strategySelector.ts
index 4be701e205..e95581b814 100644
--- a/open-sse/services/compression/strategySelector.ts
+++ b/open-sse/services/compression/strategySelector.ts
@@ -13,7 +13,7 @@ import { cavemanCompress } from "./caveman.ts";
 import { compressAggressive } from "./aggressive.ts";
 import { ultraCompress, ultraCompressHeuristic } from "./ultra.ts";
 import { createCompressionStats } from "./stats.ts";
-import { guardPipelineInflation } from "./pipelineGuards.ts";
+import { applyStackedInflationGuard } from "./pipelineGuards.ts";
 import {
   resolvePipelineBreakerConfig,
   canRunEngine,
@@ -30,6 +30,7 @@ import {
 } from "./stackedStepCore.ts";
 import { registerBuiltinCompressionEngines } from "./engines/index.ts";
 import { getCompressionEngine, getEngineEntry } from "./engines/registry.ts";
+import { applyOmniglyphSingleMode } from "./engines/omniglyphSingleMode.ts";
 import { applyRtkCompression } from "./engines/rtk/index.ts";
 import { adaptBodyForCompression } from "./bodyAdapter.ts";
 import {
@@ -321,6 +322,10 @@ function runCompression(
       config: { ...(options?.config?.rtkConfig ?? {}), enabled: true },
     });
   }
+  if (mode === "omniglyph") {
+    // omniglyph is async-only — use applyCompressionAsync. Safe no-op here.
+    return { body, compressed: false, stats: null };
+  }
   const adapter = adaptBodyForCompression(body);
   const compressionBody = adapter.body;
   if (mode === "lite") {
@@ -440,6 +445,8 @@ export async function applyCompressionAsync(
   options?: {
     model?: string;
     supportsVision?: boolean | null;
+    /** Direct-to-provider vs. aggregator transport (gates transport-sensitive engines like omniglyph). */
+    providerTransport?: "direct" | "aggregator";
     config?: CompressionConfig;
     principalId?: string;
     onEngineStep?: (step: StackedCompressionStep) => void;
@@ -457,6 +464,8 @@ async function runCompressionAsync(
   options?: {
     model?: string;
     supportsVision?: boolean | null;
+    /** Direct-to-provider vs. aggregator transport (gates transport-sensitive engines like omniglyph). */
+    providerTransport?: "direct" | "aggregator";
     config?: CompressionConfig;
     principalId?: string;
     onEngineStep?: (step: StackedCompressionStep) => void;
@@ -489,6 +498,8 @@ async function runCompressionAsync(
     memoStore(key, result);
     return memoLookup(key)!;
   }
+  // Single-mode omniglyph (async-only) — resolution lives in engines/omniglyphSingleMode.ts.
+  if (mode === "omniglyph") return applyOmniglyphSingleMode(body, options);
   if (mode === "stacked") {
     const adapter = adaptBodyForCompression(body);
     const result = await applyStackedCompressionAsync(
@@ -631,6 +642,8 @@ export interface StackedCompressionStep {
 interface StackOptions {
   model?: string;
   supportsVision?: boolean | null;
+  /** Direct-to-provider vs. aggregator transport (gates transport-sensitive engines like omniglyph). */
+  providerTransport?: "direct" | "aggregator";
   config?: CompressionConfig;
   compressionComboId?: string | null;
   /** TV1 bail-out discipline (opt-in, default disabled). */
@@ -669,15 +682,32 @@ function reportEngineStep(
   });
 }
 
+/**
+ * #6463: When callers dispatch mode="stacked" WITHOUT pre-deriving the pipeline from the
+ * per-engine toggle map (e.g. /api/compression/preview, external routes that only forward
+ * the persisted config), the stacked loop must not silently fall back to the built-in
+ * [rtk, caveman] default while ignoring the operator's toggled engines. This resolver
+ * honors the explicit pipeline first, then the engines-derived pipeline, and only
+ * falls back to the historical default when neither source produced steps.
+ */
 function resolveStackSteps(
-  pipeline?: Array<CompressionPipelineStep | string>
+  pipeline?: Array<CompressionPipelineStep | string>,
+  config?: CompressionConfig
 ): CompressionPipelineStep[] {
-  return pipeline && pipeline.length > 0
-    ? pipeline.map(normalizePipelineStep)
-    : [
-        { engine: "rtk", intensity: "standard" },
-        { engine: "caveman", intensity: "full" },
-      ];
+  if (pipeline && pipeline.length > 0) return pipeline.map(normalizePipelineStep);
+
+  const engines = config?.engines;
+  if (engines && Object.values(engines).some((e) => e?.enabled === true)) {
+    const derived = deriveDefaultPlan(engines, true);
+    if (derived.mode === "stacked" && derived.stackedPipeline.length > 0) {
+      return derived.stackedPipeline as CompressionPipelineStep[];
+    }
+  }
+
+  return [
+    { engine: "rtk", intensity: "standard" },
+    { engine: "caveman", intensity: "full" },
+  ];
 }
 
 function buildStepOptions(
@@ -732,30 +762,10 @@ function finalizeStackedResult(
     });
   }
 
-  // T02 / H1: honest aggregate inflation guard. If the fully-stacked body did not actually shrink
-  // (its token count is >= the original), discard it and return the verbatim original — safe by
-  // construction, since the original request body is always a valid payload.
-  const inflation = guardPipelineInflation({
-    originalBody,
-    compressedBody: currentBody,
-    originalTokens: stats.originalTokens,
-    compressedTokens: stats.compressedTokens,
-  });
-  if (inflation.inflated) {
-    const inflatedTokens = stats.compressedTokens;
-    const warnings = new Set(stats.validationWarnings ?? []);
-    warnings.add(
-      `pipeline-inflation-guard: stacked output (${inflatedTokens} tok) did not shrink input ` +
-        `(${stats.originalTokens} tok); reverted to original`
-    );
-    stats.validationWarnings = Array.from(warnings);
-    stats.fallbackApplied = true;
-    stats.compressedTokens = stats.originalTokens;
-    stats.savingsPercent = 0;
-    return { body: inflation.body, compressed: false, stats };
-  }
-
-  return { body: currentBody, compressed, stats };
+  // T02 / H1 / #6480: honest aggregate inflation guard, gated on the loop-level `compressed`
+  // flag so a pipeline where nothing ever advanced isn't mislabeled as a reverted fallback.
+  // See `applyStackedInflationGuard` in `pipelineGuards.ts` for the full rationale.
+  return applyStackedInflationGuard(originalBody, currentBody, compressed, stats);
 }
 
 // ── Shared per-step helpers (used by the sync + async stacked loops; keep them in lockstep) ──
@@ -819,7 +829,7 @@ function runStackedCompression(
   pipeline?: Array<CompressionPipelineStep | string>,
   options?: StackOptions
 ): CompressionResult {
-  const steps = resolveStackSteps(pipeline);
+  const steps = resolveStackSteps(pipeline, options?.config);
   registerBuiltinCompressionEngines();
 
   let currentBody = body;
@@ -845,7 +855,10 @@ function runStackedCompression(
     }
     // Respect the registry enabled flag: a step naming a disabled engine is skipped, so an
     // operator can turn an engine off (setEngineEnabled) without editing every pipeline.
-    if (getEngineEntry(step.engine)?.enabled === false) continue;
+    if (getEngineEntry(step.engine)?.enabled === false) {
+      acc.validationWarnings.add(`${step.engine}: skipped (engine disabled in registry)`);
+      continue;
+    }
     // T02: when the per-engine breaker is OPEN, skip this step (verbatim body kept — fail-open).
     if (breakerOn && !canRunEngine(step.engine, breaker)) {
       acc.validationWarnings.add(`${step.engine}: skipped (pipeline circuit-breaker open)`);
@@ -922,7 +935,7 @@ async function runStackedCompressionAsync(
   pipeline?: Array<CompressionPipelineStep | string>,
   options?: StackOptions
 ): Promise<CompressionResult> {
-  const steps = resolveStackSteps(pipeline);
+  const steps = resolveStackSteps(pipeline, options?.config);
   registerBuiltinCompressionEngines();
 
   let currentBody = body;
@@ -947,7 +960,10 @@ async function runStackedCompressionAsync(
       continue;
     }
     // Respect the registry enabled flag (same as the sync loop) — keep both in lockstep.
-    if (getEngineEntry(step.engine)?.enabled === false) continue;
+    if (getEngineEntry(step.engine)?.enabled === false) {
+      acc.validationWarnings.add(`${step.engine}: skipped (engine disabled in registry)`);
+      continue;
+    }
     // T02: skip an engine whose breaker is OPEN (verbatim body kept — fail-open). Lockstep w/ sync.
     if (breakerOn && !canRunEngine(step.engine, breaker)) {
       acc.validationWarnings.add(`${step.engine}: skipped (pipeline circuit-breaker open)`);
diff --git a/open-sse/services/compression/types.ts b/open-sse/services/compression/types.ts
index 5df5f266c4..9bba7973b2 100644
--- a/open-sse/services/compression/types.ts
+++ b/open-sse/services/compression/types.ts
@@ -25,7 +25,7 @@ import type { QuantumLockConfig, QuantumLockStats } from "./quantumLock/quantumP
 export { ENGINE_IDS };
 
 export type CompressionMode =
-  "off" | "lite" | "standard" | "aggressive" | "ultra" | "rtk" | "stacked";
+  "off" | "lite" | "standard" | "aggressive" | "ultra" | "rtk" | "omniglyph" | "stacked";
 export type CavemanIntensity = "lite" | "full" | "ultra";
 export type RtkIntensity = "minimal" | "standard" | "aggressive";
 export type RtkRawOutputRetention = "never" | "failures" | "always";
@@ -38,7 +38,9 @@ export type CompressionEngineId =
   | "session-dedup"
   | "headroom"
   | "ccr"
-  | "llmlingua";
+  | "llmlingua"
+  | "relevance"
+  | "omniglyph";
 
 export interface CavemanRule {
   name: string;
diff --git a/open-sse/services/crofUsageFetcher.ts b/open-sse/services/crofUsageFetcher.ts
index 869aa27303..442d70659c 100644
--- a/open-sse/services/crofUsageFetcher.ts
+++ b/open-sse/services/crofUsageFetcher.ts
@@ -31,6 +31,7 @@
 
 import { registerQuotaFetcher, type QuotaInfo } from "./quotaPreflight.ts";
 import { registerMonitorFetcher } from "./quotaMonitor.ts";
+import { throttleQuotaFetch } from "./quotaFetchThrottle.ts";
 
 const CROF_USAGE_URL = "https://crof.ai/usage_api/";
 const CACHE_TTL_MS = 60_000;
@@ -137,6 +138,8 @@ export async function fetchCrofUsage(
   }
 
   try {
+    // #6911: space concurrent upstream quota fetches (mirrors codexQuotaFetcher.ts).
+    await throttleQuotaFetch();
     const response = await fetch(CROF_USAGE_URL, {
       method: "GET",
       headers: {
diff --git a/open-sse/services/deepseekQuotaFetcher.ts b/open-sse/services/deepseekQuotaFetcher.ts
index 04585df0c0..f7f771f58c 100644
--- a/open-sse/services/deepseekQuotaFetcher.ts
+++ b/open-sse/services/deepseekQuotaFetcher.ts
@@ -24,6 +24,7 @@
 
 import { registerQuotaFetcher, type QuotaInfo } from "./quotaPreflight.ts";
 import { registerMonitorFetcher } from "./quotaMonitor.ts";
+import { throttleQuotaFetch } from "./quotaFetchThrottle.ts";
 
 // DeepSeek API config
 const DEEPSEEK_CONFIG = {
@@ -188,6 +189,11 @@ export async function fetchDeepseekQuota(
   const url = `${DEEPSEEK_CONFIG.baseUrl}${DEEPSEEK_CONFIG.balancePath}`;
 
   try {
+    // #6911: space concurrent upstream quota fetches so N accounts on one IP do
+    // not all hit the provider in the same second (mirrors codexQuotaFetcher.ts).
+    // Cache hits above never reach here; this only paces genuine network calls.
+    await throttleQuotaFetch();
+
     const response = await fetch(url, {
       method: "GET",
       headers: {
diff --git a/open-sse/services/errorClassifier.ts b/open-sse/services/errorClassifier.ts
index fb1f9c2116..3d978fec4c 100644
--- a/open-sse/services/errorClassifier.ts
+++ b/open-sse/services/errorClassifier.ts
@@ -4,7 +4,7 @@ import {
   isDailyQuotaExhausted,
   isOAuthInvalidToken,
 } from "./accountFallback.ts";
-import { getProviderCategory } from "../config/providerRegistry.ts";
+import { getProviderCategory, getRegistryEntry } from "../config/providerRegistry.ts";
 
 // Terminal stop signals where an empty content payload is still a legitimate,
 // successful completion (truncated at the token limit, or a tool-call turn) —
@@ -76,6 +76,7 @@ export const PROVIDER_ERROR_TYPES = {
   CONTEXT_OVERFLOW: "context_overflow",
   OAUTH_INVALID_TOKEN: "oauth_invalid_token",
   EMPTY_CONTENT: "empty_content",
+  MODEL_NOT_FOUND: "model_not_found",
 };
 
 export const CONTEXT_OVERFLOW_SIGNALS = [
@@ -144,6 +145,15 @@ export function classifyProviderError(
     return PROVIDER_ERROR_TYPES.RATE_LIMITED;
   }
 
+  // 404 — model or endpoint not found. Without classification the error
+  // falls through to `return null`, so no cooldown/lockout is applied and the
+  // retry/backoff loop keeps hammering the dead endpoint until the upstream
+  // rate-limits it (404 + 429 storm). Classify as MODEL_NOT_FOUND so the model
+  // gets locked via the cooldown layer and retries stop. (#6827)
+  if (statusCode === 404) {
+    return PROVIDER_ERROR_TYPES.MODEL_NOT_FOUND;
+  }
+
   if (statusCode === 401) {
     if (oauthInvalid) {
       return PROVIDER_ERROR_TYPES.OAUTH_INVALID_TOKEN;
@@ -186,6 +196,15 @@ export function classifyProviderError(
     if (provider && getProviderCategory(provider) === "apikey") {
       return null;
     }
+    // No-credential ("authType: none") providers — free, stateless per-request
+    // token proxies like mimocode/theoldllm — have no real account/credential
+    // to revoke. An unrecognized 403 from these is a transient upstream
+    // rate-limit/blocklist signal, not an account ban: keep it recoverable so
+    // the connection cooldown/retry layer handles it instead of a permanent
+    // "banned" state on the first unmatched 403. (#6315, #6345)
+    if (provider && getRegistryEntry(provider)?.authType === "none") {
+      return null;
+    }
     return PROVIDER_ERROR_TYPES.FORBIDDEN;
   }
   if (statusCode >= 500) return PROVIDER_ERROR_TYPES.SERVER_ERROR;
diff --git a/open-sse/services/fusion.ts b/open-sse/services/fusion.ts
index 5d6f5bac0a..000f5a21c5 100644
--- a/open-sse/services/fusion.ts
+++ b/open-sse/services/fusion.ts
@@ -122,7 +122,11 @@ export function buildJudgePrompt(answers: Array<{ text: string }>): string {
     "",
     "Do NOT mention that multiple models were used, and do NOT refer to the sources. Produce ONE authoritative final answer addressed directly to the user.",
     "",
-    "First, internally analyze the panel along these dimensions: consensus (points most sources agree on — treat as higher-confidence), contradictions (where they disagree — resolve with your own judgment), partial coverage, unique insights only one source surfaced, and blind spots every source missed. Then write the best possible final answer grounded in that analysis — more complete and correct than any single response, with no filler.",
+    "First, internally analyze the panel along these dimensions: consensus (points most sources agree on — usually higher-confidence, but NOT automatically correct), contradictions (where they disagree — resolve with your own judgment), partial coverage, unique insights only one source surfaced, and blind spots every source missed.",
+    "",
+    "You are not a vote-counter, and the panel is not a ceiling — treat it as strong evidence, not as the limit of what you may say. Apply your OWN reasoning and knowledge as a full participant: if the consensus is wrong, incomplete, or outdated, override it and state what is correct; if every source missed something you know, add it; if a lone source is right against the majority, side with it. Do not water down a correct answer to match panel agreement. The only hard limit is honesty — do not assert facts you are not confident about.",
+    "",
+    "Then write the best possible final answer — more complete and correct than any single response, and than the panel as a whole — with no filler.",
     "",
     "=== PANEL RESPONSES ===",
     panel,
@@ -247,8 +251,11 @@ export async function handleFusionChat({
     stragglerGraceMs: tuning?.stragglerGraceMs ?? FUSION_DEFAULTS.stragglerGraceMs,
     panelHardTimeoutMs: tuning?.panelHardTimeoutMs ?? FUSION_DEFAULTS.panelHardTimeoutMs,
   };
-  const minPanel = Math.min(Math.max(2, cfg.minPanel), panel.length);
-  const judge = judgeModel && judgeModel.trim() ? judgeModel.trim() : panel[0];
+  // Honor user-supplied minPanel down to 1: with 1 survivor we still degrade
+  // gracefully via the answers.length===1 branch below (issue #6454).
+  const minPanel = Math.min(Math.max(1, cfg.minPanel), panel.length);
+  const hasExplicitJudge = Boolean(judgeModel && judgeModel.trim());
+  const judge = hasExplicitJudge ? (judgeModel as string).trim() : panel[0];
   log.info(
     "FUSION",
     `Combo "${comboName ?? ""}" | panel=${panel.length} [${panel.join(", ")}] | judge=${judge} | quorum=${minPanel}`
@@ -266,35 +273,39 @@ export async function handleFusionChat({
   const settled = await collectPanel(calls, { ...cfg, minPanel });
   log.info("FUSION", `fan-out collected in ${Date.now() - t0}ms`);
 
-  // 2. Collect successful answers.
+  // 2. Collect successful answers + per-member failure reasons (issue #6454).
   const answers: Array<{ model: string; text: string }> = [];
-  const rateLimited: string[] = [];
+  const failures: Array<{ model: string; reason: string }> = [];
   for (let i = 0; i < settled.length; i++) {
     const res = settled[i];
     const model = panel[i];
     if (!res) {
       log.warn("FUSION", `Panel ${model} dropped (straggler/timeout)`);
+      failures.push({ model, reason: "straggler_dropped" });
       continue;
     }
     const sentinel = res as Sentinel;
     if (sentinel.__timeout) {
       log.warn("FUSION", `Panel ${model} timed out`);
+      failures.push({ model, reason: "timeout" });
       continue;
     }
     if (sentinel.__error) {
       log.warn("FUSION", `Panel ${model} threw`, {
         error: sanitizeErrorMessage(sentinel.__error as Error),
       });
+      failures.push({ model, reason: "threw" });
       continue;
     }
     const resp = res as Response;
     if (!resp.ok) {
-      if (resp.status === 429) {
-        rateLimited.push(model);
-        log.warn("FUSION", `Panel ${model} rate-limited`, { status: resp.status });
-      } else {
-        log.warn("FUSION", `Panel ${model} failed`, { status: resp.status });
-      }
+      // Per-member reason keeps the exact status code (e.g. status_429 for a
+      // rate-limit fan-fail, status_503 for an outage) — strictly more
+      // informative than the earlier aggregate rate-limit count (#6454).
+      failures.push({ model, reason: `status_${resp.status}` });
+      log.warn("FUSION", `Panel ${model} ${resp.status === 429 ? "rate-limited" : "failed"}`, {
+        status: resp.status,
+      });
       continue;
     }
     try {
@@ -305,33 +316,69 @@ export async function handleFusionChat({
         log.info("FUSION", `Panel ${model} ok (${text.length} chars)`);
       } else {
         log.warn("FUSION", `Panel ${model} returned empty content`);
+        failures.push({ model, reason: "empty_content" });
       }
     } catch (e) {
       log.warn("FUSION", `Panel ${model} unparseable`, {
         error: sanitizeErrorMessage(e as Error),
       });
+      failures.push({ model, reason: "unparseable" });
     }
   }
 
   // 3. Degrade gracefully when the panel is too thin to fuse.
   if (answers.length === 0) {
-    const detail =
-      rateLimited.length > 0
-        ? `${rateLimited.length} models rate-limited, ${panel.length - rateLimited.length} failed`
-        : `all ${panel.length} models failed`;
+    // Surface per-member reasons so operators can distinguish a rate-limit
+    // fan-fail (reason=rate_limited) from an outage (issue #6454). This supersedes
+    // the earlier aggregate "N rate-limited, M failed" summary — per-member is
+    // strictly more informative. Still routed through errorResponse for sanitization.
+    const detail = failures.map((f) => `${f.model}=${f.reason}`).join(", ");
     log.warn("FUSION", `No live models: ${detail}`);
-    return errorResponse(503, `All fusion panel models failed (${detail})`);
+    return errorResponse(
+      503,
+      detail ? `All fusion panel models failed: ${detail}` : "All fusion panel models failed"
+    );
   }
+  if (answers.length === 1) {
+    // No explicit judgeModel configured: the "judge" is just panel[0], so
+    // synthesizing from a single source through itself would be redundant —
+    // answer directly with the lone survivor (issue #6454).
+    if (!hasExplicitJudge) {
+      log.info(
+        "FUSION",
+        `Only ${answers[0].model} succeeded — answering directly (no fusion)`
+      );
+      return handleSingleModel(body, answers[0].model);
+    }
+    // An explicit judgeModel IS configured: honor it even with a single
+    // surviving panel answer, rather than silently substituting the panel
+    // member for the configured judge (issue #6455). The judge still adds
+    // value reviewing/polishing a lone source per its documented contract.
+  }
+
+  // Resolve the judge that ACTUALLY runs synthesis. An explicit judgeModel is
+  // honored as configured (operator intent — kept even if it was down during
+  // fan-out; that's the operator's choice). With NO explicit judge the judge
+  // defaulted to panel[0] — but panel[0] may have FAILED fan-out (timeout /
+  // rate-limit / dropped straggler → it lands in `failures`, not `answers`).
+  // Handing synthesis to a dead panel[0] sinks the whole request despite a
+  // healthy quorum — exactly the case fusion exists to tolerate. So pick a
+  // SURVIVOR: prefer panel[0] when it survived, otherwise the first survivor.
+  const effectiveJudge = hasExplicitJudge
+    ? judge
+    : answers.some((a) => a.model === panel[0])
+      ? panel[0]
+      : answers[0].model;
+
   if (answers.length === 1) {
     log.info(
       "FUSION",
-      `Only ${answers[0].model} succeeded — answering directly (no fusion)`
+      `Only ${answers[0].model} succeeded — judging single answer with ${effectiveJudge}`
     );
-    return handleSingleModel(body, answers[0].model);
   }
 
   // 4. Judge analyzes + writes one final answer (streams to client if requested).
   const judgeBody = appendUserTurn(body, buildJudgePrompt(answers));
-  log.info("FUSION", `Judging ${answers.length} answers with ${judge}`);
-  return handleSingleModel(judgeBody, judge);
+  log.info("FUSION", `Judging ${answers.length} answers with ${effectiveJudge}`);
+  return handleSingleModel(judgeBody, effectiveJudge);
 }
diff --git a/open-sse/services/genericQuotaFetcher.ts b/open-sse/services/genericQuotaFetcher.ts
index acf03996a2..bed1409596 100644
--- a/open-sse/services/genericQuotaFetcher.ts
+++ b/open-sse/services/genericQuotaFetcher.ts
@@ -72,6 +72,11 @@ function percentUsedForQuota(entry: unknown): number | null {
   if (!entry || typeof entry !== "object") return null;
   const q = entry as Record<string, unknown>;
   if (q.unlimited === true) return null;
+  // Upstream explicitly told us it did not report this window's fraction
+  // (e.g. Antigravity per-model quota with no usage data yet). Treat as
+  // unknown rather than defaulting remainingPercentage:0 into "100% used" —
+  // otherwise one unreported model falsely exhausts the whole connection.
+  if (q.fractionReported === false) return null;
 
   const remainingPercentage = toNumber(q.remainingPercentage);
   if (remainingPercentage !== null) {
diff --git a/open-sse/services/kiroExternalIdp.ts b/open-sse/services/kiroExternalIdp.ts
new file mode 100644
index 0000000000..3e27c8120d
--- /dev/null
+++ b/open-sse/services/kiroExternalIdp.ts
@@ -0,0 +1,175 @@
+/**
+ * kiroExternalIdp.ts — shared helpers for Kiro / Amazon Q **External IdP**
+ * (enterprise "Your organization" SSO) accounts.
+ *
+ * Unlike AWS Builder ID / IAM Identity Center (which mint AWS SSO-OIDC tokens
+ * refreshed at `oidc.{region}.amazonaws.com` and whose refresh token starts with
+ * `aorAAAAAG`) or the Google/GitHub social flow (refreshed at the Kiro auth
+ * service), an **External IdP** login federates through the organization's own
+ * identity provider (most commonly Microsoft Entra ID). Its Kiro token file
+ * (`~/.aws/sso/cache/kiro-auth-token.json`) looks like:
+ *
+ *   {
+ *     "accessToken":  "<JWT issued by the org IdP, scp: codewhisperer:*>",
+ *     "refreshToken": "<IdP refresh token, NOT aorAAAAAG…>",
+ *     "authMethod":   "external_idp",
+ *     "provider":     "ExternalIdp",
+ *     "clientId":     "<IdP application (client) id — a public client, no secret>",
+ *     "tokenEndpoint":"https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token",
+ *     "issuerUrl":    "https://login.microsoftonline.com/{tenant}/v2.0",
+ *     "scopes":       "api://{clientId}/codewhisperer:conversations … offline_access"
+ *   }
+ *
+ * Two consequences this module encodes (both verified against a live org token):
+ *   1. The token is refreshed with a **standard public-client OAuth2
+ *      `refresh_token` grant against `tokenEndpoint`** (form-encoded
+ *      client_id + refresh_token + scope, NO client_secret) — see
+ *      {@link buildExternalIdpRefreshParams}.
+ *   2. At runtime the access token is sent to CodeWhisperer as a normal bearer
+ *      but MUST carry the header `TokenType: EXTERNAL_IDP` so the service binds
+ *      it to the Amazon Q Developer profile (without it every call returns
+ *      `ValidationException: Invalid ARN <clientId>`). The profileArn itself is
+ *      NOT discoverable via `ListAvailableProfiles` (it returns an empty list
+ *      for these tokens); it is read from the Kiro IDE `profile.json` at import.
+ */
+
+/** authMethod marker persisted on External IdP connections. */
+export const KIRO_EXTERNAL_IDP_AUTH_METHOD = "external_idp";
+
+/** Header CodeWhisperer requires to bind an External IdP bearer to its profile. */
+export const KIRO_EXTERNAL_IDP_TOKEN_TYPE_HEADER = "TokenType";
+export const KIRO_EXTERNAL_IDP_TOKEN_TYPE_VALUE = "EXTERNAL_IDP";
+
+/**
+ * Allowlist of enterprise IdP token-endpoint host suffixes. The refresh token is
+ * POSTed to this endpoint, so we constrain it to well-known identity providers
+ * (SSRF guard — the value ultimately originates from an on-disk token file).
+ * Microsoft Entra is by far the most common Kiro org IdP; the others cover the
+ * major enterprise SSO vendors an org might federate Kiro through.
+ */
+const ALLOWED_IDP_HOST_SUFFIXES: readonly string[] = [
+  "login.microsoftonline.com",
+  "login.microsoftonline.us",
+  "login.partner.microsoftonline.cn",
+  "login.microsoft.com",
+  "login.windows.net",
+  "sts.windows.net",
+  ".okta.com",
+  ".oktapreview.com",
+  ".okta-emea.com",
+  ".auth0.com",
+  ".onelogin.com",
+  ".pingidentity.com",
+  ".pingone.com",
+  "accounts.google.com",
+  "oauth2.googleapis.com",
+  ".amazoncognito.com",
+];
+
+function normalizeString(value: unknown): string {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+/** True when a connection's providerSpecificData marks it as an External IdP login. */
+export function isExternalIdpAuthMethod(authMethod: unknown): boolean {
+  return normalizeString(authMethod).toLowerCase() === KIRO_EXTERNAL_IDP_AUTH_METHOD;
+}
+
+/**
+ * Validate the IdP token endpoint before it is used as a fetch target. Requires
+ * https and a host on {@link ALLOWED_IDP_HOST_SUFFIXES}. Returns the normalized
+ * URL string; throws on anything unexpected.
+ */
+export function validateExternalIdpTokenEndpoint(rawEndpoint: unknown): string {
+  const tokenEndpoint = normalizeString(rawEndpoint);
+  if (!tokenEndpoint) throw new Error("tokenEndpoint is required for external_idp");
+  let parsed: URL;
+  try {
+    parsed = new URL(tokenEndpoint);
+  } catch {
+    throw new Error("tokenEndpoint must be a valid URL");
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error("tokenEndpoint must use https");
+  }
+  const host = parsed.hostname.toLowerCase();
+  const allowed = ALLOWED_IDP_HOST_SUFFIXES.some((suffix) =>
+    suffix.startsWith(".") ? host.endsWith(suffix) : host === suffix
+  );
+  if (!allowed) {
+    throw new Error(`tokenEndpoint host is not an allowed identity provider: ${host}`);
+  }
+  return parsed.toString();
+}
+
+/** Collapse an array-or-space-delimited scope value into a single space-delimited string. */
+export function normalizeScope(scopes: unknown): string {
+  if (Array.isArray(scopes)) {
+    return scopes.map(normalizeString).filter(Boolean).join(" ");
+  }
+  return normalizeString(scopes);
+}
+
+/** Best-effort base64url JWT payload decode (no signature verification). */
+export function decodeJwtPayload(jwt: unknown): Record<string, unknown> | null {
+  try {
+    if (typeof jwt !== "string") return null;
+    const parts = jwt.split(".");
+    if (parts.length !== 3) return null;
+    const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const padding = (4 - (base64.length % 4)) % 4;
+    const json = Buffer.from(`${base64}${"=".repeat(padding)}`, "base64").toString("utf8");
+    return JSON.parse(json) as Record<string, unknown>;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Extract the login identity (email) from an External IdP access token. Org IdP
+ * tokens carry it as `preferred_username`/`upn`/`email` rather than the AWS
+ * `email` claim — otherwise the connection surfaces as the opaque "ExternalIdp".
+ */
+export function emailFromExternalIdpToken(accessToken: unknown): string | null {
+  const claims = decodeJwtPayload(accessToken);
+  if (!claims) return null;
+  const pick = (k: string): string | undefined =>
+    typeof claims[k] === "string" ? (claims[k] as string) : undefined;
+  return pick("email") || pick("preferred_username") || pick("upn") || null;
+}
+
+export interface ExternalIdpRefreshRequest {
+  tokenEndpoint: string;
+  body: URLSearchParams;
+}
+
+/**
+ * Build the public-client `refresh_token` grant for an External IdP token. The
+ * IdP application is a PUBLIC client (no secret), so the body is exactly
+ * `grant_type=refresh_token&client_id&refresh_token&scope`. Throws when any
+ * required field is missing/invalid so callers can fail closed.
+ */
+export function buildExternalIdpRefreshParams(
+  refreshToken: string,
+  providerSpecificData: Record<string, unknown> | null | undefined
+): ExternalIdpRefreshRequest {
+  const psd = providerSpecificData || {};
+  const clientId = normalizeString(psd.clientId ?? (psd as Record<string, unknown>).client_id);
+  const tokenEndpoint = validateExternalIdpTokenEndpoint(
+    psd.tokenEndpoint ?? (psd as Record<string, unknown>).token_endpoint
+  );
+  const scope = normalizeScope(psd.scope ?? psd.scopes);
+
+  if (!refreshToken) throw new Error("refresh token is required for external_idp refresh");
+  if (!clientId) throw new Error("clientId is required for external_idp refresh");
+  if (!scope) throw new Error("scope is required for external_idp refresh");
+
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    client_id: clientId,
+    refresh_token: refreshToken,
+    scope,
+  });
+
+  return { tokenEndpoint, body };
+}
diff --git a/open-sse/services/kiroModels.ts b/open-sse/services/kiroModels.ts
index 24bc13d810..717e8bac66 100644
--- a/open-sse/services/kiroModels.ts
+++ b/open-sse/services/kiroModels.ts
@@ -23,8 +23,23 @@
  * never breaks when the account is offline / unauthenticated / token-expired.
  */
 
+import { createHash } from "node:crypto";
+
+import { v4 as uuidv4 } from "uuid";
+
+import { resolveKiroRuntimeRegion } from "./kiroRegion.ts";
+
 type RawRecord = Record<string, unknown>;
 
+const KIRO_RUNTIME_SDK_VERSION = "1.0.0";
+const KIRO_AGENT_OS = "windows";
+const KIRO_AGENT_OS_VERSION = "10.0.26200";
+const KIRO_NODE_VERSION = "22.21.1";
+const KIRO_IDE_VERSION = "0.10.32";
+const CACHE_TTL_MS = 5 * 60 * 1000;
+
+const catalogCache = new Map<string, { expiresAt: number; models: KiroModel[] }>();
+
 function asRecord(value: unknown): RawRecord {
   return value && typeof value === "object" && !Array.isArray(value) ? (value as RawRecord) : {};
 }
@@ -39,6 +54,14 @@ export type KiroModel = {
   id: string;
   name: string;
   owned_by: string;
+  capabilities?: {
+    thinking: boolean;
+    agentic: boolean;
+  };
+  contextLength?: number;
+  rateMultiplier?: number;
+  upstreamModelId?: string;
+  description?: string;
 };
 
 export type KiroModelsResult = {
@@ -75,21 +98,104 @@ export function parseKiroModels(data: unknown): KiroModel[] {
   return models;
 }
 
+function stripSyntheticSuffixes(id: string): string {
+  let out = id;
+  if (out.endsWith("-agentic")) out = out.slice(0, -"-agentic".length);
+  if (out.endsWith("-thinking")) out = out.slice(0, -"-thinking".length);
+  return out;
+}
+
+function formatDisplayName(modelName: unknown, modelId: string, rateMultiplier: unknown): string {
+  const base = toNonEmptyString(modelName) || modelId;
+  const rate = Number(rateMultiplier);
+  if (!Number.isFinite(rate) || Math.abs(rate - 1.0) < 1e-9 || rate <= 0) {
+    return `Kiro ${base}`;
+  }
+  return `Kiro ${base} (${rate.toFixed(1)}x credit)`;
+}
+
+function buildVariants(upstream: string, displayName: string): KiroModel[] {
+  const safeUpstream = stripSyntheticSuffixes(upstream);
+  const display = displayName || `Kiro ${safeUpstream}`;
+  const isAuto = safeUpstream === "auto" || safeUpstream === "auto-kiro";
+  const variants: KiroModel[] = [
+    {
+      id: safeUpstream,
+      name: display,
+      owned_by: "kiro",
+      capabilities: { thinking: false, agentic: false },
+    },
+    {
+      id: `${safeUpstream}-thinking`,
+      name: `${display} (Thinking)`,
+      owned_by: "kiro",
+      capabilities: { thinking: true, agentic: false },
+    },
+  ];
+
+  if (!isAuto) {
+    variants.push({
+      id: `${safeUpstream}-agentic`,
+      name: `${display} (Agentic)`,
+      owned_by: "kiro",
+      capabilities: { thinking: false, agentic: true },
+    });
+    variants.push({
+      id: `${safeUpstream}-thinking-agentic`,
+      name: `${display} (Thinking + Agentic)`,
+      owned_by: "kiro",
+      capabilities: { thinking: true, agentic: true },
+    });
+  }
+
+  return variants;
+}
+
+function expandKiroModels(data: unknown): KiroModel[] {
+  const payload = asRecord(data);
+  const items = Array.isArray(payload.models)
+    ? (payload.models as unknown[])
+    : Array.isArray(payload.availableModels)
+      ? (payload.availableModels as unknown[])
+      : [];
+  const expanded: KiroModel[] = [];
+  const seen = new Set<string>();
+
+  for (const value of items) {
+    const item = asRecord(value);
+    const upstreamId = toNonEmptyString(item.modelId) || toNonEmptyString(item.id);
+    if (!upstreamId) continue;
+    const display = formatDisplayName(item.modelName || item.name, upstreamId, item.rateMultiplier);
+    const tokenLimits = asRecord(item.tokenLimits);
+    const contextLength = Number(tokenLimits.maxInputTokens) || 200000;
+    const rateMultiplier = Number(item.rateMultiplier);
+
+    for (const variant of buildVariants(upstreamId, display)) {
+      if (seen.has(variant.id)) continue;
+      seen.add(variant.id);
+      expanded.push({
+        ...variant,
+        contextLength,
+        rateMultiplier: Number.isFinite(rateMultiplier) ? rateMultiplier : 1.0,
+        upstreamModelId: upstreamId,
+        description: toNonEmptyString(item.description) || "",
+      });
+    }
+  }
+
+  return expanded;
+}
+
 /**
- * Derive the AWS region for a Kiro connection. Mirrors getKiroUsage: prefer the
- * stored region, then the region embedded in the profileArn, else us-east-1.
+ * Derive the RUNTIME AWS region for a Kiro connection's model discovery. Delegates to the shared
+ * resolver: the profileArn region wins (that is where the Q Developer profile + ListAvailableModels
+ * live — us-east-1 / eu-central-1), then a valid stored profile region, else us-east-1. The IdC
+ * token region (e.g. eu-north-1) is deliberately not used as a runtime region.
  */
 export function resolveKiroRegion(providerSpecificData: unknown): string {
-  const psd = asRecord(providerSpecificData);
-  const explicit = toNonEmptyString(psd.region);
-  if (explicit) return explicit.toLowerCase();
-
-  const profileArn = toNonEmptyString(psd.profileArn);
-  const fromArn = profileArn
-    ? profileArn.toLowerCase().match(/^arn:aws:codewhisperer:([a-z0-9-]+):/)?.[1]
-    : undefined;
-
-  return fromArn || "us-east-1";
+  return resolveKiroRuntimeRegion(
+    asRecord(providerSpecificData) as { region?: unknown; profileArn?: unknown }
+  );
 }
 
 /**
@@ -124,28 +230,69 @@ function toFallbackResult(
     .map((model) => {
       const id = toNonEmptyString(model.id);
       if (!id) return null;
-      return { id, name: toNonEmptyString(model.name) || id, owned_by: "kiro" };
+      return {
+        id,
+        name: toNonEmptyString(model.name) || id,
+        owned_by: "kiro",
+      };
     })
     .filter((model): model is KiroModel => Boolean(model));
   return { models, source: "fallback" };
 }
 
+function buildKiroFingerprintHeaders(providerSpecificData: unknown, accessToken: string) {
+  const psd = asRecord(providerSpecificData);
+  const seed =
+    toNonEmptyString(psd.clientId) ||
+    toNonEmptyString(psd.profileArn) ||
+    accessToken ||
+    "kiro-anonymous";
+  const machineId = createHash("sha256").update(String(seed)).digest("hex");
+  const userAgent =
+    `aws-sdk-js/${KIRO_RUNTIME_SDK_VERSION} ua/2.1 ` +
+    `os/${KIRO_AGENT_OS}#${KIRO_AGENT_OS_VERSION} ` +
+    `lang/js md/nodejs#${KIRO_NODE_VERSION} ` +
+    `api/codewhispererruntime#${KIRO_RUNTIME_SDK_VERSION} m/N,E ` +
+    `KiroIDE-${KIRO_IDE_VERSION}-${machineId}`;
+
+  return {
+    "User-Agent": userAgent,
+    "x-amz-user-agent": `aws-sdk-js/${KIRO_RUNTIME_SDK_VERSION} KiroIDE-${KIRO_IDE_VERSION}-${machineId}`,
+    "x-amzn-kiro-agent-mode": "vibe",
+    "x-amzn-codewhisperer-optout": "true",
+    "amz-sdk-request": "attempt=1; max=1",
+    "amz-sdk-invocation-id": uuidv4(),
+    Accept: "application/json",
+  };
+}
+
+function cacheKey(accessToken: string, providerSpecificData: unknown): string {
+  const psd = asRecord(providerSpecificData);
+  const seed =
+    toNonEmptyString(psd.profileArn) ||
+    toNonEmptyString(psd.clientId) ||
+    accessToken ||
+    "anonymous";
+  return createHash("sha256").update(`kiro:${seed}`).digest("hex");
+}
+
 async function tryFetchModels(
   fetchImpl: typeof fetch,
   url: string,
-  accessToken: string
+  accessToken: string,
+  providerSpecificData: unknown
 ): Promise<KiroModel[] | null> {
   try {
     const response = await fetchImpl(url, {
       method: "GET",
       headers: {
+        ...buildKiroFingerprintHeaders(providerSpecificData, accessToken),
         Authorization: `Bearer ${accessToken}`,
-        Accept: "application/json",
       },
     });
     if (!response.ok) return null;
     const data = await response.json();
-    const models = parseKiroModels(data);
+    const models = expandKiroModels(data);
     return models.length > 0 ? models : null;
   } catch {
     return null;
@@ -172,14 +319,28 @@ export async function fetchKiroAvailableModels(
     return toFallbackResult(fallbackModels);
   }
 
+  const key = cacheKey(token, providerSpecificData);
+  const cached = catalogCache.get(key);
+  if (cached && cached.expiresAt > Date.now()) {
+    return { models: cached.models, source: "api" };
+  }
+
   const region = resolveKiroRegion(providerSpecificData);
   const endpoints = buildKiroModelsEndpoints(region);
   const profileArn = toNonEmptyString(asRecord(providerSpecificData).profileArn);
 
   // Pass 1: origin-only (works for Builder ID / social / IdC).
   for (const base of endpoints) {
-    const models = await tryFetchModels(fetchImpl, `${base}?origin=AI_EDITOR`, token);
-    if (models) return { models, source: "api" };
+    const models = await tryFetchModels(
+      fetchImpl,
+      `${base}?origin=AI_EDITOR`,
+      token,
+      providerSpecificData
+    );
+    if (models) {
+      catalogCache.set(key, { expiresAt: Date.now() + CACHE_TTL_MS, models });
+      return { models, source: "api" };
+    }
   }
 
   // Pass 2: retry with profileArn (desktop accounts that require it) on the
@@ -187,9 +348,16 @@ export async function fetchKiroAvailableModels(
   // profileArn can 403.
   if (profileArn) {
     const url = `${endpoints[0]}?origin=AI_EDITOR&profileArn=${encodeURIComponent(profileArn)}`;
-    const models = await tryFetchModels(fetchImpl, url, token);
-    if (models) return { models, source: "api" };
+    const models = await tryFetchModels(fetchImpl, url, token, providerSpecificData);
+    if (models) {
+      catalogCache.set(key, { expiresAt: Date.now() + CACHE_TTL_MS, models });
+      return { models, source: "api" };
+    }
   }
 
   return toFallbackResult(fallbackModels);
 }
+
+export function clearKiroModelCache(): void {
+  catalogCache.clear();
+}
diff --git a/open-sse/services/kiroRegion.ts b/open-sse/services/kiroRegion.ts
new file mode 100644
index 0000000000..e87495cf33
--- /dev/null
+++ b/open-sse/services/kiroRegion.ts
@@ -0,0 +1,185 @@
+/**
+ * Shared Amazon Q Developer (Kiro / AWS CodeWhisperer) region resolution.
+ *
+ * TWO DISTINCT REGIONS — verified against the AWS docs "Amazon Q Developer Pro Region support"
+ * ("Supported Regions for the Q Developer console and Q Developer profile"):
+ *
+ *   • IdC / OIDC / token region — `providerSpecificData.region`. May be ANY of the ~30 IdC-
+ *     supported AWS regions (us-east-1, us-west-2, ca-central-1, sa-east-1, eu-west-1/2/3,
+ *     eu-central-1/2, eu-north-1, eu-south-1/2, ap-south-1/2, ap-east-1/2, ap-southeast-1..7,
+ *     ap-northeast-1/2/3, me-central-1, me-south-1, af-south-1, il-central-1, …). Used ONLY for
+ *     `oidc.{region}.amazonaws.com` token mint/refresh (see tokenRefresh.ts / oauth providers).
+ *   • Q Developer PROFILE / RUNTIME region — where the `profileArn` lives and every CodeWhisperer
+ *     runtime call is served (generateAssistantResponse, GetUsageLimits, ListAvailableModels,
+ *     ListAvailableProfiles). AWS currently hosts the profile ONLY in us-east-1 and eu-central-1,
+ *     REGARDLESS of the IdC region ("Regardless of the IAM Identity Center Region, data is stored
+ *     in the Region where you create the Amazon Q Developer profile"). The AWS docs' own example:
+ *     an IdC in us-west-1 → profile in us-east-1.
+ *
+ * Consequences enforced here:
+ *   • The RUNTIME region is the region embedded in the `profileArn` (authoritative — whatever
+ *     region AWS actually hosts the profile in), NOT the IdC region. Routing a runtime call to
+ *     `q.{idcRegion}.amazonaws.com` for a non-profile IdC region (e.g. q.eu-north-1, which does
+ *     not exist as a Q Developer runtime endpoint) is the root cause of the "Kiro IAM shows no
+ *     limits + every request returns 502" failure.
+ *   • profileArn discovery works for an IdC in ANY region: it probes the known profile regions
+ *     (us-east-1 / eu-central-1) with the cross-region SSO token, AND the IdC's own region as a
+ *     forward-compatible fallback (in case AWS ever co-locates or expands profile regions). The
+ *     discovered ARN's region then drives every runtime call.
+ */
+
+// Canonical AWS region shape — kept local (identical to AWS_REGION_PATTERN in
+// src/lib/oauth/constants/oauth.ts) so this open-sse module has no cross-tree import just to
+// validate a string. Guards against SSRF via region injection (GHSA-6mwv-4mrm-5p3m): the value
+// is interpolated into upstream URLs.
+export const AWS_REGION_PATTERN = /^[a-z]{2}-[a-z]+-\d{1,2}$/;
+
+/**
+ * Regions where the Amazon Q Developer *profile* is currently hosted (AWS docs: "Supported
+ * Regions for the Q Developer console and Q Developer profile"). These are the guaranteed
+ * discovery targets and the only regions trusted as a runtime fallback when no profileArn is
+ * known. The profileArn's own region is always honored above this list, so a future AWS
+ * profile-region expansion works automatically once an ARN is discovered.
+ */
+export const KIRO_PROFILE_REGIONS = ["us-east-1", "eu-central-1"] as const;
+
+/**
+ * CodeWhisperer / Amazon Q runtime host for a region. us-east-1 keeps the legacy
+ * codewhisperer.us-east-1 host (AWS Builder ID home region); other regions use the regional
+ * Amazon Q endpoint `q.{region}.amazonaws.com` — codewhisperer.{region}.amazonaws.com does not
+ * resolve for non-us-east-1 regions.
+ */
+export function kiroRuntimeHost(region: string): string {
+  return region === "us-east-1"
+    ? "https://codewhisperer.us-east-1.amazonaws.com"
+    : `https://q.${region}.amazonaws.com`;
+}
+
+/** Extract the region from a CodeWhisperer profile ARN (`arn:aws:codewhisperer:{region}:...`). */
+export function regionFromKiroProfileArn(profileArn?: string | null): string | undefined {
+  if (typeof profileArn !== "string") return undefined;
+  return profileArn.toLowerCase().match(/^arn:aws:codewhisperer:([a-z0-9-]+):/)?.[1];
+}
+
+function normalizeRegion(region: unknown): string {
+  return typeof region === "string" ? region.trim().toLowerCase() : "";
+}
+
+/**
+ * Resolve the RUNTIME region for CodeWhisperer / Amazon Q calls.
+ *
+ * Priority:
+ *   1. The region embedded in the `profileArn` — authoritative, this is where the Q Developer
+ *      profile (and thus the runtime) actually lives.
+ *   2. A stored region ONLY when it is a valid Q Developer profile region (us-east-1 /
+ *      eu-central-1). A stored IdC region that is not a Q profile region (e.g. eu-north-1) is
+ *      deliberately IGNORED for runtime — it is a token/OIDC region, not a runtime region.
+ *   3. us-east-1 (CodeWhisperer home region) as the final fallback.
+ */
+export function resolveKiroRuntimeRegion(
+  providerSpecificData: { region?: unknown; profileArn?: unknown } | null | undefined
+): string {
+  const fromArn = regionFromKiroProfileArn(
+    typeof providerSpecificData?.profileArn === "string"
+      ? providerSpecificData.profileArn
+      : undefined
+  );
+  if (fromArn) return fromArn;
+
+  const stored = normalizeRegion(providerSpecificData?.region);
+  if (stored && (KIRO_PROFILE_REGIONS as readonly string[]).includes(stored)) return stored;
+
+  return "us-east-1";
+}
+
+/**
+ * Build the ordered list of regions to probe for `ListAvailableProfiles`.
+ *
+ * The Amazon Q Developer profile (and thus every runtime endpoint) is currently hosted only in
+ * KIRO_PROFILE_REGIONS (us-east-1 / eu-central-1) regardless of the IdC region, so those are
+ * probed FIRST — EU-first when the IdC region is in EMEA (eu-, af-, me-, il- prefixes) to
+ * minimize latency. The IdC/stored region is then appended as a forward-compatible fallback: if
+ * AWS ever co-locates the profile with the IdC, or expands the profile-region list, a same-region
+ * probe still finds it. It is only appended when it is a valid AWS region distinct from the known
+ * profile regions; probing a region with no profile simply returns nothing and we fall through.
+ * This makes discovery work for an IdC in ANY region (us-west-2, ap-southeast-2, me-central-1,
+ * af-south-1, …), not just eu-north-1.
+ */
+export function buildKiroProfileDiscoveryRegions(storedRegion?: string | null): string[] {
+  const stored = normalizeRegion(storedRegion);
+  const preferEu = /^(eu|af|me|il)-/.test(stored);
+  const regions: string[] = preferEu
+    ? ["eu-central-1", "us-east-1"]
+    : ["us-east-1", "eu-central-1"];
+
+  if (stored && AWS_REGION_PATTERN.test(stored) && !regions.includes(stored)) {
+    regions.push(stored);
+  }
+  return regions;
+}
+
+async function listKiroProfileArnForRegion(
+  accessToken: string,
+  region: string,
+  fetchImpl: typeof fetch
+): Promise<string | undefined> {
+  // Defensive: region comes from a hardcoded allowlist here, but validate before it is
+  // interpolated into the runtime host (SSRF guard, GHSA-6mwv-4mrm-5p3m).
+  if (!AWS_REGION_PATTERN.test(region)) return undefined;
+  try {
+    const response = await fetchImpl(`${kiroRuntimeHost(region)}/`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-amz-json-1.0",
+        Accept: "application/json",
+        "x-amz-target": "AmazonCodeWhispererService.ListAvailableProfiles",
+        Authorization: `Bearer ${accessToken}`,
+      },
+      body: JSON.stringify({ maxResults: 10 }),
+      // Never let a hung/region-mismatched profile lookup block login or the quota refresh.
+      signal: AbortSignal.timeout(10000),
+    });
+    if (!response.ok) return undefined;
+
+    const data = (await response.json()) as { profiles?: unknown };
+    const profiles = Array.isArray(data?.profiles) ? data.profiles : [];
+    // Prefer a profile whose ARN region matches the region we queried; else take the first.
+    const matched =
+      profiles.find((profile: unknown) => {
+        const arn = (profile as { arn?: unknown })?.arn;
+        return typeof arn === "string" && regionFromKiroProfileArn(arn) === region;
+      }) || profiles[0];
+    const arn = (matched as { arn?: unknown })?.arn;
+    return typeof arn === "string" && arn.length > 0 ? arn : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Discover a Kiro/CodeWhisperer profile ARN by probing the Q Developer profile regions
+ * (us-east-1 / eu-central-1) AND the IdC/stored region with the account's access token. The SSO
+ * bearer token minted from the IdC region works cross-region against the Q Developer profile's
+ * region (AWS's documented multi-region IdC ⇄ profile setup), so an IdC in ANY region resolves.
+ * Returns the first ARN found (its embedded region is the authoritative runtime region), or
+ * undefined when no profile is available (e.g. AWS Builder ID accounts, or an org/token with no
+ * Kiro entitlement). Best-effort: never throws.
+ */
+export async function discoverKiroProfileArnAcrossRegions(
+  accessToken: string | null | undefined,
+  storedRegion?: string | null,
+  fetchImpl?: typeof fetch
+): Promise<string | undefined> {
+  const token = typeof accessToken === "string" ? accessToken.trim() : "";
+  if (!token) return undefined;
+
+  // Resolve fetch at call time (not module-load) so callers/tests that swap globalThis.fetch
+  // are honored when no explicit implementation is injected.
+  const doFetch = fetchImpl ?? globalThis.fetch;
+
+  for (const region of buildKiroProfileDiscoveryRegions(storedRegion)) {
+    const arn = await listKiroProfileArnForRegion(token, region, doFetch);
+    if (arn) return arn;
+  }
+  return undefined;
+}
diff --git a/open-sse/services/lmarenaTlsClient.ts b/open-sse/services/lmarenaTlsClient.ts
new file mode 100644
index 0000000000..896a6e7462
--- /dev/null
+++ b/open-sse/services/lmarenaTlsClient.ts
@@ -0,0 +1,605 @@
+/**
+ * Browser-TLS-impersonating HTTP client for arena.ai.
+ *
+ * Why this exists: LMArena sits behind Cloudflare Enterprise which pins
+ * `cf_clearance` to the client's TLS fingerprint (JA3/JA4) + HTTP/2 SETTINGS
+ * frame ordering. Node's Undici fetch presents an obvious "not a browser"
+ * handshake and gets challenged with a 403 even with a valid arena session
+ * cookie (and often a browser-minted `cf_clearance`). This module wraps
+ * `tls-client-node` (bogdanfinn/tls-client) to send a Chrome handshake instead.
+ *
+ * Mirrors `grokTlsClient.ts` / `perplexityTlsClient.ts` as an independent
+ * module so changes here cannot regress those production paths.
+ *
+ * Note: Arena may still require a browser-issued reCAPTCHA v3 token on
+ * create-evaluation; TLS alone is necessary but not always sufficient.
+ */
+
+import { tmpdir } from "node:os";
+import { join, dirname } from "node:path";
+import { mkdtemp, open, unlink, rmdir, stat } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+
+let clientPromise: Promise<unknown> | null = null;
+let exitHookInstalled = false;
+
+// Newest Chrome JA3 profile shipped by tls-client-node (no chrome_147+ yet).
+// HTTP User-Agent / Sec-Ch-Ua track Chrome 150 separately in models.ts.
+const LMARENA_PROFILE = "chrome_146";
+// Fixed timeouts (same defaults as other TLS sidecars). No extra env knobs —
+// env-doc-sync must not grow for provider-local constants.
+const DEFAULT_TIMEOUT_MS = 60_000;
+// Grace period added to the binding's wire-level timeout before our JS-level
+// hard timeout fires. Under healthy operation `tls-client-node` honors
+// `timeoutMilliseconds` and rejects on its own; the JS-level race only wins
+// when the koffi-loaded native library is wedged (which the binding's own
+// timer can't escape).
+const HARD_TIMEOUT_GRACE_MS = 10_000;
+
+function installExitHook(): void {
+  if (exitHookInstalled) return;
+  exitHookInstalled = true;
+  const stop = async () => {
+    if (clientPromise === null) return;
+    try {
+      const c = (await clientPromise) as { stop?: () => Promise<unknown> };
+      await c.stop?.();
+    } catch {
+      // ignore
+    }
+  };
+  process.once("beforeExit", stop);
+  process.once("SIGINT", () => {
+    void stop();
+  });
+  process.once("SIGTERM", () => {
+    void stop();
+  });
+}
+
+/**
+ * Drop the cached client so the next `getClient()` call respawns it. Called
+ * when a request observes the native binding has wedged — releasing the
+ * reference lets a fresh TLSClient (and a fresh koffi load) take over without
+ * a process restart.
+ */
+function resetClientCache(): void {
+  clientPromise = null;
+}
+
+export class TlsClientHangError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "TlsClientHangError";
+  }
+}
+
+/**
+ * Race a `client.request()` promise against (a) a JS-level hard timeout and
+ * (b) the caller's abort signal. The native binding's `timeoutMilliseconds`
+ * already covers the wire path; this guards the case where the koffi binding
+ * itself deadlocks (observed after sustained load), where neither the
+ * binding's own timer nor a post-call `signal.aborted` re-check can recover.
+ */
+async function raceWithTimeout<T>(
+  promise: Promise<T>,
+  timeoutMs: number,
+  signal: AbortSignal | null | undefined
+): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | null = null;
+  let abortListener: (() => void) | null = null;
+  try {
+    const racers: Promise<T>[] = [
+      promise,
+      new Promise<T>((_, reject) => {
+        timer = setTimeout(() => {
+          reject(
+            new TlsClientHangError(
+              `tls-client-node call exceeded ${timeoutMs}ms — native binding likely deadlocked`
+            )
+          );
+        }, timeoutMs);
+      }),
+    ];
+    if (signal) {
+      racers.push(
+        new Promise<T>((_, reject) => {
+          if (signal.aborted) {
+            reject(makeAbortError(signal));
+            return;
+          }
+          abortListener = () => reject(makeAbortError(signal));
+          signal.addEventListener("abort", abortListener, { once: true });
+        })
+      );
+    }
+    return await Promise.race(racers);
+  } finally {
+    if (timer) clearTimeout(timer);
+    if (signal && abortListener) signal.removeEventListener("abort", abortListener);
+  }
+}
+
+async function getClient(): Promise<{
+  request: (url: string, opts: Record<string, unknown>) => Promise<TlsResponseLike>;
+}> {
+  if (!clientPromise) {
+    clientPromise = (async () => {
+      try {
+        const mod = await import("tls-client-node");
+        const TLSClient = (mod as { TLSClient: new (opts?: Record<string, unknown>) => unknown })
+          .TLSClient;
+        // Native mode loads the shared library directly via koffi, avoiding the
+        // managed sidecar's localhost HTTP calls that OmniRoute's global fetch
+        // proxy patch interferes with.
+        const client = new TLSClient({ runtimeMode: "native" }) as {
+          start: () => Promise<void>;
+          request: (url: string, opts: Record<string, unknown>) => Promise<TlsResponseLike>;
+        };
+        await client.start();
+
+        installExitHook();
+        return client;
+      } catch (err) {
+        clientPromise = null;
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new TlsClientUnavailableError(
+          `TLS impersonation client failed to start: ${msg}. ` +
+            `Verify tls-client-node is installed and its native binary downloaded.`
+        );
+      }
+    })();
+  }
+  return clientPromise as Promise<{
+    request: (url: string, opts: Record<string, unknown>) => Promise<TlsResponseLike>;
+  }>;
+}
+
+interface TlsResponseLike {
+  status: number;
+  headers: Record<string, string[]>;
+  body: string; // for non-streaming requests, the full response body
+  cookies?: Record<string, string>;
+  text: () => Promise<string>;
+  bytes: () => Promise<Uint8Array>;
+  json: <T = unknown>() => Promise<T>;
+}
+
+export class TlsClientUnavailableError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "TlsClientUnavailableError";
+  }
+}
+
+export interface TlsFetchOptions {
+  method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+  headers?: Record<string, string>;
+  body?: string;
+  timeoutMs?: number;
+  signal?: AbortSignal | null;
+  /**
+   * If true, the response body is streamed to a temp file and exposed as a
+   * ReadableStream<Uint8Array>. Use for NDJSON streaming responses (the
+   * LMArena conversation endpoint). Otherwise, the full body is read into memory.
+   */
+  stream?: boolean;
+  /** EOF marker the upstream sends to signal end of stream (default: "[DONE]"). */
+  streamEofSymbol?: string;
+  /**
+   * Optional upstream proxy URL (`http://user:pass@host:port` or
+   * `socks5://...`). When set, the request is tunneled through this proxy
+   * before reaching arena.ai.
+   *
+   * Resolution order:
+   *   1. `options.proxyUrl` (per-call override from caller)
+   *   2. `process.env.OMNIROUTE_TLS_PROXY_URL` (single-flag opt-in)
+   *   3. `process.env.HTTPS_PROXY` / `HTTP_PROXY` / `ALL_PROXY` (POSIX-standard fallback)
+   *
+   * The native `tls-client-node` binding does **not** consult Go's
+   * `http.ProxyFromEnvironment`, so the env vars need to be plumbed in here at
+   * the JS layer.
+   */
+  proxyUrl?: string;
+}
+
+import { resolveProxyForRequest } from "../utils/proxyFetch.ts";
+import { resolveTlsClientProxyUrl } from "./tlsClientProxy.ts";
+
+/**
+ * Resolve the proxy URL for a tls-client request. Per-call value wins;
+ * otherwise we use the standard proxy fetch resolution which reads from
+ * the dashboard AsyncLocalStorage context or falls back to env vars.
+ *
+ * Fail-closed: if resolution throws (e.g. a configured socks5 proxy with
+ * ENABLE_SOCKS5_PROXY=false), this rethrows rather than returning undefined —
+ * undefined would let the native binding connect directly and leak the real IP.
+ */
+function resolveProxyUrl(perCall: string | undefined): string | undefined {
+  return resolveTlsClientProxyUrl("https://arena.ai", perCall, resolveProxyForRequest);
+}
+
+export interface TlsFetchResult {
+  status: number;
+  headers: Headers;
+  /** Full response body as text — only populated for non-streaming requests. */
+  text: string | null;
+  /** Streaming body — only populated when options.stream === true. */
+  body: ReadableStream<Uint8Array> | null;
+}
+
+// Test-only injection point. Tests call __setTlsFetchOverrideForTesting()
+// to replace the real TLS client with a mock; production never touches this.
+let testOverride: ((url: string, options: TlsFetchOptions) => Promise<TlsFetchResult>) | null =
+  null;
+
+export function __setTlsFetchOverrideForTesting(fn: typeof testOverride): void {
+  testOverride = fn;
+}
+
+function throwIfAborted(signal: AbortSignal | null | undefined): void {
+  if (signal?.aborted) throw makeAbortError(signal);
+}
+
+function buildTlsRequestOptions(options: TlsFetchOptions): Record<string, unknown> {
+  return {
+    method: options.method || "GET",
+    headers: options.headers || {},
+    body: options.body,
+    tlsClientIdentifier: LMARENA_PROFILE,
+    timeoutMilliseconds: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+    followRedirects: true,
+    withRandomTLSExtensionOrder: true,
+    // Plumb proxy via options — tls-client-node does not read HTTP_PROXY env.
+    proxyUrl: resolveProxyUrl(options.proxyUrl),
+  };
+}
+
+function hardTimeoutMs(options: TlsFetchOptions): number {
+  return (options.timeoutMs ?? DEFAULT_TIMEOUT_MS) + HARD_TIMEOUT_GRACE_MS;
+}
+
+async function tlsFetchNonStreaming(
+  client: { request: (url: string, opts: Record<string, unknown>) => Promise<TlsResponseLike> },
+  url: string,
+  requestOptions: Record<string, unknown>,
+  options: TlsFetchOptions
+): Promise<TlsFetchResult> {
+  let tlsResponse: TlsResponseLike;
+  try {
+    tlsResponse = await raceWithTimeout(
+      client.request(url, requestOptions),
+      hardTimeoutMs(options),
+      options.signal ?? null
+    );
+  } catch (err) {
+    if (err instanceof TlsClientHangError) resetClientCache();
+    throw err;
+  }
+  throwIfAborted(options.signal);
+  return {
+    status: tlsResponse.status,
+    headers: toHeaders(tlsResponse.headers),
+    text: tlsResponse.body,
+    body: null,
+  };
+}
+
+/**
+ * Make a single HTTP request to arena.ai with a Chrome-like TLS fingerprint.
+ * Throws TlsClientUnavailableError if the native binary failed to load.
+ */
+export async function tlsFetchLMArena(
+  url: string,
+  options: TlsFetchOptions = {}
+): Promise<TlsFetchResult> {
+  if (testOverride) return testOverride(url, options);
+  throwIfAborted(options.signal);
+  const client = await getClient();
+  throwIfAborted(options.signal);
+
+  const requestOptions = buildTlsRequestOptions(options);
+  if (options.stream) {
+    return tlsFetchStreaming(
+      client,
+      url,
+      requestOptions,
+      options.streamEofSymbol,
+      options.signal ?? null,
+      hardTimeoutMs(options)
+    );
+  }
+  return tlsFetchNonStreaming(client, url, requestOptions, options);
+}
+
+function makeAbortError(signal: AbortSignal): Error {
+  const reason = signal.reason;
+  if (reason instanceof Error) return reason;
+  const err = new Error(typeof reason === "string" ? reason : "The operation was aborted");
+  err.name = "AbortError";
+  return err;
+}
+
+function toHeaders(raw: Record<string, string[]>): Headers {
+  const h = new Headers();
+  for (const [k, vs] of Object.entries(raw || {})) {
+    for (const v of vs) h.append(k, v);
+  }
+  return h;
+}
+
+/**
+ * Returns true if the response body is a Cloudflare challenge/interstitial page
+ * rather than a real LMArena response. From VPS/datacenter IPs a valid cookie
+ * still gets a 403 "Request rejected by anti-bot rules." JSON; distinguishing
+ * it from a genuine auth failure lets the caller surface an actionable error
+ * (issue #3180).
+ *
+ * Exported so the executor and the connection validator share one detector.
+ */
+export function isCloudflareChallenge(text: string | null | undefined): boolean {
+  if (!text) return false;
+  return /just a moment|window\._cf_chl_opt|challenges\.cloudflare\.com|attention required|cf-chl/i.test(
+    text
+  );
+}
+
+// ─── Streaming via temp file ────────────────────────────────────────────────
+// tls-client-node's streaming primitive writes the response body chunk-by-chunk
+// to a file path, terminating when the upstream sends `streamOutputEOFSymbol`.
+// We tail the file from a worker and surface the bytes as a ReadableStream.
+
+async function tlsFetchStreaming(
+  client: { request: (url: string, opts: Record<string, unknown>) => Promise<TlsResponseLike> },
+  url: string,
+  requestOptions: Record<string, unknown>,
+  eofSymbol = "[DONE]",
+  signal: AbortSignal | null = null,
+  hardTimeoutMs: number = DEFAULT_TIMEOUT_MS + HARD_TIMEOUT_GRACE_MS
+): Promise<TlsFetchResult> {
+  const dir = await mkdtemp(join(tmpdir(), "LMArena-stream-"));
+  const path = join(dir, `${randomUUID()}.ndjson`);
+
+  const streamOpts = {
+    ...requestOptions,
+    streamOutputPath: path,
+    streamOutputBlockSize: 1024,
+    streamOutputEOFSymbol: eofSymbol,
+  };
+
+  // Kick off the request without awaiting — tls-client writes the body to
+  // `path` chunk-by-chunk while the call runs. The Promise resolves when the
+  // request fully completes (full body written). Wrapping in raceWithTimeout
+  // guarantees this promise eventually settles even if the koffi binding
+  // wedges; on hang we reset the singleton so the next request respawns.
+  let resetOnHang = true;
+  const requestPromise = raceWithTimeout(
+    client.request(url, streamOpts),
+    hardTimeoutMs,
+    signal
+  ).catch((err: unknown) => {
+    if (resetOnHang && err instanceof TlsClientHangError) {
+      resetClientCache();
+      resetOnHang = false;
+    }
+    // Re-throw so downstream consumers (waitForContent, tailFile) observe
+    // the rejection and surface it instead of treating the stream as having
+    // ended cleanly.
+    throw err;
+  });
+
+  // Wait for the file to exist AND have at least one byte.
+  const ready = await waitForContent(path, 5_000, requestPromise);
+  if (!ready) {
+    const r = await requestPromise.catch(
+      (e) => ({ status: 502, headers: {}, body: String(e) }) as TlsResponseLike
+    );
+    await cleanupTempPath(path);
+    return {
+      status: r.status,
+      headers: toHeaders(r.headers),
+      text: r.body,
+      body: null,
+    };
+  }
+
+  // Peek at the first bytes to distinguish a genuine NDJSON stream from a
+  // Cloudflare challenge page or an HTML error response that tls-client-node
+  // streamed to the temp file with a 200 status.
+  const peek = await readFirstBytes(path, 256);
+  if (isCloudflareChallenge(peek)) {
+    await cleanupTempPath(path);
+    return {
+      status: 403,
+      headers: new Headers({ "Content-Type": "text/html" }),
+      text: peek,
+      body: null,
+    };
+  }
+  if (peek.trimStart().startsWith("<")) {
+    // HTML error page (not a challenge) — surface as a non-2xx so the executor
+    // can emit a proper SSE error chunk instead of feeding HTML to the NDJSON
+    // parser.
+    await cleanupTempPath(path);
+    return {
+      status: 502,
+      headers: new Headers({ "Content-Type": "text/html" }),
+      text: peek,
+      body: null,
+    };
+  }
+
+  // Looks like NDJSON — start tailing. The requestPromise will eventually
+  // resolve with the real upstream status; tailFile propagates non-2xx errors
+  // into the stream so the consumer sees them instead of a truncated success.
+  const stream = tailFile(path, eofSymbol, requestPromise, signal);
+  const headers = new Headers({
+    "Content-Type": "application/x-ndjson",
+    "Cache-Control": "no-cache",
+  });
+  return { status: 200, headers, text: null, body: stream };
+}
+
+async function cleanupTempPath(path: string): Promise<void> {
+  await unlink(path).catch(() => {});
+  await rmdir(dirname(path)).catch(() => {});
+}
+
+async function readFirstBytes(path: string, n: number): Promise<string> {
+  const fd = await open(path, "r");
+  try {
+    const buf = Buffer.alloc(n);
+    const { bytesRead } = await fd.read(buf, 0, n, 0);
+    return buf.subarray(0, bytesRead).toString("utf8");
+  } finally {
+    await fd.close().catch(() => {});
+  }
+}
+
+/**
+ * Wait for the streaming output file to exist AND contain at least one byte.
+ * Returns false if the request settles before any bytes arrive (so the caller
+ * can drain `requestPromise` and surface the real upstream status). Returns
+ * true as soon as the file has data — even one byte is enough for the NDJSON
+ * heuristic to give a useful answer.
+ */
+async function waitForContent(
+  path: string,
+  timeoutMs: number,
+  requestPromise: Promise<TlsResponseLike>
+): Promise<boolean> {
+  let requestSettled = false;
+  requestPromise.then(
+    () => {
+      requestSettled = true;
+    },
+    () => {
+      requestSettled = true;
+    }
+  );
+  const start = Date.now();
+  while (Date.now() - start < timeoutMs) {
+    try {
+      const s = await stat(path);
+      if (s.size > 0) return true;
+    } catch {
+      // file doesn't exist yet
+    }
+    // If the request finished without producing any bytes, no point waiting
+    // out the rest of the timeout — let the caller drain it.
+    if (requestSettled) return false;
+    await sleep(25);
+  }
+  return false;
+}
+
+/** Enqueue chunk bytes, splitting off an EOF symbol when present. Returns true if closed. */
+function enqueueChunkMaybeEof(
+  controller: ReadableStreamDefaultController<Uint8Array>,
+  chunk: Buffer,
+  eofSymbol: string
+): boolean {
+  const text = chunk.toString("utf8");
+  if (!text.includes(eofSymbol)) {
+    controller.enqueue(Buffer.from(chunk));
+    return false;
+  }
+  const beforeEof = text.substring(0, text.indexOf(eofSymbol));
+  if (beforeEof) controller.enqueue(Buffer.from(beforeEof, "utf8"));
+  controller.close();
+  return true;
+}
+
+type FileHandle = Awaited<ReturnType<typeof open>>;
+
+async function drainRemaining(
+  fd: FileHandle,
+  buf: Buffer,
+  offsetRef: { offset: number },
+  controller: ReadableStreamDefaultController<Uint8Array>,
+  eofSymbol: string
+): Promise<"closed" | "drained"> {
+  while (true) {
+    const { bytesRead } = await fd.read(buf, 0, buf.length, offsetRef.offset);
+    if (bytesRead === 0) return "drained";
+    const chunk = buf.subarray(0, bytesRead);
+    offsetRef.offset += bytesRead;
+    if (enqueueChunkMaybeEof(controller, chunk, eofSymbol)) return "closed";
+  }
+}
+
+function tailFile(
+  path: string,
+  eofSymbol: string,
+  done: Promise<TlsResponseLike>,
+  signal: AbortSignal | null = null
+): ReadableStream<Uint8Array> {
+  return new ReadableStream<Uint8Array>({
+    async start(controller) {
+      const fd = await open(path, "r");
+      const buf = Buffer.alloc(64 * 1024);
+      const offsetRef = { offset: 0 };
+      let finished = false;
+      let aborted = false;
+      let upstreamError: Error | null = null;
+      let errored = false;
+
+      done.then(
+        () => {
+          finished = true;
+        },
+        (err) => {
+          upstreamError = err instanceof Error ? err : new Error(String(err));
+          finished = true;
+        }
+      );
+
+      const onAbort = () => {
+        aborted = true;
+      };
+      if (signal) {
+        if (signal.aborted) aborted = true;
+        else signal.addEventListener("abort", onAbort, { once: true });
+      }
+
+      try {
+        while (!aborted) {
+          const { bytesRead } = await fd.read(buf, 0, buf.length, offsetRef.offset);
+          if (bytesRead > 0) {
+            const chunk = buf.subarray(0, bytesRead);
+            offsetRef.offset += bytesRead;
+            if (enqueueChunkMaybeEof(controller, chunk, eofSymbol)) return;
+          }
+
+          if (!finished) {
+            await sleep(25);
+            continue;
+          }
+
+          const drained = await drainRemaining(fd, buf, offsetRef, controller, eofSymbol);
+          if (drained === "closed") return;
+          if (upstreamError && !errored) {
+            errored = true;
+            controller.error(upstreamError);
+            return;
+          }
+          controller.close();
+          return;
+        }
+      } catch (err) {
+        if (!errored) {
+          errored = true;
+          controller.error(err instanceof Error ? err : new Error(String(err)));
+        }
+      } finally {
+        await fd.close().catch(() => {});
+        await cleanupTempPath(path);
+        if (signal) signal.removeEventListener("abort", onAbort);
+      }
+    },
+  });
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
diff --git a/open-sse/services/model.ts b/open-sse/services/model.ts
index 03b8ba4853..a742155147 100644
--- a/open-sse/services/model.ts
+++ b/open-sse/services/model.ts
@@ -66,6 +66,15 @@ const PROVIDER_MODEL_ALIASES: ProviderModelAliasMap = {
     "gpt-oss-20b": "openai/gpt-oss-20b",
     "nvidia/gpt-oss-20b": "openai/gpt-oss-20b",
   },
+  synthetic: {
+    "syn:gpt-oss-120b": "hf:openai/gpt-oss-120b",
+    "syn:large:text": "hf:zai-org/GLM-5.2",
+    "syn:large:vision": "hf:moonshotai/Kimi-K2.7-Code",
+    "syn:small:vision": "hf:Qwen/Qwen3.6-27B",
+    "syn:minimax-m3": "hf:MiniMaxAI/MiniMax-M3",
+    "syn:small:text": "hf:zai-org/GLM-4.7-Flash",
+    "syn:nemotron-3-super": "hf:nvidia/NVIDIA-Nemotron-3-Super-120B-A12B-NVFP4",
+  },
   // Antigravity model aliases must be applied by the Antigravity executor, not by
   // the global model resolver. Applying them here rewrites the client-visible model
   // before credential/account routing and before UI/logging, causing clean IDs like
diff --git a/open-sse/services/opencodeQuotaFetcher.ts b/open-sse/services/opencodeQuotaFetcher.ts
index 28cf4d07e1..79d38b81c2 100644
--- a/open-sse/services/opencodeQuotaFetcher.ts
+++ b/open-sse/services/opencodeQuotaFetcher.ts
@@ -47,6 +47,7 @@
 
 import { registerQuotaFetcher, registerQuotaWindows, type QuotaInfo } from "./quotaPreflight.ts";
 import { registerMonitorFetcher } from "./quotaMonitor.ts";
+import { throttleQuotaFetch } from "./quotaFetchThrottle.ts";
 
 // OpenCode quota endpoint — same key works across opencode, opencode-go, opencode-zen
 // Default points at /zen/go/v1/quota which returns 404 today (no public quota API yet,
@@ -264,6 +265,8 @@ export async function fetchOpencodeQuota(
   }
 
   try {
+    // #6911: space concurrent upstream quota fetches (mirrors codexQuotaFetcher.ts).
+    await throttleQuotaFetch();
     const response = await fetch(OPENCODE_QUOTA_URL, {
       method: "GET",
       headers: {
diff --git a/open-sse/services/quotaResetParsing.ts b/open-sse/services/quotaResetParsing.ts
new file mode 100644
index 0000000000..b3606b02a2
--- /dev/null
+++ b/open-sse/services/quotaResetParsing.ts
@@ -0,0 +1,44 @@
+import { looksLikeQuotaExhausted } from "../../src/shared/utils/classify429";
+import { getProviderCategory } from "../config/providerRegistry.ts";
+
+/**
+ * Issue #6638 — Ollama Cloud (and any other apikey-category provider) 429s
+ * skip body-text quota classification by default: a bare 429 usually just
+ * means "too many requests/min" for these providers, so a short exponential
+ * backoff applies instead of the long cooldown reserved for genuine
+ * daily/monthly/weekly quota exhaustion.
+ *
+ * That default is correct for plain rate limiting, but it must not swallow
+ * an EXPLICIT quota-exhausted signal in the body (see `looksLikeQuotaExhausted`
+ * / QUOTA_PATTERNS) — otherwise the account looks "available" again seconds
+ * after a multi-day quota was exhausted, and combo routing retries it right
+ * away (the reported symptom). OAuth-category providers always preserve
+ * quota signals; apikey-category providers only do when the body explicitly
+ * says a long-period cap was hit.
+ */
+export function shouldPreserveQuotaSignals(
+  provider: string | null | undefined,
+  errorText?: string | null
+): boolean {
+  if (!provider) return true;
+  if (getProviderCategory(provider) === "oauth") return true;
+  return Boolean(errorText) && looksLikeQuotaExhausted(errorText);
+}
+
+/**
+ * Parse a day-granularity quota reset countdown ("Your quota will reset in
+ * 3 days.", "Resets in 13 days") out of an upstream 429 body.
+ *
+ * Companion to the Xh/Ym/Zs countdown parsing already handled inline by
+ * `parseRetryFromErrorText` — none of those patterns match when the upstream
+ * expresses the reset window in whole days rather than hours/minutes/seconds,
+ * so a multi-day quota reset previously parsed to `null` and fell back to the
+ * engine's ~seconds-scale default cooldown.
+ */
+export function parseDayGranularityResetMs(msg: string, maxMs: number): number | null {
+  const dayMatch = /reset(?:s)?\s+in\s+(\d+)\s*day(?:s)?/i.exec(msg);
+  if (!dayMatch) return null;
+  const days = Number.parseInt(dayMatch[1], 10);
+  if (!Number.isFinite(days) || days <= 0) return null;
+  return Math.min(days * 24 * 3600 * 1000, maxMs);
+}
diff --git a/open-sse/services/quotaTextCooldowns.ts b/open-sse/services/quotaTextCooldowns.ts
new file mode 100644
index 0000000000..0146d72ea5
--- /dev/null
+++ b/open-sse/services/quotaTextCooldowns.ts
@@ -0,0 +1,105 @@
+/**
+ * Text-based quota-exhaustion classifiers for the account-fallback engine.
+ *
+ * Extracted out of `accountFallback.ts` (frozen at its file-size-baseline
+ * cap — see `config/quality/file-size-baseline.json`) so a new quota-text
+ * signal (Issue #3709) could be added without growing that file. These are
+ * pure functions with no dependency back on `accountFallback.ts`, so there
+ * is no circular import (`npm run check:cycles`).
+ *
+ * @module services/quotaTextCooldowns
+ */
+
+import { RateLimitReason } from "../config/constants.ts";
+
+type RateLimitReasonValue = (typeof RateLimitReason)[keyof typeof RateLimitReason];
+
+export interface QuotaTextFallback {
+  shouldFallback: true;
+  cooldownMs: number;
+  reason: RateLimitReasonValue;
+  usedUpstreamRetryHint?: boolean;
+  quotaResetHintMs?: number;
+}
+
+// ─── Issue #2321 — Subscription (5h) usage-limit text ──────────────────────
+//
+// Anthropic OAuth (Claude Pro/Team) returns 429 with "Usage Limit Reached"
+// for the 5-hour subscription quota. Without a dedicated branch the request
+// falls through to the generic 429 retry path (~5s base cooldown).
+
+export function isSubscriptionQuotaText(lower: string): boolean {
+  return (
+    lower.includes("usage limit reached") ||
+    lower.includes("usage limit has been") ||
+    lower.includes("claude pro usage limit") ||
+    lower.includes("you've reached your usage limit") ||
+    lower.includes("you have reached your usage limit")
+  );
+}
+
+const SUBSCRIPTION_QUOTA_COOLDOWN_MS = 60 * 60 * 1000; // 1 hour
+
+/**
+ * Builds the QUOTA_EXHAUSTED fallback for the subscription-quota text above.
+ * Honor upstream Retry-After / reset hints only when the caller's profile
+ * enables them (via `getUpstreamRetryHintMs`); otherwise apply a local 1h
+ * cooldown so all Pro accounts on the same subscription tier stop cycling
+ * through tight retries. (We deliberately do not use COOLDOWN_MS.paymentRequired
+ * — that constant is 2 minutes, shorter than the recovery time of a
+ * subscription quota.)
+ *
+ * `getUpstreamRetryHintMs`/`parseRetryFromErrorText` are injected by the
+ * caller (accountFallback.ts) to avoid importing back into that file.
+ */
+export function buildSubscriptionQuotaFallback(
+  errorStr: string,
+  getUpstreamRetryHintMs: () => number | null,
+  parseRetryFromErrorText: (text: string) => number | null
+): QuotaTextFallback | null {
+  if (!isSubscriptionQuotaText(errorStr.toLowerCase())) return null;
+  const hintMs = getUpstreamRetryHintMs();
+  const bodyHint = parseRetryFromErrorText(errorStr);
+  return {
+    shouldFallback: true,
+    cooldownMs: hintMs ?? SUBSCRIPTION_QUOTA_COOLDOWN_MS,
+    reason: RateLimitReason.QUOTA_EXHAUSTED,
+    usedUpstreamRetryHint: Boolean(hintMs),
+    quotaResetHintMs: bodyHint ?? undefined,
+  };
+}
+
+// ─── Issue #3709 — Ollama Cloud weekly usage cap ───────────────────────────
+//
+// Ollama Cloud free-tier accounts have a hard WEEKLY request cap. On cap the
+// upstream returns 429 "you (<account>) have reached your weekly usage
+// limit". ollama-cloud is an apikey-category provider (not oauth), so the
+// `shouldUseQuotaSignal` gate in `checkFallbackError` (oauth-only) skips the
+// subscription-quota-text branch above for its 429s — without a dedicated,
+// ungated check the account fell through to the generic 429 backoff
+// (~1s, capped at 2min) and got retried every few minutes for the rest of
+// the week (one account took 285x429 in 48h — issue #3709).
+//
+// The exact weekly reset anchor (UTC Monday? rolling 7d from first request?)
+// is not publicly documented by Ollama, so this uses a fixed 24h cooldown —
+// short enough to recover promptly once the real window resets, long enough
+// to stop the every-5-minute retry storm. The phrase match is generic (not
+// ollama-specific), so any other provider using the same wording benefits.
+const WEEKLY_QUOTA_COOLDOWN_MS = 24 * 60 * 60 * 1000; // 24 hours
+
+export function isWeeklyUsageLimitText(lower: string): boolean {
+  return (
+    lower.includes("weekly usage limit") ||
+    lower.includes("weekly limit reached") ||
+    lower.includes("reached your weekly")
+  );
+}
+
+export function buildWeeklyQuotaFallback(errorStr: string): QuotaTextFallback | null {
+  if (!isWeeklyUsageLimitText(errorStr.toLowerCase())) return null;
+  return {
+    shouldFallback: true,
+    cooldownMs: WEEKLY_QUOTA_COOLDOWN_MS,
+    reason: RateLimitReason.QUOTA_EXHAUSTED,
+  };
+}
diff --git a/open-sse/services/reasoningTokenBuffer.ts b/open-sse/services/reasoningTokenBuffer.ts
index bbb67da335..8cce846d14 100644
--- a/open-sse/services/reasoningTokenBuffer.ts
+++ b/open-sse/services/reasoningTokenBuffer.ts
@@ -1,4 +1,7 @@
-import { getResolvedModelCapabilities } from "../../src/lib/modelCapabilities.ts";
+import {
+  getExplicitModelOutputCap,
+  getResolvedModelCapabilities,
+} from "../../src/lib/modelCapabilities.ts";
 
 /**
  * Below this caller-supplied `max_tokens`, the request is treated as a probe
@@ -34,17 +37,14 @@ export function resolveReasoningBufferedMaxTokens(
   const capabilities = getResolvedModelCapabilities(modelStr);
   if (capabilities.supportsThinking !== true) return null;
 
-  const maxOutputTokens = toPositiveInteger(capabilities.maxOutputTokens);
+  const maxOutputTokens = toPositiveInteger(getExplicitModelOutputCap(modelStr));
   if (maxOutputTokens === null) return null;
   if (current > maxOutputTokens) return maxOutputTokens;
-  if (current === maxOutputTokens) return current;
 
   // Issue #6274: a tiny explicit budget is a capability probe, not a reasoning
   // request. Respect it verbatim instead of inflating (e.g. 1 -> 1001).
   if (current < REASONING_BUFFER_MIN_TRIGGER) return current;
 
   const buffered = Math.max(current + 1000, Math.ceil(current * 1.5));
-  if (buffered > maxOutputTokens) return current;
-
-  return buffered;
+  return buffered > maxOutputTokens ? current : buffered;
 }
diff --git a/open-sse/services/responseModelEcho.ts b/open-sse/services/responseModelEcho.ts
index 0a920d2422..b8c8e1e6f2 100644
--- a/open-sse/services/responseModelEcho.ts
+++ b/open-sse/services/responseModelEcho.ts
@@ -15,6 +15,11 @@
  * Rewrite the top-level `model` field of a parsed response object (Chat Completions
  * JSON or an OpenAI SSE chunk) to `echoModel`. Mutates and returns `obj`. No-op when
  * `echoModel` is falsy or `obj` has no string `model` field.
+ *
+ * #3697: the Responses API nests `model` one level down — `{ type: "response.completed",
+ * response: { model, ... } }` — so also rewrite `obj.response.model` when present. This is
+ * what lets the Codex CLI compatibility shim echo the requested effort-suffixed model id
+ * (e.g. `gpt-5.5-xhigh`) in `response.created`/`response.completed` payloads.
  */
 export function echoModelInObject(obj: unknown, echoModel: string | null | undefined): unknown {
   if (!echoModel) return obj;
@@ -23,6 +28,13 @@ export function echoModelInObject(obj: unknown, echoModel: string | null | undef
     if (typeof rec.model === "string") {
       rec.model = echoModel;
     }
+    const nested = rec.response;
+    if (nested && typeof nested === "object" && !Array.isArray(nested)) {
+      const nestedRec = nested as Record<string, unknown>;
+      if (typeof nestedRec.model === "string") {
+        nestedRec.model = echoModel;
+      }
+    }
   }
   return obj;
 }
@@ -39,8 +51,22 @@ export function echoModelInSseLine(line: string, echoModel: string | null | unde
   if (!payload || payload === "[DONE]" || payload[0] !== "{") return line;
   try {
     const parsed = JSON.parse(payload) as Record<string, unknown>;
-    if (typeof parsed.model !== "string") return line;
-    parsed.model = echoModel;
+    let changed = false;
+    if (typeof parsed.model === "string") {
+      parsed.model = echoModel;
+      changed = true;
+    }
+    // #3697: Responses API events nest `model` under `response.model` — see
+    // echoModelInObject for the shape.
+    const nested = parsed.response;
+    if (nested && typeof nested === "object" && !Array.isArray(nested)) {
+      const nestedRec = nested as Record<string, unknown>;
+      if (typeof nestedRec.model === "string") {
+        nestedRec.model = echoModel;
+        changed = true;
+      }
+    }
+    if (!changed) return line;
     return `data: ${JSON.stringify(parsed)}`;
   } catch {
     return line;
diff --git a/open-sse/services/rotationConfig.ts b/open-sse/services/rotationConfig.ts
new file mode 100644
index 0000000000..42c47a92e9
--- /dev/null
+++ b/open-sse/services/rotationConfig.ts
@@ -0,0 +1,390 @@
+/**
+ * Runtime rotation configuration.
+ *
+ * OmniRoute's account-fallback engine (accountFallback.ts) historically rotated accounts using
+ * only hardcoded constants (COOLDOWN_MS / BACKOFF_CONFIG / ERROR_RULES): every retryable error
+ * cooled the account down immediately, on a fixed exponential backoff, with no operator control.
+ *
+ * A front-end/orchestrator (e.g. the VibeProxy desktop app) that manages the SAME set of accounts
+ * needs the backend to rotate according to the operator's own rules. This module exposes those
+ * rules as a runtime config, sourced from environment variables (so a supervising process can set
+ * them per launch) with an optional per-connection override (read from a connection's
+ * `providerSpecificData.rotationOverrides`).
+ *
+ * Config surface (all optional — defaults preserve the pre-existing engine behavior):
+ *   - master enable                            OMNIROUTE_ROTATION_ENABLED               (default true)
+ *   - rate-limit reset/cooldown seconds        OMNIROUTE_ROTATION_RATE_LIMIT_RESET_SECONDS (0 => engine default)
+ *   - per-status fallback enable               OMNIROUTE_ROTATE_ON_{429,500,502,400}    (429/500/502 default true, 400 default false)
+ *   - per-status threshold (errors in window)  OMNIROUTE_ROTATE_{status}_THRESHOLD      (default 1 => immediate, current behavior)
+ *   - per-status window seconds                OMNIROUTE_ROTATE_{status}_WINDOW_SECONDS (default 120)
+ *
+ * Everything here is a pure function or a small in-memory sliding-window counter — no DB / IO on
+ * the hot path — so it is cheap to consult per request and trivially unit-testable.
+ */
+
+import { RateLimitReason } from "../config/constants.ts";
+import { COOLDOWN_MS } from "../config/errorConfig.ts";
+
+export interface RotationErrorClassConfig {
+  enabled: boolean;
+  /** Number of errors of this class (within the window) required before an account is rotated. */
+  threshold: number;
+  /** Sliding window (ms) over which errors are counted. */
+  windowMs: number;
+}
+
+export interface RotationConfig {
+  /** Master switch. When false, none of the configurable error classes trigger account fallback. */
+  enabled: boolean;
+  /** Cooldown (ms) applied to a rate-limited account when the upstream gives no explicit hint. 0 => engine default. */
+  rateLimitResetMs: number;
+  /** Mirror of the front-end "don't tag as rate-limited without a reset time" preference. */
+  disableTagWithoutReset: boolean;
+  rateLimit429: RotationErrorClassConfig;
+  serverError500: RotationErrorClassConfig;
+  badGateway502: RotationErrorClassConfig;
+  badRequest400: RotationErrorClassConfig;
+}
+
+const GLOBAL_KEY = "__omniroute_rotation_config__";
+const DEFAULT_WINDOW_MS = 120_000;
+
+function envBool(name: string, dflt: boolean): boolean {
+  const raw = process.env[name];
+  if (raw === undefined || raw === null || raw === "") return dflt;
+  const v = raw.trim().toLowerCase();
+  if (v === "true" || v === "1" || v === "yes" || v === "on") return true;
+  if (v === "false" || v === "0" || v === "no" || v === "off") return false;
+  return dflt;
+}
+
+function envInt(name: string, dflt: number, min = 0): number {
+  const raw = process.env[name];
+  if (raw === undefined || raw === null || raw === "") return dflt;
+  const n = Number.parseInt(raw.trim(), 10);
+  if (!Number.isFinite(n)) return dflt;
+  return Math.max(min, n);
+}
+
+function buildClass(
+  enableEnv: string,
+  thresholdEnv: string,
+  windowEnv: string,
+  enableDefault: boolean
+): RotationErrorClassConfig {
+  return {
+    enabled: envBool(enableEnv, enableDefault),
+    threshold: envInt(thresholdEnv, 1, 1),
+    windowMs: envInt(windowEnv, DEFAULT_WINDOW_MS / 1000, 1) * 1000,
+  };
+}
+
+function buildFromEnv(): RotationConfig {
+  return {
+    enabled: envBool("OMNIROUTE_ROTATION_ENABLED", true),
+    rateLimitResetMs: envInt("OMNIROUTE_ROTATION_RATE_LIMIT_RESET_SECONDS", 0, 0) * 1000,
+    disableTagWithoutReset: envBool("OMNIROUTE_ROTATION_DISABLE_TAG_WITHOUT_RESET", true),
+    rateLimit429: buildClass(
+      "OMNIROUTE_ROTATE_ON_429",
+      "OMNIROUTE_ROTATE_429_THRESHOLD",
+      "OMNIROUTE_ROTATE_429_WINDOW_SECONDS",
+      true
+    ),
+    serverError500: buildClass(
+      "OMNIROUTE_ROTATE_ON_500",
+      "OMNIROUTE_ROTATE_500_THRESHOLD",
+      "OMNIROUTE_ROTATE_500_WINDOW_SECONDS",
+      true
+    ),
+    badGateway502: buildClass(
+      "OMNIROUTE_ROTATE_ON_502",
+      "OMNIROUTE_ROTATE_502_THRESHOLD",
+      "OMNIROUTE_ROTATE_502_WINDOW_SECONDS",
+      true
+    ),
+    badRequest400: buildClass(
+      "OMNIROUTE_ROTATE_ON_400",
+      "OMNIROUTE_ROTATE_400_THRESHOLD",
+      "OMNIROUTE_ROTATE_400_WINDOW_SECONDS",
+      false
+    ),
+  };
+}
+
+/**
+ * The global (env-derived) rotation config, parsed once and cached on `globalThis` so the Next.js
+ * app-route module graph and the startup graph share one instance (same pattern as the other
+ * runtime-config singletons in this codebase).
+ */
+export function getGlobalRotationConfig(): RotationConfig {
+  const g = globalThis as Record<string, unknown>;
+  let cfg = g[GLOBAL_KEY] as RotationConfig | undefined;
+  if (!cfg) {
+    cfg = buildFromEnv();
+    g[GLOBAL_KEY] = cfg;
+  }
+  return cfg;
+}
+
+/** Test/reset hook: clears the cached global config so the next read re-parses env. */
+export function resetGlobalRotationConfigForTest(): void {
+  const g = globalThis as Record<string, unknown>;
+  delete g[GLOBAL_KEY];
+  clearRotationErrorCounters();
+}
+
+function coerceBool(v: unknown, dflt: boolean): boolean {
+  if (typeof v === "boolean") return v;
+  if (typeof v === "string") return envBoolFromString(v, dflt);
+  return dflt;
+}
+
+function envBoolFromString(v: string, dflt: boolean): boolean {
+  const s = v.trim().toLowerCase();
+  if (s === "true" || s === "1" || s === "yes" || s === "on") return true;
+  if (s === "false" || s === "0" || s === "no" || s === "off") return false;
+  return dflt;
+}
+
+function coerceInt(v: unknown, dflt: number, min = 0): number {
+  const n = typeof v === "number" ? v : typeof v === "string" ? Number.parseInt(v, 10) : NaN;
+  if (!Number.isFinite(n)) return dflt;
+  return Math.max(min, Math.floor(n));
+}
+
+/**
+ * Merges a connection's per-connection overrides (from
+ * `providerSpecificData.rotationOverrides`) over the global env config. Any absent override key
+ * inherits the global value. Returns the global config unchanged when there are no overrides.
+ */
+export function resolveRotationConfig(overrides?: Record<string, unknown> | null): RotationConfig {
+  const base = getGlobalRotationConfig();
+  if (!overrides || typeof overrides !== "object") return base;
+
+  const cls = (
+    src: RotationErrorClassConfig,
+    enableKey: string,
+    thrKey: string,
+    winKey: string
+  ): RotationErrorClassConfig => ({
+    enabled: enableKey in overrides ? coerceBool(overrides[enableKey], src.enabled) : src.enabled,
+    threshold: thrKey in overrides ? coerceInt(overrides[thrKey], src.threshold, 1) : src.threshold,
+    windowMs:
+      winKey in overrides ? coerceInt(overrides[winKey], src.windowMs / 1000, 1) * 1000 : src.windowMs,
+  });
+
+  return {
+    enabled: base.enabled,
+    rateLimitResetMs:
+      "rateLimitResetSeconds" in overrides
+        ? coerceInt(overrides.rateLimitResetSeconds, base.rateLimitResetMs / 1000, 0) * 1000
+        : base.rateLimitResetMs,
+    disableTagWithoutReset: base.disableTagWithoutReset,
+    rateLimit429: cls(base.rateLimit429, "rotateOn429", "error429Threshold", "error429WindowSeconds"),
+    serverError500: cls(base.serverError500, "rotateOn500", "error500Threshold", "error500WindowSeconds"),
+    badGateway502: cls(base.badGateway502, "rotateOn502", "error502Threshold", "error502WindowSeconds"),
+    badRequest400: cls(base.badRequest400, "rotateOn400", "error400Threshold", "error400WindowSeconds"),
+  };
+}
+
+/** Maps an HTTP status to its configured error class (or null for statuses this config doesn't gate). */
+export function classForStatus(status: number, cfg: RotationConfig): RotationErrorClassConfig | null {
+  if (status === 429) return cfg.rateLimit429;
+  if (status === 502) return cfg.badGateway502;
+  if (status >= 500 && status < 600) return cfg.serverError500;
+  if (status === 400) return cfg.badRequest400;
+  return null; // 401/402/403/404/… are not gated by this config
+}
+
+/**
+ * True when the operator config should BLOCK account fallback for this status.
+ *
+ * This is RESTRICTIVE and applies only to the default-enabled classes (429 / 502 / other 5xx):
+ * when the operator disables one, fallback for it is blocked (the error returns to the client
+ * instead of rotating). 400 is NEVER restrictively blocked here — it is handled additively by
+ * {@link shouldForceFallbackFor400}, so the engine's existing 400 behavior (a 400 carrying
+ * rate-limit/quota text still falls over; a plain malformed 400 does not) is fully preserved.
+ * Statuses this config does not gate (401/403/404/…) are never blocked.
+ */
+export function isFallbackBlockedForStatus(status: number, cfg: RotationConfig): boolean {
+  const c = classForStatus(status, cfg);
+  if (c === null) return false; // ungated statuses: engine default
+  if (c === cfg.badRequest400) return false; // 400 is additive, never restrictively blocked
+  if (!cfg.enabled) return true; // master off blocks the gated 429/500/502 classes
+  return !c.enabled; // per-class disable
+}
+
+/** True when the operator opted IN to rotating on a 400 (bad request) — off by default. */
+export function shouldForceFallbackFor400(status: number, cfg: RotationConfig): boolean {
+  return status === 400 && cfg.enabled && cfg.badRequest400.enabled;
+}
+
+/** Rate-limit cooldown override (ms) or null to use the engine default. */
+export function rateLimitCooldownOverrideMs(cfg: RotationConfig): number | null {
+  return cfg.rateLimitResetMs > 0 ? cfg.rateLimitResetMs : null;
+}
+
+// ── Sliding-window per-key error counter (for threshold-based fallback) ──────────────────────
+
+const COUNTER_KEY = "__omniroute_rotation_counters__";
+
+function counters(): Map<string, number[]> {
+  const g = globalThis as Record<string, unknown>;
+  let m = g[COUNTER_KEY] as Map<string, number[]> | undefined;
+  if (!m) {
+    m = new Map<string, number[]>();
+    g[COUNTER_KEY] = m;
+  }
+  return m;
+}
+
+export function clearRotationErrorCounters(): void {
+  counters().clear();
+}
+
+/**
+ * Records an error for (key, status) and returns true when the number of errors within the class
+ * window reaches the configured threshold (i.e. the account should now be rotated). When the
+ * threshold is 1 (default) this returns true on the first error — preserving the engine's
+ * historical "rotate immediately" behavior. `nowMs` is injectable for tests.
+ */
+export function recordErrorAndCheckThreshold(
+  key: string,
+  status: number,
+  cfg: RotationConfig,
+  nowMs: number = Date.now()
+): boolean {
+  const cls = classForStatus(status, cfg);
+  if (cls === null) return true; // not gated => defer to engine (treat as immediate)
+  if (cls.threshold <= 1) return true; // immediate rotation (historical behavior)
+
+  const bucketKey = `${key}::${status}`;
+  const list = counters().get(bucketKey) ?? [];
+  const windowStart = nowMs - cls.windowMs;
+  const pruned = list.filter((ts) => ts >= windowStart);
+  pruned.push(nowMs);
+  counters().set(bucketKey, pruned);
+
+  if (pruned.length >= cls.threshold) {
+    counters().delete(bucketKey); // reset after reaching the threshold
+    return true;
+  }
+  return false;
+}
+
+// ── accountFallback.ts integration helpers ──────────────────────────────────────────────────
+// These encapsulate the "runtime rotation config" glue that `checkFallbackError` /
+// `applyErrorState` (open-sse/services/accountFallback.ts, a size-frozen file) consult before
+// falling back to their own hardcoded heuristics. Keeping the glue here (rather than inline in
+// accountFallback.ts) keeps that file's line budget stable as this config surface grows.
+
+export interface RotationGateDecision {
+  shouldFallback: boolean;
+  cooldownMs: number;
+  baseCooldownMs?: number;
+  newBackoffLevel?: number;
+  reason?: string;
+}
+
+/**
+ * Evaluates the runtime rotation config gate for a given status BEFORE the engine's own error
+ * classification runs. Returns a decision that should short-circuit `checkFallbackError`
+ * (block fallback, hold pending threshold/window, or force-fallback an opted-in 400), or `null`
+ * when the engine should proceed with its normal heuristics.
+ */
+export function evaluateRotationGate(
+  status: number,
+  rotationCfg: RotationConfig,
+  rotationKey?: string | null
+): RotationGateDecision | null {
+  if (isFallbackBlockedForStatus(status, rotationCfg)) {
+    return { shouldFallback: false, cooldownMs: 0, reason: RateLimitReason.UNKNOWN };
+  }
+  if (
+    rotationKey &&
+    classForStatus(status, rotationCfg) &&
+    !recordErrorAndCheckThreshold(rotationKey, status, rotationCfg)
+  ) {
+    return { shouldFallback: false, cooldownMs: 0, reason: RateLimitReason.UNKNOWN };
+  }
+  if (shouldForceFallbackFor400(status, rotationCfg)) {
+    const overrideMs = rateLimitCooldownOverrideMs(rotationCfg);
+    const cooldownMs = overrideMs ?? COOLDOWN_MS.rateLimit;
+    return {
+      shouldFallback: true,
+      cooldownMs,
+      baseCooldownMs: cooldownMs,
+      newBackoffLevel: 0,
+      reason: RateLimitReason.RATE_LIMIT_EXCEEDED,
+    };
+  }
+  return null;
+}
+
+export interface RotationRateLimitFallback {
+  shouldFallback: true;
+  cooldownMs: number;
+  baseCooldownMs: number;
+  newBackoffLevel: 0;
+  usedUpstreamRetryHint: false;
+  reason: string;
+}
+
+/**
+ * Operator-configured rate-limit cooldown override (no upstream retry hint available). Applies
+ * only to the rate-limit reason so 5xx / capacity errors keep their scaled exponential backoff.
+ * Returns `null` when the reason isn't rate-limit or no override is configured, in which case
+ * the caller should fall through to its own scaled-backoff calculation.
+ */
+export function rotationRateLimitFallback(
+  reason: string,
+  rotationCfg: RotationConfig
+): RotationRateLimitFallback | null {
+  if (reason !== RateLimitReason.RATE_LIMIT_EXCEEDED) return null;
+  const overrideMs = rateLimitCooldownOverrideMs(rotationCfg);
+  if (overrideMs === null) return null;
+  return {
+    shouldFallback: true,
+    cooldownMs: overrideMs,
+    baseCooldownMs: overrideMs,
+    newBackoffLevel: 0,
+    usedUpstreamRetryHint: false,
+    reason,
+  };
+}
+
+/** Combines extractRotationContext + resolveRotationConfig + evaluateRotationGate for an account. */
+export function gateFor(status: number, account?: unknown): RotationGateDecision | null {
+  const { rotationOverrides, rotationKey } = extractRotationContext(account);
+  return evaluateRotationGate(status, resolveRotationConfig(rotationOverrides), rotationKey);
+}
+
+/** Combines extractRotationContext + resolveRotationConfig + rotationRateLimitFallback for an account. */
+export function overrideFor(reason: string, account?: unknown): RotationRateLimitFallback | null {
+  const { rotationOverrides } = extractRotationContext(account);
+  return rotationRateLimitFallback(reason, resolveRotationConfig(rotationOverrides));
+}
+
+/**
+ * Extracts a connection's per-connection rotation overrides and rotation key from its account
+ * state (`providerSpecificData.rotationOverrides` and `id`). Both are optional — absent =>
+ * global env config / count-immediately. `account` is typed `unknown` here because callers pass
+ * a generic `AccountState`-shaped value; this only does structural checks, no behavior change.
+ */
+export function extractRotationContext(account: unknown): {
+  rotationOverrides: Record<string, unknown> | null;
+  rotationKey: string | null;
+} {
+  const rec = account && typeof account === "object" ? (account as Record<string, unknown>) : null;
+  const psd = rec ? rec["providerSpecificData"] : undefined;
+  const rotationOverrides =
+    psd &&
+    typeof psd === "object" &&
+    (psd as Record<string, unknown>).rotationOverrides &&
+    typeof (psd as Record<string, unknown>).rotationOverrides === "object"
+      ? ((psd as Record<string, unknown>).rotationOverrides as Record<string, unknown>)
+      : null;
+  const id = rec ? rec["id"] : undefined;
+  const rotationKey = typeof id === "string" && id.length > 0 ? id : null;
+  return { rotationOverrides, rotationKey };
+}
diff --git a/open-sse/services/tokenExtractionConfig.ts b/open-sse/services/tokenExtractionConfig.ts
index 8d7736f7e1..7238a38ddd 100644
--- a/open-sse/services/tokenExtractionConfig.ts
+++ b/open-sse/services/tokenExtractionConfig.ts
@@ -374,6 +374,17 @@ const RAW_CONFIGS: TokenExtractionConfig[] = [
     "Log in to Manus at manus.im. The session cookie will be extracted.",
     { cookieDomain: ".manus.im" }
   ),
+
+  // ── Z.ai Web (#4056) ────────────────────────────────────────
+  config(
+    "zai-web",
+    "Z.ai Web (Free)",
+    "https://chat.z.ai/",
+    "https://chat.z.ai",
+    [{ type: "cookie", name: "token", domain: ".z.ai" }],
+    "Log in to Z.ai at chat.z.ai. The session token will be extracted.",
+    { cookieDomain: ".z.ai" }
+  ),
 ];
 
 // ─── Registry ───────────────────────────────────────────────────────────────
diff --git a/open-sse/services/tokenRefresh.ts b/open-sse/services/tokenRefresh.ts
index 338ddca604..b479daf278 100755
--- a/open-sse/services/tokenRefresh.ts
+++ b/open-sse/services/tokenRefresh.ts
@@ -5,6 +5,10 @@ import { getGitHubCopilotRefreshHeaders } from "../config/providerHeaderProfiles
 import { pbkdf2Sync } from "node:crypto";
 import { runWithProxyContext } from "../utils/proxyFetch.ts";
 import { serializeRefresh, wasRefreshTokenRotated } from "./refreshSerializer.ts";
+import {
+  buildExternalIdpRefreshParams,
+  isExternalIdpAuthMethod,
+} from "./kiroExternalIdp.ts";
 import { WINDSURF_CONFIG } from "@/lib/oauth/constants/oauth";
 import { buildGitLabOAuthEndpoints, resolveGitLabOAuthBaseUrl } from "@/lib/oauth/gitlab";
 
@@ -1209,6 +1213,69 @@ export async function refreshKiroToken(
     const clientSecret = providerSpecificData?.clientSecret;
     const region = providerSpecificData?.region;
 
+    // Enterprise / Microsoft Entra "Your organization" (external_idp) logins refresh with a
+    // standard PUBLIC-client OAuth2 refresh_token grant against the org IdP's own tokenEndpoint
+    // (form-encoded client_id + refresh_token + scope, no client_secret) — NOT the AWS SSO OIDC
+    // or Kiro social endpoints. The rotated refresh_token is persisted by the caller.
+    if (isExternalIdpAuthMethod(authMethod)) {
+      let refreshRequest;
+      try {
+        refreshRequest = buildExternalIdpRefreshParams(refreshToken, providerSpecificData);
+      } catch (cfgErr) {
+        log?.error?.(
+          "TOKEN_REFRESH",
+          `Invalid Kiro external_idp refresh config: ${cfgErr instanceof Error ? cfgErr.message : String(cfgErr)}`
+        );
+        return null;
+      }
+
+      const response = await runWithProxyContext(proxyConfig, () =>
+        fetch(refreshRequest.tokenEndpoint, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            Accept: "application/json",
+          },
+          body: refreshRequest.body,
+        })
+      );
+
+      if (!response.ok) {
+        const errorText = await response.text();
+        let oauthErr: string | undefined;
+        try {
+          oauthErr = JSON.parse(errorText)?.error;
+        } catch {
+          /* not JSON */
+        }
+        if (oauthErr === "invalid_grant" || oauthErr === "invalid_client") {
+          log?.error?.(
+            "TOKEN_REFRESH",
+            "Kiro external_idp refresh token expired/invalid. Re-authentication required.",
+            { oauthErr }
+          );
+          return { error: "unrecoverable_refresh_error", code: oauthErr };
+        }
+        log?.error?.("TOKEN_REFRESH", "Failed to refresh Kiro external_idp token", {
+          status: response.status,
+          error: errorText.slice(0, 200),
+        });
+        return null;
+      }
+
+      const tokens = await response.json();
+      log?.info?.("TOKEN_REFRESH", "Successfully refreshed Kiro external_idp token", {
+        hasNewAccessToken: !!tokens.access_token,
+        hasNewRefreshToken: !!tokens.refresh_token,
+        expiresIn: tokens.expires_in,
+      });
+      return {
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token || refreshToken,
+        expiresIn: tokens.expires_in || 3600,
+      };
+    }
+
     // AWS SSO OIDC (Builder ID or IDC)
     // If clientId and clientSecret exist, assume AWS SSO OIDC (default to builder-id if authMethod not specified).
     // Exception: imported social tokens (authMethod === "imported") carry a freshly-registered
@@ -1602,6 +1669,7 @@ async function _getAccessTokenInternal(provider, credentials, log, proxyConfig:
       );
 
     case "cline":
+    case "clinepass": // reuses the Cline WorkOS refresh flow (clinepass: cline)
       return await refreshClineToken(credentials.refreshToken, log, proxyConfig);
 
     case "kimi-coding":
diff --git a/open-sse/services/usage/antigravity.ts b/open-sse/services/usage/antigravity.ts
index 99f246155c..84f01420e0 100644
--- a/open-sse/services/usage/antigravity.ts
+++ b/open-sse/services/usage/antigravity.ts
@@ -43,6 +43,7 @@ import {
 } from "../codeAssistSubscription.ts";
 import { toRecord, toNumber, getFieldValue } from "./scalars.ts";
 import { type UsageQuota, parseResetTime } from "./quota.ts";
+import { fetchAndParseAntigravityWeeklyQuotas } from "./antigravityWeeklyQuota.ts";
 
 type JsonRecord = Record<string, unknown>;
 type SubscriptionCacheEntry = {
@@ -604,9 +605,10 @@ export async function getAntigravityUsage(
       );
     }
 
-    const [data, userQuotaData] = await Promise.all([
+    const [data, userQuotaData, weeklyQuotas] = await Promise.all([
       fetchAntigravityAvailableModelsCached(accessToken, projectId, options),
       fetchAntigravityUserQuotaCached(accessToken, projectId, options),
+      fetchAndParseAntigravityWeeklyQuotas(accessToken, projectId, options), // #4017
     ]);
     const dataObj = toRecord(data);
     if (dataObj.__antigravityForbidden === true) {
@@ -717,6 +719,7 @@ export async function getAntigravityUsage(
       plan: getAntigravityPlanLabel(subscriptionInfo, providerSpecificData),
       quotas: {
         ...quotas,
+        ...weeklyQuotas,
         ...(creditBalance !== null && {
           credits: {
             used: 0,
diff --git a/open-sse/services/usage/antigravityWeeklyQuota.ts b/open-sse/services/usage/antigravityWeeklyQuota.ts
new file mode 100644
index 0000000000..d0a2dcceaa
--- /dev/null
+++ b/open-sse/services/usage/antigravityWeeklyQuota.ts
@@ -0,0 +1,191 @@
+/**
+ * usage/antigravityWeeklyQuota.ts — Antigravity weekly-quota fetcher + parser (#4017).
+ *
+ * Antigravity enforces both a 5-hour window (already surfaced per-model by
+ * `getAntigravityUsage()` via `retrieveUserQuota`) and a separate weekly window.
+ * The weekly window is NOT part of the per-model `retrieveUserQuota` response —
+ * it lives in a distinct upstream RPC, `v1internal:retrieveUserQuotaSummary`,
+ * which groups models into families ("Gemini Models", "Claude and GPT models")
+ * and reports one bucket per family per window (5h + weekly), keyed by a
+ * `bucketId`/`displayName` pair rather than by individual modelId. There is no
+ * dedicated window-type field on the bucket — the window is inferred from the
+ * bucketId/displayName text (matches the reverse-engineered shape documented by
+ * third-party Antigravity clients, since Google does not publish this API).
+ *
+ * This module is a small, self-contained leaf so `usage/antigravity.ts` stays a
+ * thin caller: fetch (cached, best-effort) + pure parse, mirroring the existing
+ * `fetchAntigravityUserQuotaCached` pattern.
+ */
+
+import { toRecord, toNumber } from "./scalars.ts";
+import { type UsageQuota, parseResetTime } from "./quota.ts";
+
+type JsonRecord = Record<string, unknown>;
+
+interface AntigravityWeeklyQuotaOptions {
+  forceRefresh?: boolean;
+}
+
+const WEEKLY_QUOTA_CACHE_TTL_MS = 60 * 1000;
+const _weeklyQuotaCache = new Map<string, { data: unknown; fetchedAt: number }>();
+const _weeklyQuotaInflight = new Map<string, Promise<unknown>>();
+
+// Self-contained purge timer — this leaf owns its own cache, so it owns the cleanup too
+// (same pattern as usage/antigravity.ts's module-level caches).
+const _weeklyQuotaCacheCleanupTimer = setInterval(
+  () => {
+    const now = Date.now();
+    for (const [key, entry] of _weeklyQuotaCache) {
+      if (now - entry.fetchedAt > WEEKLY_QUOTA_CACHE_TTL_MS) _weeklyQuotaCache.delete(key);
+    }
+  },
+  5 * 60 * 1000
+);
+_weeklyQuotaCacheCleanupTimer.unref?.();
+
+function buildCacheKey(accessToken: string, projectId?: string | null): string {
+  return `${accessToken.substring(0, 16)}:${projectId || "default"}`;
+}
+
+/**
+ * Fetch the weekly-quota-bearing `retrieveUserQuotaSummary` response (cached, best-effort).
+ * Returns `null` on any failure — callers must treat this as optional data, never a hard
+ * dependency, since the RPC is undocumented and may not be available for every account/tier.
+ */
+export async function fetchAntigravityUserQuotaSummaryCached(
+  accessToken: string,
+  projectId?: string | null,
+  options: AntigravityWeeklyQuotaOptions = {}
+): Promise<unknown | null> {
+  if (!accessToken || !projectId) return null;
+
+  const cacheKey = buildCacheKey(accessToken, projectId);
+  const cached = _weeklyQuotaCache.get(cacheKey);
+  if (!options.forceRefresh && cached && Date.now() - cached.fetchedAt < WEEKLY_QUOTA_CACHE_TTL_MS) {
+    return cached.data;
+  }
+
+  const inflight = _weeklyQuotaInflight.get(cacheKey);
+  if (inflight) return inflight;
+
+  const promise = (async () => {
+    try {
+      const response = await fetch(
+        "https://cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary",
+        {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${accessToken}`,
+            "Content-Type": "application/json",
+          },
+          body: JSON.stringify({ project: projectId }),
+          signal: AbortSignal.timeout(10000),
+        }
+      );
+
+      if (!response.ok) return null;
+
+      const data = await response.json();
+      _weeklyQuotaCache.set(cacheKey, { data, fetchedAt: Date.now() });
+      return data;
+    } catch {
+      return null;
+    }
+  })().finally(() => {
+    _weeklyQuotaInflight.delete(cacheKey);
+  });
+
+  _weeklyQuotaInflight.set(cacheKey, promise);
+  return promise;
+}
+
+/** Matches a bucket's combined bucketId+displayName text against a window keyword. */
+function bucketMatchesWindow(bucket: JsonRecord, keyword: RegExp): boolean {
+  const text = `${String(bucket.bucketId || "")} ${String(bucket.displayName || "")}`.toLowerCase();
+  return keyword.test(text);
+}
+
+const WEEKLY_KEYWORD = /\bweekly\b/;
+
+/** Turns a group displayName (e.g. "Gemini Models", "Claude and GPT models") into a quota key. */
+function slugifyGroupWeeklyKey(displayName: string): string | null {
+  const cleaned = String(displayName || "")
+    .toLowerCase()
+    .replace(/\bmodels?\b/g, "")
+    .replace(/\band\b/g, " ")
+    .replace(/[^a-z0-9]+/g, "_")
+    .replace(/^_+|_+$/g, "");
+  return cleaned ? `${cleaned}_weekly` : null;
+}
+
+/**
+ * Parse the raw `retrieveUserQuotaSummary` response into weekly `UsageQuota` entries,
+ * one per model family group. Tolerant of the two response envelopes third-party
+ * Antigravity clients have observed (`groups[]` at the top level, or nested under
+ * `quotaSummary.groups[]`) since the RPC is undocumented and unversioned by Google.
+ */
+export function parseAntigravityWeeklyQuotas(summaryData: unknown): Record<string, UsageQuota> {
+  const quotas: Record<string, UsageQuota> = {};
+  for (const groupValue of extractSummaryGroups(summaryData)) {
+    const entry = parseGroupWeeklyQuota(toRecord(groupValue));
+    if (entry) quotas[entry.key] = entry.quota;
+  }
+  return quotas;
+}
+
+/** Extracts `groups[]` from either observed response envelope (top-level or nested). */
+function extractSummaryGroups(summaryData: unknown): unknown[] {
+  const root = toRecord(summaryData);
+  if (Array.isArray(root.groups)) return root.groups;
+  const nested = toRecord(root.quotaSummary).groups;
+  return Array.isArray(nested) ? nested : [];
+}
+
+/** Parses one model-family group into its weekly quota entry, or null when absent/invalid. */
+function parseGroupWeeklyQuota(group: JsonRecord): { key: string; quota: UsageQuota } | null {
+  const buckets = Array.isArray(group.buckets) ? group.buckets : [];
+  const weeklyBucketValue = buckets.find(
+    (b) => b && typeof b === "object" && bucketMatchesWindow(toRecord(b), WEEKLY_KEYWORD)
+  );
+  if (!weeklyBucketValue) return null;
+
+  const weeklyBucket = toRecord(weeklyBucketValue);
+  if (weeklyBucket.disabled === true) return null;
+
+  const key = slugifyGroupWeeklyKey(String(group.displayName || ""));
+  if (!key) return null;
+
+  const rawFraction = toNumber(weeklyBucket.remainingFraction, -1);
+  if (rawFraction < 0) return null;
+
+  const remainingFraction = Math.max(0, Math.min(1, rawFraction));
+  const resetAt = parseResetTime(weeklyBucket.resetTime);
+  const isUnlimited = !resetAt && remainingFraction >= 1;
+  const QUOTA_NORMALIZED_BASE = 1000;
+  const total = QUOTA_NORMALIZED_BASE;
+  const remaining = Math.round(total * remainingFraction);
+
+  return {
+    key,
+    quota: {
+      used: isUnlimited ? 0 : Math.max(0, total - remaining),
+      total: isUnlimited ? 0 : total,
+      resetAt,
+      remainingPercentage: isUnlimited ? 100 : remainingFraction * 100,
+      unlimited: isUnlimited,
+      fractionReported: true,
+      quotaSource: "retrieveUserQuota",
+      displayName: String(group.displayName || "").trim() || undefined,
+    },
+  };
+}
+
+/** Fetch + parse in one call — the only entry point `usage/antigravity.ts` needs. */
+export async function fetchAndParseAntigravityWeeklyQuotas(
+  accessToken: string,
+  projectId: string | undefined | null,
+  options: AntigravityWeeklyQuotaOptions = {}
+): Promise<Record<string, UsageQuota>> {
+  const data = await fetchAntigravityUserQuotaSummaryCached(accessToken, projectId, options);
+  return parseAntigravityWeeklyQuotas(data);
+}
diff --git a/open-sse/services/usage/kiro.ts b/open-sse/services/usage/kiro.ts
index 9b85579103..6ed5f72ed6 100644
--- a/open-sse/services/usage/kiro.ts
+++ b/open-sse/services/usage/kiro.ts
@@ -13,6 +13,16 @@
 
 import { toRecord, toNumber } from "./scalars.ts";
 import { type UsageQuota, parseResetTime } from "./quota.ts";
+import {
+  discoverKiroProfileArnAcrossRegions,
+  kiroRuntimeHost,
+  resolveKiroRuntimeRegion,
+} from "../kiroRegion.ts";
+import {
+  isExternalIdpAuthMethod,
+  KIRO_EXTERNAL_IDP_TOKEN_TYPE_HEADER,
+  KIRO_EXTERNAL_IDP_TOKEN_TYPE_VALUE,
+} from "../kiroExternalIdp.ts";
 
 type JsonRecord = Record<string, unknown>;
 
@@ -113,17 +123,24 @@ export function buildKiroUsageResult(
 export async function discoverKiroProfileArn(
   accessToken: string,
   usageBaseUrl: string,
-  region: string
+  region: string,
+  authMethod?: string
 ): Promise<string | undefined> {
   try {
+    const isApiKey = authMethod === "api_key";
+    const headers: Record<string, string> = {
+      Authorization: `Bearer ${accessToken}`,
+      "Content-Type": "application/x-amz-json-1.0",
+      "x-amz-target": "AmazonCodeWhispererService.ListAvailableProfiles",
+      Accept: "application/json",
+    };
+    if (isApiKey) {
+      headers.tokentype = "API_KEY";
+    }
+
     const response = await fetch(usageBaseUrl, {
       method: "POST",
-      headers: {
-        Authorization: `Bearer ${accessToken}`,
-        "Content-Type": "application/x-amz-json-1.0",
-        "x-amz-target": "AmazonCodeWhispererService.ListAvailableProfiles",
-        Accept: "application/json",
-      },
+      headers,
       body: JSON.stringify({ maxResults: 10 }),
       // Don't let a hung profile lookup block the usage/quota refresh indefinitely.
       signal: AbortSignal.timeout(10000),
@@ -145,84 +162,235 @@ export async function discoverKiroProfileArn(
   }
 }
 
+/**
+ * The three GetUsageLimits attempts (CodeWhisperer POST, regional GET, Q GET) tried in
+ * order by getKiroUsage — extracted so the auth-method header variants (api_key
+ * `tokentype`, external_idp `TokenType`) stay in one authHeaders object and the parent
+ * function stays under the function-length gate.
+ *
+ * The POST variant (x-amz-json-1.0 + `x-amz-target: ...GetUsageLimits`) is tried FIRST: it
+ * is the canonical AWS JSON-RPC shape used everywhere else in the Kiro integration
+ * (discoverKiroProfileArn's ListAvailableProfiles call, kiroModels.ts fingerprinting) and,
+ * critically, it is the only variant whose URL is built from the RUNTIME-region-resolved
+ * `usageBaseUrl` (see resolveKiroRuntimeRegion in getKiroUsage) with the profileArn in the
+ * payload — required for cross-region IAM Identity Center accounts (#6099) where the profile
+ * lives in a different region than the IdC/token region. The two GET variants are
+ * best-effort fallbacks (added for #6587 API-key auth) for accounts/regions where the POST
+ * shape is rejected.
+ */
+function buildKiroUsageAttempts(opts: {
+  authHeaders: Record<string, string>;
+  usageParams: URLSearchParams;
+  qParams: URLSearchParams;
+  payload: Record<string, unknown>;
+  usageBaseUrl: string;
+  qBaseUrl: string;
+}): Array<{ name: string; run: () => Promise<Response> }> {
+  const { authHeaders, usageParams, qParams, payload, usageBaseUrl, qBaseUrl } = opts;
+  return [
+    {
+      name: "codewhisperer-post",
+      run: () =>
+        fetch(usageBaseUrl, {
+          method: "POST",
+          headers: {
+            ...authHeaders,
+            "Content-Type": "application/x-amz-json-1.0",
+            "x-amz-target": "AmazonCodeWhispererService.GetUsageLimits",
+          },
+          body: JSON.stringify(payload),
+        }),
+    },
+    {
+      name: "codewhisperer-get",
+      run: () =>
+        fetch(`${CODEWHISPERER_BASE_URL}/getUsageLimits?${usageParams.toString()}`, {
+          method: "GET",
+          headers: {
+            ...authHeaders,
+            "x-amz-user-agent": "aws-sdk-js/1.0.0 KiroIDE",
+            "user-agent": "aws-sdk-js/1.0.0 KiroIDE",
+          },
+        }),
+    },
+    {
+      name: "q-get",
+      run: () =>
+        fetch(`${qBaseUrl}/getUsageLimits?${qParams.toString()}`, {
+          method: "GET",
+          headers: authHeaders,
+        }),
+    },
+  ];
+}
+
+/**
+ * Base auth headers for the usage endpoints, per auth method: long-lived API keys add
+ * `tokentype: API_KEY`; enterprise / Microsoft Entra (external_idp) org accounts require
+ * `TokenType: EXTERNAL_IDP` for CodeWhisperer to bind the bearer to the profile (without
+ * it GetUsageLimits returns `ValidationException: Invalid ARN`).
+ */
+function buildKiroAuthHeaders(
+  accessToken: string | undefined,
+  isApiKey: boolean,
+  providerSpecificData?: JsonRecord
+): Record<string, string> {
+  const authHeaders: Record<string, string> = {
+    Authorization: `Bearer ${accessToken}`,
+    Accept: "application/json",
+  };
+  if (isApiKey) {
+    authHeaders.tokentype = "API_KEY";
+  }
+  if (isExternalIdpAuthMethod(providerSpecificData?.authMethod)) {
+    authHeaders[KIRO_EXTERNAL_IDP_TOKEN_TYPE_HEADER] = KIRO_EXTERNAL_IDP_TOKEN_TYPE_VALUE;
+  }
+  return authHeaders;
+}
+
+/**
+ * Runs the GetUsageLimits attempts in order until one succeeds. Collects per-attempt
+ * errors and whether any endpoint rejected the token (401/403) so getKiroUsage can
+ * pick the right user-facing message — extracted for the function-length gate.
+ */
+async function runKiroUsageAttempts(
+  attempts: Array<{ name: string; run: () => Promise<Response> }>
+): Promise<{
+  data?: JsonRecord;
+  sawAuthError: boolean;
+  errors: string[];
+  lastHttpFailure?: string;
+}> {
+  let sawAuthError = false;
+  let lastHttpFailure: string | undefined;
+  const errors: string[] = [];
+  for (const attempt of attempts) {
+    let response: Response;
+    try {
+      response = await attempt.run();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      errors.push(`${attempt.name}:${message}`);
+      continue;
+    }
+    if (!response.ok) {
+      const errorText = await response.text().catch(() => "");
+      if (response.status === 401 || response.status === 403) {
+        sawAuthError = true;
+      }
+      lastHttpFailure = `Kiro API error (${response.status}): ${errorText}`;
+      errors.push(`${attempt.name}:${response.status}${errorText ? `:${errorText}` : ""}`);
+      continue;
+    }
+    return { data: toRecord(await response.json()), sawAuthError, errors, lastHttpFailure };
+  }
+  return { sawAuthError, errors, lastHttpFailure };
+}
+
 /**
  * Kiro (AWS CodeWhisperer) Usage
  */
 export async function getKiroUsage(accessToken?: string, providerSpecificData?: JsonRecord) {
   try {
+    const authMethod =
+      typeof providerSpecificData?.authMethod === "string"
+        ? providerSpecificData.authMethod
+        : undefined;
+    const isApiKey = authMethod === "api_key";
     let profileArn =
       typeof providerSpecificData?.profileArn === "string"
         ? providerSpecificData.profileArn
         : undefined;
 
-    // Enterprise IAM Identity Center accounts are region-bound: the profileArn, token and
-    // endpoint must all match the region. Derive the region from the stored region (preferred)
-    // or the profileArn, then route to the regional Amazon Q endpoint (us-east-1 keeps the
-    // legacy codewhisperer host; codewhisperer.{region} does not resolve for other regions).
-    const regionFromArn = profileArn
-      ? profileArn.toLowerCase().match(/^arn:aws:codewhisperer:([a-z0-9-]+):/)?.[1]
-      : undefined;
-    const region =
-      (typeof providerSpecificData?.region === "string" &&
-        providerSpecificData.region.trim().toLowerCase()) ||
-      regionFromArn ||
-      "us-east-1";
-    const usageBaseUrl =
-      region === "us-east-1" ? CODEWHISPERER_BASE_URL : `https://q.${region}.amazonaws.com`;
+    const storedRegion =
+      typeof providerSpecificData?.region === "string"
+        ? providerSpecificData.region.trim().toLowerCase()
+        : undefined;
 
-    // IAM Identity Center logins and kiro-cli imports frequently don't persist a profileArn, which
-    // previously caused the quota card to show nothing ("0 used"). Discover it on demand from
-    // ListAvailableProfiles (region-matched) so usage still resolves for those accounts.
+    // Enterprise IAM Identity Center logins and kiro-cli imports frequently don't persist a
+    // profileArn. Discover it by probing the Q Developer PROFILE regions (us-east-1 / eu-central-1)
+    // — NOT the IdC/token region. An IdC in eu-north-1 has no Q runtime host (q.eu-north-1 does not
+    // exist); its profile lives in eu-central-1 (or us-east-1) and the SSO token works cross-region
+    // against it. Without this, the quota card previously showed nothing ("no limits") for such
+    // accounts because the single-region lookup at q.{idcRegion} always failed.
     if (!profileArn && accessToken) {
-      profileArn = await discoverKiroProfileArn(accessToken, usageBaseUrl, region);
+      profileArn = await discoverKiroProfileArnAcrossRegions(accessToken, storedRegion);
     }
 
-    if (!profileArn) {
+    if (!profileArn && !isApiKey) {
       return { message: "Kiro connected. Profile ARN not available for quota tracking." };
     }
 
-    // Kiro uses AWS CodeWhisperer GetUsageLimits API
+    // The RUNTIME region is the profileArn region (us-east-1 / eu-central-1), never the IdC token
+    // region. Route GetUsageLimits to that region's host so quota resolves for cross-region IdC.
+    const region = resolveKiroRuntimeRegion({ region: storedRegion, profileArn });
+    const usageBaseUrl = region === "us-east-1" ? CODEWHISPERER_BASE_URL : kiroRuntimeHost(region);
+    const qBaseUrl = `https://q.${region}.amazonaws.com`;
+
+    const authHeaders = buildKiroAuthHeaders(accessToken, isApiKey, providerSpecificData);
+
+    const usageParams = new URLSearchParams({
+      isEmailRequired: "true",
+      origin: "AI_EDITOR",
+      resourceType: "AGENTIC_REQUEST",
+    });
+    const qParams = new URLSearchParams({
+      origin: "AI_EDITOR",
+      ...(profileArn ? { profileArn } : {}),
+      resourceType: "AGENTIC_REQUEST",
+    });
     const payload = {
       origin: "AI_EDITOR",
-      profileArn: profileArn,
+      ...(profileArn ? { profileArn } : {}),
       resourceType: "AGENTIC_REQUEST",
     };
 
-    const response = await fetch(usageBaseUrl, {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${accessToken}`,
-        "Content-Type": "application/x-amz-json-1.0",
-        "x-amz-target": "AmazonCodeWhispererService.GetUsageLimits",
-        Accept: "application/json",
-      },
-      body: JSON.stringify(payload),
+    const attempts = buildKiroUsageAttempts({
+      authHeaders,
+      usageParams,
+      qParams,
+      payload,
+      usageBaseUrl,
+      qBaseUrl,
     });
 
-    if (!response.ok) {
+    const outcome = await runKiroUsageAttempts(attempts);
+    if (outcome.data) {
+      return buildKiroUsageResult(outcome.data);
+    }
+    const { sawAuthError, errors } = outcome;
+
+    if (sawAuthError) {
       // Social-auth Kiro accounts (added via /api/oauth/kiro/social-exchange with provider
       // Google or GitHub) use a different token format that AWS CodeWhisperer's GetUsageLimits
       // routinely rejects with 401/403, even when /messages still works. Surface a clear
       // "auth expired, chat may still work" message instead of a generic upstream-error blob
       // so the quota card matches what users with legacy social-auth accounts already see.
       // Inspired by https://github.com/decolua/9router/pull/620.
-      if (
-        (response.status === 401 || response.status === 403) &&
-        isSocialAuthKiroAccount(providerSpecificData)
-      ) {
+      if (isSocialAuthKiroAccount(providerSpecificData)) {
         return {
           message: "Kiro quota API authentication expired. Chat may still work.",
           quotas: {},
         };
       }
-      const errorText = await response.text();
-      throw new Error(`Kiro API error (${response.status}): ${errorText}`);
+      return {
+        message: "Kiro quota API rejected the current token. Chat may still work.",
+        quotas: {},
+      };
     }
 
-    const data = toRecord(await response.json());
-    return buildKiroUsageResult(data);
+    // Hard (non-auth) failure keeps the pre-#6587 reject semantics — callers and
+    // tests/unit/usage-service-hardening.test.ts rely on the rejection; prefer the last
+    // HTTP-status failure (most informative) over a network-level error.
+    throw new Error(
+      outcome.lastHttpFailure ||
+        (errors.length > 0
+          ? errors[errors.length - 1]
+          : "no usage endpoint responded")
+    );
   } catch (error) {
-    throw new Error(`Failed to fetch Kiro usage: ${error.message}`);
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Failed to fetch Kiro usage: ${message}`);
   }
 }
 
diff --git a/open-sse/services/webSearchFallback.ts b/open-sse/services/webSearchFallback.ts
index f82b565630..9d80610d47 100644
--- a/open-sse/services/webSearchFallback.ts
+++ b/open-sse/services/webSearchFallback.ts
@@ -142,12 +142,20 @@ export function supportsNativeWebSearchFallbackBypass({
   sourceFormat,
   targetFormat,
   nativeCodexPassthrough,
+  interceptSearchOverride,
 }: {
   provider?: string | null;
   sourceFormat?: string | null;
   targetFormat: string | null | undefined;
   nativeCodexPassthrough: boolean;
+  // Per-model rule (#3384) — resolveInterceptSearch() in src/lib/db/interceptionRules.ts.
+  // true = force interception (never bypass); false = force native bypass; undefined =
+  // fall through to the native-bypass defaults below.
+  interceptSearchOverride?: boolean;
 }): boolean {
+  if (typeof interceptSearchOverride === "boolean") {
+    return !interceptSearchOverride;
+  }
   // Native Codex (OpenAI Responses) passthrough: the upstream runs web search itself.
   if (nativeCodexPassthrough) return true;
   // Gemini target: the Gemini translator maps built-in web search to googleSearch natively.
@@ -171,6 +179,7 @@ export function prepareWebSearchFallbackBody<T extends JsonRecord>(
     sourceFormat?: string | null;
     targetFormat?: string | null;
     nativeCodexPassthrough: boolean;
+    interceptSearchOverride?: boolean;
   }
 ): { body: T; fallback: WebSearchFallbackPlan } {
   const tools = Array.isArray(body.tools) ? body.tools : null;
diff --git a/open-sse/transformer/responsesTransformer.ts b/open-sse/transformer/responsesTransformer.ts
index afe245a019..ab8ce9596f 100644
--- a/open-sse/transformer/responsesTransformer.ts
+++ b/open-sse/transformer/responsesTransformer.ts
@@ -108,6 +108,10 @@ export function createResponsesApiTransformStream(logger = null, keepaliveInterv
     completedSent: false,
     usage: null,
     keepaliveTimer: null,
+    // #6906: true once a finish_reason chunk closed all output items but deferred
+    // response.completed — a trailing usage-only chunk (choices: [], usage: {...}) may
+    // still arrive for stream_options.include_usage=true upstreams.
+    awaitingTrailingUsage: false,
   };
 
   const encoder = new TextEncoder();
@@ -403,6 +407,11 @@ export function createResponsesApiTransformStream(logger = null, keepaliveInterv
             if (parsed.usage) {
               state.usage = parsed.usage;
             }
+            // #6906: trailing usage-only chunk after finish_reason already deferred
+            // completion — send it now with the usage just captured above.
+            if (state.awaitingTrailingUsage && !state.completedSent) {
+              sendCompleted(controller);
+            }
             continue;
           }
 
@@ -630,7 +639,18 @@ export function createResponsesApiTransformStream(logger = null, keepaliveInterv
             for (const i in state.msgItemAdded) closeMessage(controller, i);
             closeReasoning(controller);
             for (const i in state.funcCallIds) closeToolCall(controller, i);
-            sendCompleted(controller);
+            if (state.usage) {
+              // Usage already captured — either it arrived in this same chunk, or an
+              // earlier usage-bearing chunk already populated state.usage. Either way
+              // there is nothing left to wait for, so complete right away.
+              sendCompleted(controller);
+            } else {
+              // #6906: defer response.completed — a trailing usage-only chunk may
+              // still arrive (stream_options.include_usage=true). The empty-choices
+              // branch above (or flush() at stream end, as a fallback) actually
+              // calls sendCompleted().
+              state.awaitingTrailingUsage = true;
+            }
           }
         }
       },
diff --git a/open-sse/translator/helpers/geminiHelper.ts b/open-sse/translator/helpers/geminiHelper.ts
index 5fd500b2da..7f45cf329d 100644
--- a/open-sse/translator/helpers/geminiHelper.ts
+++ b/open-sse/translator/helpers/geminiHelper.ts
@@ -172,17 +172,35 @@ export function convertOpenAIContentToParts(content: unknown): JsonRecord[] {
 
         // 3. Handle raw data strings (e.g. {"type": "file", "data": "JVBER...", "mime_type": "..."}).
         //    Also accept the Responses-API shape {"type":"input_file","file_data":"JVBER...","filename":...}
-        //    so PDFs sent as `input_file` reach Gemini instead of being silently dropped (#2515).
+        //    AND the OpenAI Chat Completions shape
+        //    {"type":"file","file":{"filename":...,"file_data":"data:<mime>;base64,..."}} so PDFs and
+        //    videos reach Gemini instead of being silently dropped (#2515). Gemini reads
+        //    application/pdf and video/* natively via inlineData, exactly like images.
         const file = toRecord(rec.file);
         const doc = toRecord(rec.document);
-        const rawDataStr = rec.data || rec.file_data || file?.data || doc?.data;
-        const mimeTypeFallback =
-          rec.mime_type || rec.media_type || file?.mime_type || doc?.mime_type || "application/pdf";
+        const rawDataStr =
+          rec.data || rec.file_data || file?.data || file?.file_data || doc?.data || doc?.file_data;
         if (typeof rawDataStr === "string" && !rawDataStr.startsWith("http")) {
+          // Prefer the mime embedded in the data: URI (e.g. application/pdf, video/mp4) so
+          // documents and videos are not mislabeled as the fallback; the fallback applies
+          // only to bare base64 that carries no data: prefix.
+          let mimeType =
+            rec.mime_type ||
+            rec.media_type ||
+            file?.mime_type ||
+            doc?.mime_type ||
+            "application/pdf";
+          if (rawDataStr.startsWith("data:")) {
+            const commaIndex = rawDataStr.indexOf(",");
+            if (commaIndex !== -1) {
+              const parsedMime = rawDataStr.substring(5, commaIndex).split(";")[0];
+              if (parsedMime) mimeType = parsedMime;
+            }
+          }
           const rawData = rawDataStr.replace(/^data:[a-zA-Z0-9/+-]+;base64,/, "");
           parts.push({
             inlineData: {
-              mimeType: String(mimeTypeFallback),
+              mimeType: String(mimeType),
               data: rawData,
             },
           });
diff --git a/open-sse/translator/paramSupport.ts b/open-sse/translator/paramSupport.ts
index 30a32e2b5c..974e1ef311 100644
--- a/open-sse/translator/paramSupport.ts
+++ b/open-sse/translator/paramSupport.ts
@@ -6,17 +6,29 @@
 //   - `provider` (optional) limits the rule to a single provider id.
 //   - `match` is a RegExp tested against the model id OR a predicate (model -> boolean).
 //   - `drop` is the list of param keys to remove when the rule fires.
+//   - `clampToModelMaxOutput` clamps max_tokens/max_completion_tokens/max_output_tokens
+//     down to the model's catalog `maxOutputTokens` ceiling, when one is set.
+//   - `maxOutputCap` clamps the same keys down to a fixed endpoint-imposed ceiling
+//     (independent of the model's own advertised ceiling). When both are present on
+//     the same rule, the lower of the two wins.
 //
 // A param is removed only when it is present (!== undefined). The helper never
 // introduces new keys and never throws on null/undefined bodies — call sites
 // can chain it without extra guards.
 
+import { getParamFilterConfig, ModelParamFilter, ProviderParamFilter } from "@/lib/db/paramFilters";
+import { getProviderModel } from "../config/providerModels.ts";
+
 type StripRule = {
   provider?: string;
   match: RegExp | ((model: string) => boolean);
-  drop: string[];
+  drop?: string[];
+  clampToModelMaxOutput?: boolean;
+  maxOutputCap?: number;
 };
 
+const MAX_OUTPUT_TOKEN_KEYS = ["max_tokens", "max_completion_tokens", "max_output_tokens"] as const;
+
 const STRIP_RULES: StripRule[] = [
   // claude-opus-4 series: temperature is deprecated (Anthropic returns 400). #1748
   { match: /claude-opus-4/i, drop: ["temperature"] },
@@ -25,8 +37,7 @@ const STRIP_RULES: StripRule[] = [
   // GitHub Copilot Claude (except opus/sonnet 4.6): thinking + reasoning_effort rejected. #713
   {
     provider: "github",
-    match: (m: string) =>
-      /claude/i.test(m) && !/claude.*(opus|sonnet).*4\.6/i.test(m),
+    match: (m: string) => /claude/i.test(m) && !/claude.*(opus|sonnet).*4\.6/i.test(m),
     drop: ["thinking", "reasoning_effort"],
   },
   // NVIDIA NIM z-ai/glm-5.2: OpenAI-compatible wrapper rejects BOTH the `reasoning`
@@ -39,12 +50,56 @@ const STRIP_RULES: StripRule[] = [
   // (format:"openai") does not accept the Claude-style `thinking` body field
   // and returns 400 "Unsupported parameter(s): thinking". Upstream #2268.
   { provider: "nvidia", match: /minimax-m2\.7/i, drop: ["thinking"] },
+  // VolcEngine Ark caps the Kimi coding-plan endpoint at max_tokens <= 32768
+  // server-side ("integer above maximum value, expected a value <= 32768"),
+  // independent of the model's own catalog ceiling. Confirmed against two
+  // independent live-endpoint reports hitting the same Ark endpoint for both
+  // kimi-k2.5 and kimi-k2.7-code (NousResearch/hermes-agent#51773,
+  // MoonshotAI/kimi-cli#1124), and by upstream decolua/9router#2460. Scoped to
+  // OmniRoute's actual volcengine Kimi id (not a broad /kimi/i regex) so it
+  // never clamps an unrelated future Kimi listing whose Ark cap may differ.
+  { provider: "volcengine", match: /^kimi-k2-5-260127$/, maxOutputCap: 32768, clampToModelMaxOutput: true },
 ];
 
 function matches(rule: StripRule, model: string): boolean {
   return typeof rule.match === "function" ? rule.match(model) : rule.match.test(model);
 }
 
+/**
+ * When a rule requests it, clamp the max-output-token family of params down to
+ * the lowest applicable ceiling: the model's own catalog `maxOutputTokens`
+ * (`clampToModelMaxOutput`) and/or a fixed endpoint cap (`maxOutputCap`). Only
+ * clamps keys that are present and numeric; never introduces a new key.
+ */
+function applyMaxOutputClamp(
+  rule: StripRule,
+  provider: string | null | undefined,
+  model: string,
+  body: Record<string, unknown>
+): void {
+  if (!rule.clampToModelMaxOutput && !Number.isFinite(rule.maxOutputCap)) return;
+
+  const candidates: number[] = [];
+  if (rule.clampToModelMaxOutput) {
+    const modelCeiling = getProviderModel(provider ?? "", model)?.maxOutputTokens;
+    if (Number.isFinite(modelCeiling) && (modelCeiling as number) > 0) {
+      candidates.push(modelCeiling as number);
+    }
+  }
+  if (Number.isFinite(rule.maxOutputCap) && (rule.maxOutputCap as number) > 0) {
+    candidates.push(rule.maxOutputCap as number);
+  }
+  if (candidates.length === 0) return;
+
+  const ceiling = Math.min(...candidates);
+  for (const key of MAX_OUTPUT_TOKEN_KEYS) {
+    const value = body[key];
+    if (typeof value === "number" && Number.isFinite(value) && value > ceiling) {
+      body[key] = ceiling;
+    }
+  }
+}
+
 /**
  * Remove unsupported params from `body` in place. Returns the same reference
  * (or `body` unchanged when it is not a plain object / model is empty).
@@ -56,15 +111,107 @@ export function stripUnsupportedParams<T>(
 ): T {
   if (!model || !body || typeof body !== "object") return body;
   const rec = body as unknown as Record<string, unknown>;
+  // Snapshot the original body before any mutations so the allowlist can
+  // restore params that were stripped by hardcoded or config-driven denylist.
+  const snapshot = { ...rec };
+
+  // Phase 1: Hardcoded rules (unchanged)
   for (const rule of STRIP_RULES) {
     if (rule.provider && rule.provider !== provider) continue;
     if (!matches(rule, model)) continue;
-    for (const key of rule.drop) {
+    for (const key of rule.drop ?? []) {
       if (rec[key] !== undefined) delete rec[key];
     }
+    applyMaxOutputClamp(rule, provider, model, rec);
   }
+
+  // Phase 2: Config-driven rules from DB
+  applyConfigFilters(provider, model, rec, snapshot);
+
   return body;
 }
 
+/**
+ * Restore keys from `snapshot` into `body` for every key listed in `allow`,
+ * but only when the key was present in the original request. Shared by the
+ * provider-level and model-level allowlist passes below.
+ */
+function restoreAllowedKeys(
+  body: Record<string, unknown>,
+  snapshot: Record<string, unknown>,
+  allow: readonly string[]
+): void {
+  for (const key of allow) {
+    if (key in snapshot) {
+      body[key] = snapshot[key];
+    }
+  }
+}
+
+/**
+ * Apply the provider-level denylist, then restore the provider-level
+ * allowlist from `snapshot`. Runs BEFORE model-level operations so
+ * model-level settings can override provider-level ones.
+ */
+function applyProviderLevelFilters(
+  body: Record<string, unknown>,
+  snapshot: Record<string, unknown>,
+  config: ProviderParamFilter
+): void {
+  for (const key of config.block) {
+    delete body[key];
+  }
+  if (config.allow.length > 0) {
+    restoreAllowedKeys(body, snapshot, config.allow);
+  }
+}
+
+/**
+ * Apply the model-level denylist (overrides the provider-level allowlist),
+ * then restore the model-level allowlist from `snapshot` (final pass, most
+ * specific wins).
+ */
+function applyModelLevelFilters(
+  body: Record<string, unknown>,
+  snapshot: Record<string, unknown>,
+  modelCfg: ModelParamFilter | undefined
+): void {
+  if (modelCfg?.block) {
+    for (const key of modelCfg.block) {
+      delete body[key];
+    }
+  }
+  if (modelCfg?.allow) {
+    restoreAllowedKeys(body, snapshot, modelCfg.allow);
+  }
+}
+
+/**
+ * Apply config-driven denylist + allowlist rules from the DB-backed
+ * ProviderParamFilter store. Order of operations:
+ *   1. Provider-level denylist
+ *   2. Model-level denylist
+ *   3. Provider-level allowlist (restores from snapshot)
+ *   4. Model-level allowlist (restores from snapshot)
+ *
+ * The allowlist only restores keys that were present in the original request
+ * (the snapshot). It never introduces new params the client didn't send.
+ */
+export function applyConfigFilters(
+  provider: string | null | undefined,
+  model: string | null | undefined,
+  body: Record<string, unknown>,
+  snapshot: Record<string, unknown>
+): void {
+  if (!provider || !body) return;
+  const config = getParamFilterConfig(provider);
+  if (!config) return;
+
+  applyProviderLevelFilters(body, snapshot, config);
+
+  const modelCfg = config.models?.[model ?? ""];
+  applyModelLevelFilters(body, snapshot, modelCfg);
+}
+
 // Exported for unit tests only — do not import from production code.
 export const __STRIP_RULES_FOR_TEST: ReadonlyArray<StripRule> = STRIP_RULES;
diff --git a/open-sse/translator/request/openai-responses/toResponses.ts b/open-sse/translator/request/openai-responses/toResponses.ts
index d52608496f..bda9113d08 100644
--- a/open-sse/translator/request/openai-responses/toResponses.ts
+++ b/open-sse/translator/request/openai-responses/toResponses.ts
@@ -17,6 +17,16 @@ import {
   normalizeResponsesReasoningEffort,
 } from "./helpers.ts";
 
+// A Chat-Completions client can only express reasoning via the top-level
+// `reasoning_effort` hint; it has no way to request a reasoning summary. When we
+// promote that hint to the Responses API's `reasoning.effort`, default the
+// summary (plus the encrypted-content include that actually streams it) so a
+// downstream chat client still sees a thinking stream instead of an empty
+// summary. Mirrors the Codex executor's `ensureCodexReasoningSummary`. An
+// explicit `reasoning` object from a Responses-shaped client is preserved as-is.
+const DEFAULT_RESPONSES_REASONING_SUMMARY = "auto";
+const RESPONSES_REASONING_ENCRYPTED_CONTENT_INCLUDE = "reasoning.encrypted_content";
+
 // Chat Completions `response_format: { type: "json_schema" }` → Responses API `text.format`.
 // Merges into any existing `result.text` (e.g. verbosity) so structured-output schemas from
 // Chat clients survive the translation to the Responses/Codex upstream (#5933).
@@ -329,11 +339,17 @@ export function openaiToOpenAIResponsesRequest(
   if (chatVerbosity) {
     result.text = { ...toRecord(result.text), verbosity: chatVerbosity };
   }
+  let defaultedReasoningSummary = false;
   if (root.reasoning !== undefined) {
     result.reasoning = root.reasoning;
   } else if (root.reasoning_effort !== undefined) {
     const effort = normalizeResponsesReasoningEffort(root.reasoning_effort);
-    if (effort) {
+    if (effort && effort !== "none") {
+      // Effort-only chat request: default a reasoning summary so the upstream
+      // streams thinking back (see the constant's note above).
+      result.reasoning = { effort, summary: DEFAULT_RESPONSES_REASONING_SUMMARY };
+      defaultedReasoningSummary = true;
+    } else if (effort) {
       result.reasoning = { effort };
     }
   }
@@ -345,6 +361,14 @@ export function openaiToOpenAIResponsesRequest(
   if (Array.isArray(root.include) && root.include.length > 0) {
     result.include = root.include;
   }
+  // When we defaulted a reasoning summary above, also request the encrypted
+  // reasoning content so the summary actually streams back to the chat client.
+  if (defaultedReasoningSummary) {
+    const include = Array.isArray(result.include) ? (result.include as unknown[]) : [];
+    if (!include.includes(RESPONSES_REASONING_ENCRYPTED_CONTENT_INCLUDE)) {
+      result.include = [...include, RESPONSES_REASONING_ENCRYPTED_CONTENT_INCLUDE];
+    }
+  }
   if (storeEnabled) {
     if (root[RESPONSES_STORE_MARKER] !== undefined) {
       result.store = root[RESPONSES_STORE_MARKER];
diff --git a/open-sse/translator/request/openai-to-claude.ts b/open-sse/translator/request/openai-to-claude.ts
index 1c380b5f33..ff5dc4b6d5 100644
--- a/open-sse/translator/request/openai-to-claude.ts
+++ b/open-sse/translator/request/openai-to-claude.ts
@@ -363,7 +363,15 @@ export function openaiToClaudeRequest(model, body, stream) {
   if (body.tools && Array.isArray(body.tools)) {
     result.tools = body.tools
       .map((tool) => {
-        const toolData = tool.type === "function" && tool.function ? tool.function : tool;
+        // Function-shaped tools arrive in two flavors from real clients:
+        //   (a) openai-spec: { type: "function", function: { name, ... } }
+        //   (b) bare/loose:  { function: { name, ... } }   (no parent `type`)
+        // Unwrap `tool.function` whenever it is present, regardless of the
+        // parent `type` field — some OpenAI-shape clients omit the wrapper's
+        // `type: "function"` entirely. Previously that bare shape fell
+        // through to `toolData = tool` (the wrapper itself, with no `.name`),
+        // producing an empty `originalName` and silently dropping the tool.
+        const toolData = tool.function ?? tool;
         const originalName = typeof toolData.name === "string" ? toolData.name.trim() : "";
 
         if (!originalName) {
@@ -545,6 +553,36 @@ function getContentBlocksFromMessage(
           } else if (url.trim()) {
             blocks.push({ type: "image", source: { type: "url", url } });
           }
+        } else if (part.type === "file" && (part.file?.file_data || part.file?.data)) {
+          // OpenAI Chat Completions file block:
+          // {type:"file", file:{filename, file_data:"data:<mime>;base64,..."}}.
+          // Map PDFs to a Claude document block and image mimes to an image block so the
+          // attachment reaches the model instead of being silently dropped. Claude has no
+          // native video input, so non-pdf/non-image files are skipped here.
+          const fileData = part.file.file_data || part.file.data;
+          const fmatch =
+            typeof fileData === "string" ? fileData.match(/^data:([^;]+);base64,(.+)$/) : null;
+          if (fmatch) {
+            const mediaType = fmatch[1];
+            if (mediaType === "application/pdf") {
+              blocks.push({
+                type: "document",
+                source: { type: "base64", media_type: mediaType, data: fmatch[2] },
+                ...(part.file.filename ? { title: part.file.filename } : {}),
+              });
+            } else if (mediaType.startsWith("image/")) {
+              blocks.push({
+                type: "image",
+                source: { type: "base64", media_type: mediaType, data: fmatch[2] },
+              });
+            }
+          } else if (typeof fileData === "string" && /^https?:\/\//i.test(fileData)) {
+            blocks.push({
+              type: "document",
+              source: { type: "url", url: fileData },
+              ...(part.file.filename ? { title: part.file.filename } : {}),
+            });
+          }
         }
       }
     }
@@ -622,7 +660,12 @@ function getContentBlocksFromMessage(
       (b) => b.type === "thinking" || b.type === "redacted_thinking"
     );
     const hasToolUseBlock = blocks.some((b) => b.type === "tool_use");
-    if (msg.reasoning_content && thinkingEnabledForRequest && hasToolUseBlock && !hasThinkingBlock) {
+    if (
+      msg.reasoning_content &&
+      thinkingEnabledForRequest &&
+      hasToolUseBlock &&
+      !hasThinkingBlock
+    ) {
       blocks.unshift({
         type: "redacted_thinking",
         data: DEFAULT_THINKING_CLAUDE_SIGNATURE,
diff --git a/open-sse/translator/request/openai-to-gemini.ts b/open-sse/translator/request/openai-to-gemini.ts
index 703f2cbe10..a45fb3232d 100644
--- a/open-sse/translator/request/openai-to-gemini.ts
+++ b/open-sse/translator/request/openai-to-gemini.ts
@@ -188,35 +188,50 @@ function openaiToGeminiBase(
   }
 
   // Thinking / Reasoning support (Google Gemini 2.0+ Thinking models)
-  // 1. OpenAI format: reasoning_effort (low/medium/high/auto/max/xhigh)
-  // "auto", "max", and "xhigh" are clamped to the high-tier budget because Gemini
-  // does not accept these strings directly. "auto" signals "use max reasonable effort"
-  // which maps to high. "max"/"xhigh" exceed Gemini's accepted range and are clamped.
-  // Port of decolua/9router#2043 by @nguyenxvotanminh3.
-  if (body.reasoning_effort) {
-    const highBudget = capThinkingBudget(model, 32768);
-    const budgetMap: Record<string, number> = {
-      low: 1024,
-      medium: getDefaultThinkingBudget(model) || 8192,
-      high: highBudget,
-      auto: highBudget,
-      max: highBudget,
-      xhigh: highBudget,
-    };
-    const budget =
-      budgetMap[body.reasoning_effort as string] ?? getDefaultThinkingBudget(model) ?? 8192;
-    result.generationConfig.thinkingConfig = {
-      thinkingBudget: budget,
-      includeThoughts: true,
-    };
-  }
-  // 2. Claude format: thinking (type: enabled, budget_tokens)
-  const thinking = body.thinking as { type?: string; budget_tokens?: number } | undefined;
-  if (thinking?.type === "enabled" && thinking.budget_tokens) {
-    result.generationConfig.thinkingConfig = {
-      thinkingBudget: thinking.budget_tokens,
-      includeThoughts: true,
-    };
+  // gemma-4 models return - 400: Thinking budget is not supported for this model.
+  // Mirrors the same guard in claude-to-gemini.ts. Port of the thinkingConfig
+  // guard half of decolua/9router#2480 (the signature-replay half of that PR
+  // is out of scope and not ported here).
+  if (model.startsWith("gemma-4")) {
+    // gemma-4 models returns - 400: Thinking budget is not supported for this model
+  } else {
+    // 1. OpenAI format: reasoning_effort (none/low/medium/high/auto/max/xhigh)
+    // "auto", "max", and "xhigh" are clamped to the high-tier budget because Gemini
+    // does not accept these strings directly. "auto" signals "use max reasonable effort"
+    // which maps to high. "max"/"xhigh" exceed Gemini's accepted range and are clamped.
+    // "none" maps to budget 0 — an explicit, documented off-switch (#6813 defect 2),
+    // distinct from the no-knob-at-all default-injection case below (#4170).
+    // Port of decolua/9router#2043 by @nguyenxvotanminh3.
+    if (body.reasoning_effort) {
+      const highBudget = capThinkingBudget(model, 32768);
+      const budgetMap: Record<string, number> = {
+        none: 0,
+        low: 1024,
+        medium: getDefaultThinkingBudget(model) || 8192,
+        high: highBudget,
+        auto: highBudget,
+        max: highBudget,
+        xhigh: highBudget,
+      };
+      const budget =
+        budgetMap[body.reasoning_effort as string] ?? getDefaultThinkingBudget(model) ?? 8192;
+      result.generationConfig.thinkingConfig = {
+        thinkingBudget: budget,
+        includeThoughts: budget !== 0,
+      };
+    }
+    // 2. Claude format: thinking (type: enabled, budget_tokens)
+    // Use an explicit numeric check (not truthy) so an explicit `budget_tokens: 0` — the
+    // natural way to disable thinking — is honored as thinkingBudget 0 instead of being
+    // dropped and falling through to the default injection below (#6813). A zero budget
+    // yields no thoughts, so includeThoughts is only set for a non-zero budget.
+    const thinking = body.thinking as { type?: string; budget_tokens?: number } | undefined;
+    if (thinking?.type === "enabled" && typeof thinking.budget_tokens === "number") {
+      result.generationConfig.thinkingConfig = {
+        thinkingBudget: thinking.budget_tokens,
+        includeThoughts: thinking.budget_tokens !== 0,
+      };
+    }
   }
 
   // 3. Default: all modern Gemini models (2.5+) have thinking capability.
@@ -224,7 +239,9 @@ function openaiToGeminiBase(
   // thinking.type), still set includeThoughts so the upstream marks thought
   // parts with thought:true. Without this, the model's reasoning leaks into
   // visible content instead of being routed to reasoning_content by the
-  // response translator. (#4170)
+  // response translator. (#4170) — this default-injection case is intentionally
+  // unconditional (no-knob-at-all still gets includeThoughts:true); the explicit
+  // "reasoning_effort: none" off-switch above (#6813) is the supported opt-out.
   if (!result.generationConfig.thinkingConfig) {
     const modelLower = model.toLowerCase();
     if (
@@ -621,6 +638,7 @@ function wrapInCloudCodeEnvelope(model, cloudCodeRequest, credentials = null) {
       systemInstruction: cloudCodeRequest.systemInstruction,
       generationConfig: applyAntigravityGenerationDefaults(cloudCodeRequest.generationConfig),
       tools: cloudCodeRequest.tools,
+      safetySettings: cloudCodeRequest.safetySettings,
     },
     model: cleanModel,
     userAgent: getAntigravityEnvelopeUserAgent(credentials),
diff --git a/open-sse/translator/request/openai-to-kiro.ts b/open-sse/translator/request/openai-to-kiro.ts
index 8508fe54d0..3da0a59340 100644
--- a/open-sse/translator/request/openai-to-kiro.ts
+++ b/open-sse/translator/request/openai-to-kiro.ts
@@ -5,12 +5,13 @@
 import { register } from "../registry.ts";
 import { FORMATS } from "../formats.ts";
 import { v4 as uuidv4, v5 as uuidv5 } from "uuid";
-import { capMaxOutputTokens, capThinkingBudget, supportsReasoning } from "@/lib/modelCapabilities";
+import { capMaxOutputTokens, capThinkingBudget } from "@/lib/modelCapabilities";
 import {
   parseToolInput,
   normalizeKiroToolSchema,
   serializeToolResultContent,
 } from "./openai-to-kiro/messageHelpers.ts";
+import { supportsKiroAdaptiveThinking } from "./openai-to-kiro/adaptiveThinking.ts";
 
 /**
  * Anthropic's direct-provider `[1m]` context-1m beta suffix. Kiro is AWS
@@ -579,6 +580,26 @@ function convertMessages(messages, tools, model) {
 /** Kiro's accepted reasoning-effort levels (`output_config.effort`). */
 const KIRO_EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
 
+function resolveKiroModelAlias(model: string): { upstream: string; thinking: boolean } {
+  let upstream = String(model || "");
+  let thinking = false;
+
+  if (upstream.endsWith("-agentic")) {
+    upstream = upstream.slice(0, -"-agentic".length);
+  }
+  if (upstream.endsWith("-thinking")) {
+    upstream = upstream.slice(0, -"-thinking".length);
+    thinking = true;
+  }
+  if (upstream === "auto-kiro") {
+    upstream = "auto";
+  }
+
+  upstream = upstream.replace(/^(claude-(?:opus|sonnet|haiku|3-\d+)-\d+)-(\d{1,2})$/, "$1.$2");
+
+  return { upstream, thinking };
+}
+
 /**
  * Resolve the Kiro effort level for a request, or "" when no reasoning was asked
  * for. Effort sources, in priority order:
@@ -665,10 +686,11 @@ export function buildKiroPayload(model, body, stream, credentials) {
   // The minor group is bounded to 1-2 digits so date-suffixed ids (e.g.
   // claude-opus-4-20250514) are never mistaken for a dash-separated minor
   // version and corrupted into claude-opus-4.20250514 (upstream 9router #2270).
-  const normalizedModel = model.replace(
-    /^(claude-(?:opus|sonnet|haiku|3-\d+)-\d+)-(\d{1,2})$/,
-    "$1.$2"
-  );
+  // Synthetic Kiro selector variants (`-thinking`, `-agentic`) are local aliases:
+  // strip them before the request leaves OmniRoute so Kiro only receives real
+  // upstream model IDs. We intentionally do not inject an agentic system prompt here.
+  const { upstream: normalizedModel, thinking: modelRequestsThinking } =
+    resolveKiroModelAlias(model);
   const messages = body.messages || [];
   let tools = body.tools || [];
   const maxTokens = body.max_tokens ?? body.max_completion_tokens ?? 32000;
@@ -837,14 +859,14 @@ export function buildKiroPayload(model, body, stream, credentials) {
   // Thinking mode for Claude models on Kiro (ported from javargasm/pi-kiro).
   // Two coordinated signals steer reasoning on the CodeWhisperer surface:
   //   1. a `<thinking_mode>enabled</thinking_mode><max_thinking_length>N</...>`
-  //      directive prepended to the current user message — makes Claude emit its
-  //      reasoning INLINE as `<thinking>…</thinking>`, which the Kiro executor
-  //      splits back into the OpenAI `reasoning_content` channel (kiroThinking.ts);
+  //      directive prepended to the user message — makes Claude emit reasoning
+  //      INLINE, split back into `reasoning_content` by the executor (kiroThinking.ts);
   //   2. top-level `additionalModelRequestFields` (output_config.effort +
   //      thinking:{type:"adaptive"} + a clamped max_tokens), forwarded to AWS by
-  //      the Kiro executor's transformRequest allowlist — this is the graded
-  //      effort lever. Gated on models that advertise thinking support.
-  const kiroEffort = supportsReasoning(normalizedModel) ? resolveKiroEffort(body) : "";
+  //      the Kiro executor's transformRequest allowlist — the graded effort lever,
+  //      gated on Kiro's adaptive-thinking allowlist (#6576), not supportsReasoning().
+  const requestedEffort = resolveKiroEffort(body) || (modelRequestsThinking ? "high" : "");
+  const kiroEffort = supportsKiroAdaptiveThinking(normalizedModel) ? requestedEffort : "";
   if (kiroEffort) {
     // `<thinking_mode>` / `<max_thinking_length>` are Kiro/CodeWhisperer prompt
     // conventions (NOT Anthropic API params); the length is a soft hint (the hard
diff --git a/open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts b/open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts
new file mode 100644
index 0000000000..ba8fefdc97
--- /dev/null
+++ b/open-sse/translator/request/openai-to-kiro/adaptiveThinking.ts
@@ -0,0 +1,19 @@
+/**
+ * Kiro/AWS CodeWhisperer only accepts the adaptive-thinking
+ * `additionalModelRequestFields` envelope for a narrow allowlist of models —
+ * NOT the same set the generic Anthropic-API capability table
+ * (`supportsReasoning()` in `@/lib/modelCapabilities`) marks as
+ * thinking-capable. That table is correct for Anthropic's own API, but Kiro
+ * rejects the field for `claude-sonnet-4.5` and `claude-haiku-4.5` with a raw
+ * upstream 400 (`additionalModelRequestFields is not supported for this
+ * model`, issue #6576) even though both ARE thinking-capable on Anthropic's
+ * direct API. Only `claude-sonnet-5` is confirmed to accept the adaptive
+ * envelope on Kiro today — keep this allowlist in sync with
+ * `open-sse/config/providers/registry/kiro/index.ts` if Kiro's catalog or
+ * upstream behavior changes.
+ */
+const KIRO_ADAPTIVE_THINKING_MODELS = new Set(["claude-sonnet-5"]);
+
+export function supportsKiroAdaptiveThinking(normalizedModel: string): boolean {
+  return KIRO_ADAPTIVE_THINKING_MODELS.has(normalizedModel);
+}
diff --git a/open-sse/translator/response/gemini-to-claude.ts b/open-sse/translator/response/gemini-to-claude.ts
index 2019c46100..f2c96bf137 100644
--- a/open-sse/translator/response/gemini-to-claude.ts
+++ b/open-sse/translator/response/gemini-to-claude.ts
@@ -1,5 +1,6 @@
 import { register } from "../registry.ts";
 import { FORMATS } from "../formats.ts";
+import { isAbortFinishReason } from "../../utils/finishReason.ts";
 
 /**
  * Direct Gemini → Claude response translator.
@@ -178,6 +179,14 @@ export function geminiToClaudeResponse(chunk, state) {
       // reason has already been emitted to the client — this is unavoidable in
       // SSE streaming. Map to end_turn (Claude has no "content blocked" reason).
       stopReason = "end_turn";
+    } else if (isAbortFinishReason(reason)) {
+      // Aborted/malformed tool call (e.g. MALFORMED_FUNCTION_CALL,
+      // UNEXPECTED_TOOL_CALL). Surface as tool_use rather than a clean end_turn
+      // so the client sees the turn did not complete normally. Same fix as the
+      // hub path (openai-to-claude.ts) — this direct Gemini→Claude translator is
+      // the one Claude Code hits through an antigravity/Gemini-routed model.
+      // Port of decolua/9router#2462 by @anhdiepmmk.
+      stopReason = "tool_use";
     } else {
       stopReason = "end_turn";
     }
diff --git a/open-sse/translator/response/gemini-to-openai.ts b/open-sse/translator/response/gemini-to-openai.ts
index 9d8a8629fe..464a3feee3 100644
--- a/open-sse/translator/response/gemini-to-openai.ts
+++ b/open-sse/translator/response/gemini-to-openai.ts
@@ -729,6 +729,12 @@ export function geminiToOpenAIResponse(chunk, state) {
     // normalizeOpenAICompatibleFinishReasonString lowercases, maps max_tokens→length,
     // and folds Gemini safety reasons (safety/recitation/blocklist/...) → content_filter
     // so downstream clients can distinguish a blocked completion from a normal stop.
+    // Abort reasons (MALFORMED_FUNCTION_CALL, UNEXPECTED_TOOL_CALL, ...) are NOT in
+    // either mapped set, so they surface here unchanged (e.g. raw
+    // "malformed_function_call") rather than being folded into a misleading "stop" —
+    // isAbortFinishReason() (finishReason.ts) is what the openai→claude hub step
+    // uses downstream to recognize this raw value and keep it off a clean end_turn
+    // (9router#2462 sub-bug #2).
     let finishReason = normalizeOpenAICompatibleFinishReasonString(candidate.finishReason);
     if (finishReason === "stop" && state.toolCalls.size > 0) {
       finishReason = "tool_calls";
diff --git a/open-sse/translator/response/openai-responses.ts b/open-sse/translator/response/openai-responses.ts
index 6e62715f84..42fca56462 100644
--- a/open-sse/translator/response/openai-responses.ts
+++ b/open-sse/translator/response/openai-responses.ts
@@ -14,10 +14,52 @@ import {
   normalizeUpstreamFailure,
   extractResponsesReasoningSummaryText,
 } from "./openai-responses/pureHelpers.ts";
+import { createEventEmitter } from "./openai-responses/eventEmitter.ts";
 
 // normalizeUpstreamFailure is re-exported for external importers (tests).
 export { normalizeUpstreamFailure } from "./openai-responses/pureHelpers.ts";
 
+/**
+ * Escape control characters (newlines, tabs, carriage returns) that appear
+ * inside JSON string values, ensuring the resulting string is valid JSON.
+ * This handles upstream providers (e.g. Gemini/Gemma) that emit literal
+ * newlines (0x0A) instead of \n escapes inside tool call argument JSON.
+ * Only escapes characters inside string contexts to avoid double-escaping
+ * already-proper JSON or corrupting structural newlines.
+ */
+function escapeJsonStringValues(json: string): string {
+  let result = "";
+  let inString = false;
+
+  for (let i = 0; i < json.length; i++) {
+    const ch = json[i];
+
+    // Inside a string, skip over escape sequences
+    if (inString && ch === "\\") {
+      result += ch + (json[i + 1] ?? "");
+      i++;
+      continue;
+    }
+
+    // Toggle string state on unescaped double quotes
+    if (ch === '"') {
+      result += ch;
+      inString = !inString;
+      continue;
+    }
+
+    // Escape control characters only inside string values
+    if (inString && (ch === "\n" || ch === "\r" || ch === "\t")) {
+      result += ch === "\n" ? "\\n" : ch === "\r" ? "\\r" : "\\t";
+      continue;
+    }
+
+    result += ch;
+  }
+
+  return result;
+}
+
 /**
  * Translate OpenAI chunk to Responses API events
  * @returns {Array} Array of events with { event, data } structure
@@ -52,16 +94,19 @@ export function openaiToOpenAIResponsesResponse(chunk, state) {
   }
 
   if (!chunk.choices?.length) {
+    // #6906: a deferred finish_reason (awaitingTrailingUsage, see below) completes here —
+    // the trailing usage-only chunk (choices: [], usage: {...}) is what real
+    // stream_options.include_usage=true upstreams send after finish_reason (see the
+    // "READ THIS" block in stream.ts); state.usage was already captured above.
+    if (state.awaitingTrailingUsage && !state.completedSent) {
+      const { events, emit } = createEventEmitter(state);
+      sendCompleted(state, emit);
+      return events;
+    }
     return [];
   }
 
-  const events = [];
-  const nextSeq = () => ++state.seq;
-
-  const emit = (eventType, data) => {
-    data.sequence_number = nextSeq();
-    events.push({ event: eventType, data });
-  };
+  const { events, emit } = createEventEmitter(state);
 
   const choice = chunk.choices[0];
   const idx = choice.index || 0;
@@ -70,33 +115,44 @@ export function openaiToOpenAIResponsesResponse(chunk, state) {
     state.parseTextualReasoningTags = shouldParseTextualReasoningTags(undefined, chunk.model);
   }
   const parseTextualReasoningTags = state.parseTextualReasoningTags === true;
+  // #3697: remember the upstream-resolved model so response.created/in_progress/completed
+  // can carry a `model` field (the Responses API spec has one; this translator previously
+  // omitted it). Codex CLI compatibility shim (chatCore's echoModel pipeline) rewrites this
+  // field to the client-requested effort-suffixed id for codex-originated requests.
+  if (!state.model && typeof chunk.model === "string" && chunk.model.trim()) {
+    state.model = chunk.model.trim();
+  }
 
   // Emit initial events
   if (!state.started) {
     state.started = true;
     state.responseId = chunk.id ? `resp_${chunk.id}` : state.responseId;
 
+    const createdResponse: Record<string, unknown> = {
+      id: state.responseId,
+      object: "response",
+      created_at: state.created,
+      status: "in_progress",
+      background: false,
+      error: null,
+      output: [],
+    };
+    if (state.model) createdResponse.model = state.model;
     emit("response.created", {
       type: "response.created",
-      response: {
-        id: state.responseId,
-        object: "response",
-        created_at: state.created,
-        status: "in_progress",
-        background: false,
-        error: null,
-        output: [],
-      },
+      response: createdResponse,
     });
 
+    const inProgressResponse: Record<string, unknown> = {
+      id: state.responseId,
+      object: "response",
+      created_at: state.created,
+      status: "in_progress",
+    };
+    if (state.model) inProgressResponse.model = state.model;
     emit("response.in_progress", {
       type: "response.in_progress",
-      response: {
-        id: state.responseId,
-        object: "response",
-        created_at: state.created,
-        status: "in_progress",
-      },
+      response: inProgressResponse,
     });
   }
 
@@ -163,7 +219,13 @@ export function openaiToOpenAIResponsesResponse(chunk, state) {
     for (const i in state.msgItemAdded) closeMessage(state, emit, i);
     closeReasoning(state, emit);
     for (const i in state.funcCallIds) closeToolCall(state, emit, i);
-    sendCompleted(state, emit);
+    // #6906: usage already captured (same chunk or earlier) completes now; otherwise
+    // defer for a trailing usage-only chunk, handled above and in flushEvents().
+    if (state.usage) {
+      sendCompleted(state, emit);
+    } else {
+      state.awaitingTrailingUsage = true;
+    }
   }
 
   return events;
@@ -397,7 +459,8 @@ function emitToolCall(state, emit, tc) {
   if (tc.function?.arguments) {
     const refCallId = state.funcCallIds[tcIdx] || newCallId;
     const existingArgs = state.funcArgsBuf[tcIdx] || "";
-    const nextArgs = appendToolCallArgumentDelta(existingArgs, tc.function.arguments);
+    const sanitized = escapeJsonStringValues(tc.function.arguments);
+    const nextArgs = appendToolCallArgumentDelta(existingArgs, sanitized);
     const emittedDelta = nextArgs.slice(existingArgs.length);
     state.funcArgsBuf[tcIdx] = nextArgs;
 
@@ -498,16 +561,30 @@ function sendCompleted(state, emit) {
     // emission sequence for stable ordering.
     const output = buildDenseOutput(state);
 
+    // Surface upstream mid-stream errors (e.g. Gemini 503) in the
+    // Responses-API `response.completed` event instead of silently emitting
+    // `status: "completed"`. The error is set by the Gemini-to-OpenAI
+    // translator or the OpenAI-Responses translator itself when the upstream
+    // SSE stream emits a JSON error object after partial content.
+    const upstreamErr = state.upstreamError;
+
     const response: Record<string, unknown> = {
       id: state.responseId,
       object: "response",
       created_at: state.created,
-      status: "completed",
+      status: upstreamErr ? "failed" : "completed",
       background: false,
-      error: null,
+      error: upstreamErr
+        ? { code: String(upstreamErr.status ?? ""), message: upstreamErr.message ?? "" }
+        : null,
       output,
     };
 
+    // #3697: same model echo as response.created/in_progress above.
+    if (state.model) {
+      response.model = state.model;
+    }
+
     if (state.usage) {
       response.usage = state.usage;
     }
@@ -522,12 +599,7 @@ function sendCompleted(state, emit) {
 function flushEvents(state) {
   if (state.completedSent) return [];
 
-  const events = [];
-  const nextSeq = () => ++state.seq;
-  const emit = (eventType, data) => {
-    data.sequence_number = nextSeq();
-    events.push({ event: eventType, data });
-  };
+  const { events, emit } = createEventEmitter(state);
 
   for (const i in state.msgItemAdded) closeMessage(state, emit, i);
   closeReasoning(state, emit);
@@ -775,6 +847,7 @@ function openaiResponsesToOpenAIResponseStream(chunk, state) {
     const currentIndex = state.toolCallIndex; // capture before increment
     const callId = item.call_id || state.currentToolCallId || fallbackToolCallId();
     const toolName = normalizeToolName(item.name);
+    const toolSchema = state.toolSchemas?.get(toolName);
 
     if (state.currentToolCallDeferred) {
       state.currentToolCallDeferred = false;
@@ -787,7 +860,7 @@ function openaiResponsesToOpenAIResponseStream(chunk, state) {
 
       state.toolCallIndex++;
 
-      const argsToEmit = stripEmptyOptionalToolArgs(item.arguments, toolName);
+      const argsToEmit = stripEmptyOptionalToolArgs(item.arguments, toolName, toolSchema);
 
       const argsStr =
         argsToEmit != null
@@ -829,7 +902,7 @@ function openaiResponsesToOpenAIResponseStream(chunk, state) {
 
     // Only emit if arguments exist in the done event AND they weren't already streamed via deltas
     if (item.arguments != null && !buffered) {
-      const argsToEmit = stripEmptyOptionalToolArgs(item.arguments, toolName);
+      const argsToEmit = stripEmptyOptionalToolArgs(item.arguments, toolName, toolSchema);
 
       const argsStr = typeof argsToEmit === "string" ? argsToEmit : JSON.stringify(argsToEmit);
       if (argsStr) {
diff --git a/open-sse/translator/response/openai-responses/eventEmitter.ts b/open-sse/translator/response/openai-responses/eventEmitter.ts
new file mode 100644
index 0000000000..1db4e29e26
--- /dev/null
+++ b/open-sse/translator/response/openai-responses/eventEmitter.ts
@@ -0,0 +1,12 @@
+// Shared event-collector for the OpenAI Responses response translator's three emission
+// sites (main per-chunk pass, the deferred-completion empty-choices branch introduced by
+// #6906, and flushEvents at stream end) — avoids duplicating the events/emit boilerplate.
+// Carries stream state (state.seq), so it lives outside the stateless pureHelpers.ts leaf.
+export function createEventEmitter(state: { seq: number }) {
+  const events: Array<{ event: string; data: Record<string, unknown> }> = [];
+  const emit = (eventType: string, data: Record<string, unknown>) => {
+    data.sequence_number = ++state.seq;
+    events.push({ event: eventType, data });
+  };
+  return { events, emit };
+}
diff --git a/open-sse/translator/response/openai-responses/pureHelpers.ts b/open-sse/translator/response/openai-responses/pureHelpers.ts
index 3ed559fb55..094d7dc58d 100644
--- a/open-sse/translator/response/openai-responses/pureHelpers.ts
+++ b/open-sse/translator/response/openai-responses/pureHelpers.ts
@@ -5,17 +5,96 @@ export function normalizeToolName(value) {
   return typeof value === "string" ? value.trim() : "";
 }
 
-export function stripEmptyOptionalToolArgs(value, toolName) {
+// Tools whose empty-string/empty-array optional args are safe to strip. Arbitrary
+// tools are left untouched because an empty string/array can be a valid payload.
+// - "Read": Claude Code's Read tool (empty `pages`) — #2937.
+// - "Subagent": Cursor's local subagent tool emits a cloud-only `cloud_base_branch: ""`,
+//   which Cursor rejects unless environment is cloud — ported from decolua/9router#2446.
+const STRIPPABLE_EMPTY_ARG_TOOLS = new Set(["Read", "Subagent"]);
+
+// Deep-equal for JSON-shaped values (schema `default` comparison). Cheap and safe:
+// tool args are always JSON-serializable, so a stringify comparison is exact.
+function jsonValuesEqual(a, b) {
+  if (a === b) return true;
+  if (a == null || b == null) return false;
+  try {
+    return JSON.stringify(a) === JSON.stringify(b);
+  } catch {
+    return false;
+  }
+}
+
+function hasUsableSchema(schema) {
+  return !!(schema && typeof schema === "object" && !Array.isArray(schema));
+}
+
+function schemaProperties(schema) {
+  return hasUsableSchema(schema) && schema.properties && typeof schema.properties === "object"
+    ? schema.properties
+    : null;
+}
+
+function schemaRequiredSet(schema) {
+  return new Set(hasUsableSchema(schema) && Array.isArray(schema.required) ? schema.required : []);
+}
+
+function isEmptyToolArgValue(entry) {
+  return entry === "" || (Array.isArray(entry) && entry.length === 0);
+}
+
+// True when `entry` strictly equals the property's declared JSON Schema `default` — an
+// emitted value indistinguishable from omission, safe to drop for any tool.
+function matchesSchemaDefault(propSchema, entry) {
+  if (!propSchema || !Object.prototype.hasOwnProperty.call(propSchema, "default")) return false;
+  return jsonValuesEqual(entry, propSchema.default);
+}
+
+// True when `entry` is empty and either the tool is on the legacy allowlist, or the
+// schema declares this property but does not mark it `required` (generalized #6951 rule).
+function isDroppableEmptyEntry(entry, propSchema, required, key, allowlisted) {
+  if (!isEmptyToolArgValue(entry)) return false;
+  return allowlisted || (propSchema != null && !required.has(key));
+}
+
+function stripEmptyOptionalToolArgsObject(value, toolName, schema) {
+  const properties = schemaProperties(schema);
+  const required = schemaRequiredSet(schema);
+  const allowlisted = STRIPPABLE_EMPTY_ARG_TOOLS.has(toolName);
+
+  const cleaned = { ...value };
+  for (const [key, entry] of Object.entries(cleaned)) {
+    const propSchema = properties ? properties[key] : null;
+    if (
+      matchesSchemaDefault(propSchema, entry) ||
+      isDroppableEmptyEntry(entry, propSchema, required, key, allowlisted)
+    ) {
+      delete cleaned[key];
+    }
+  }
+  return cleaned;
+}
+
+// #6951 — Responses API strict mode forces every tool property into `required`, so the
+// model always emits *some* value for "optional" params (no first-class optional).
+// When the tool's JSON Schema is available (`schema`, from the request's `tools[]`),
+// normalization becomes schema-aware instead of allowlist-only:
+//   - drop-if-default: value strictly equals the property's declared `default`.
+//   - drop-if-empty (generalized): empty string/array for a property that is declared
+//     in `schema.properties` but absent from `schema.required` — any tool, not just the
+//     Read/Subagent allowlist above.
+// Without a schema, behavior is unchanged (allowlist + empty-only), preserving existing
+// callers that only pass (value, toolName).
+export function stripEmptyOptionalToolArgs(value, toolName, schema) {
   if (value == null) return value;
 
   if (typeof value === "string") {
-    // JSON-string cleanup is intentionally scoped to Claude Code's Read tool.
-    // For arbitrary tools, empty strings/arrays may be valid user payloads.
-    if (toolName !== "Read") return value;
+    // JSON-string cleanup runs for allowlisted tools, or for any tool once a schema is
+    // supplied (schema-aware normalization is not restricted to the allowlist).
+    if (!hasUsableSchema(schema) && !STRIPPABLE_EMPTY_ARG_TOOLS.has(toolName)) return value;
     try {
       const parsed = JSON.parse(value);
       if (Array.isArray(parsed) || typeof parsed !== "object" || parsed === null) return value;
-      const cleaned = stripEmptyOptionalToolArgs(parsed, toolName);
+      const cleaned = stripEmptyOptionalToolArgs(parsed, toolName, schema);
       return JSON.stringify(cleaned ?? {});
     } catch {
       return value;
@@ -24,13 +103,7 @@ export function stripEmptyOptionalToolArgs(value, toolName) {
 
   if (Array.isArray(value) || typeof value !== "object") return value;
 
-  const cleaned = { ...value };
-  for (const [key, entry] of Object.entries(cleaned)) {
-    if (entry === "" || (Array.isArray(entry) && entry.length === 0)) {
-      delete cleaned[key];
-    }
-  }
-  return cleaned;
+  return stripEmptyOptionalToolArgsObject(value, toolName, schema);
 }
 
 export function normalizeOutputIndex(outputIndex) {
diff --git a/open-sse/translator/response/openai-responses/toolSchemas.ts b/open-sse/translator/response/openai-responses/toolSchemas.ts
new file mode 100644
index 0000000000..8f5457ea72
--- /dev/null
+++ b/open-sse/translator/response/openai-responses/toolSchemas.ts
@@ -0,0 +1,29 @@
+// Pure, stateless helper: build a Map<toolName, parametersSchema> from a request body's
+// `tools[]` (Chat Completions `{type:"function",function:{name,parameters}}` shape or
+// Responses API `{type:"function",name,parameters}` shape). Used to thread each tool's
+// JSON Schema into response-side normalization (#6951 — stripEmptyOptionalToolArgs) so
+// it can be schema-aware instead of allowlist-only. No stream state, no host import.
+
+type JsonRecord = Record<string, unknown>;
+
+function asRecord(value: unknown): JsonRecord | null {
+  return value && typeof value === "object" && !Array.isArray(value) ? (value as JsonRecord) : null;
+}
+
+export function extractToolSchemaMap(body: unknown): Map<string, JsonRecord> | null {
+  const record = asRecord(body);
+  const tools = record?.tools;
+  if (!Array.isArray(tools)) return null;
+
+  const map = new Map<string, JsonRecord>();
+  for (const tool of tools) {
+    const item = asRecord(tool);
+    if (!item) continue;
+    const fn = asRecord(item.function);
+    const name = (typeof fn?.name === "string" ? fn.name : typeof item.name === "string" ? item.name : "").trim();
+    if (!name) continue;
+    const schema = asRecord(fn?.parameters ?? item.parameters);
+    if (schema) map.set(name, schema);
+  }
+  return map.size > 0 ? map : null;
+}
diff --git a/open-sse/translator/response/openai-to-claude.ts b/open-sse/translator/response/openai-to-claude.ts
index e899778d4c..a2f77461af 100644
--- a/open-sse/translator/response/openai-to-claude.ts
+++ b/open-sse/translator/response/openai-to-claude.ts
@@ -3,6 +3,7 @@ import { FORMATS } from "../formats.ts";
 import { CLAUDE_OAUTH_TOOL_PREFIX } from "../request/openai-to-claude.ts";
 import { hasToolCallShim, applyToolCallShimToBuffer } from "../helpers/toolCallShim.ts";
 import { appendToolCallArgumentDelta } from "../../utils/toolCallArguments.ts";
+import { isAbortFinishReason } from "../../utils/finishReason.ts";
 
 // Helper: stop thinking block if started
 function stopThinkingBlock(state, results) {
@@ -154,42 +155,62 @@ export function openaiToClaudeResponse(chunk, state) {
     for (const tc of delta.tool_calls) {
       const idx = tc.index ?? 0;
 
-      if (tc.id) {
+      // Strip the Claude OAuth prefix from an incoming tool name (if any).
+      const incomingName = (() => {
+        let n = tc.function?.name || "";
+        if (n.startsWith(CLAUDE_OAUTH_TOOL_PREFIX)) n = n.slice(CLAUDE_OAUTH_TOOL_PREFIX.length);
+        return n;
+      })();
+
+      // A tool call is identified by its id. Some OpenAI-compatible upstreams
+      // (GLM 5.2) stream the id and function.name in SEPARATE SSE chunks. The
+      // Claude protocol cannot patch a content_block_start after it is emitted,
+      // so we register the tool call on the id chunk but DEFER content_block_start
+      // until the name arrives (#2077 / decolua/9router#2077).
+      if (tc.id && !state.toolCalls.has(idx)) {
         stopThinkingBlock(state, results);
         stopTextBlock(state, results);
 
-        const toolBlockIndex = state.nextBlockIndex++;
-
-        // Strip prefix from tool name for response
-        let toolName = tc.function?.name || "";
-        if (toolName.startsWith(CLAUDE_OAUTH_TOOL_PREFIX)) {
-          toolName = toolName.slice(CLAUDE_OAUTH_TOOL_PREFIX.length);
-        }
-
         state.toolCalls.set(idx, {
           id: tc.id,
-          name: toolName,
-          blockIndex: toolBlockIndex,
+          name: incomingName,
+          blockIndex: state.nextBlockIndex++,
           // Shimmed tools buffer their raw args and emit a single corrected
           // input_json_delta at content_block_stop time (see finish handler).
-          shimmed: hasToolCallShim(toolName),
+          shimmed: incomingName ? hasToolCallShim(incomingName) : false,
           argBuffer: "",
-        });
-
-        results.push({
-          type: "content_block_start",
-          index: toolBlockIndex,
-          content_block: {
-            type: "tool_use",
-            id: tc.id,
-            name: toolName,
-            input: {},
-          },
+          startEmitted: false,
         });
       }
 
+      const toolInfo = state.toolCalls.get(idx);
+      if (toolInfo) {
+        // Capture a late-arriving id or name (streamed after the initial chunk).
+        if (tc.id && !toolInfo.id) toolInfo.id = tc.id;
+        if (incomingName && !toolInfo.startEmitted && !toolInfo.name) {
+          toolInfo.name = incomingName;
+          toolInfo.shimmed = hasToolCallShim(incomingName);
+        }
+
+        // Emit content_block_start once we have a name. If arguments arrive before
+        // any name was ever seen, start the block anyway with the (empty) name so
+        // the input_json_delta stays well-formed.
+        if (!toolInfo.startEmitted && (toolInfo.name || tc.function?.arguments != null)) {
+          toolInfo.startEmitted = true;
+          results.push({
+            type: "content_block_start",
+            index: toolInfo.blockIndex,
+            content_block: {
+              type: "tool_use",
+              id: toolInfo.id,
+              name: toolInfo.name || "",
+              input: {},
+            },
+          });
+        }
+      }
+
       if (tc.function?.arguments) {
-        const toolInfo = state.toolCalls.get(idx);
         if (toolInfo) {
           // Always buffer the raw stream so shimmed tools can re-emit a
           // corrected JSON at stop time.
@@ -238,6 +259,18 @@ export function openaiToClaudeResponse(chunk, state) {
     stopTextBlock(state, results);
 
     for (const [, toolInfo] of state.toolCalls) {
+      // A tool call whose name/args never arrived (only an id chunk was seen)
+      // still has a reserved block index but no content_block_start. Emit it now
+      // so the terminal content_block_stop is not orphaned (#2077 edge case).
+      if (!toolInfo.startEmitted) {
+        toolInfo.startEmitted = true;
+        results.push({
+          type: "content_block_start",
+          index: toolInfo.blockIndex,
+          content_block: { type: "tool_use", id: toolInfo.id, name: toolInfo.name || "", input: {} },
+        });
+      }
+
       // For shimmed tools, emit one corrective input_json_delta with the
       // fully patched JSON before closing the block.
       if (toolInfo.shimmed) {
@@ -281,7 +314,16 @@ function convertFinishReason(reason) {
     case "tool_calls":
       return "tool_use";
     default:
-      return "end_turn";
+      // Gemini/Antigravity abort reasons (e.g. MALFORMED_FUNCTION_CALL,
+      // UNEXPECTED_TOOL_CALL — see isAbortFinishReason) reach here unrecognized
+      // after the OpenAI hub normalization. Collapsing them to a clean
+      // "end_turn" presents an aborted tool call to the client as a successful
+      // completion (9router#2462 sub-bug #2). Surface them as "tool_use" —
+      // the same non-clean-stop signal already used for real tool_calls above —
+      // so the client does not treat the turn as done. Genuinely unknown future
+      // reasons still fall back to "end_turn" so a benign new value does not
+      // start misreporting every Gemini-family turn as an unfinished tool call.
+      return isAbortFinishReason(reason) ? "tool_use" : "end_turn";
   }
 }
 
diff --git a/open-sse/utils/cursorAgentCliVersion.ts b/open-sse/utils/cursorAgentCliVersion.ts
new file mode 100644
index 0000000000..2a65df051b
--- /dev/null
+++ b/open-sse/utils/cursorAgentCliVersion.ts
@@ -0,0 +1,124 @@
+/**
+ * Cursor Agent CLI version for AgentService/Run impersonation.
+ *
+ * Wire header: `x-cursor-client-version: cli-${id}` where `id` is a dated
+ * build like `2026.07.08-0c04a8a` (not the IDE `3.x` semver).
+ *
+ * Resolution: CURSOR_AGENT_CLI_VERSION env → local install detect → pin.
+ */
+
+import { existsSync, lstatSync, readdirSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+/**
+ * Pinned Agent CLI build id used when no local install is found (typical
+ * headless OmniRoute). Bump when refreshing Cursor CLI impersonation.
+ */
+export const CURSOR_AGENT_CLI_VERSION = "2026.07.08-0c04a8a";
+
+const VERSION_ID_RE = /^\d{4}\.\d{2}\.\d{2}-[0-9a-f]+$/;
+const CACHE_TTL_MS = 60 * 60 * 1000;
+
+let cachedVersion: string | null = null;
+let cachedAt = 0;
+
+export function isCursorAgentCliVersionId(value: string): boolean {
+  return VERSION_ID_RE.test(value);
+}
+
+export function formatCursorAgentClientVersion(id: string): string {
+  return `cli-${id}`;
+}
+
+/** Extract `versions/<id>` from a resolved agent binary path. */
+export function extractVersionIdFromResolvedPath(resolvedPath: string): string | null {
+  const parts = resolvedPath.split(/[/\\]/);
+  const versionsIdx = parts.lastIndexOf("versions");
+  if (versionsIdx < 0 || versionsIdx + 1 >= parts.length) return null;
+  const id = parts[versionsIdx + 1];
+  return isCursorAgentCliVersionId(id) ? id : null;
+}
+
+export function newestVersionInDir(versionsDir: string): string | null {
+  try {
+    if (!existsSync(versionsDir)) return null;
+    const matches = readdirSync(versionsDir)
+      .filter((name) => {
+        if (!isCursorAgentCliVersionId(name)) return false;
+        try {
+          return lstatSync(join(versionsDir, name)).isDirectory();
+        } catch {
+          return false;
+        }
+      })
+      .sort();
+    return matches.length > 0 ? matches[matches.length - 1] : null;
+  } catch {
+    return null;
+  }
+}
+
+function versionFromShim(shimPath: string): string | null {
+  try {
+    if (!existsSync(shimPath)) return null;
+    const resolved = realpathSync(shimPath);
+    return extractVersionIdFromResolvedPath(resolved);
+  } catch {
+    return null;
+  }
+}
+
+function defaultVersionsDir(home: string): string {
+  if (process.platform === "win32") {
+    const localAppData = process.env.LOCALAPPDATA || join(home, "AppData", "Local");
+    return join(localAppData, "cursor-agent", "versions");
+  }
+  return join(home, ".local", "share", "cursor-agent", "versions");
+}
+
+/**
+ * Detect an installed Agent CLI build id from the filesystem.
+ * @param home - injectable home for tests (defaults to os.homedir())
+ */
+export function detectCursorAgentCliVersionFromFs(home: string = homedir()): string | null {
+  const localBin = join(home, ".local", "bin");
+  for (const name of ["agent", "cursor-agent"]) {
+    const fromShim = versionFromShim(join(localBin, name));
+    if (fromShim) return fromShim;
+  }
+
+  const dataDir = process.env.CURSOR_DATA_DIR;
+  const versionsDir = dataDir ? join(dataDir, "versions") : defaultVersionsDir(home);
+  return newestVersionInDir(versionsDir);
+}
+
+export function getCursorAgentCliVersion(): string {
+  const now = Date.now();
+  if (cachedVersion && now - cachedAt < CACHE_TTL_MS) {
+    return cachedVersion;
+  }
+
+  const fromEnv = process.env.CURSOR_AGENT_CLI_VERSION?.trim();
+  if (fromEnv && isCursorAgentCliVersionId(fromEnv)) {
+    cachedVersion = fromEnv;
+    cachedAt = now;
+    return cachedVersion;
+  }
+
+  const home = process.env.HOME || process.env.USERPROFILE || homedir();
+  const fromFs = detectCursorAgentCliVersionFromFs(home);
+  if (fromFs) {
+    cachedVersion = fromFs;
+    cachedAt = now;
+    return cachedVersion;
+  }
+
+  return CURSOR_AGENT_CLI_VERSION;
+}
+
+/** Exposed for testing: reset the in-memory cache. */
+export function resetCursorAgentCliVersionCache(): void {
+  cachedVersion = null;
+  cachedAt = 0;
+}
diff --git a/open-sse/utils/error.ts b/open-sse/utils/error.ts
index 9afc237715..88efa6c67d 100644
--- a/open-sse/utils/error.ts
+++ b/open-sse/utils/error.ts
@@ -120,6 +120,88 @@ export function buildErrorBody(
   return body;
 }
 
+/**
+ * Sanitized auto-combo diagnostic trace surfaced on a combo terminal failure.
+ * Contains ONLY provider/model ids, enumerated reason codes, and counts — never
+ * keys, tokens, cookies, credentials, or upstream bodies. Fields are length- and
+ * count-capped so the projection is safe to place in HTTP headers too. (QA P0:
+ * "Add a sanitized combo diagnostic trace … candidate pool count, excluded
+ * provider/model reasons, selected attempt order, terminal failure summary.")
+ */
+export interface ComboExclusion {
+  provider: string;
+  model?: string;
+  reason: string;
+}
+export interface ComboDiagnostics {
+  poolSize: number;
+  attempted: number;
+  excluded: ComboExclusion[];
+  attemptOrder: Array<{ provider: string; model: string }>;
+  terminalReason: string;
+}
+
+function clampDiagStr(v: unknown, max = 128): string {
+  return typeof v === "string" ? v.slice(0, max).replace(/[\r\n]+/g, " ") : "";
+}
+
+/**
+ * Whitelist projection — guarantees only id/reason string primitives + integer
+ * counts can escape, regardless of what the caller assembled. This is the secret
+ * containment boundary for the diagnostic trace.
+ */
+export function sanitizeComboDiagnostics(d: ComboDiagnostics): ComboDiagnostics {
+  return {
+    poolSize: Number.isFinite(d?.poolSize) ? d.poolSize : 0,
+    attempted: Number.isFinite(d?.attempted) ? d.attempted : 0,
+    excluded: (d?.excluded ?? []).slice(0, 64).map((e) => ({
+      provider: clampDiagStr(e?.provider, 64),
+      ...(e?.model ? { model: clampDiagStr(e.model, 96) } : {}),
+      reason: clampDiagStr(e?.reason, 64),
+    })),
+    attemptOrder: (d?.attemptOrder ?? [])
+      .slice(0, 64)
+      .map((a) => ({ provider: clampDiagStr(a?.provider, 64), model: clampDiagStr(a?.model, 96) })),
+    terminalReason: clampDiagStr(d?.terminalReason, 200),
+  };
+}
+
+/**
+ * errorResponse variant that attaches a sanitized combo diagnostic trace as BOTH
+ * `x-omniroute-combo-*` headers and a `diagnostics` field in the OpenAI-shaped
+ * error body (extra field — backward-compatible with standard error parsers).
+ * `opts.code`/`opts.type` override the status-derived defaults (e.g. to preserve
+ * the `ALL_ACCOUNTS_INACTIVE` code on the 503 terminal path).
+ */
+export function errorResponseWithComboDiagnostics(
+  statusCode: number,
+  message: string,
+  diagnostics: ComboDiagnostics,
+  opts: { code?: string; type?: string } = {}
+): Response {
+  const safe = sanitizeComboDiagnostics(diagnostics);
+  const body = buildErrorBody(statusCode, message) as ErrorResponseBody & {
+    diagnostics?: ComboDiagnostics;
+  };
+  if (opts.code) body.error.code = opts.code;
+  if (opts.type) body.error.type = opts.type;
+  body.diagnostics = safe;
+  const excludedHeader = safe.excluded
+    .map((e) => `${e.provider}${e.model ? `/${e.model}` : ""}:${e.reason}`)
+    .join(",")
+    .slice(0, 900);
+  return new Response(JSON.stringify(body), {
+    status: statusCode,
+    headers: {
+      "Content-Type": "application/json",
+      "x-omniroute-combo-pool-size": String(safe.poolSize),
+      "x-omniroute-combo-attempted": String(safe.attempted),
+      "x-omniroute-combo-excluded": excludedHeader,
+      "x-omniroute-combo-terminal-reason": safe.terminalReason.slice(0, 200),
+    },
+  });
+}
+
 /**
  * Create error Response object (for non-streaming)
  * @param {number} statusCode - HTTP status code
@@ -408,11 +490,23 @@ export function providerCircuitOpenResponse(
 export function buildModelCooldownBody({
   model,
   retryAfterSec,
+  retryAfterAt,
+  credentialsCoolingCount,
 }: {
   model?: string | null;
   retryAfterSec: number;
+  retryAfterAt?: string | null;
+  credentialsCoolingCount?: number | null;
 }): ModelCooldownErrorPayload {
   const resolvedModel = typeof model === "string" && model.trim().length > 0 ? model.trim() : null;
+  const resolvedRetryAfterAt =
+    typeof retryAfterAt === "string" && retryAfterAt.length > 0 ? retryAfterAt : null;
+  const resolvedCoolingCount =
+    typeof credentialsCoolingCount === "number" &&
+    Number.isFinite(credentialsCoolingCount) &&
+    credentialsCoolingCount > 0
+      ? Math.floor(credentialsCoolingCount)
+      : null;
 
   return {
     error: {
@@ -423,6 +517,8 @@ export function buildModelCooldownBody({
       code: "model_cooldown",
       ...(resolvedModel ? { model: resolvedModel } : {}),
       reset_seconds: Math.max(Math.ceil(retryAfterSec), 1),
+      ...(resolvedRetryAfterAt ? { retry_after: resolvedRetryAfterAt } : {}),
+      ...(resolvedCoolingCount ? { credentials_cooling: resolvedCoolingCount } : {}),
     },
   };
 }
@@ -430,16 +526,28 @@ export function buildModelCooldownBody({
 export function modelCooldownResponse({
   model,
   retryAfter,
+  retryAfterAt,
+  credentialsCoolingCount,
 }: {
   model?: string | null;
   retryAfter?: string | number | Date | null;
+  retryAfterAt?: string | null;
+  credentialsCoolingCount?: number | null;
 }) {
   const retryAfterSec = normalizeRetryAfterSeconds(retryAfter);
+  const resolvedRetryAfterAt =
+    typeof retryAfterAt === "string" && retryAfterAt.length > 0
+      ? retryAfterAt
+      : typeof retryAfter === "string" && retryAfter.length > 0
+        ? retryAfter
+        : null;
   return new Response(
     JSON.stringify(
       buildModelCooldownBody({
         model,
         retryAfterSec,
+        retryAfterAt: resolvedRetryAfterAt,
+        credentialsCoolingCount,
       })
     ),
     {
diff --git a/open-sse/utils/finishReason.ts b/open-sse/utils/finishReason.ts
index 5d8ab33667..5bb0835adc 100644
--- a/open-sse/utils/finishReason.ts
+++ b/open-sse/utils/finishReason.ts
@@ -16,6 +16,31 @@ const SAFETY_FINISH_REASONS = new Set([
   "malformed_response",
 ]);
 
+// Gemini/Antigravity finish reasons that mean the model ABORTED the turn before
+// completing it — most commonly a tool call the model started narrating but
+// Gemini could not parse/execute (MALFORMED_FUNCTION_CALL, UNEXPECTED_TOOL_CALL).
+// Distinct from SAFETY_FINISH_REASONS: those are deliberate, deterministic
+// content blocks; these are execution failures mid tool-call. Left un-mapped
+// here (still passed through raw, e.g. "malformed_function_call") so an
+// OpenAI-format client at least sees a non-standard-but-honest value instead of
+// a misleading "stop" — downstream Claude translation classifies them via
+// isAbortFinishReason() so it does not collapse them to a clean "end_turn"
+// (9router#2462 sub-bug #2: an aborted tool call must not present to the client
+// as a successful completion).
+const ABORT_FINISH_REASONS = new Set([
+  "malformed_function_call",
+  "unexpected_tool_call",
+  "finish_reason_unspecified",
+  "other",
+  "language",
+  "no_image",
+]);
+
+export function isAbortFinishReason(value: unknown): boolean {
+  if (typeof value !== "string") return false;
+  return ABORT_FINISH_REASONS.has(value.toLowerCase());
+}
+
 export function normalizeOpenAICompatibleFinishReason(value: unknown): unknown {
   if (typeof value !== "string") return value;
 
diff --git a/open-sse/utils/publicCreds.ts b/open-sse/utils/publicCreds.ts
index bc4d0993e8..87f67564f3 100644
--- a/open-sse/utils/publicCreds.ts
+++ b/open-sse/utils/publicCreds.ts
@@ -182,6 +182,8 @@ const EMBEDDED_DEFAULTS = {
     13, 92, 15, 89, 66, 91, 76, 70, 72, 29, 71, 70, 3, 65, 93, 84, 72, 23, 28, 87, 92, 88, 15, 95,
     91, 22, 71, 87, 20, 66, 67, 86, 13, 81, 81, 21,
   ],
+  // Trae Cloud IDE — public oauth client id
+  trae_id: [10, 3, 95, 6, 10, 22, 66, 3, 11, 90, 72, 31, 91, 2],
 } as const;
 
 export type EmbeddedDefaultKey = keyof typeof EMBEDDED_DEFAULTS;
diff --git a/open-sse/utils/responsesCommentaryDrop.ts b/open-sse/utils/responsesCommentaryDrop.ts
new file mode 100644
index 0000000000..4c0f300a15
--- /dev/null
+++ b/open-sse/utils/responsesCommentaryDrop.ts
@@ -0,0 +1,110 @@
+// open-sse/utils/responsesCommentaryDrop.ts
+//
+// #6199 / #6561 — statefully decide whether a Responses SSE event belongs to
+// an internal "commentary" phase item and must be dropped from the
+// passthrough stream. The `response.output_item.added` event announces the
+// phase; the follow-up delta/done events only carry `item_id`/`output_index`,
+// so we key off those (tracked across calls in the two Sets the caller owns).
+//
+// Extracted out of `stream.ts` (a frozen file — see
+// config/quality/file-size-baseline.json) so the #6561 fix (clearing the
+// buffered `event:` line alongside every drop) does not grow that file.
+import { isResponsesCommentaryMessageItem } from "../handlers/responseSanitizer.ts";
+import { FORMATS } from "../translator/formats.ts";
+
+type JsonRecord = Record<string, unknown>;
+
+function extractEventItem(parsed: JsonRecord): JsonRecord | null {
+  return parsed.item && typeof parsed.item === "object" && !Array.isArray(parsed.item)
+    ? (parsed.item as JsonRecord)
+    : null;
+}
+
+function extractEventItemId(parsed: JsonRecord, eventItem: JsonRecord | null): string | null {
+  if (typeof parsed.item_id === "string") return parsed.item_id;
+  if (eventItem && typeof eventItem.id === "string") return eventItem.id;
+  return null;
+}
+
+function extractEventOutputIndex(parsed: JsonRecord): number | null {
+  return typeof parsed.output_index === "number" ? parsed.output_index : null;
+}
+
+// The `response.output_item.added` event that announces a new commentary-phase
+// item. Records its identifiers so follow-up delta/done events are recognized.
+function isCommentaryStart(
+  eventType: string,
+  parsed: JsonRecord,
+  eventItemId: string | null,
+  eventOutputIndex: number | null,
+  commentaryItemIds: Set<string>,
+  commentaryIndexes: Set<number>
+): boolean {
+  const isAddedEvent = eventType === "response.output_item.added";
+  if (!isAddedEvent || !isResponsesCommentaryMessageItem(parsed.item)) return false;
+
+  if (eventItemId) commentaryItemIds.add(eventItemId);
+  if (eventOutputIndex !== null) commentaryIndexes.add(eventOutputIndex);
+  return true;
+}
+
+// A follow-up delta/done event for an item already tracked as commentary.
+// Untracks the item once its `output_item.done` event is seen.
+function isCommentaryContinuation(
+  eventType: string,
+  eventItemId: string | null,
+  eventOutputIndex: number | null,
+  commentaryItemIds: Set<string>,
+  commentaryIndexes: Set<number>
+): boolean {
+  const belongsToCommentary =
+    (eventItemId !== null && commentaryItemIds.has(eventItemId)) ||
+    (eventOutputIndex !== null && commentaryIndexes.has(eventOutputIndex));
+  if (!belongsToCommentary) return false;
+
+  if (eventType === "response.output_item.done") {
+    if (eventItemId) commentaryItemIds.delete(eventItemId);
+    if (eventOutputIndex !== null) commentaryIndexes.delete(eventOutputIndex);
+  }
+  return true;
+}
+
+export function shouldDropResponsesCommentaryEvent(
+  parsed: JsonRecord,
+  commentaryItemIds: Set<string>,
+  commentaryIndexes: Set<number>
+): boolean {
+  const eventType = parsed.type as string;
+  const eventItem = extractEventItem(parsed);
+  const eventItemId = extractEventItemId(parsed, eventItem);
+  const eventOutputIndex = extractEventOutputIndex(parsed);
+
+  return (
+    isCommentaryStart(
+      eventType,
+      parsed,
+      eventItemId,
+      eventOutputIndex,
+      commentaryItemIds,
+      commentaryIndexes
+    ) ||
+    isCommentaryContinuation(
+      eventType,
+      eventItemId,
+      eventOutputIndex,
+      commentaryItemIds,
+      commentaryIndexes
+    )
+  );
+}
+
+// #6952 — TRANSLATE-mode chunk loop was missing this filter (only PASSTHROUGH
+// had it wired), so commentary-phase text leaked into the client. Own Sets +
+// the `targetFormat` gate, closed over so stream.ts (frozen) stays a one-liner.
+export function createTranslateCommentaryFilter(targetFormat: string | undefined) {
+  const commentaryItemIds = new Set<string>();
+  const commentaryIndexes = new Set<number>();
+  const applies = targetFormat === FORMATS.OPENAI_RESPONSES;
+  return (parsed: JsonRecord): boolean =>
+    applies && shouldDropResponsesCommentaryEvent(parsed, commentaryItemIds, commentaryIndexes);
+}
diff --git a/open-sse/utils/responsesInputNormalization.ts b/open-sse/utils/responsesInputNormalization.ts
index da1517a812..7c176d9ab0 100644
--- a/open-sse/utils/responsesInputNormalization.ts
+++ b/open-sse/utils/responsesInputNormalization.ts
@@ -10,6 +10,15 @@ function normalizeCodexMessageContentPart(part: unknown, role: string): unknown
 
   const record = { ...(part as JsonRecord) };
   if (record.type === "text") record.type = textPartTypeForRole(role);
+  // Assistant history in the Responses API must use `output_text` (or `refusal`),
+  // never `input_text` (which is user-only). codex-cli sends assistant turns as
+  // `input_text`; normalize them so the Codex/OpenAI backend accepts the replay.
+  if (role === "assistant" && (record.type === "input_text" || record.type === "text")) {
+    record.type = "output_text";
+    delete record.annotations;
+    delete record.logprobs;
+    delete record.obfuscation;
+  }
   return record;
 }
 
diff --git a/open-sse/utils/stream.ts b/open-sse/utils/stream.ts
index 120644ac9d..581f1f6342 100644
--- a/open-sse/utils/stream.ts
+++ b/open-sse/utils/stream.ts
@@ -8,7 +8,6 @@ import {
   logUsage,
   addBufferToUsage,
   filterUsageForFormat,
-  COLORS,
 } from "./usageTracking.ts";
 import {
   parseSSELine,
@@ -30,12 +29,16 @@ import { STREAM_IDLE_TIMEOUT_MS, FETCH_BODY_TIMEOUT_MS, HTTP_STATUS } from "../c
 import {
   OMIT_STREAMING_CHUNK_MARKER,
   sanitizeStreamingChunk,
-  isResponsesCommentaryMessageItem,
 } from "../handlers/responseSanitizer.ts";
 import { isFeatureFlagEnabled } from "@/shared/utils/featureFlags";
+import {
+  shouldDropResponsesCommentaryEvent,
+  createTranslateCommentaryFilter,
+} from "./responsesCommentaryDrop.ts";
 import { buildErrorBody } from "./error.ts";
 import { parseTextualToolCallCandidate, isValidToolCallHeaderPrefix } from "./textualToolCall.ts";
 import { recordToolLatency } from "../services/toolLatencyTracker.ts";
+import { extractToolSchemaMap } from "../translator/response/openai-responses/toolSchemas.ts";
 import {
   generateSessionId,
   markToolFinish,
@@ -73,10 +76,10 @@ export function withBodyTimeout<T>(
       reject(err);
     }, timeoutMs);
   });
-  return Promise.race([promise, timeout]).finally(() => clearTimeout(timer)) as Promise<T>;
+  return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
 }
 
-export { COLORS, formatSSE };
+export { formatSSE };
 export { backfillResponsesCompletedOutput, stripResponsesLifecycleEcho };
 
 type JsonRecord = Record<string, unknown>;
@@ -149,6 +152,10 @@ type TranslateState = ReturnType<typeof initState> & {
   suppressThinkClose?: boolean;
   /** Accumulated message content for call log response body */
   accumulatedContent?: string;
+  /** Accumulated reasoning content (separate from content) */
+  accumulatedReasoning?: string;
+  /** #6951 — per-tool JSON Schema (from request `tools[]`), keyed by tool name. */
+  toolSchemas?: Map<string, Record<string, unknown>> | null;
   upstreamError?: {
     status: number;
     type: string;
@@ -682,6 +689,8 @@ export function createSSEStream(options: StreamOptions = {}) {
           copilotCompatibleReasoning,
           suppressThinkClose,
           accumulatedContent: "",
+          accumulatedReasoning: "",
+          toolSchemas: extractToolSchemaMap(body),
         }
       : null;
 
@@ -705,6 +714,7 @@ export function createSSEStream(options: StreamOptions = {}) {
   // item id + output_index here and drop every matching follow-up event.
   const passthroughResponsesCommentaryItemIds = new Set<string>();
   const passthroughResponsesCommentaryIndexes = new Set<number>();
+  const dropCommentary = createTranslateCommentaryFilter(targetFormat);
   // #5786 — highest Responses-API `sequence_number` already forwarded on this stream.
   // The Responses API guarantees a strictly increasing sequence_number, so any event at
   // or below this watermark is an upstream reconnect/retry replay and must be dropped —
@@ -1308,48 +1318,19 @@ export function createSSEStream(options: StreamOptions = {}) {
                     parsed.type === "error");
 
                 if (isResponsesSSE) {
-                  // #6199 — statefully drop internal commentary-phase output. The
-                  // `response.output_item.added` announces the phase; the follow-up
-                  // delta/done events only carry `item_id`/`output_index`, so we key
-                  // off those. Happy-path (non-commentary) events are untouched.
-                  if (shouldDropResponsesCommentary) {
-                    const responsesEventType = parsed.type as string;
-                    const eventOutputIndex =
-                      typeof parsed.output_index === "number" ? parsed.output_index : null;
-                    const eventItem =
-                      parsed.item && typeof parsed.item === "object" && !Array.isArray(parsed.item)
-                        ? (parsed.item as JsonRecord)
-                        : null;
-                    const eventItemId =
-                      typeof parsed.item_id === "string"
-                        ? parsed.item_id
-                        : eventItem && typeof eventItem.id === "string"
-                          ? eventItem.id
-                          : null;
-
-                    if (
-                      responsesEventType === "response.output_item.added" &&
-                      isResponsesCommentaryMessageItem(parsed.item)
-                    ) {
-                      if (eventItemId) passthroughResponsesCommentaryItemIds.add(eventItemId);
-                      if (eventOutputIndex !== null)
-                        passthroughResponsesCommentaryIndexes.add(eventOutputIndex);
-                      continue;
-                    }
-
-                    const belongsToCommentary =
-                      (eventItemId !== null &&
-                        passthroughResponsesCommentaryItemIds.has(eventItemId)) ||
-                      (eventOutputIndex !== null &&
-                        passthroughResponsesCommentaryIndexes.has(eventOutputIndex));
-                    if (belongsToCommentary) {
-                      if (responsesEventType === "response.output_item.done") {
-                        if (eventItemId) passthroughResponsesCommentaryItemIds.delete(eventItemId);
-                        if (eventOutputIndex !== null)
-                          passthroughResponsesCommentaryIndexes.delete(eventOutputIndex);
-                      }
-                      continue;
-                    }
+                  // #6199/#6561 — statefully drop internal commentary-phase output (see
+                  // ./responsesCommentaryDrop.ts) and clear the buffered `event:` line
+                  // for the same frame, or it flushes alone as an event-only SSE frame.
+                  if (
+                    shouldDropResponsesCommentary &&
+                    shouldDropResponsesCommentaryEvent(
+                      parsed as JsonRecord,
+                      passthroughResponsesCommentaryItemIds,
+                      passthroughResponsesCommentaryIndexes
+                    )
+                  ) {
+                    clearPendingPassthroughEvent();
+                    continue;
                   }
 
                   const responsesIdsNormalized = normalizeResponsesSseIds(parsed as JsonRecord);
@@ -1729,7 +1710,7 @@ export function createSSEStream(options: StreamOptions = {}) {
                     const reasoningChunk =
                       typeof structuredClone === "function"
                         ? structuredClone(parsed)
-                        : JSON.parse(JSON.stringify(parsed));
+                        : structuredClone(parsed);
                     const rDelta = reasoningChunk.choices[0].delta;
                     delete rDelta.content;
                     reasoningChunk.choices[0].finish_reason = null;
@@ -1959,6 +1940,8 @@ export function createSSEStream(options: StreamOptions = {}) {
             continue;
           }
 
+          if (shouldDropResponsesCommentary && dropCommentary(parsed as JsonRecord)) continue;
+
           providerPayloadCollector.push(parsed);
 
           if (parsed && parsed.done) {
@@ -2016,9 +1999,9 @@ export function createSSEStream(options: StreamOptions = {}) {
           const openAiReasoning = getReadableReasoningValue(openAiDelta);
           if (openAiReasoning) {
             totalContentLength += openAiReasoning.length;
-            if (state?.accumulatedContent !== undefined)
-              state.accumulatedContent = appendBoundedText(
-                state.accumulatedContent,
+            if (state?.accumulatedReasoning !== undefined)
+              state.accumulatedReasoning = appendBoundedText(
+                state.accumulatedReasoning,
                 openAiReasoning
               );
           }
@@ -2031,8 +2014,8 @@ export function createSSEStream(options: StreamOptions = {}) {
               delete parsed.choices[0].delta.thinking;
               delete parsed.choices[0].delta.thought;
               totalContentLength += r.length;
-              if (state?.accumulatedContent !== undefined)
-                state.accumulatedContent = appendBoundedText(state.accumulatedContent, r);
+              if (state?.accumulatedReasoning !== undefined)
+                state.accumulatedReasoning = appendBoundedText(state.accumulatedReasoning, r);
             }
           }
 
@@ -2269,8 +2252,7 @@ export function createSSEStream(options: StreamOptions = {}) {
                     if (Array.isArray(flushedParsed.choices)) {
                       for (const choice of flushedParsed.choices as JsonRecord[]) {
                         const tcs = (choice as JsonRecord | undefined)?.delta as
-                          | JsonRecord
-                          | undefined;
+                          JsonRecord | undefined;
                         if (Array.isArray(tcs?.tool_calls)) {
                           for (const tc of tcs.tool_calls as JsonRecord[]) {
                             if (tc?.id != null && typeof tc.id !== "string") {
@@ -2521,6 +2503,24 @@ export function createSSEStream(options: StreamOptions = {}) {
 
           if (state?.upstreamError) {
             const err = state.upstreamError;
+
+            // Flush pending translation events BEFORE erroring the stream.
+            // This lets the openai-responses translator emit a proper
+            // `response.completed` with `status: "failed"` and close any
+            // open items (reasoning, tool calls, etc.), instead of silently
+            // aborting the stream and leaving partial items dangling.
+            try {
+              const flushed = translateResponse(targetFormat, sourceFormat, null, state);
+              if (flushed?.length > 0) {
+                for (const item of flushed) {
+                  emitTranslatedClientItem(controller, item);
+                }
+              }
+            } catch {
+              // Swallow flush errors — the controller.error below is the
+              // terminal signal for the client.
+            }
+
             let failureHandled = false;
             if (onFailure) {
               try {
@@ -2644,17 +2644,15 @@ export function createSSEStream(options: StreamOptions = {}) {
               let content = (state?.accumulatedContent ?? "").trim() || "";
               const normalizedToolCalls: ToolCall[] = state?.toolCalls?.size
                 ? [...state.toolCalls.values()]
-                    .map(
-                      (tc: Record<string, unknown>): ToolCall => ({
-                        id: tc.id != null ? String(tc.id) : null,
-                        index: (tc.index as number) ?? (tc.blockIndex as number) ?? 0,
-                        type: (tc.type as string) ?? "function",
-                        function: (tc.function as ToolCall["function"]) ?? {
-                          name: (tc.name as string) ?? "",
-                          arguments: "",
-                        },
-                      })
-                    )
+                    .map((tc: Record<string, unknown>): ToolCall => ({
+                      id: tc.id != null ? String(tc.id) : null,
+                      index: (tc.index as number) ?? (tc.blockIndex as number) ?? 0,
+                      type: (tc.type as string) ?? "function",
+                      function: (tc.function as ToolCall["function"]) ?? {
+                        name: (tc.name as string) ?? "",
+                        arguments: "",
+                      },
+                    }))
                     .sort((a, b) => a.index - b.index)
                 : [];
               const textualToolCall = parseTextualToolCallFromContent(content);
@@ -2672,10 +2670,14 @@ export function createSSEStream(options: StreamOptions = {}) {
               } else if (containsMalformedTextualToolCall(content, allowedToolNames)) {
                 content = "";
               }
+              const reasoning = (state?.accumulatedReasoning ?? "").trim();
               const message: Record<string, unknown> = {
                 role: "assistant",
                 content: content || null,
               };
+              if (reasoning) {
+                message.reasoning_content = reasoning;
+              }
               const hasToolCalls = normalizedToolCalls.length > 0;
               if (hasToolCalls) {
                 message.tool_calls = normalizedToolCalls;
@@ -2789,3 +2791,5 @@ export function createPassthroughStreamWithLogger(
     clientResponseFormat,
   });
 }
+
+export { COLORS } from "./usageTracking.ts";
diff --git a/open-sse/utils/streamPayloadCollector.ts b/open-sse/utils/streamPayloadCollector.ts
index 26e9f4418e..63cb901179 100644
--- a/open-sse/utils/streamPayloadCollector.ts
+++ b/open-sse/utils/streamPayloadCollector.ts
@@ -129,13 +129,29 @@ function buildOpenAISummary(events: StructuredSSEEvent[], fallbackModel?: string
     function: { name: string; arguments: string };
   };
   const toolCalls = new Map<string, ToolCall>();
+  // Aliases every `idx:N` key we've seen to the `id:X` it was first observed with (and
+  // vice versa), so a later delta chunk that only carries one of the two dimensions
+  // (e.g. a continuation chunk with `id` but no `index` — a known quirk of some
+  // OpenAI-compatible proxies) still resolves to the SAME accumulator entry instead of
+  // splitting one logical tool call into two (#6276).
+  const keyAliases = new Map<string, string>();
   let unknownToolCallSeq = 0;
   let finishReason = "stop";
   let usage: JsonRecord | null = null;
 
   const getToolCallKey = (toolCall: JsonRecord) => {
-    if (Number.isInteger(toolCall.index)) return `idx:${toolCall.index}`;
-    if (toolCall.id) return `id:${toolCall.id}`;
+    const idKey = typeof toolCall.id === "string" && toolCall.id ? `id:${toolCall.id}` : null;
+    const idxKey = Number.isInteger(toolCall.index) ? `idx:${toolCall.index}` : null;
+
+    const resolvedKey = (idKey && keyAliases.get(idKey)) || (idxKey && keyAliases.get(idxKey));
+    const key = resolvedKey || idKey || idxKey;
+
+    if (key) {
+      if (idKey) keyAliases.set(idKey, key);
+      if (idxKey) keyAliases.set(idxKey, key);
+      return key;
+    }
+
     unknownToolCallSeq += 1;
     return `seq:${unknownToolCallSeq}`;
   };
diff --git a/open-sse/utils/toolCallArguments.ts b/open-sse/utils/toolCallArguments.ts
index b5554c681a..9d7c797994 100644
--- a/open-sse/utils/toolCallArguments.ts
+++ b/open-sse/utils/toolCallArguments.ts
@@ -15,10 +15,32 @@
  * A fuzzy suffix/prefix-overlap heuristic must NOT be used here: it silently
  * drops bytes from legitimate incremental deltas (turning `ll` into `l`, `xx`
  * into `x`), which trades a visible duplication bug for a silent truncation bug.
+ *
+ * A third, non-conformant shape some upstreams emit (#6459): the FULL
+ * `arguments` value delivered as an already-parsed JSON object/array instead
+ * of a JSON-encoded string (violates the OpenAI streaming contract, but seen
+ * from some Anthropic-shape-passthrough backends). Treating that as "not a
+ * string" and silently discarding it left `tool_use.input` empty upstream —
+ * or, when a caller re-serialized the buffer with plain string coercion
+ * instead of JSON, rendered literally as `[object Object]` in the client
+ * transcript. JSON.stringify it into a proper fragment instead of dropping it.
  */
+function normalizeIncomingFragment(incoming: unknown): string {
+  if (typeof incoming === "string") return incoming;
+  if (incoming == null) return "";
+  if (typeof incoming === "object") {
+    try {
+      return JSON.stringify(incoming);
+    } catch {
+      return "";
+    }
+  }
+  return "";
+}
+
 export function appendToolCallArgumentDelta(current: unknown, incoming: unknown): string {
   const existing = typeof current === "string" ? current : "";
-  const next = typeof incoming === "string" ? incoming : "";
+  const next = normalizeIncomingFragment(incoming);
 
   if (!existing) return next;
   if (!next) return existing;
diff --git a/open-sse/utils/usageTracking.ts b/open-sse/utils/usageTracking.ts
index 8fc24f511a..116bdfe575 100644
--- a/open-sse/utils/usageTracking.ts
+++ b/open-sse/utils/usageTracking.ts
@@ -1,4 +1,3 @@
-// @ts-nocheck
 /**
  * Token Usage Tracking - Extract, normalize, estimate and log token usage
  */
@@ -254,7 +253,7 @@ export function filterUsageForFormat(usage, targetFormat) {
 export function normalizeUsage(usage) {
   if (!usage || typeof usage !== "object" || Array.isArray(usage)) return null;
 
-  const normalized = {};
+  const normalized: Record<string, number> = {};
   const assignNumber = (key, value) => {
     if (value === undefined || value === null) return;
     const numeric = Number(value);
@@ -270,6 +269,16 @@ export function normalizeUsage(usage) {
   assignNumber("cache_creation_input_tokens", usage?.cache_creation_input_tokens);
   assignNumber("cached_tokens", usage?.cached_tokens);
   assignNumber("reasoning_tokens", usage?.reasoning_tokens);
+  // xAI's exact provider-reported cost (port of decolua/9router#2453, capability A —
+  // @ryanngit). Ticks → USD conversion happens in costCalculator.ts, not here.
+  const exactCostTicks = usage?.cost_in_usd_ticks;
+  if (
+    typeof exactCostTicks === "number" &&
+    Number.isFinite(exactCostTicks) &&
+    exactCostTicks >= 0
+  ) {
+    normalized.cost_in_usd_ticks = exactCostTicks;
+  }
 
   if (Object.keys(normalized).length === 0) return null;
   return normalized;
@@ -388,6 +397,8 @@ export function extractUsage(chunk) {
         chunk.usage.completion_tokens_details?.reasoning_tokens ??
         chunk.usage.output_tokens_details?.reasoning_tokens ??
         chunk.usage.reasoning_tokens,
+      // xAI's exact provider-reported cost (port of decolua/9router#2453, capability A).
+      cost_in_usd_ticks: chunk.usage.cost_in_usd_ticks,
     });
   }
 
diff --git a/package-lock.json b/package-lock.json
index 2060e35789..7e32dc68d1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "omniroute",
-  "version": "3.8.46",
+  "version": "3.8.47",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "omniroute",
-      "version": "3.8.46",
+      "version": "3.8.47",
       "hasInstallScript": true,
       "license": "MIT",
       "workspaces": [
@@ -58,6 +58,7 @@
         "next-intl": "^4.12.0",
         "next-themes": "^0.4.6",
         "node-machine-id": "^1.1.12",
+        "omniglyph": "^1.0.2",
         "open": "^11.0.0",
         "ora": "^9.4.1",
         "parse5": "^8.0.1",
@@ -16108,6 +16109,12 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/gpt-tokenizer": {
+      "version": "3.4.0",
+      "resolved": "https://registry.npmjs.org/gpt-tokenizer/-/gpt-tokenizer-3.4.0.tgz",
+      "integrity": "sha512-wxFLnhIXTDjYebd9A9pGl3e31ZpSypbpIJSOswbgop5jLte/AsZVDvjlbEuVFlsqZixVKqbcoNmRlFDf6pz/UQ==",
+      "license": "MIT"
+    },
     "node_modules/graceful-fs": {
       "version": "4.2.11",
       "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
@@ -22136,6 +22143,21 @@
       ],
       "license": "MIT"
     },
+    "node_modules/omniglyph": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/omniglyph/-/omniglyph-1.0.2.tgz",
+      "integrity": "sha512-GGLet99n3HVxOx3WuNPda4B0ETptX9SA8h1fnm/AYSXmvsKXE3mN11Ae2jfX8ldAOA/rVJRXHzPhNkXsRHzMsg==",
+      "license": "MIT",
+      "dependencies": {
+        "gpt-tokenizer": "^3.4.0"
+      },
+      "bin": {
+        "omniglyph": "bin/cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/on-exit-leak-free": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/on-exit-leak-free/-/on-exit-leak-free-2.1.2.tgz",
@@ -28464,7 +28486,7 @@
     },
     "open-sse": {
       "name": "@omniroute/open-sse",
-      "version": "3.8.46",
+      "version": "3.8.47",
       "dependencies": {
         "@toon-format/toon": "^2.3.0",
         "safe-regex": "^2.1.1"
diff --git a/package.json b/package.json
index cb789935e0..9b1b5aeb23 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "omniroute",
-  "version": "3.8.46",
+  "version": "3.8.47",
   "description": "Unified AI router with 160+ providers, RTK+Caveman compression, auto fallback, MCP/A2A, desktop, PWA, and OpenAI-compatible APIs.",
   "type": "module",
   "bin": {
@@ -87,7 +87,8 @@
     "build:release": "rm -rf .build dist && OMNIROUTE_BUILD_SHA=$(git rev-parse --short HEAD) npm run build && npm run build:cli && node scripts/build/write-build-sha.mjs",
     "build:native:tproxy": "cd src/mitm/tproxy/native && npx --yes node-gyp rebuild",
     "start": "node scripts/dev/run-next.mjs start",
-    "lint": "eslint . --suppressions-location config/quality/eslint-suppressions.json",
+    "lint": "eslint . --cache --cache-location .eslintcache --suppressions-location config/quality/eslint-suppressions.json",
+    "lint:json": "node scripts/quality/run-eslint-json.mjs",
     "lint:md": "npx --yes markdownlint-cli2 \"docs/**/*.md\" \"*.md\" \"!docs/i18n\" \"!docs/research\"",
     "lint:prose": "vale docs",
     "electron:dev": "concurrently \"npm run dev\" \"wait-on http://localhost:20128 && cd electron && npm run dev\"",
@@ -136,6 +137,7 @@
     "check:provider-assets": "node scripts/check/check-provider-assets.mjs",
     "check:fetch-targets": "node scripts/check/check-fetch-targets.mjs",
     "check:openapi-routes": "node scripts/check/check-openapi-routes.mjs",
+    "check:api-docs-refs": "node scripts/check/check-api-docs-refs.mjs",
     "check:openapi-breaking": "node scripts/check/check-openapi-breaking.mjs",
     "check:deps": "node scripts/check/check-deps.mjs",
     "check:file-size": "node scripts/check/check-file-size.mjs",
@@ -144,6 +146,7 @@
     "check:test-masking": "node scripts/check/check-test-masking.mjs",
     "check:test-runner-api": "node scripts/check/check-test-runner-api.mjs",
     "check:changelog-integrity": "node scripts/check/check-changelog-integrity.mjs",
+    "changelog:aggregate": "node scripts/release/aggregate-changelog.mjs",
     "check:agent-skills-sync": "node --import tsx/esm scripts/skills/generate-agent-skills.mjs",
     "check:build-scope": "node scripts/check/check-build-scope.mjs",
     "check:error-helper": "node scripts/check/check-error-helper.mjs",
@@ -158,6 +161,7 @@
     "check:complexity": "node scripts/check/check-complexity.mjs",
     "check:dead-code": "node scripts/check/check-dead-code.mjs",
     "check:cognitive-complexity": "node scripts/check/check-cognitive-complexity.mjs",
+    "check:complexity-ratchets": "node scripts/check/check-complexity-ratchets.mjs",
     "check:release-green": "node scripts/quality/validate-release-green.mjs",
     "check:type-coverage": "node scripts/check/check-type-coverage.mjs",
     "check:lockfile": "node scripts/check/check-lockfile.mjs",
@@ -186,6 +190,7 @@
     "test:combo:live": "cross-env RUN_COMBO_LIVE=1 DISABLE_SQLITE_AUTO_BACKUP=true node --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=1 \"tests/integration/combo-live/*.live.test.ts\"",
     "test:combo:live:vps": "node scripts/test/combo-live-vps.mjs",
     "test:combo:live:vps:failover": "node scripts/test/combo-live-vps.mjs --failover",
+    "test:boundary:live": "cross-env RUN_BOUNDARY_LIVE=1 DISABLE_SQLITE_AUTO_BACKUP=true node --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=1 \"tests/boundary/*.live.test.ts\"",
     "test:heap": "node --expose-gc --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit tests/integration/heap-growth.test.ts",
     "test:chaos": "cross-env RUN_CHAOS_INT=1 node --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=1 tests/integration/resilience-chaos.test.ts",
     "test:e2e": "node scripts/dev/run-playwright-tests.mjs test tests/e2e/*.spec.ts",
@@ -261,6 +266,7 @@
     "next-intl": "^4.12.0",
     "next-themes": "^0.4.6",
     "node-machine-id": "^1.1.12",
+    "omniglyph": "^1.0.2",
     "open": "^11.0.0",
     "ora": "^9.4.1",
     "parse5": "^8.0.1",
diff --git a/images/tier-flow-dark.svg b/public/images/tier-flow-dark.svg
similarity index 100%
rename from images/tier-flow-dark.svg
rename to public/images/tier-flow-dark.svg
diff --git a/images/tier-flow-light.svg b/public/images/tier-flow-light.svg
similarity index 100%
rename from images/tier-flow-light.svg
rename to public/images/tier-flow-light.svg
diff --git a/public/providers/360ai.svg b/public/providers/360ai.svg
index caeb6eb2c9..dc393ef67b 100644
--- a/public/providers/360ai.svg
+++ b/public/providers/360ai.svg
@@ -1,5 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
-  <circle cx="16" cy="16" r="14" fill="#00B96B" opacity="0.15"/>
-  <circle cx="16" cy="16" r="14" fill="none" stroke="#00B96B" stroke-width="2"/>
-  <text x="16" y="16" text-anchor="middle" dominant-baseline="central" font-family="system-ui,-apple-system,sans-serif" font-size="11" font-weight="600" fill="#00B96B">360</text>
-</svg>
+<svg height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>AI360</title><path clip-rule="evenodd" d="M12 0h.018c1.473-.002 2.88.261 4.179.754C20.755 2.456 24 6.85 24 12c0 6.627-5.373 12-12 12S0 18.627 0 12 5.373 0 12 0zm8.604 18.967A11.024 11.024 0 0023.07 12c0-1.717-.39-3.344-1.089-4.794a2.59 2.59 0 01-3.214.62 6.278 6.278 0 01-1.333-.992C16.283 5.73 15.109 4.66 13.696 3.9c-3.211-1.729-6.825-1.501-9.695.447A11.033 11.033 0 00.93 12c0 1.663.367 3.241 1.024 4.657.75-.973 2.131-1.346 3.232-.71.667.384 1.257.92 1.837 1.447l.176.16c1.365 1.234 2.794 2.355 4.558 2.965 3.053 1.053 6.356.437 8.847-1.552z" fill="url(#lobe-icons-ai-360-0-_R_0_)" fill-rule="evenodd"></path><path d="M5.643 10.312c-.83.11-1.401.766-1.408 1.618a1.715 1.715 0 001.45 1.72c.805.128 1.64-.426 1.87-1.26.046-.167.076-.338.106-.51.025-.14.05-.282.084-.42.318-1.317 1.237-1.95 2.788-1.93 1.086.013 1.318.271 1.68 1.855.017.076.043.151.07.226.26.714.976 1.17 1.67 1.065a1.647 1.647 0 001.38-1.438c.083-.729-.348-1.264-1.122-1.575-.34-.136-.664-.158-.995-.141-.726.037-1.121-.36-1.339-.977a3.359 3.359 0 01-.134-.65c-.014-.093-.027-.186-.043-.278-.156-.887-.835-1.51-1.669-1.532-.791-.02-1.464.551-1.665 1.418l-.06.27-.025.117c-.355 1.636-.974 2.205-2.638 2.422z" fill="url(#lobe-icons-ai-360-1-_R_0_)"></path><path d="M18.059 13.644c.989-.206 1.577-.838 1.592-1.697.015-.83-.624-1.582-1.46-1.724-.77-.13-1.599.383-1.844 1.18-.069.22-.117.448-.165.676-.06.29-.122.58-.225.854-.367.986-1.593 1.546-2.926 1.394-.824-.095-1.106-.446-1.342-1.674-.18-.938-.864-1.535-1.681-1.467-.85.07-1.515.829-1.468 1.673.05.892.678 1.44 1.705 1.489 1.375.064 1.75.396 1.926 1.787.067.531.267.967.685 1.288 1.02.783 2.407.208 2.66-1.108l.022-.114c.152-.796.3-1.577 1.04-2.101.36-.255.761-.326 1.166-.397.105-.019.21-.037.315-.06z" fill="url(#lobe-icons-ai-360-2-_R_0_)"></path><path d="M13.83 7.961a.755.755 0 11-1.51 0 .755.755 0 011.51 0z" fill="url(#lobe-icons-ai-360-3-_R_0_)"></path><path d="M10.809 16.678a.755.755 0 100-1.511.755.755 0 000 1.51z" fill="url(#lobe-icons-ai-360-4-_R_0_)"></path><defs><linearGradient gradientUnits="userSpaceOnUse" id="lobe-icons-ai-360-0-_R_0_" x1="12" x2="12" y1="0" y2="24"><stop stop-color="#12B7FA"></stop><stop offset="1" stop-color="#006ffb"></stop></linearGradient><linearGradient gradientUnits="userSpaceOnUse" id="lobe-icons-ai-360-1-_R_0_" x1="11.943" x2="11.943" y1="6.085" y2="17.778"><stop stop-color="#006ffb"></stop><stop offset="1" stop-color="#12B7FA"></stop></linearGradient><linearGradient gradientUnits="userSpaceOnUse" id="lobe-icons-ai-360-2-_R_0_" x1="11.943" x2="11.943" y1="6.085" y2="17.778"><stop stop-color="#006ffb"></stop><stop offset="1" stop-color="#12B7FA"></stop></linearGradient><linearGradient gradientUnits="userSpaceOnUse" id="lobe-icons-ai-360-3-_R_0_" x1="11.943" x2="11.943" y1="6.085" y2="17.778"><stop stop-color="#006ffb"></stop><stop offset="1" stop-color="#12B7FA"></stop></linearGradient><linearGradient gradientUnits="userSpaceOnUse" id="lobe-icons-ai-360-4-_R_0_" x1="11.943" x2="11.943" y1="6.085" y2="17.778"><stop stop-color="#006ffb"></stop><stop offset="1" stop-color="#12B7FA"></stop></linearGradient></defs></svg>
\ No newline at end of file
diff --git a/public/providers/alibaba.svg b/public/providers/alibaba.svg
new file mode 100644
index 0000000000..f6b764f99d
--- /dev/null
+++ b/public/providers/alibaba.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Alibaba</title>
+  <path d="M24 14.014c-2.8 1.512-5.62 2.896-8.759 3.524-.7.139-1.476.139-2.187.043-.678-.085-1.017-.682-.776-1.31.23-.585.536-1.181.93-1.671.852-1.065 1.814-2.034 2.678-3.088a15.75 15.75 0 001.422-2.054c.306-.511.164-1.129-.372-1.384-.897-.437-1.859-.745-2.81-1.075-.11-.043-.274.074-.492.149.273.244.47.425.743.67-2.821.48-5.49 1.16-8.08 2.098-.012.053-.033.095-.023.117.383.585.208 1.032-.35 1.394a2.365 2.365 0 00-.568.522c1.706.5 3.226.213 4.68-.735-.087-.127-.175-.244-.262-.372.546.096.874.394.918.862.011.107-.054.213-.087.32-.077-.086-.175-.17-.24-.267-.045-.064-.056-.138-.088-.245-1.728 1.15-3.587 1.438-5.632.842 0 .404-.022.745.011 1.075.022.287-.098.415-.36.564-.591.362-1.204.735-1.696 1.214-.59.585-.371 1.299.427 1.597.907.34 1.859.35 2.81.234 1.126-.139 2.23-.32 3.456-.49-1.433.67-2.844 1.14-4.33 1.33-1.04.14-2.078.214-3.106-.084-1.476-.415-2.133-1.501-1.75-2.96.361-1.363 1.236-2.449 2.176-3.45 3.139-3.332 7.108-5.024 11.7-5.365 1.072-.074 2.155.064 3.16.511 1.411.639 2.002 1.99 1.313 3.354-.448.905-1.072 1.735-1.695 2.555-.612.809-1.301 1.554-1.946 2.331-.186.234-.361.48-.503.745-.274.5-.088.83.492.778 1.213-.118 2.45-.213 3.62-.511 1.716-.437 3.389-1.054 5.084-1.597.175-.043.339-.107.492-.17z"
+        fill="#FF6003"
+        fill-rule="evenodd" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/anthropic.svg b/public/providers/anthropic.svg
new file mode 100644
index 0000000000..f31bfac298
--- /dev/null
+++ b/public/providers/anthropic.svg
@@ -0,0 +1 @@
+<svg fill="#ffff" fill-rule="evenodd" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Anthropic</title><path d="M13.827 3.52h3.603L24 20h-3.603l-6.57-16.48zm-7.258 0h3.767L16.906 20h-3.674l-1.343-3.461H5.017l-1.344 3.46H0L6.57 3.522zm4.132 9.959L8.453 7.687 6.205 13.48H10.7z"></path></svg>
\ No newline at end of file
diff --git a/public/providers/api-airforce.svg b/public/providers/api-airforce.svg
new file mode 100644
index 0000000000..a7e52fc992
--- /dev/null
+++ b/public/providers/api-airforce.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>API Airforce</title>
+  <!-- Shield shape -->
+  <path fill="#0066FF" d="M12 2L4 5v6c0 5.25 4.67 9 8 10 3.33-1 8-4.75 8-10V5l-8-3zm-1.2 14.5l-1.5-3H7.5v3H6V9h3.5c.83 0 1.5.67 1.5 1.5v2c0 .65-.42 1.2-1 1.4l1.6 3.3l-1.8-.7zM7.5 11.5H9V10H7.5v1.5zm7.7-1.5H13v1.5h2.2V13H13v1.5h2.2v1.5H13v-1h-1.5v3.5h-1.5V9H13v1.5h2.2v1.5z"/>
+</svg>
diff --git a/public/providers/arcee-ai.svg b/public/providers/arcee-ai.svg
index b63a13ab3f..dc809fc95e 100644
--- a/public/providers/arcee-ai.svg
+++ b/public/providers/arcee-ai.svg
@@ -1,5 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
-  <circle cx="16" cy="16" r="14" fill="#8B5CF6" opacity="0.15"/>
-  <circle cx="16" cy="16" r="14" fill="none" stroke="#8B5CF6" stroke-width="2"/>
-  <text x="16" y="16" text-anchor="middle" dominant-baseline="central" font-family="system-ui,-apple-system,sans-serif" font-size="11" font-weight="600" fill="#8B5CF6">AR</text>
-</svg>
+<svg height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Arcee</title><path d="M13.236 2.377L2.751 20.493H0L11.863 0l1.373 2.377zm3.554 6.156l-9.606 11.96H4.13L15.511 6.32l1.279 2.212zm6.908 11.96H14.05l8.406-2.151 1.242 2.15zm-3.42-5.922l-7.843 5.92H8.482l10.597-7.997 1.2 2.077z" fill="#008C8C"></path></svg>
\ No newline at end of file
diff --git a/public/providers/arcee.svg b/public/providers/arcee.svg
new file mode 100644
index 0000000000..df3fd30356
--- /dev/null
+++ b/public/providers/arcee.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Arcee</title>
+  <path d="M13.236 2.377L2.751 20.493H0L11.863 0l1.373 2.377zm3.554 6.156l-9.606 11.96H4.13L15.511 6.32l1.279 2.212zm6.908 11.96H14.05l8.406-2.151 1.242 2.15zm-3.42-5.922l-7.843 5.92H8.482l10.597-7.997 1.2 2.077z"
+        fill="#008C8C" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/arena-dark.svg b/public/providers/arena-dark.svg
new file mode 100644
index 0000000000..0435f9ee24
--- /dev/null
+++ b/public/providers/arena-dark.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 121.75 91.97"><path fill="#fff" d="M42.03 39.58c-3.93 0-7.12 3.24-7.12 7.24v45.14h4.53V46.82c0-1.46 1.16-2.64 2.6-2.64s2.6 1.18 2.6 2.64v45.14h4.53V46.82c0-4-3.19-7.24-7.12-7.24h-.03Zm37.68 0c-3.93 0-7.12 3.24-7.12 7.24v45.14h4.53V46.82c0-1.46 1.17-2.64 2.6-2.64s2.6 1.18 2.6 2.64v45.14h4.53V46.82c0-4-3.19-7.24-7.12-7.24zm-18.83 0c-3.94 0-7.12 3.24-7.12 7.24v45.14h4.53V46.82c0-1.46 1.17-2.64 2.6-2.64s2.6 1.18 2.6 2.64v45.14h4.54V46.82c0-4-3.19-7.24-7.12-7.24h-.02Z"/><path fill="#fff" d="m105.04 20.81 3.14-5.54h7.29L121.76 0H0l6.29 15.27h7.29l3.12 5.54c-6.09 2.12-11.1 7.5-11.1 15.6s5.76 14.97 14.39 14.97c1.89 0 3.64-.4 5.2-1.1v41.68h4.52V46.6c1.42-1.96 2.26-4.4 2.32-7.16 0-.04.01-.09.01-.14 0-.04-.01-.06-.01-.1 0-.03.01-.05.01-.07 0-.04-.01-.08-.01-.12-.05-1.87-.54-3.61-1.4-5.09h60.5c-.86 1.48-1.35 3.22-1.4 5.09 0 .05-.01.09-.01.12v.17s.01.1.01.14c.06 2.76.89 5.21 2.32 7.16v45.36h4.52V50.28c1.63.73 3.41 1.1 5.2 1.1 8.62 0 14.39-7.16 14.39-14.97s-5.03-13.49-11.12-15.6M9.3 10.66 6.8 4.61h108.15l-2.5 6.05zm93.65 4.61-2.51 4.45H21.31l-2.51-4.45zm-1.19 31.51c-4.43 0-7.46-3.04-7.51-7.51.02-3.16 2.03-5.28 4.95-5.32h.09c1.83 0 3.32 1.53 3.32 3.14v.08c-.04.93-.77 1.66-1.69 1.66-1.25 0-2.27 1.03-2.27 2.3s1.02 2.3 2.27 2.3c3.43 0 6.24-2.83 6.24-6.34 0-.11-.03-.22-.04-.32-.18-4.12-3.5-7.41-7.89-7.41H60.57l-.31-.01H22.53c-4.39.01-7.71 3.3-7.89 7.42-.01.1-.04.21-.04.32 0 3.51 2.81 6.34 6.24 6.34 1.25 0 2.27-1.03 2.27-2.3s-1.02-2.3-2.27-2.3c-.92 0-1.66-.72-1.7-1.66 0-.03.01-.05.01-.08 0-1.61 1.48-3.14 3.32-3.14h.07c2.93.04 4.94 2.15 4.96 5.32-.05 4.47-3.1 7.51-7.51 7.51-5.81 0-9.85-4.77-9.85-10.36 0-7.55 5.82-12.1 13.02-12.1h75.45c7.19 0 13.02 4.56 13.02 12.1 0 5.59-4.04 10.36-9.85 10.36"/></svg>
\ No newline at end of file
diff --git a/public/providers/arena-light.svg b/public/providers/arena-light.svg
new file mode 100644
index 0000000000..6ae050e8f8
--- /dev/null
+++ b/public/providers/arena-light.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 121.75 91.97"><path d="M42.03 39.58c-3.93 0-7.12 3.24-7.12 7.24v45.14h4.53V46.82c0-1.46 1.16-2.64 2.6-2.64s2.6 1.18 2.6 2.64v45.14h4.53V46.82c0-4-3.19-7.24-7.12-7.24h-.03Zm37.68 0c-3.93 0-7.12 3.24-7.12 7.24v45.14h4.53V46.82c0-1.46 1.17-2.64 2.6-2.64s2.6 1.18 2.6 2.64v45.14h4.53V46.82c0-4-3.19-7.24-7.12-7.24zm-18.83 0c-3.94 0-7.12 3.24-7.12 7.24v45.14h4.53V46.82c0-1.46 1.17-2.64 2.6-2.64s2.6 1.18 2.6 2.64v45.14h4.54V46.82c0-4-3.19-7.24-7.12-7.24h-.02Z"/><path d="m105.04 20.81 3.14-5.54h7.29L121.76 0H0l6.29 15.27h7.29l3.12 5.54c-6.09 2.12-11.1 7.5-11.1 15.6s5.76 14.97 14.39 14.97c1.89 0 3.64-.4 5.2-1.1v41.68h4.52V46.6c1.42-1.96 2.26-4.4 2.32-7.16 0-.04.01-.09.01-.14 0-.04-.01-.06-.01-.1 0-.03.01-.05.01-.07 0-.04-.01-.08-.01-.12-.05-1.87-.54-3.61-1.4-5.09h60.5c-.86 1.48-1.35 3.22-1.4 5.09 0 .05-.01.09-.01.12v.17s.01.1.01.14c.06 2.76.89 5.21 2.32 7.16v45.36h4.52V50.28c1.63.73 3.41 1.1 5.2 1.1 8.62 0 14.39-7.16 14.39-14.97s-5.03-13.49-11.12-15.6M9.3 10.66 6.8 4.61h108.15l-2.5 6.05zm93.65 4.61-2.51 4.45H21.31l-2.51-4.45zm-1.19 31.51c-4.43 0-7.46-3.04-7.51-7.51.02-3.16 2.03-5.28 4.95-5.32h.09c1.83 0 3.32 1.53 3.32 3.14v.08c-.04.93-.77 1.66-1.69 1.66-1.25 0-2.27 1.03-2.27 2.3s1.02 2.3 2.27 2.3c3.43 0 6.24-2.83 6.24-6.34 0-.11-.03-.22-.04-.32-.18-4.12-3.5-7.41-7.89-7.41H60.57l-.31-.01H22.53c-4.39.01-7.71 3.3-7.89 7.42-.01.1-.04.21-.04.32 0 3.51 2.81 6.34 6.24 6.34 1.25 0 2.27-1.03 2.27-2.3s-1.02-2.3-2.27-2.3c-.92 0-1.66-.72-1.7-1.66 0-.03.01-.05.01-.08 0-1.61 1.48-3.14 3.32-3.14h.07c2.93.04 4.94 2.15 4.96 5.32-.05 4.47-3.1 7.51-7.51 7.51-5.81 0-9.85-4.77-9.85-10.36 0-7.55 5.82-12.1 13.02-12.1h75.45c7.19 0 13.02 4.56 13.02 12.1 0 5.59-4.04 10.36-9.85 10.36"/></svg>
\ No newline at end of file
diff --git a/public/providers/assemblyai.svg b/public/providers/assemblyai.svg
new file mode 100644
index 0000000000..c6d4cffee7
--- /dev/null
+++ b/public/providers/assemblyai.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>AssemblyAI</title>
+  <path d="M10.595 1.5a3.695 3.695 0 00-3.444 2.355L0 22.26h5.432l5.629-14.486h.002a.96.96 0 011.782 0h.75V4.835h-1.393L13.498 1.5h-2.902z"
+        fill="#2545D3" />
+  <path d="M7.151 3.855a3.695 3.695 0 013.26-2.35l-.002-.005H13.405c1.524 0 2.893.936 3.444 2.355L24 22.26h-5.525L11.54 4.413a2.528 2.528 0 00-4.609.006l.22-.564z"
+        fill="#566DE8" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/auggie.svg b/public/providers/auggie.svg
new file mode 100644
index 0000000000..6017026d6c
--- /dev/null
+++ b/public/providers/auggie.svg
@@ -0,0 +1 @@
+<svg height="1em" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Auggie</title><circle cx="12" cy="12" r="12" fill="#7C3AED"/><text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui">A</text></svg>
diff --git a/public/providers/aws.svg b/public/providers/aws.svg
new file mode 100644
index 0000000000..0e1a90a7b0
--- /dev/null
+++ b/public/providers/aws.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" fill-rule="evenodd">
+  <title>AWS</title>
+  <path d="M6.763 11.212c0 .296.032.535.088.71.064.176.144.368.256.576.04.063.056.127.056.183 0 .08-.048.16-.152.24l-.503.335a.383.383 0 01-.208.072c-.08 0-.16-.04-.239-.112a2.47 2.47 0 01-.287-.375 6.18 6.18 0 01-.248-.471c-.622.734-1.405 1.101-2.347 1.101-.67 0-1.205-.191-1.596-.574-.39-.384-.59-.894-.59-1.533 0-.678.24-1.23.726-1.644.487-.415 1.133-.623 1.955-.623.272 0 .551.024.846.064.296.04.6.104.918.176v-.583c0-.607-.127-1.03-.375-1.277-.255-.248-.686-.367-1.3-.367-.28 0-.568.031-.863.103-.295.072-.583.16-.862.272a2.4 2.4 0 01-.28.104.488.488 0 01-.127.023c-.112 0-.168-.08-.168-.247v-.391c0-.128.016-.224.056-.28a.597.597 0 01.224-.167 4.577 4.577 0 011.005-.36 4.84 4.84 0 011.246-.151c.95 0 1.644.216 2.091.647.44.43.662 1.085.662 1.963v2.586h.016zm-3.24 1.214c.263 0 .534-.048.822-.144a1.78 1.78 0 00.758-.51 1.27 1.27 0 00.272-.512c.047-.191.08-.423.08-.694v-.335a6.66 6.66 0 00-.735-.136 6.02 6.02 0 00-.75-.048c-.535 0-.926.104-1.19.32-.263.215-.39.518-.39.917 0 .375.095.655.295.846.191.2.47.296.838.296zm6.41.862c-.144 0-.24-.024-.304-.08-.064-.048-.12-.16-.168-.311L7.586 6.726a1.398 1.398 0 01-.072-.32c0-.128.064-.2.191-.2h.783c.151 0 .255.025.31.08.065.048.113.16.16.312l1.342 5.284 1.245-5.284c.04-.16.088-.264.151-.312a.549.549 0 01.32-.08h.638c.152 0 .256.025.32.08.063.048.12.16.151.312l1.261 5.348 1.381-5.348c.048-.16.104-.264.16-.312a.52.52 0 01.311-.08h.743c.127 0 .2.065.2.2 0 .04-.009.08-.017.128a1.137 1.137 0 01-.056.2l-1.923 6.17c-.048.16-.104.263-.168.311a.51.51 0 01-.303.08h-.687c-.15 0-.255-.024-.32-.08-.063-.056-.119-.16-.15-.32L12.32 7.747l-1.23 5.14c-.04.16-.087.264-.15.32-.065.056-.177.08-.32.08l-.686.001zm10.256.215c-.415 0-.83-.048-1.229-.143-.399-.096-.71-.2-.918-.32-.128-.071-.215-.151-.247-.223a.563.563 0 01-.048-.224v-.407c0-.167.064-.247.183-.247.048 0 .096.008.144.024.048.016.12.048.2.08.271.12.566.215.878.279.32.064.63.096.95.096.502 0 .894-.088 1.165-.264a.86.86 0 00.415-.758.777.777 0 00-.215-.559c-.144-.151-.416-.287-.807-.415l-1.157-.36c-.583-.183-1.014-.454-1.277-.813a1.902 1.902 0 01-.4-1.158c0-.335.073-.63.216-.886.144-.255.335-.479.575-.654.24-.184.51-.32.83-.415.32-.096.655-.136 1.006-.136.175 0 .36.008.535.032.183.024.35.056.518.088.16.04.312.08.455.127.144.048.256.096.336.144a.69.69 0 01.24.2.43.43 0 01.071.263v.375c0 .168-.064.256-.184.256a.83.83 0 01-.303-.096 3.652 3.652 0 00-1.532-.311c-.455 0-.815.071-1.062.223-.248.152-.375.383-.375.71 0 .224.08.416.24.567.16.152.454.304.877.44l1.134.358c.574.184.99.44 1.237.767.247.327.367.702.367 1.117 0 .343-.072.655-.207.926a2.157 2.157 0 01-.583.703c-.248.2-.543.343-.886.447-.36.111-.734.167-1.142.167z" />
+  <path d="M.378 15.475c3.384 1.963 7.56 3.153 11.877 3.153 2.914 0 6.114-.607 9.06-1.852.44-.2.814.287.383.607-2.626 1.94-6.442 2.969-9.722 2.969-4.598 0-8.74-1.7-11.87-4.526-.247-.223-.024-.527.272-.351zm23.531-.2c.287.36-.08 2.826-1.485 4.007-.215.184-.423.088-.327-.151l.175-.439c.343-.88.802-2.198.52-2.555-.336-.43-2.22-.207-3.074-.103-.255.032-.295-.192-.063-.36 1.5-1.053 3.967-.75 4.254-.399z"
+        fill="#F90" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/azure.svg b/public/providers/azure.svg
new file mode 100644
index 0000000000..038645c7e0
--- /dev/null
+++ b/public/providers/azure.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 199"><path d="M118.432 187.698c32.89-5.81 60.055-10.618 60.367-10.684l.568-.12l-31.052-36.935c-17.078-20.314-31.051-37.014-31.051-37.11c0-.182 32.063-88.477 32.243-88.792c.06-.105 21.88 37.567 52.893 91.32c29.035 50.323 52.973 91.815 53.195 92.203l.405.707l-98.684-.012l-98.684-.013l59.8-10.564zM0 176.435c0-.052 14.631-25.451 32.514-56.442l32.514-56.347l37.891-31.799C123.76 14.358 140.867.027 140.935.001c.069-.026-.205.664-.609 1.534s-18.919 40.582-41.145 88.25l-40.41 86.67l-29.386.037c-16.162.02-29.385-.005-29.385-.057z" fill="#0089D6" fill-rule="nonzero"/></svg>
\ No newline at end of file
diff --git a/public/providers/azureai.svg b/public/providers/azureai.svg
new file mode 100644
index 0000000000..b9ae255923
--- /dev/null
+++ b/public/providers/azureai.svg
@@ -0,0 +1,82 @@
+<svg
+      viewBox="0 0 24 24"
+      xmlns="http://www.w3.org/2000/svg"
+    >
+      <title>AzureAI</title>
+      <path
+        clip-rule="evenodd"
+        d="M16.233 0c.713 0 1.345.551 1.572 1.329.227.778 1.555 5.59 1.555 5.59v9.562h-4.813L14.645 0h1.588z"
+        fill="url(#grad-a)"
+        fill-rule="evenodd"
+      />
+      <path
+        d="M23.298 7.47c0-.34-.275-.6-.6-.6h-2.835a3.617 3.617 0 00-3.614 3.615v5.996h3.436a3.617 3.617 0 003.613-3.614V7.47z"
+        fill="url(#grad-b)"
+      />
+      <path
+        clip-rule="evenodd"
+        d="M16.233 0a.982.982 0 00-.989.989l-.097 18.198A4.814 4.814 0 0110.334 24H1.6a.597.597 0 01-.567-.794l7-19.981A4.819 4.819 0 0112.57 0h3.679-.016z"
+        fill="url(#grad-c)"
+        fill-rule="evenodd"
+      />
+      <defs>
+        <linearGradient
+          gradientUnits="userSpaceOnUse"
+          id="grad-a"
+          x1="18.242"
+          x2="14.191"
+          y1="16.837"
+          y2=".616"
+        >
+          <stop stop-color="#712575" />
+          <stop offset=".09" stop-color="#9A2884" />
+          <stop offset=".18" stop-color="#BF2C92" />
+          <stop offset=".27" stop-color="#DA2E9C" />
+          <stop offset=".34" stop-color="#EB30A2" />
+          <stop offset=".4" stop-color="#F131A5" />
+          <stop offset=".5" stop-color="#EC30A3" />
+          <stop offset=".61" stop-color="#DF2F9E" />
+          <stop offset=".72" stop-color="#C92D96" />
+          <stop offset=".83" stop-color="#AA2A8A" />
+          <stop offset=".95" stop-color="#83267C" />
+          <stop offset="1" stop-color="#712575" />
+        </linearGradient>
+        <linearGradient
+          gradientUnits="userSpaceOnUse"
+          id="grad-b"
+          x1="19.782"
+          x2="19.782"
+          y1=".34"
+          y2="23.222"
+        >
+          <stop stop-color="#DA7ED0" />
+          <stop offset=".08" stop-color="#B17BD5" />
+          <stop offset=".19" stop-color="#8778DB" />
+          <stop offset=".3" stop-color="#6276E1" />
+          <stop offset=".41" stop-color="#4574E5" />
+          <stop offset=".54" stop-color="#2E72E8" />
+          <stop offset=".67" stop-color="#1D71EB" />
+          <stop offset=".81" stop-color="#1471EC" />
+          <stop offset="1" stop-color="#1171ED" />
+        </linearGradient>
+        <linearGradient
+          gradientUnits="userSpaceOnUse"
+          id="grad-c"
+          x1="18.404"
+          x2="3.236"
+          y1=".859"
+          y2="25.183"
+        >
+          <stop stop-color="#DA7ED0" />
+          <stop offset=".05" stop-color="#B77BD4" />
+          <stop offset=".11" stop-color="#9079DA" />
+          <stop offset=".18" stop-color="#6E77DF" />
+          <stop offset=".25" stop-color="#5175E3" />
+          <stop offset=".33" stop-color="#3973E7" />
+          <stop offset=".42" stop-color="#2772E9" />
+          <stop offset=".54" stop-color="#1A71EB" />
+          <stop offset=".68" stop-color="#1371EC" />
+          <stop offset="1" stop-color="#1171ED" />
+        </linearGradient>
+      </defs>
+    </svg>
\ No newline at end of file
diff --git a/public/providers/baichuan.svg b/public/providers/baichuan.svg
index fa3789f62e..11b27e7913 100644
--- a/public/providers/baichuan.svg
+++ b/public/providers/baichuan.svg
@@ -1,5 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
-  <circle cx="16" cy="16" r="14" fill="#6366F1" opacity="0.15"/>
-  <circle cx="16" cy="16" r="14" fill="none" stroke="#6366F1" stroke-width="2"/>
-  <text x="16" y="16" text-anchor="middle" dominant-baseline="central" font-family="system-ui,-apple-system,sans-serif" font-size="11" font-weight="600" fill="#6366F1">BC</text>
-</svg>
+<svg height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Baichuan</title><defs><linearGradient id="lobe-icons-baichuan-_R_0_" x1="17.764%" x2="100%" y1="8.678%" y2="91.322%"><stop offset="0%" stop-color="#FEC13E"></stop><stop offset="100%" stop-color="#FF6933"></stop></linearGradient></defs><path d="M7.333 2h-3.2l-2 4.333V17.8L0 22h5.2l2.028-4.2L7.333 2zm7.334 0h-5.2v20h5.2V2zM16.8 7.733H22V22h-5.2V7.733zM22 2h-5.2v4.133H22V2z" fill="url(#lobe-icons-baichuan-_R_0_)" fill-rule="nonzero"></path></svg>
\ No newline at end of file
diff --git a/public/providers/baidu.svg b/public/providers/baidu.svg
index 0c74817895..ead7f89822 100644
--- a/public/providers/baidu.svg
+++ b/public/providers/baidu.svg
@@ -1,5 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
-  <circle cx="16" cy="16" r="14" fill="#2932E1" opacity="0.15"/>
-  <circle cx="16" cy="16" r="14" fill="none" stroke="#2932E1" stroke-width="2"/>
-  <text x="16" y="16" text-anchor="middle" dominant-baseline="central" font-family="system-ui,-apple-system,sans-serif" font-size="11" font-weight="600" fill="#2932E1">BD</text>
-</svg>
+<svg height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Baidu</title><path d="M8.859 11.735c1.017-1.71 4.059-3.083 6.202.286 1.579 2.284 4.284 4.397 4.284 4.397s2.027 1.601.73 4.684c-1.24 2.956-5.64 1.607-6.005 1.49l-.024-.009s-1.746-.568-3.776-.112c-2.026.458-3.773.286-3.773.286l-.045-.001c-.328-.01-2.38-.187-3.001-2.968-.675-3.028 2.365-4.687 2.592-4.968.226-.288 1.802-1.37 2.816-3.085zm.986 1.738v2.032h-1.64s-1.64.138-2.213 2.014c-.2 1.252.177 1.99.242 2.148.067.157.596 1.073 1.927 1.342h3.078v-7.514l-1.394-.022zm3.588 2.191l-1.44.024v3.956s.064.985 1.44 1.344h3.541v-5.3h-1.528v3.979h-1.46s-.466-.068-.553-.447v-3.556zM9.82 16.715v3.06H8.58s-.863-.045-1.126-1.049c-.136-.445.02-.959.088-1.16.063-.203.353-.671.951-.85H9.82zm9.525-9.036c2.086 0 2.646 2.06 2.646 2.742 0 .688.284 3.597-2.309 3.655-2.595.057-2.704-1.77-2.704-3.08 0-1.374.277-3.317 2.367-3.317zM4.24 6.08c1.523-.135 2.645 1.55 2.762 2.513.07.625.393 3.486-1.975 4-2.364.515-3.244-2.249-2.984-3.544 0 0 .28-2.797 2.197-2.969zm8.847-1.483c.14-1.31 1.69-3.316 2.931-3.028 1.236.285 2.367 1.944 2.137 3.37-.224 1.428-1.345 3.313-3.095 3.082-1.748-.226-2.143-1.823-1.973-3.424zM9.425 1c1.307 0 2.364 1.519 2.364 3.398 0 1.879-1.057 3.4-2.364 3.4s-2.367-1.521-2.367-3.4C7.058 2.518 8.118 1 9.425 1z" fill="#2932E1" fill-rule="nonzero"></path></svg>
\ No newline at end of file
diff --git a/public/providers/bailian.svg b/public/providers/bailian.svg
new file mode 100644
index 0000000000..7618aaad1c
--- /dev/null
+++ b/public/providers/bailian.svg
@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Bailian (阿里云百炼)</title>
+  <path d="M6.336 8.919v6.162l5.335-3.083L6.337 8.92z" fill="#1C54E3" />
+  <path d="M21.394 5.288s-.006-.006-.01-.006L17.01 2.754 6.336 8.92l5.335 3.082 9.701-5.6.016-.01a.635.635 0 00.006-1.1v-.003z"
+        fill="#AA9AFF" />
+  <path d="M21.71 12.465a.62.62 0 00-.316.085s-.006 0-.009.003l-4.375 2.528 5.05 2.915h.006a2.06 2.06 0 00.28-1.04v-3.855a.637.637 0 00-.636-.636z"
+        fill="#00EAD1" />
+  <path d="M22.06 17.996l-5.05-2.915L6.34 21.242l4.27 2.465s.016.006.022.012a2.102 2.102 0 002.093 0c.006-.003.016-.006.022-.012l8.538-4.93c.003 0 .006-.003.01-.006.321-.183.589-.45.775-.772h-.006l-.004-.003z"
+        fill="#00CEC9" />
+  <path d="M11.672 11.998l-5.336 3.083-1.444.832-3.605 2.083H1.28c.173.303.416.555.709.738l.078.044.016.01.02.012 4.232 2.442 10.671-6.161-5.335-3.082z"
+        fill="#00EAD1" />
+  <path d="M12.74.29c-.1-.06-.208-.107-.315-.148-.02-.006-.038-.016-.057-.022a2.121 2.121 0 00-.7-.12c-.233 0-.457.038-.668.11l-.031.01a2.196 2.196 0 00-.372.17L2.068 5.222s-.003 0-.006.003c-.324.183-.592.451-.781.773h.006l5.049 2.918L17.01 2.758 12.74.29z"
+        fill="#7347FF" />
+  <path d="M1.287 6.001H1.28A2.06 2.06 0 001 7.041v9.915c0 .378.1.735.28 1.043h.007l5.049-2.918V8.919l-5.05-2.918z"
+        fill="#0423DA" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/baseten.svg b/public/providers/baseten.svg
new file mode 100644
index 0000000000..c6a5fb32c1
--- /dev/null
+++ b/public/providers/baseten.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" fill-rule="evenodd">
+  <title>Baseten</title>
+  <path d="M2.316 4.8h14.682v4.8H7.31a.302.302 0 00-.308.3v4.2c0 .171.14.3.308.3h9.688v4.8h-4.686a.302.302 0 00-.308.3v4.2c0 .171.141.3.308.3h4.378a.297.297 0 00.308-.3v-4.5h4.694a.302.302 0 00.308-.3v-4.2c0-.171-.14-.3-.308-.3h-4.694V9.6h4.694A.302.302 0 0022 9.3V5.1c0-.171-.14-.3-.308-.3h-4.694V.3c0-.171-.14-.3-.308-.3H2.316A.31.31 0 002 .3v4.2c0 .171.14.3.316.3z" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/bluesminds.svg b/public/providers/bluesminds.svg
new file mode 100644
index 0000000000..d99ec9cdb9
--- /dev/null
+++ b/public/providers/bluesminds.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Bluesminds</title>
+  <circle cx="12" cy="12" r="12" fill="#2563EB"/>
+  <text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui">B</text>
+</svg>
diff --git a/public/providers/byteplus.svg b/public/providers/byteplus.svg
new file mode 100644
index 0000000000..a1ba8812d6
--- /dev/null
+++ b/public/providers/byteplus.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>BytePlus</title>
+  <path transform="translate(0, 2.6) scale(0.585)" d="M25.2693 13.2742C25.0189 13.4778 24.6546 13.3194 24.6546 12.9801V11.1931V0.380245C24.6546 0.0635515 24.2676 -0.117416 24.04 0.0861724L8.8784 12.867C8.62798 13.0706 8.26374 12.9122 8.26374 12.5729V3.84125C8.26374 3.59242 8.05886 3.38883 7.80844 3.38883H0.455303C0.204886 3.38883 0 3.59242 0 3.84125V31.19C0 31.5066 0.387007 31.6876 0.614659 31.484L15.7535 18.7032C16.0039 18.4996 16.3681 18.658 16.3681 18.9973V31.6198C16.3681 31.9364 16.7551 32.1174 16.9828 31.9138L32.1216 19.133C32.372 18.9294 32.7363 19.0878 32.7363 19.4271V28.1588C32.7363 28.4076 32.9411 28.6112 33.1916 28.6112H40.5447C40.7951 28.6112 41 28.4076 41 28.1588V0.787421C41 0.470728 40.613 0.289761 40.3853 0.493349L25.2693 13.2742Z" fill="#42B549"/>
+</svg>
diff --git a/public/providers/bytez.svg b/public/providers/bytez.svg
new file mode 100644
index 0000000000..3614fa3475
--- /dev/null
+++ b/public/providers/bytez.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Bytez</title>
+  <circle cx="12" cy="12" r="12" fill="#0D9488"/>
+  <text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui">B</text>
+</svg>
diff --git a/public/providers/cerebras.svg b/public/providers/cerebras.svg
new file mode 100644
index 0000000000..88b7cb5632
--- /dev/null
+++ b/public/providers/cerebras.svg
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor">
+  <title>Cerebras</title>
+  <path clip-rule="evenodd"
+        d="M14.121 2.701a9.299 9.299 0 000 18.598V22.7c-5.91 0-10.7-4.791-10.7-10.701S8.21 1.299 14.12 1.299V2.7zm4.752 3.677A7.353 7.353 0 109.42 17.643l-.901 1.074a8.754 8.754 0 01-1.08-12.334 8.755 8.755 0 0112.335-1.08l-.901 1.075zm-2.255.844a5.407 5.407 0 00-5.048 9.563l-.656 1.24a6.81 6.81 0 016.358-12.043l-.654 1.24zM14.12 8.539a3.46 3.46 0 100 6.922v1.402a4.863 4.863 0 010-9.726v1.402z"
+        fill="#F15A29"
+        fill-rule="evenodd" />
+  <path d="M15.407 10.836a2.24 2.24 0 00-.51-.409 1.084 1.084 0 00-.544-.152c-.255 0-.483.047-.684.14a1.58 1.58 0 00-.84.912c-.074.203-.11.416-.11.631 0 .218.036.43.11.631a1.594 1.594 0 00.84.913c.2.093.43.14.684.14.216 0 .417-.046.602-.135.188-.09.35-.225.475-.392l.928 1.006c-.14.14-.3.261-.482.363a3.367 3.367 0 01-1.083.38c-.17.026-.317.04-.44.04a3.315 3.315 0 01-1.182-.21 2.825 2.825 0 01-.961-.597 2.816 2.816 0 01-.644-.929 2.987 2.987 0 01-.238-1.21c0-.444.08-.847.238-1.21.15-.35.368-.666.643-.929.278-.261.605-.464.962-.596a3.315 3.315 0 011.182-.21c.355 0 .712.068 1.072.204.361.138.685.36.944.649l-.962.97z" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/charm-hyper.svg b/public/providers/charm-hyper.svg
new file mode 100644
index 0000000000..97233bf019
--- /dev/null
+++ b/public/providers/charm-hyper.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Charm Hyper</title>
+  <circle cx="12" cy="12" r="12" fill="#DB2777"/>
+  <text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui">C</text>
+</svg>
diff --git a/public/providers/chipotle.svg b/public/providers/chipotle.svg
new file mode 100644
index 0000000000..e82accbfe2
--- /dev/null
+++ b/public/providers/chipotle.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Chipotle</title>
+  <path d="M3 12a9 9 0 1118 0 9 9 0 01-18 0zm4.5 0a4.5 4.5 0 109 0 4.5 4.5 0 00-9 0z" fill="#EA580C" opacity=".15"/>
+  <path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm-1 15.5H8V6.5h3c3.31 0 6 2.24 6 5.5s-2.69 5.5-6 5.5zm0-9.5v8h1c2.21 0 4-1.79 4-4s-1.79-4-4-4h-1z" fill="#EA580C"/>
+</svg>
diff --git a/public/providers/chutes.svg b/public/providers/chutes.svg
new file mode 100644
index 0000000000..2f6d7be9a0
--- /dev/null
+++ b/public/providers/chutes.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Chutes</title>
+  <circle cx="12" cy="12" r="12" fill="#16A34A"/>
+  <text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui">C</text>
+</svg>
diff --git a/public/providers/claude-web.svg b/public/providers/claude-web.svg
index 882c6d2245..62dc0db12d 100644
--- a/public/providers/claude-web.svg
+++ b/public/providers/claude-web.svg
@@ -1,5 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
-  <circle cx="16" cy="16" r="14" fill="#D97757" opacity="0.15"/>
-  <circle cx="16" cy="16" r="14" fill="none" stroke="#D97757" stroke-width="2"/>
-  <text x="16" y="16" text-anchor="middle" dominant-baseline="central" font-family="system-ui,-apple-system,sans-serif" font-size="11" font-weight="600" fill="#D97757">CW</text>
-</svg>
+<svg height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Claude</title><path d="M4.709 15.955l4.72-2.647.08-.23-.08-.128H9.2l-.79-.048-2.698-.073-2.339-.097-2.266-.122-.571-.121L0 11.784l.055-.352.48-.321.686.06 1.52.103 2.278.158 1.652.097 2.449.255h.389l.055-.157-.134-.098-.103-.097-2.358-1.596-2.552-1.688-1.336-.972-.724-.491-.364-.462-.158-1.008.656-.722.881.06.225.061.893.686 1.908 1.476 2.491 1.833.365.304.145-.103.019-.073-.164-.274-1.355-2.446-1.446-2.49-.644-1.032-.17-.619a2.97 2.97 0 01-.104-.729L6.283.134 6.696 0l.996.134.42.364.62 1.414 1.002 2.229 1.555 3.03.456.898.243.832.091.255h.158V9.01l.128-1.706.237-2.095.23-2.695.08-.76.376-.91.747-.492.584.28.48.685-.067.444-.286 1.851-.559 2.903-.364 1.942h.212l.243-.242.985-1.306 1.652-2.064.73-.82.85-.904.547-.431h1.033l.76 1.129-.34 1.166-1.064 1.347-.881 1.142-1.264 1.7-.79 1.36.073.11.188-.02 2.856-.606 1.543-.28 1.841-.315.833.388.091.395-.328.807-1.969.486-2.309.462-3.439.813-.042.03.049.061 1.549.146.662.036h1.622l3.02.225.79.522.474.638-.079.485-1.215.62-1.64-.389-3.829-.91-1.312-.329h-.182v.11l1.093 1.068 2.006 1.81 2.509 2.33.127.578-.322.455-.34-.049-2.205-1.657-.851-.747-1.926-1.62h-.128v.17l.444.649 2.345 3.521.122 1.08-.17.353-.608.213-.668-.122-1.374-1.925-1.415-2.167-1.143-1.943-.14.08-.674 7.254-.316.37-.729.28-.607-.461-.322-.747.322-1.476.389-1.924.315-1.53.286-1.9.17-.632-.012-.042-.14.018-1.434 1.967-2.18 2.945-1.726 1.845-.414.164-.717-.37.067-.662.401-.589 2.388-3.036 1.44-1.882.93-1.086-.006-.158h-.055L4.132 18.56l-1.13.146-.487-.456.061-.746.231-.243 1.908-1.312-.006.006z" fill="#D97757" fill-rule="nonzero"></path></svg>
\ No newline at end of file
diff --git a/public/providers/claude.svg b/public/providers/claude.svg
index 8bc1fd43ba..62dc0db12d 100644
--- a/public/providers/claude.svg
+++ b/public/providers/claude.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 130 130"><defs><clipPath id="a"><rect width="130" height="130" rx="29" ry="29"/></clipPath></defs><g clip-path="url(#a)"><path fill="#da7352" d="M0 0h130v130H0z"/><path fill="#fefcfb" d="m34.6 81.5 19.7-11 .3-1-.3-.5h-1l-3.3-.2-11.2-.3L29 68l-9.5-.5-2.4-.5-2.1-3 .2-1.5 2-1.3 2.9.2 6.3.5 9.5.6 6.9.4L53 64.1h1.6l.2-.7-.5-.4-.4-.4L44 56l-10.6-7-5.6-4.1-3-2-1.5-2-.6-4.2 2.7-3 3.7.3.9.2 3.7 2.9 8 6.1L52 51l1.5 1.2.6-.4.1-.3-.7-1.1L48 40l-6-10.4-2.7-4.3-.7-2.6c-.3-1-.4-2-.4-3l3-4.2L43 15l4.2.6 1.6 1.4 2.6 6 4.1 9.3L62 44.9l2 3.8 1 3.4.3 1h.7v-.5l.5-7.2 1-8.7 1-11.2.3-3.2 1.6-3.8 3-2 2.6 1.1 2 2.9-.3 1.8-1.1 7.7L74 42.1l-1.5 8.2h.9l1-1.1 4.1-5.4 6.9-8.6 3-3.5L92 28l2.3-1.8h4.3l3.1 4.7-1.4 4.9-4.4 5.6-3.7 4.7-5.3 7.1-3.2 5.7.3.4h.7l12-2.6 6.4-1.1 7.6-1.3 3.5 1.6.4 1.6-1.4 3.4-8.2 2-9.6 2-14.3 3.3-.2.1.2.3 6.4.6 2.8.2h6.8l12.6 1 3.3 2 1.9 2.7-.3 2-5.1 2.6-6.8-1.6-16-3.8-5.4-1.3h-.8v.4l4.6 4.5 8.3 7.5 10.6 9.7.5 2.4-1.3 2-1.4-.2-9.2-7-3.6-3-8-6.8h-.5v.7l1.8 2.7 9.8 14.7.5 4.5-.7 1.4-2.6 1-2.7-.6-5.8-8-6-9-4.7-8.2-.5.4-2.9 30.2-1.3 1.5-3 1.2-2.5-2-1.4-3 1.4-6.2 1.6-8 1.3-6.4 1.2-7.9.7-2.6v-.2H64L58 87l-9 12.3-7.2 7.6-1.7.7-3-1.5.3-2.8L39 101l10-12.8 6-7.9 4-4.6-.1-.5h-.3L32.2 92.4l-4.7.6-2-2 .2-3 1-1 8-5.5Z"/></g></svg>
\ No newline at end of file
+<svg height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Claude</title><path d="M4.709 15.955l4.72-2.647.08-.23-.08-.128H9.2l-.79-.048-2.698-.073-2.339-.097-2.266-.122-.571-.121L0 11.784l.055-.352.48-.321.686.06 1.52.103 2.278.158 1.652.097 2.449.255h.389l.055-.157-.134-.098-.103-.097-2.358-1.596-2.552-1.688-1.336-.972-.724-.491-.364-.462-.158-1.008.656-.722.881.06.225.061.893.686 1.908 1.476 2.491 1.833.365.304.145-.103.019-.073-.164-.274-1.355-2.446-1.446-2.49-.644-1.032-.17-.619a2.97 2.97 0 01-.104-.729L6.283.134 6.696 0l.996.134.42.364.62 1.414 1.002 2.229 1.555 3.03.456.898.243.832.091.255h.158V9.01l.128-1.706.237-2.095.23-2.695.08-.76.376-.91.747-.492.584.28.48.685-.067.444-.286 1.851-.559 2.903-.364 1.942h.212l.243-.242.985-1.306 1.652-2.064.73-.82.85-.904.547-.431h1.033l.76 1.129-.34 1.166-1.064 1.347-.881 1.142-1.264 1.7-.79 1.36.073.11.188-.02 2.856-.606 1.543-.28 1.841-.315.833.388.091.395-.328.807-1.969.486-2.309.462-3.439.813-.042.03.049.061 1.549.146.662.036h1.622l3.02.225.79.522.474.638-.079.485-1.215.62-1.64-.389-3.829-.91-1.312-.329h-.182v.11l1.093 1.068 2.006 1.81 2.509 2.33.127.578-.322.455-.34-.049-2.205-1.657-.851-.747-1.926-1.62h-.128v.17l.444.649 2.345 3.521.122 1.08-.17.353-.608.213-.668-.122-1.374-1.925-1.415-2.167-1.143-1.943-.14.08-.674 7.254-.316.37-.729.28-.607-.461-.322-.747.322-1.476.389-1.924.315-1.53.286-1.9.17-.632-.012-.042-.14.018-1.434 1.967-2.18 2.945-1.726 1.845-.414.164-.717-.37.067-.662.401-.589 2.388-3.036 1.44-1.882.93-1.086-.006-.158h-.055L4.132 18.56l-1.13.146-.487-.456.061-.746.231-.243 1.908-1.312-.006.006z" fill="#D97757" fill-rule="nonzero"></path></svg>
\ No newline at end of file
diff --git a/public/providers/cline.svg b/public/providers/cline.svg
new file mode 100644
index 0000000000..8dcc05786c
--- /dev/null
+++ b/public/providers/cline.svg
@@ -0,0 +1 @@
+<svg fill="#18181B" role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Cline</title><path d="m23.365 13.556-1.442-2.895V8.994c0-2.764-2.218-5.002-4.954-5.002h-2.464c.178-.367.276-.779.276-1.213A2.77 2.77 0 0 0 12.018 0a2.77 2.77 0 0 0-2.763 2.779c0 .434.098.846.276 1.213H7.067c-2.736 0-4.954 2.238-4.954 5.002v1.667L.64 13.549c-.149.29-.149.636 0 .927l1.472 2.855v1.667C2.113 21.762 4.33 24 7.067 24h9.902c2.736 0 4.954-2.238 4.954-5.002V17.33l1.44-2.865c.143-.286.143-.622.002-.91m-12.854 2.36a2.27 2.27 0 0 1-2.261 2.273 2.27 2.27 0 0 1-2.261-2.273v-4.042A2.27 2.27 0 0 1 8.249 9.6a2.267 2.267 0 0 1 2.262 2.274zm7.285 0a2.27 2.27 0 0 1-2.26 2.273 2.27 2.27 0 0 1-2.262-2.273v-4.042A2.267 2.267 0 0 1 15.535 9.6a2.267 2.267 0 0 1 2.261 2.274z"/></svg>
\ No newline at end of file
diff --git a/public/providers/cloudflare.svg b/public/providers/cloudflare.svg
new file mode 100644
index 0000000000..ac59cd621a
--- /dev/null
+++ b/public/providers/cloudflare.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Cloudflare</title>
+  <path d="M16.493 17.4c.135-.52.08-.983-.161-1.338-.215-.328-.592-.519-1.05-.519l-8.663-.109a.148.148 0 01-.135-.082c-.027-.054-.027-.109-.027-.163.027-.082.108-.164.189-.164l8.744-.11c1.05-.054 2.153-.9 2.556-1.937l.511-1.31c.027-.055.027-.11.027-.164C17.92 8.91 15.66 7 12.942 7c-2.503 0-4.628 1.638-5.381 3.903a2.432 2.432 0 00-1.803-.491c-1.21.109-2.153 1.092-2.287 2.32-.027.328 0 .628.054.9C1.56 13.688 0 15.326 0 17.319c0 .19.027.355.027.545 0 .082.08.137.161.137h15.983c.08 0 .188-.055.215-.164l.107-.437"
+        fill="#F38020" />
+  <path d="M19.238 11.75h-.242c-.054 0-.108.054-.135.109l-.35 1.2c-.134.52-.08.983.162 1.338.215.328.592.518 1.05.518l1.855.11c.054 0 .108.027.135.082.027.054.027.109.027.163-.027.082-.108.164-.188.164l-1.91.11c-1.05.054-2.153.9-2.557 1.937l-.134.355c-.027.055.026.137.107.137h6.592c.081 0 .162-.055.162-.137.107-.41.188-.846.188-1.31-.027-2.62-2.153-4.777-4.762-4.777"
+        fill="#FCAD32" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/cohere.svg b/public/providers/cohere.svg
new file mode 100644
index 0000000000..62aec42312
--- /dev/null
+++ b/public/providers/cohere.svg
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Cohere</title>
+  <path clip-rule="evenodd"
+        d="M8.128 14.099c.592 0 1.77-.033 3.398-.703 1.897-.781 5.672-2.2 8.395-3.656 1.905-1.018 2.74-2.366 2.74-4.18A4.56 4.56 0 0018.1 1H7.549A6.55 6.55 0 001 7.55c0 3.617 2.745 6.549 7.128 6.549z"
+        fill="#39594D"
+        fill-rule="evenodd" />
+  <path clip-rule="evenodd"
+        d="M9.912 18.61a4.387 4.387 0 012.705-4.052l3.323-1.38c3.361-1.394 7.06 1.076 7.06 4.715a5.104 5.104 0 01-5.105 5.104l-3.597-.001a4.386 4.386 0 01-4.386-4.387z"
+        fill="#D18EE2"
+        fill-rule="evenodd" />
+  <path d="M4.776 14.962A3.775 3.775 0 001 18.738v.489a3.776 3.776 0 007.551 0v-.49a3.775 3.775 0 00-3.775-3.775z"
+        fill="#FF7759" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/comfyui.svg b/public/providers/comfyui.svg
new file mode 100644
index 0000000000..85e93cd06b
--- /dev/null
+++ b/public/providers/comfyui.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>ComfyUI</title>
+  <path d="M5.485 23.76c-.568 0-1.026-.207-1.325-.598-.307-.402-.387-.964-.22-1.54l.672-2.315a.605.605 0 00-.1-.536.622.622 0 00-.494-.243H2.085c-.568 0-1.026-.207-1.325-.598-.307-.403-.387-.964-.22-1.54l2.31-7.917.255-.87c.343-1.18 1.592-2.14 2.786-2.14h2.313c.276 0 .519-.18.595-.442l.764-2.633C9.906 1.208 11.155.249 12.35.249l4.945-.008h3.62c.568 0 1.027.206 1.325.597.307.402.387.964.22 1.54l-1.035 3.566c-.343 1.178-1.593 2.137-2.787 2.137l-4.956.01H11.37a.618.618 0 00-.594.441l-1.928 6.604a.605.605 0 00.1.537c.118.153.3.243.495.243l3.275-.006h3.61c.568 0 1.026.206 1.325.598.307.402.387.964.22 1.54l-1.036 3.565c-.342 1.179-1.592 2.138-2.786 2.138l-4.957.01h-3.61z"
+        fill="#F0FF41" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/continue.png b/public/providers/continue.png
deleted file mode 100644
index f54685be8d..0000000000
Binary files a/public/providers/continue.png and /dev/null differ
diff --git a/public/providers/continue.svg b/public/providers/continue.svg
new file mode 100644
index 0000000000..e9f56c259e
--- /dev/null
+++ b/public/providers/continue.svg
@@ -0,0 +1 @@
+<svg width="300" height="300" viewBox="0 0 300 300" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M300 150C300 67.1573 232.843 0 150 0C67.1573 0 0 67.1573 0 150C0 232.843 67.1573 300 150 300C232.843 300 300 232.843 300 150Z" fill="#F3F3F3"/><path d="M206.97 92.7966L197.78 108.729L221.009 148.932C221.179 149.237 221.281 149.61 221.281 149.949C221.281 150.288 221.179 150.661 221.009 150.966L197.78 191.203L206.97 207.136L240 149.949L206.97 92.7627V92.7966ZM194.219 106.661L203.409 90.7288H185.029L175.839 106.661H194.253H194.219ZM175.805 110.797L197.271 147.915H215.651L194.219 110.797H175.805ZM194.219 189.169L215.651 152.017H197.271L175.805 189.169H194.219ZM175.805 193.305L184.995 209.169H203.375L194.185 193.305H175.771H175.805ZM113.509 213.102C113.136 213.102 112.797 213 112.492 212.83C112.186 212.661 111.915 212.39 111.745 212.085L88.4819 171.847H70.1017L103.132 229H169.158L159.968 213.102H113.543H113.509ZM163.529 211.034L172.719 226.932L181.909 211L172.719 195.068L163.529 211V211.034ZM169.158 193.034H126.294L117.104 208.966H159.968L169.158 193.034ZM122.699 191L101.233 153.847L92.0427 169.78L113.509 206.932L122.699 191ZM70.0678 167.712H88.448L97.6381 151.78H79.2918L70.0678 167.712ZM111.644 87.9491C111.813 87.6441 112.085 87.3729 112.39 87.2034C112.695 87.0339 113.068 86.9322 113.407 86.9322H159.9L169.09 71H103.03L70 128.186H88.3802L111.576 87.9831L111.644 87.9491ZM97.6381 148.22L88.448 132.288H70.0678L79.2579 148.22H97.6381ZM113.441 93.1017L92.0088 130.22L101.199 146.153L122.631 109.034L113.441 93.1017ZM159.934 91.0339H117.002L126.192 106.966H169.124L159.934 91.0339ZM172.719 104.898L181.875 89L172.719 73.0678L163.529 88.9661L172.719 104.898Z" fill="#33333B"/></svg>
diff --git a/public/providers/copilot.png b/public/providers/copilot.png
deleted file mode 100644
index 9907963e40..0000000000
Binary files a/public/providers/copilot.png and /dev/null differ
diff --git a/public/providers/copilot.svg b/public/providers/copilot.svg
new file mode 100644
index 0000000000..5426933b61
--- /dev/null
+++ b/public/providers/copilot.svg
@@ -0,0 +1 @@
+<svg height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Copilot</title><path d="M17.533 1.829A2.528 2.528 0 0015.11 0h-.737a2.531 2.531 0 00-2.484 2.087l-1.263 6.937.314-1.08a2.528 2.528 0 012.424-1.833h4.284l1.797.706 1.731-.706h-.505a2.528 2.528 0 01-2.423-1.829l-.715-2.453z" fill="url(#lobe-icons-copilot-0-_R_0_)" transform="translate(0 1)"></path><path d="M6.726 20.16A2.528 2.528 0 009.152 22h1.566c1.37 0 2.49-1.1 2.525-2.48l.17-6.69-.357 1.228a2.528 2.528 0 01-2.423 1.83h-4.32l-1.54-.842-1.667.843h.497c1.124 0 2.113.75 2.426 1.84l.697 2.432z" fill="url(#lobe-icons-copilot-1-_R_0_)" transform="translate(0 1)"></path><path d="M15 0H6.252c-2.5 0-4 3.331-5 6.662-1.184 3.947-2.734 9.225 1.75 9.225H6.78c1.13 0 2.12-.753 2.43-1.847.657-2.317 1.809-6.359 2.713-9.436.46-1.563.842-2.906 1.43-3.742A1.97 1.97 0 0115 0" fill="url(#lobe-icons-copilot-2-_R_0_)" transform="translate(0 1)"></path><path d="M15 0H6.252c-2.5 0-4 3.331-5 6.662-1.184 3.947-2.734 9.225 1.75 9.225H6.78c1.13 0 2.12-.753 2.43-1.847.657-2.317 1.809-6.359 2.713-9.436.46-1.563.842-2.906 1.43-3.742A1.97 1.97 0 0115 0" fill="url(#lobe-icons-copilot-3-_R_0_)" transform="translate(0 1)"></path><path d="M9 22h8.749c2.5 0 4-3.332 5-6.663 1.184-3.948 2.734-9.227-1.75-9.227H17.22c-1.129 0-2.12.754-2.43 1.848a1149.2 1149.2 0 01-2.713 9.437c-.46 1.564-.842 2.907-1.43 3.743A1.97 1.97 0 019 22" fill="url(#lobe-icons-copilot-4-_R_0_)" transform="translate(0 1)"></path><path d="M9 22h8.749c2.5 0 4-3.332 5-6.663 1.184-3.948 2.734-9.227-1.75-9.227H17.22c-1.129 0-2.12.754-2.43 1.848a1149.2 1149.2 0 01-2.713 9.437c-.46 1.564-.842 2.907-1.43 3.743A1.97 1.97 0 019 22" fill="url(#lobe-icons-copilot-5-_R_0_)" transform="translate(0 1)"></path><defs><radialGradient cx="85.44%" cy="100.653%" fx="85.44%" fy="100.653%" gradientTransform="scale(-.8553 -1) rotate(50.927 2.041 -1.946)" id="lobe-icons-copilot-0-_R_0_" r="105.116%"><stop offset="9.6%" stop-color="#00AEFF"></stop><stop offset="77.3%" stop-color="#2253CE"></stop><stop offset="100%" stop-color="#0736C4"></stop></radialGradient><radialGradient cx="18.143%" cy="32.928%" fx="18.143%" fy="32.928%" gradientTransform="scale(.8897 1) rotate(52.069 .193 .352)" id="lobe-icons-copilot-1-_R_0_" r="95.612%"><stop offset="0%" stop-color="#FFB657"></stop><stop offset="63.4%" stop-color="#FF5F3D"></stop><stop offset="92.3%" stop-color="#C02B3C"></stop></radialGradient><radialGradient cx="82.987%" cy="-9.792%" fx="82.987%" fy="-9.792%" gradientTransform="scale(-1 -.9441) rotate(-70.872 .142 1.17)" id="lobe-icons-copilot-4-_R_0_" r="140.622%"><stop offset="6.6%" stop-color="#8C48FF"></stop><stop offset="50%" stop-color="#F2598A"></stop><stop offset="89.6%" stop-color="#FFB152"></stop></radialGradient><linearGradient id="lobe-icons-copilot-2-_R_0_" x1="39.465%" x2="46.884%" y1="12.117%" y2="103.774%"><stop offset="15.6%" stop-color="#0D91E1"></stop><stop offset="48.7%" stop-color="#52B471"></stop><stop offset="65.2%" stop-color="#98BD42"></stop><stop offset="93.7%" stop-color="#FFC800"></stop></linearGradient><linearGradient id="lobe-icons-copilot-3-_R_0_" x1="45.949%" x2="50%" y1="0%" y2="100%"><stop offset="0%" stop-color="#3DCBFF"></stop><stop offset="24.7%" stop-color="#0588F7" stop-opacity="0"></stop></linearGradient><linearGradient id="lobe-icons-copilot-5-_R_0_" x1="83.507%" x2="83.453%" y1="-6.106%" y2="21.131%"><stop offset="5.8%" stop-color="#F8ADFA"></stop><stop offset="70.8%" stop-color="#A86EDD" stop-opacity="0"></stop></linearGradient></defs></svg>
\ No newline at end of file
diff --git a/public/providers/crof.svg b/public/providers/crof.svg
new file mode 100644
index 0000000000..53daa56ab6
--- /dev/null
+++ b/public/providers/crof.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>CroF</title>
+  <circle cx="12" cy="12" r="12" fill="#0891B2"/>
+  <text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui">C</text>
+</svg>
diff --git a/public/providers/cursor.png b/public/providers/cursor.png
deleted file mode 100644
index ec02b070ba..0000000000
Binary files a/public/providers/cursor.png and /dev/null differ
diff --git a/public/providers/cursor.svg b/public/providers/cursor.svg
new file mode 100644
index 0000000000..10d50ca847
--- /dev/null
+++ b/public/providers/cursor.svg
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg id="Ebene_1" xmlns="http://www.w3.org/2000/svg" version="1.1" viewBox="0 0 466.73 532.09">
+  <!-- Generator: Adobe Illustrator 29.6.1, SVG Export Plug-In . SVG Version: 2.1.1 Build 9)  -->
+  <defs>
+    <style>
+      .st0 {
+        fill: #edecec;
+      }
+    </style>
+  </defs>
+  <path class="st0" d="M457.43,125.94L244.42,2.96c-6.84-3.95-15.28-3.95-22.12,0L9.3,125.94c-5.75,3.32-9.3,9.46-9.3,16.11v247.99c0,6.65,3.55,12.79,9.3,16.11l213.01,122.98c6.84,3.95,15.28,3.95,22.12,0l213.01-122.98c5.75-3.32,9.3-9.46,9.3-16.11v-247.99c0-6.65-3.55-12.79-9.3-16.11h-.01ZM444.05,151.99l-205.63,356.16c-1.39,2.4-5.06,1.42-5.06-1.36v-233.21c0-4.66-2.49-8.97-6.53-11.31L24.87,145.67c-2.4-1.39-1.42-5.06,1.36-5.06h411.26c5.84,0,9.49,6.33,6.57,11.39h-.01Z"/>
+</svg>
\ No newline at end of file
diff --git a/public/providers/deepgram.png b/public/providers/deepgram.png
deleted file mode 100644
index 6bee16b860..0000000000
--- a/public/providers/deepgram.png
+++ /dev/null
@@ -1,52 +0,0 @@
-
-    <html>
-      <head>
-        <title>404</title>
-        <style>
-          @font-face {
-            font-family: 'colfax-web';
-            font-display: swap;
-            src: url('https://www.datocms.com/fonts/colfax-web-regular.woff2') format('woff2'), url('https://www.datocms.com/fonts/colfax-web-regular.woff') format('woff');
-          }
-
-          @font-face {
-            font-family: 'colfax-web';
-            font-display: swap;
-            font-weight: 700;
-            src: url('https://www.datocms.com/fonts/colfax-web-bold.woff2') format('woff2'), url('https://www.datocms.com/fonts/colfax-web-bold.woff') format('woff');
-          }
-
-          * {
-            margin: 0;
-          }
-
-          body {
-            box-sizing: border-box;
-            font-family: colfax;
-            display: grid;
-            align-items: center;
-            justify-content: center;
-            height: 100%;
-            text-align: center;
-            padding: 20px;
-          }
-
-          main {
-            display: flex;
-            flex-direction: column;
-            gap: 30px;
-          }
-
-          h1 {
-            font-size: 50px;
-          }
-        </style>
-      </head>
-      <body>
-        <main>
-          <h1>404</h1>
-          <p>Not Found</p>
-        </main>
-      </body>
-    </html>
-  
\ No newline at end of file
diff --git a/public/providers/deepgram.svg b/public/providers/deepgram.svg
new file mode 100644
index 0000000000..988a37743f
--- /dev/null
+++ b/public/providers/deepgram.svg
@@ -0,0 +1 @@
+<svg fill="#13EF93" role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Deepgram</title><path d="M11.203 24H1.517a.364.364 0 0 1-.258-.62l6.239-6.275a.366.366 0 0 1 .259-.108h3.52c2.723 0 5.025-2.127 5.107-4.845a5.004 5.004 0 0 0-4.999-5.148H7.613v4.646c0 .2-.164.364-.365.364H.968a.365.365 0 0 1-.363-.364V.364C.605.164.768 0 .969 0h10.416c6.684 0 12.111 5.485 12.01 12.187C23.293 18.77 17.794 24 11.202 24z"/></svg>
\ No newline at end of file
diff --git a/public/providers/deepinfra.svg b/public/providers/deepinfra.svg
new file mode 100644
index 0000000000..458107109c
--- /dev/null
+++ b/public/providers/deepinfra.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>DeepInfra</title>
+  <path d="M3.294 7.821A2.297 2.297 0 011 5.527a2.297 2.297 0 012.294-2.295A2.297 2.297 0 015.59 5.527 2.297 2.297 0 013.294 7.82zm0-3.688a1.396 1.396 0 000 2.79 1.396 1.396 0 000-2.79zM3.294 14.293A2.297 2.297 0 011 11.998a2.297 2.297 0 012.294-2.294 2.297 2.297 0 012.295 2.294 2.297 2.297 0 01-2.295 2.295zm0-3.688a1.395 1.395 0 000 2.788 1.395 1.395 0 100-2.788zM3.294 20.761A2.297 2.297 0 011 18.467a2.297 2.297 0 012.294-2.295 2.297 2.297 0 012.295 2.295 2.297 2.297 0 01-2.295 2.294zm0-3.688a1.396 1.396 0 000 2.79 1.396 1.396 0 000-2.79zM20.738 7.821a2.297 2.297 0 01-2.295-2.294 2.297 2.297 0 012.294-2.295 2.297 2.297 0 012.295 2.295 2.297 2.297 0 01-2.294 2.294zm0-3.688a1.396 1.396 0 101.395 1.395c0-.77-.626-1.395-1.395-1.395zM20.738 14.293a2.297 2.297 0 01-2.295-2.295 2.297 2.297 0 012.294-2.294 2.297 2.297 0 012.295 2.294 2.297 2.297 0 01-2.294 2.295zm0-3.688c-.769 0-1.395.625-1.395 1.393a1.396 1.396 0 002.79 0c0-.77-.626-1.393-1.395-1.393zM20.738 20.761a2.297 2.297 0 01-2.295-2.294 2.297 2.297 0 012.294-2.295 2.297 2.297 0 012.295 2.295 2.297 2.297 0 01-2.294 2.294zm0-3.688a1.396 1.396 0 101.395 1.395c0-.77-.626-1.395-1.395-1.395zM12.016 11.057a2.297 2.297 0 01-2.294-2.294 2.297 2.297 0 012.294-2.295 2.297 2.297 0 012.295 2.295 2.297 2.297 0 01-2.295 2.294zm0-3.688a1.396 1.396 0 101.395 1.395c0-.77-.625-1.395-1.395-1.395zM12.017 4.589a2.297 2.297 0 01-2.295-2.295A2.297 2.297 0 0112.017 0a2.297 2.297 0 012.294 2.294 2.297 2.297 0 01-2.294 2.295zm0-3.688a1.396 1.396 0 101.395 1.395c0-.77-.626-1.395-1.395-1.395zM12.017 17.529a2.297 2.297 0 01-2.295-2.295 2.297 2.297 0 012.295-2.294 2.297 2.297 0 012.294 2.294 2.297 2.297 0 01-2.294 2.295zm0-3.688a1.396 1.396 0 101.395 1.395c0-.77-.626-1.395-1.395-1.395zM12.016 24a2.297 2.297 0 01-2.294-2.295 2.297 2.297 0 012.294-2.294 2.297 2.297 0 012.295 2.294A2.297 2.297 0 0112.016 24zm0-3.688a1.396 1.396 0 101.395 1.395c0-.77-.625-1.395-1.395-1.395z"
+        fill="#2A3275" />
+  <path d="M8.363 8.222a.742.742 0 01-.277-.053l-1.494-.596a.75.75 0 11.557-1.392l1.493.595a.75.75 0 01-.278 1.446h-.001zM8.363 14.566a.743.743 0 01-.277-.053l-1.494-.595a.75.75 0 11.557-1.393l1.493.596a.75.75 0 01-.278 1.445h-.001zM17.124 11.397a.741.741 0 01-.277-.054l-1.493-.595a.75.75 0 11.555-1.392l1.493.595a.75.75 0 01-.278 1.446zM17.124 5.05a.744.744 0 01-.277-.054L15.354 4.4a.75.75 0 01.555-1.392l1.493.596a.75.75 0 01-.278 1.445zM17.124 17.739a.743.743 0 01-.277-.053l-1.494-.596a.75.75 0 11.556-1.392l1.493.596a.75.75 0 01-.278 1.445zM6.91 17.966a.75.75 0 01-.279-1.445l1.494-.595a.749.749 0 11.556 1.392l-1.493.595a.743.743 0 01-.277.053H6.91zM6.91 11.66a.75.75 0 01-.279-1.446l1.494-.595a.75.75 0 01.556 1.392l-1.493.595a.743.743 0 01-.277.053H6.91zM6.91 5.033a.75.75 0 01-.279-1.446l1.494-.595a.75.75 0 01.556 1.392l-1.493.596a.744.744 0 01-.277.053H6.91zM8.363 21.364a.743.743 0 01-.277-.053l-1.494-.596a.75.75 0 01.555-1.392l1.494.595a.75.75 0 01-.278 1.446zM15.63 8.223a.75.75 0 01-.278-1.447l1.494-.595a.75.75 0 01.556 1.393l-1.494.595a.744.744 0 01-.276.054h-.002zM15.63 14.567a.75.75 0 01-.278-1.446l1.494-.596a.75.75 0 01.556 1.394l-1.494.595a.743.743 0 01-.276.053h-.002zM15.63 21.363a.749.749 0 01-.278-1.445l1.494-.595a.75.75 0 11.555 1.392l-1.494.595a.741.741 0 01-.277.053z"
+        fill="#5699DB" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/deepseek.svg b/public/providers/deepseek.svg
new file mode 100644
index 0000000000..abf56cfecb
--- /dev/null
+++ b/public/providers/deepseek.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>DeepSeek</title>
+  <path d="M23.748 4.482c-.254-.124-.364.113-.512.234-.051.039-.094.09-.137.136-.372.397-.806.657-1.373.626-.829-.046-1.537.214-2.163.848-.133-.782-.575-1.248-1.247-1.548-.352-.156-.708-.311-.955-.65-.172-.241-.219-.51-.305-.774-.055-.16-.11-.323-.293-.35-.2-.031-.278.136-.356.276-.313.572-.434 1.202-.422 1.84.027 1.436.633 2.58 1.838 3.393.137.093.172.187.129.323-.082.28-.18.552-.266.833-.055.179-.137.217-.329.14a5.526 5.526 0 01-1.736-1.18c-.857-.828-1.631-1.742-2.597-2.458a11.365 11.365 0 00-.689-.471c-.985-.957.13-1.743.388-1.836.27-.098.093-.432-.779-.428-.872.004-1.67.295-2.687.684a3.055 3.055 0 01-.465.137 9.597 9.597 0 00-2.883-.102c-1.885.21-3.39 1.102-4.497 2.623C.082 8.606-.231 10.684.152 12.85c.403 2.284 1.569 4.175 3.36 5.653 1.858 1.533 3.997 2.284 6.438 2.14 1.482-.085 3.133-.284 4.994-1.86.47.234.962.327 1.78.397.63.059 1.236-.03 1.705-.128.735-.156.684-.837.419-.961-2.155-1.004-1.682-.595-2.113-.926 1.096-1.296 2.746-2.642 3.392-7.003.05-.347.007-.565 0-.845-.004-.17.035-.237.23-.256a4.173 4.173 0 001.545-.475c1.396-.763 1.96-2.015 2.093-3.517.02-.23-.004-.467-.247-.588zM11.581 18c-2.089-1.642-3.102-2.183-3.52-2.16-.392.024-.321.471-.235.763.09.288.207.486.371.739.114.167.192.416-.113.603-.673.416-1.842-.14-1.897-.167-1.361-.802-2.5-1.86-3.301-3.307-.774-1.393-1.224-2.887-1.298-4.482-.02-.386.093-.522.477-.592a4.696 4.696 0 011.529-.039c2.132.312 3.946 1.265 5.468 2.774.868.86 1.525 1.887 2.202 2.891.72 1.066 1.494 2.082 2.48 2.914.348.292.625.514.891.677-.802.09-2.14.11-3.054-.614zm1-6.44a.306.306 0 01.415-.287.302.302 0 01.2.288.306.306 0 01-.31.307.303.303 0 01-.304-.308zm3.11 1.596c-.2.081-.399.151-.59.16a1.245 1.245 0 01-.798-.254c-.274-.23-.47-.358-.552-.758a1.73 1.73 0 01.016-.588c.07-.327-.008-.537-.239-.727-.187-.156-.426-.199-.688-.199a.559.559 0 01-.254-.078c-.11-.054-.2-.19-.114-.358.028-.054.16-.186.192-.21.356-.202.767-.136 1.146.016.352.144.618.408 1.001.782.391.451.462.576.685.914.176.265.336.537.445.848.067.195-.019.354-.25.452z"
+        fill="#4D6BFE" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/dgrid.svg b/public/providers/dgrid.svg
new file mode 100644
index 0000000000..3d0dd7645f
--- /dev/null
+++ b/public/providers/dgrid.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>dgrid</title>
+  <circle cx="12" cy="12" r="12" fill="#4338CA"/>
+  <text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui">D</text>
+</svg>
diff --git a/public/providers/dify.svg b/public/providers/dify.svg
index 80be2e3447..4cea903478 100644
--- a/public/providers/dify.svg
+++ b/public/providers/dify.svg
@@ -1,5 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
-  <circle cx="16" cy="16" r="14" fill="#6366F1" opacity="0.15"/>
-  <circle cx="16" cy="16" r="14" fill="none" stroke="#6366F1" stroke-width="2"/>
-  <text x="16" y="16" text-anchor="middle" dominant-baseline="central" font-family="system-ui,-apple-system,sans-serif" font-size="11" font-weight="600" fill="#6366F1">DF</text>
-</svg>
+<svg height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Dify</title><path d="M7.043 6.487c1.635 0 2.241-1.003 2.241-2.243S8.681 2 7.044 2C5.405 2 4.801 3.003 4.801 4.244c0 1.24.604 2.243 2.241 2.243z" fill="#03F"></path><path d="M14.883 6.97v1.443h-3.679v3.203h3.68v8.012H8.801V8.41h-8v3.203h4.48v8.012H0v3.203h24v-3.203h-5.6v-8.012H24V8.41h-5.6V5.206H24V2.003h-4.161a4.97 4.97 0 00-4.961 4.967h.005z" fill="#03F"></path></svg>
\ No newline at end of file
diff --git a/public/providers/digitalocean.svg b/public/providers/digitalocean.svg
new file mode 100644
index 0000000000..b80ff01e7b
--- /dev/null
+++ b/public/providers/digitalocean.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>DigitalOcean</title>
+  <path d="M12 3C12 3 22 13 22 17.5C22 21.5 17.5 22 12 22C6.5 22 2 21.5 2 17.5C2 13 12 3 12 3Z" fill="#0080FF"/>
+</svg>
diff --git a/public/providers/dit.svg b/public/providers/dit.svg
new file mode 100644
index 0000000000..d7bc1452df
--- /dev/null
+++ b/public/providers/dit.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Dit</title>
+  <circle cx="12" cy="12" r="12" fill="#7C3AED"/>
+  <text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui">D</text>
+</svg>
diff --git a/public/providers/doubao.svg b/public/providers/doubao.svg
index 4317871d38..e2511454cf 100644
--- a/public/providers/doubao.svg
+++ b/public/providers/doubao.svg
@@ -1,5 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
-  <circle cx="16" cy="16" r="14" fill="#FE2C55" opacity="0.15"/>
-  <circle cx="16" cy="16" r="14" fill="none" stroke="#FE2C55" stroke-width="2"/>
-  <text x="16" y="16" text-anchor="middle" dominant-baseline="central" font-family="system-ui,-apple-system,sans-serif" font-size="11" font-weight="600" fill="#FE2C55">DB</text>
-</svg>
+<svg height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Doubao</title><path d="M5.31 15.756c.172-3.75 1.883-5.999 2.549-6.739-3.26 2.058-5.425 5.658-6.358 8.308v1.12C1.501 21.513 4.226 24 7.59 24a6.59 6.59 0 002.2-.375c.353-.12.7-.248 1.039-.378.913-.899 1.65-1.91 2.243-2.992-4.877 2.431-7.974.072-7.763-4.5l.002.001z" fill="#1E37FC"></path><path d="M22.57 10.283c-1.212-.901-4.109-2.404-7.397-2.8.295 3.792.093 8.766-2.1 12.773a12.782 12.782 0 01-2.244 2.992c3.764-1.448 6.746-3.457 8.596-5.219 2.82-2.683 3.353-5.178 3.361-6.66a2.737 2.737 0 00-.216-1.084v-.002z" fill="#37E1BE"></path><path d="M14.303 1.867C12.955.7 11.248 0 9.39 0 7.532 0 5.883.677 4.545 1.807 2.791 3.29 1.627 5.557 1.5 8.125v9.201c.932-2.65 3.097-6.25 6.357-8.307.5-.318 1.025-.595 1.569-.829 1.883-.801 3.878-.932 5.746-.706-.222-2.83-.718-5.002-.87-5.617h.001z" fill="#A569FF"></path><path d="M17.305 4.961a199.47 199.47 0 01-1.08-1.094c-.202-.213-.398-.419-.586-.622l-1.333-1.378c.151.615.648 2.786.869 5.617 3.288.395 6.185 1.898 7.396 2.8-1.306-1.275-3.475-3.487-5.266-5.323z" fill="#1E37FC"></path></svg>
\ No newline at end of file
diff --git a/public/providers/duckduckgo-web.svg b/public/providers/duckduckgo-web.svg
new file mode 100644
index 0000000000..0b41e7d21c
--- /dev/null
+++ b/public/providers/duckduckgo-web.svg
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>DuckDuckGo</title>
+  <circle cx="12" cy="12" r="12" fill="#DE5833"/>
+  <g transform="scale(0.1875)">
+    <path fill="#fff" d="M73 111.75c0-.5.123-.614-1.467-3.782-4.224-8.459-8.469-20.384-6.538-28.075.352-1.397-3.979-51.744-7.04-53.365-3.403-1.813-7.59-4.69-11.419-5.33-1.943-.31-4.49-.164-6.482.105-.354.047-.368.684-.03.798 1.307.443 2.895 1.212 3.83 2.375.178.22-.06.566-.342.577-.882.032-2.482.402-4.593 2.195-.244.207-.042.592.273.53 4.536-.897 9.17-.455 11.9 2.027.177.16.084.45-.147.512-23.694 6.44-19.004 27.05-12.696 52.344 5.619 22.53 7.733 29.792 8.4 32.004a.718.718 0 0 0 .423.467C55.228 118.38 73 118.524 73 113z"/>
+    <path fill="#14307e" d="M75.5 59c-3.5 0-6.5-3-6.5-6.5s3-6.5 6.5-6.5 6.5 3 6.5 6.5-3 6.5-6.5 6.5z"/>
+  </g>
+</svg>
diff --git a/public/providers/elevenlabs.svg b/public/providers/elevenlabs.svg
new file mode 100644
index 0000000000..d44617dbde
--- /dev/null
+++ b/public/providers/elevenlabs.svg
@@ -0,0 +1 @@
+<svg fill="#000000" role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>ElevenLabs</title><path d="M4.6035 0v24h4.9317V0zm9.8613 0v24h4.9317V0z"/></svg>
\ No newline at end of file
diff --git a/public/providers/exa.svg b/public/providers/exa.svg
new file mode 100644
index 0000000000..bc9f73e106
--- /dev/null
+++ b/public/providers/exa.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Exa</title>
+  <path clip-rule="evenodd"
+        d="M3 0h19v1.791L13.892 12 22 22.209V24H3V0zm9.62 10.348l6.589-8.557H6.03l6.59 8.557zM5.138 3.935v7.17h5.52l-5.52-7.17zm5.52 8.96h-5.52v7.17l5.52-7.17zM6.03 22.21l6.59-8.557 6.589 8.557H6.03z"
+        fill="#1F40ED"
+        fill-rule="evenodd" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/factory.svg b/public/providers/factory.svg
new file mode 100644
index 0000000000..9a78626d2b
--- /dev/null
+++ b/public/providers/factory.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none">
+  <title>Factory</title>
+  <circle cx="12" cy="12" r="12" fill="#F97316"/>
+  <text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui">F</text>
+</svg>
diff --git a/public/providers/fal.svg b/public/providers/fal.svg
new file mode 100644
index 0000000000..0e54aaf865
--- /dev/null
+++ b/public/providers/fal.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Fal</title>
+  <path clip-rule="evenodd"
+        d="M15.477 0c.415 0 .749.338.788.752a7.775 7.775 0 006.985 6.984c.413.04.752.373.752.788v6.952c0 .415-.338.748-.752.788a7.775 7.775 0 00-6.985 6.984c-.04.414-.373.752-.788.752H8.525c-.416 0-.749-.338-.789-.752a7.775 7.775 0 00-6.984-6.984c-.414-.04-.752-.373-.752-.788V8.524c0-.415.338-.748.752-.788A7.775 7.775 0 007.736.752C7.776.338 8.11 0 8.526 0h6.95zM4.819 11.98a7.226 7.226 0 007.223 7.23 7.226 7.226 0 007.223-7.23c0-3.994-3.234-7.23-7.223-7.23a7.227 7.227 0 00-7.223 7.23z"
+        fill="#EC0648"
+        fill-rule="evenodd" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/fireworks.svg b/public/providers/fireworks.svg
new file mode 100644
index 0000000000..946ee079af
--- /dev/null
+++ b/public/providers/fireworks.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Fireworks</title>
+  <path clip-rule="evenodd"
+        d="M14.8 5l-2.801 6.795L9.195 5H7.397l3.072 7.428a1.64 1.64 0 003.038.002L16.598 5H14.8zm1.196 10.352l5.124-5.244-.699-1.669-5.596 5.739a1.664 1.664 0 00-.343 1.807 1.642 1.642 0 001.516 1.012L16 17l8-.02-.699-1.669-7.303.041h-.002zM2.88 10.104l.699-1.669 5.596 5.739c.468.479.603 1.189.343 1.807a1.643 1.643 0 01-1.516 1.012l-8-.018-.002.002.699-1.669 7.303.042-5.122-5.246z"
+        fill="#5019C5"
+        fill-rule="evenodd" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/freeaiapikey.svg b/public/providers/freeaiapikey.svg
new file mode 100644
index 0000000000..8e5b7f1214
--- /dev/null
+++ b/public/providers/freeaiapikey.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>FreeAIAPIKey</title>
+  <circle cx="12" cy="12" r="12" fill="#059669"/>
+  <text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui">K</text>
+</svg>
diff --git a/public/providers/freemodel-dev.svg b/public/providers/freemodel-dev.svg
new file mode 100644
index 0000000000..c155e808ad
--- /dev/null
+++ b/public/providers/freemodel-dev.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>FreeModel Dev</title>
+  <circle cx="12" cy="12" r="12" fill="#3B82F6"/>
+  <text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui">M</text>
+</svg>
diff --git a/public/providers/friendli.svg b/public/providers/friendli.svg
new file mode 100644
index 0000000000..7da5293002
--- /dev/null
+++ b/public/providers/friendli.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" fill-rule="evenodd">
+  <title>Friendli</title>
+  <path d="M3.675 7.386A3.684 3.684 0 007.35 3.693 3.684 3.684 0 003.675 0 3.684 3.684 0 000 3.693a3.684 3.684 0 003.675 3.693zm0 16.614a3.683 3.683 0 003.675-3.693 3.684 3.684 0 00-3.675-3.693A3.683 3.683 0 000 20.307 3.684 3.684 0 003.675 24z" />
+  <path d="M10.338 7.2a8.002 8.002 0 011.146-.114h2.037a2.14 2.14 0 002.136-2.139V2.44c0-1.179-.96-2.139-2.136-2.139h-2.484a2.14 2.14 0 00-2.136 2.14l-.08 1.487a8.001 8.001 0 01-.12.9 5.2 5.2 0 01-.487 1.38s-.327.627-.753 1.068a5 5 0 01-.327.306l-.219.18a4.4 4.4 0 01-1.779.786c-.285.06-.939.066-1.206.072H2.433c-1.179 0-2.136.96-2.136 2.148v2.5c0 1.187.96 2.147 2.136 2.147h2.544a2.15 2.15 0 002.136-2.148v-1.794c-.02-.62.021-1.773.567-2.547.34-.48.88-.906.972-.98a3.58 3.58 0 01.798-.487c.087-.039.36-.147.885-.246V7.2h.003z" />
+  <path d="M21.897.3H19.28c-1.146 0-2.07.927-2.07 2.073V4.14s0 1.227-.3 2.14c-.321.905-1.131 1.727-1.944 2.027-.951.348-2.064.3-2.631.3h-1.59a2.07 2.07 0 00-2.064 2.073v2.634c0 1.146.924 2.073 2.064 2.073h2.622a2.07 2.07 0 002.064-2.073l.02-1.1c-.011-.409.028-1.249.226-1.86.072-.229.219-.649.552-1.108.24-.327.474-.534.71-.753.433-.387.799-.612.9-.666.22-.132.6-.36 1.138-.528.48-.147.84-.174 1.452-.213.36-.027.858-.039 1.458-.006 1.146 0 2.07-.927 2.07-2.073V2.373A2.07 2.07 0 0021.888.3h.009z" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/galadriel.svg b/public/providers/galadriel.svg
new file mode 100644
index 0000000000..70e1a2134f
--- /dev/null
+++ b/public/providers/galadriel.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Galadriel</title>
+  <circle cx="12" cy="12" r="12" fill="#7C3AED"/>
+  <text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui">G</text>
+</svg>
diff --git a/public/providers/gemini.svg b/public/providers/gemini.svg
new file mode 100644
index 0000000000..f8d7189dc6
--- /dev/null
+++ b/public/providers/gemini.svg
@@ -0,0 +1 @@
+<svg viewBox="0 0 296 298" xmlns="http://www.w3.org/2000/svg" width="296" height="298" fill="none"><mask id="a" width="296" height="298" x="0" y="0" maskUnits="userSpaceOnUse" style="mask-type:alpha"><path fill="#3186FF" d="M141.201 4.886c2.282-6.17 11.042-6.071 13.184.148l5.985 17.37a184.004 184.004 0 0 0 111.257 113.049l19.304 6.997c6.143 2.227 6.156 10.91.02 13.155l-19.35 7.082a184.001 184.001 0 0 0-109.495 109.385l-7.573 20.629c-2.241 6.105-10.869 6.121-13.133.025l-7.908-21.296a184 184 0 0 0-109.02-108.658l-19.698-7.239c-6.102-2.243-6.118-10.867-.025-13.132l20.083-7.467A183.998 183.998 0 0 0 133.291 26.28l7.91-21.394Z"/></mask><g mask="url(#a)"><g filter="url(#b)"><ellipse cx="163" cy="149" fill="#3689FF" rx="196" ry="159"/></g><g filter="url(#c)"><ellipse cx="33.5" cy="142.5" fill="#F6C013" rx="68.5" ry="72.5"/></g><g filter="url(#d)"><ellipse cx="19.5" cy="148.5" fill="#F6C013" rx="68.5" ry="72.5"/></g><g filter="url(#e)"><path fill="#FA4340" d="M194 10.5C172 82.5 65.5 134.333 22.5 135L144-66l50 76.5Z"/></g><g filter="url(#f)"><path fill="#FA4340" d="M190.5-12.5C168.5 59.5 62 111.333 19 112L140.5-89l50 76.5Z"/></g><g filter="url(#g)"><path fill="#14BB69" d="M194.5 279.5C172.5 207.5 66 155.667 23 155l121.5 201 50-76.5Z"/></g><g filter="url(#h)"><path fill="#14BB69" d="M196.5 320.5C174.5 248.5 68 196.667 25 196l121.5 201 50-76.5Z"/></g></g><defs><filter id="b" width="464" height="390" x="-69" y="-46" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_69_17998" stdDeviation="18"/></filter><filter id="c" width="265" height="273" x="-99" y="6" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_69_17998" stdDeviation="32"/></filter><filter id="d" width="265" height="273" x="-113" y="12" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_69_17998" stdDeviation="32"/></filter><filter id="e" width="299.5" height="329" x="-41.5" y="-130" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_69_17998" stdDeviation="32"/></filter><filter id="f" width="299.5" height="329" x="-45" y="-153" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_69_17998" stdDeviation="32"/></filter><filter id="g" width="299.5" height="329" x="-41" y="91" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_69_17998" stdDeviation="32"/></filter><filter id="h" width="299.5" height="329" x="-39" y="132" color-interpolation-filters="sRGB" filterUnits="userSpaceOnUse"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape"/><feGaussianBlur result="effect1_foregroundBlur_69_17998" stdDeviation="32"/></filter></defs></svg>
\ No newline at end of file
diff --git a/public/providers/gitlawb-gmi.svg b/public/providers/gitlawb-gmi.svg
new file mode 100644
index 0000000000..c04b268655
--- /dev/null
+++ b/public/providers/gitlawb-gmi.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>GitLawb GMI</title><circle cx="12" cy="12" r="12" fill="#475569"/><text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui">G</text></svg>
diff --git a/public/providers/gitlawb.svg b/public/providers/gitlawb.svg
new file mode 100644
index 0000000000..1b06a8c500
--- /dev/null
+++ b/public/providers/gitlawb.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>GitLawb</title>
+  <circle cx="12" cy="12" r="12" fill="#374151"/>
+  <text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui">G</text>
+</svg>
diff --git a/public/providers/google.svg b/public/providers/google.svg
new file mode 100644
index 0000000000..2f69df7189
--- /dev/null
+++ b/public/providers/google.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Google</title>
+  <path d="M23 12.245c0-.905-.075-1.565-.236-2.25h-10.54v4.083h6.186c-.124 1.014-.797 2.542-2.294 3.569l-.021.136 3.332 2.53.23.022C21.779 18.417 23 15.593 23 12.245z"
+        fill="#4285F4" />
+  <path d="M12.225 23c3.03 0 5.574-.978 7.433-2.665l-3.542-2.688c-.948.648-2.22 1.1-3.891 1.1a6.745 6.745 0 01-6.386-4.572l-.132.011-3.465 2.628-.045.124C4.043 20.531 7.835 23 12.225 23z"
+        fill="#34A853" />
+  <path d="M5.84 14.175A6.65 6.65 0 015.463 12c0-.758.138-1.491.361-2.175l-.006-.147-3.508-2.67-.115.054A10.831 10.831 0 001 12c0 1.772.436 3.447 1.197 4.938l3.642-2.763z"
+        fill="#FBBC05" />
+  <path d="M12.225 5.253c2.108 0 3.529.892 4.34 1.638l3.167-3.031C17.787 2.088 15.255 1 12.225 1 7.834 1 4.043 3.469 2.197 7.062l3.63 2.763a6.77 6.77 0 016.398-4.572z"
+        fill="#EB4335" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/grok.svg b/public/providers/grok.svg
new file mode 100644
index 0000000000..7057a3bfa6
--- /dev/null
+++ b/public/providers/grok.svg
@@ -0,0 +1,4 @@
+<svg width="1024" height="1024" viewBox="0 0 1024 1024" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M395.479 633.828L735.91 381.105C752.599 368.715 776.454 373.548 784.406 392.792C826.26 494.285 807.561 616.253 724.288 699.996C641.016 783.739 525.151 802.104 419.247 760.277L303.556 814.143C469.49 928.202 670.987 899.995 796.901 773.282C896.776 672.843 927.708 535.937 898.785 412.476L899.047 412.739C857.105 231.37 909.358 158.874 1016.4 10.6326C1018.93 7.11771 1021.47 3.60279 1024 0L883.144 141.651V141.212L395.392 633.916" fill="white"/>
+<path d="M325.226 695.251C206.128 580.84 226.662 403.776 328.285 301.668C403.431 226.097 526.549 195.254 634.026 240.596L749.454 186.994C728.657 171.88 702.007 155.623 671.424 144.2C533.19 86.9942 367.693 115.465 255.323 228.382C147.234 337.081 113.244 504.215 171.613 646.833C215.216 753.423 143.739 828.818 71.7385 904.916C46.2237 931.893 20.6216 958.87 0 987.429L325.139 695.339" fill="white"/>
+</svg>
diff --git a/public/providers/groq.svg b/public/providers/groq.svg
new file mode 100644
index 0000000000..cf90d287b1
--- /dev/null
+++ b/public/providers/groq.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 201 201"><path fill="#F54F35" d="M0 0h201v201H0V0Z"/><path fill="#FEFBFB" d="m128 49 1.895 1.52C136.336 56.288 140.602 64.49 142 73c.097 1.823.148 3.648.161 5.474l.03 3.247.012 3.482.017 3.613c.01 2.522.016 5.044.02 7.565.01 3.84.041 7.68.072 11.521.007 2.455.012 4.91.016 7.364l.038 3.457c-.033 11.717-3.373 21.83-11.475 30.547-4.552 4.23-9.148 7.372-14.891 9.73l-2.387 1.055c-9.275 3.355-20.3 2.397-29.379-1.13-5.016-2.38-9.156-5.17-13.234-8.925 3.678-4.526 7.41-8.394 12-12l3.063 2.375c5.572 3.958 11.135 5.211 17.937 4.625 6.96-1.384 12.455-4.502 17-10 4.174-6.784 4.59-12.222 4.531-20.094l.012-3.473c.003-2.414-.005-4.827-.022-7.241-.02-3.68 0-7.36.026-11.04-.003-2.353-.008-4.705-.016-7.058l.025-3.312c-.098-7.996-1.732-13.21-6.681-19.47-6.786-5.458-13.105-8.211-21.914-7.792-7.327 1.188-13.278 4.7-17.777 10.601C75.472 72.012 73.86 78.07 75 85c2.191 7.547 5.019 13.948 12 18 5.848 3.061 10.892 3.523 17.438 3.688l2.794.103c2.256.082 4.512.147 6.768.209v16c-16.682.673-29.615.654-42.852-10.848-8.28-8.296-13.338-19.55-13.71-31.277.394-9.87 3.93-17.894 9.562-25.875l1.688-2.563C84.698 35.563 110.05 34.436 128 49Z"/></svg>
\ No newline at end of file
diff --git a/public/providers/hackclub.svg b/public/providers/hackclub.svg
new file mode 100644
index 0000000000..86c07e144f
--- /dev/null
+++ b/public/providers/hackclub.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Hack Club</title>
+  <rect x="2" y="2" width="20" height="20" rx="4" fill="#ec3750"/>
+  <path d="M7 5v14h2V5H7zm3 3l6 4-6 4V8z" fill="#fff"/>
+</svg>
diff --git a/public/providers/haiper.svg b/public/providers/haiper.svg
new file mode 100644
index 0000000000..edc59b0e0a
--- /dev/null
+++ b/public/providers/haiper.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="24" height="24">
+  <title>Haiper</title>
+  <path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm-1.5 14.5h-2v-9h2v3.5h3V7.5h2v9h-2v-3.5h-3v3.5z" fill="#7C3AED"/>
+</svg>
\ No newline at end of file
diff --git a/public/providers/hcnsec.svg b/public/providers/hcnsec.svg
new file mode 100644
index 0000000000..5778c1200f
--- /dev/null
+++ b/public/providers/hcnsec.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>HCNsec</title>
+  <circle cx="12" cy="12" r="12" fill="#DC2626"/>
+  <text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui">H</text>
+</svg>
diff --git a/public/providers/heroku.png b/public/providers/heroku.png
deleted file mode 100644
index b96cb3f6a7..0000000000
Binary files a/public/providers/heroku.png and /dev/null differ
diff --git a/public/providers/heroku.svg b/public/providers/heroku.svg
new file mode 100644
index 0000000000..6089d6f2c2
--- /dev/null
+++ b/public/providers/heroku.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 284.4">
+  <path fill="#430098" d="M230 0c14 0 26 11 26 25v234c0 14-11 25-25 25H26c-14 0-26-11-26-25V26C0 12 11 0 25 0h1zm0 14H26c-7 0-12 5-12 11v234c0 6 5 11 11 11h205c7 0 12-5 12-11V26c0-7-5-12-12-12zM64 185l32 28-32 29zM92 43v80c15-4 34-9 54-9 17 0 28 7 34 12 12 13 12 28 12 30v86h-28v-85c-1-7-4-15-18-15-29 0-61 14-62 15l-20 9V43zm100 0c-2 16-8 31-21 46h-29c11-15 18-30 22-46z"/>
+</svg>
diff --git a/public/providers/huggingchat.svg b/public/providers/huggingchat.svg
index 30a8cef613..dc1cf3ffb7 100644
--- a/public/providers/huggingchat.svg
+++ b/public/providers/huggingchat.svg
@@ -1,5 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
-  <circle cx="16" cy="16" r="14" fill="#FFD21E" opacity="0.15"/>
-  <circle cx="16" cy="16" r="14" fill="none" stroke="#FFD21E" stroke-width="2"/>
-  <text x="16" y="16" text-anchor="middle" dominant-baseline="central" font-family="system-ui,-apple-system,sans-serif" font-size="11" font-weight="600" fill="#FFD21E">HC</text>
-</svg>
+<svg height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>HuggingFace</title><path d="M2.25 11.535c0-3.407 1.847-6.554 4.844-8.258a9.822 9.822 0 019.687 0c2.997 1.704 4.844 4.851 4.844 8.258 0 5.266-4.337 9.535-9.687 9.535S2.25 16.8 2.25 11.535z" fill="#FF9D0B"></path><path d="M11.938 20.086c4.797 0 8.687-3.829 8.687-8.551 0-4.722-3.89-8.55-8.687-8.55-4.798 0-8.688 3.828-8.688 8.55 0 4.722 3.89 8.55 8.688 8.55z" fill="#FFD21E"></path><path d="M11.875 15.113c2.457 0 3.25-2.156 3.25-3.263 0-.576-.393-.394-1.023-.089-.582.283-1.365.675-2.224.675-1.798 0-3.25-1.693-3.25-.586 0 1.107.79 3.263 3.25 3.263h-.003z" fill="#FF323D"></path><path d="M14.76 9.21c.32.108.445.753.767.585.447-.233.707-.708.659-1.204a1.235 1.235 0 00-.879-1.059 1.262 1.262 0 00-1.33.394c-.322.384-.377.92-.14 1.36.153.283.638-.177.925-.079l-.002.003zm-5.887 0c-.32.108-.448.753-.768.585a1.226 1.226 0 01-.658-1.204c.048-.495.395-.913.878-1.059a1.262 1.262 0 011.33.394c.322.384.377.92.14 1.36-.152.283-.64-.177-.925-.079l.003.003zm1.12 5.34a2.166 2.166 0 011.325-1.106c.07-.02.144.06.219.171l.192.306c.069.1.139.175.209.175.074 0 .15-.074.223-.172l.205-.302c.08-.11.157-.188.234-.165.537.168.986.536 1.25 1.026.932-.724 1.275-1.905 1.275-2.633 0-.508-.306-.426-.81-.19l-.616.296c-.52.24-1.148.48-1.824.48-.676 0-1.302-.24-1.823-.48l-.589-.283c-.52-.248-.838-.342-.838.177 0 .703.32 1.831 1.187 2.56l.18.14z" fill="#3A3B45"></path><path d="M17.812 10.366a.806.806 0 00.813-.8c0-.441-.364-.8-.813-.8a.806.806 0 00-.812.8c0 .442.364.8.812.8zm-11.624 0a.806.806 0 00.812-.8c0-.441-.364-.8-.812-.8a.806.806 0 00-.813.8c0 .442.364.8.813.8zM4.515 13.073c-.405 0-.765.162-1.017.46a1.455 1.455 0 00-.333.925 1.801 1.801 0 00-.485-.074c-.387 0-.737.146-.985.409a1.41 1.41 0 00-.2 1.722 1.302 1.302 0 00-.447.694c-.06.222-.12.69.2 1.166a1.267 1.267 0 00-.093 1.236c.238.533.81.958 1.89 1.405l.24.096c.768.3 1.473.492 1.478.494.89.243 1.808.375 2.732.394 1.465 0 2.513-.443 3.115-1.314.93-1.342.842-2.575-.274-3.763l-.151-.154c-.692-.684-1.155-1.69-1.25-1.912-.195-.655-.71-1.383-1.562-1.383-.46.007-.889.233-1.15.605-.25-.31-.495-.553-.715-.694a1.87 1.87 0 00-.993-.312zm14.97 0c.405 0 .767.162 1.017.46.216.262.333.588.333.925.158-.047.322-.071.487-.074.388 0 .738.146.985.409a1.41 1.41 0 01.2 1.722c.22.178.377.422.445.694.06.222.12.69-.2 1.166.244.37.279.836.093 1.236-.238.533-.81.958-1.889 1.405l-.239.096c-.77.3-1.475.492-1.48.494-.89.243-1.808.375-2.732.394-1.465 0-2.513-.443-3.115-1.314-.93-1.342-.842-2.575.274-3.763l.151-.154c.695-.684 1.157-1.69 1.252-1.912.195-.655.708-1.383 1.56-1.383.46.007.889.233 1.15.605.25-.31.495-.553.718-.694.244-.162.523-.265.814-.3l.176-.012z" fill="#FF9D0B"></path><path d="M9.785 20.132c.688-.994.638-1.74-.305-2.667-.945-.928-1.495-2.288-1.495-2.288s-.205-.788-.672-.714c-.468.074-.81 1.25.17 1.971.977.721-.195 1.21-.573.534-.375-.677-1.405-2.416-1.94-2.751-.532-.332-.907-.148-.782.541.125.687 2.357 2.35 2.14 2.707-.218.362-.983-.42-.983-.42S2.953 14.9 2.43 15.46c-.52.558.398 1.026 1.7 1.803 1.308.778 1.41.985 1.225 1.28-.187.295-3.07-2.1-3.34-1.083-.27 1.011 2.943 1.304 2.745 2.006-.2.7-2.265-1.324-2.685-.537-.425.79 2.913 1.718 2.94 1.725 1.075.276 3.813.859 4.77-.522zm4.432 0c-.687-.994-.64-1.74.305-2.667.943-.928 1.493-2.288 1.493-2.288s.205-.788.675-.714c.465.074.807 1.25-.17 1.971-.98.721.195 1.21.57.534.377-.677 1.407-2.416 1.94-2.751.532-.332.91-.148.782.541-.125.687-2.355 2.35-2.137 2.707.215.362.98-.42.98-.42S21.05 14.9 21.57 15.46c.52.558-.395 1.026-1.7 1.803-1.308.778-1.408.985-1.225 1.28.187.295 3.07-2.1 3.34-1.083.27 1.011-2.94 1.304-2.743 2.006.2.7 2.263-1.324 2.685-.537.423.79-2.912 1.718-2.94 1.725-1.077.276-3.815.859-4.77-.522z" fill="#FFD21E"></path></svg>
\ No newline at end of file
diff --git a/public/providers/huggingface.svg b/public/providers/huggingface.svg
new file mode 100644
index 0000000000..c141ab811a
--- /dev/null
+++ b/public/providers/huggingface.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>HuggingFace</title>
+  <path d="M2.25 11.535c0-3.407 1.847-6.554 4.844-8.258a9.822 9.822 0 019.687 0c2.997 1.704 4.844 4.851 4.844 8.258 0 5.266-4.337 9.535-9.687 9.535S2.25 16.8 2.25 11.535z"
+        fill="#FF9D0B" />
+  <path d="M11.938 20.086c4.797 0 8.687-3.829 8.687-8.551 0-4.722-3.89-8.55-8.687-8.55-4.798 0-8.688 3.828-8.688 8.55 0 4.722 3.89 8.55 8.688 8.55z"
+        fill="#FFD21E" />
+  <path d="M11.875 15.113c2.457 0 3.25-2.156 3.25-3.263 0-.576-.393-.394-1.023-.089-.582.283-1.365.675-2.224.675-1.798 0-3.25-1.693-3.25-.586 0 1.107.79 3.263 3.25 3.263h-.003z"
+        fill="#FF323D" />
+  <path d="M14.76 9.21c.32.108.445.753.767.585.447-.233.707-.708.659-1.204a1.235 1.235 0 00-.879-1.059 1.262 1.262 0 00-1.33.394c-.322.384-.377.92-.14 1.36.153.283.638-.177.925-.079l-.002.003zm-5.887 0c-.32.108-.448.753-.768.585a1.226 1.226 0 01-.658-1.204c.048-.495.395-.913.878-1.059a1.262 1.262 0 011.33.394c.322.384.377.92.14 1.36-.152.283-.64-.177-.925-.079l.003.003zm1.12 5.34a2.166 2.166 0 011.325-1.106c.07-.02.144.06.219.171l.192.306c.069.1.139.175.209.175.074 0 .15-.074.223-.172l.205-.302c.08-.11.157-.188.234-.165.537.168.986.536 1.25 1.026.932-.724 1.275-1.905 1.275-2.633 0-.508-.306-.426-.81-.19l-.616.296c-.52.24-1.148.48-1.824.48-.676 0-1.302-.24-1.823-.48l-.589-.283c-.52-.248-.838-.342-.838.177 0 .703.32 1.831 1.187 2.56l.18.14z"
+        fill="#3A3B45" />
+  <path d="M17.812 10.366a.806.806 0 00.813-.8c0-.441-.364-.8-.813-.8a.806.806 0 00-.812.8c0 .442.364.8.812.8zm-11.624 0a.806.806 0 00.812-.8c0-.441-.364-.8-.812-.8a.806.806 0 00-.813.8c0 .442.364.8.813.8zM4.515 13.073c-.405 0-.765.162-1.017.46a1.455 1.455 0 00-.333.925 1.801 1.801 0 00-.485-.074c-.387 0-.737.146-.985.409a1.41 1.41 0 00-.2 1.722 1.302 1.302 0 00-.447.694c-.06.222-.12.69.2 1.166a1.267 1.267 0 00-.093 1.236c.238.533.81.958 1.89 1.405l.24.096c.768.3 1.473.492 1.478.494.89.243 1.808.375 2.732.394 1.465 0 2.513-.443 3.115-1.314.93-1.342.842-2.575-.274-3.763l-.151-.154c-.692-.684-1.155-1.69-1.25-1.912-.195-.655-.71-1.383-1.562-1.383-.46.007-.889.233-1.15.605-.25-.31-.495-.553-.715-.694a1.87 1.87 0 00-.993-.312zm14.97 0c.405 0 .767.162 1.017.46.216.262.333.588.333.925.158-.047.322-.071.487-.074.388 0 .738.146.985.409a1.41 1.41 0 01.2 1.722c.22.178.377.422.445.694.06.222.12.69-.2 1.166.244.37.279.836.093 1.236-.238.533-.81.958-1.889 1.405l-.239.096c-.77.3-1.475.492-1.48.494-.89.243-1.808.375-2.732.394-1.465 0-2.513-.443-3.115-1.314-.93-1.342-.842-2.575.274-3.763l.151-.154c.695-.684 1.157-1.69 1.252-1.912.195-.655.708-1.383 1.56-1.383.46.007.889.233 1.15.605.25-.31.495-.553.718-.694.244-.162.523-.265.814-.3l.176-.012z"
+        fill="#FF9D0B" />
+  <path d="M9.785 20.132c.688-.994.638-1.74-.305-2.667-.945-.928-1.495-2.288-1.495-2.288s-.205-.788-.672-.714c-.468.074-.81 1.25.17 1.971.977.721-.195 1.21-.573.534-.375-.677-1.405-2.416-1.94-2.751-.532-.332-.907-.148-.782.541.125.687 2.357 2.35 2.14 2.707-.218.362-.983-.42-.983-.42S2.953 14.9 2.43 15.46c-.52.558.398 1.026 1.7 1.803 1.308.778 1.41.985 1.225 1.28-.187.295-3.07-2.1-3.34-1.083-.27 1.011 2.943 1.304 2.745 2.006-.2.7-2.265-1.324-2.685-.537-.425.79 2.913 1.718 2.94 1.725 1.075.276 3.813.859 4.77-.522zm4.432 0c-.687-.994-.64-1.74.305-2.667.943-.928 1.493-2.288 1.493-2.288s.205-.788.675-.714c.465.074.807 1.25-.17 1.971-.98.721.195 1.21.57.534.377-.677 1.407-2.416 1.94-2.751.532-.332.91-.148.782.541-.125.687-2.355 2.35-2.137 2.707.215.362.98-.42.98-.42S21.05 14.9 21.57 15.46c.52.558-.395 1.026-1.7 1.803-1.308.778-1.408.985-1.225 1.28.187.295 3.07-2.1 3.34-1.083.27 1.011-2.94 1.304-2.743 2.006.2.7 2.263-1.324 2.685-.537.423.79-2.912 1.718-2.94 1.725-1.077.276-3.815.859-4.77-.522z"
+        fill="#FFD21E" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/hyperbolic.svg b/public/providers/hyperbolic.svg
new file mode 100644
index 0000000000..591eb157ba
--- /dev/null
+++ b/public/providers/hyperbolic.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Hyperbolic</title>
+  <path d="M.193 19.503a2.413 2.413 0 00-.186.925c0 1.317 1.112 2.518 2.95 3.437a1.337 1.337 0 001.838-.738l2.049-4.93c.359-.857.642-1.745.846-2.652-3.795.637-6.656 2.092-7.448 3.872l-.032.076-.017.01zm7.49-11.047a15.981 15.981 0 00-.846-2.653L4.79.873a1.34 1.34 0 00-1.84-.738C1.112 1.054 0 2.256 0 3.573c0 .317.064.631.186.924v.01l.032.077c.81 1.78 3.67 3.234 7.466 3.872zM21.049.136c1.838.918 2.95 2.12 2.95 3.436a2.454 2.454 0 01-.196.925l-.027.063c-.785 1.792-3.653 3.254-7.46 3.896.204-.907.487-1.795.846-2.653L19.21.873a1.337 1.337 0 011.839-.738zm-4.722 15.409c.201.906.48 1.793.837 2.65l2.048 4.932a1.338 1.338 0 001.838.738c1.839-.92 2.951-2.12 2.951-3.437a2.446 2.446 0 00-.186-.925l-.027-.062c-.782-1.792-3.66-3.256-7.46-3.896zm-.129-6.04c2.695-.415 4.935-1.223 6.48-2.278L22.24 8.28a9.755 9.755 0 000 7.437l.435 1.048c-1.547-1.055-3.787-1.855-6.479-2.275l-.07-.01A27.196 27.196 0 0012 14.172c-1.377-.002-2.752.1-4.114.307l-.071.01c-2.693.413-4.933 1.222-6.48 2.277l.437-1.05a9.755 9.755 0 000-7.437l-.437-1.052c1.54 1.06 3.78 1.863 6.473 2.278l.071.01c2.734.407 5.513.407 8.246 0l.071-.01z"
+        fill="#594CE9" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/ibm.svg b/public/providers/ibm.svg
new file mode 100644
index 0000000000..36fe5889dd
--- /dev/null
+++ b/public/providers/ibm.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 400">
+  <path fill="#1f70c1" d="M0 0v27.367h194.648V0H0zm222.226 0v27.367h277.383S471.276 0 433.75 0H222.226zm331.797 0v27.367h167.812L711.875 0H554.023zm288.125 0-9.961 27.367h166.289V0H842.148zM0 53.222v27.367h194.648V53.222H0zm222.226.039V80.59h309.57s-3.615-21.063-9.922-27.329H222.226zm331.797 0V80.59h186.211l-9.219-27.329H554.023zm268.203 0-9.219 27.329h185.469V53.261h-176.25zM55.937 106.444v27.406h84.297v-27.406H55.937zm222.227 0v27.406h84.297v-27.406h-84.297zm166.289 0v27.406h84.297s5.352-14.473 5.352-27.406h-89.649zm165.508 0v27.406h149.453l-9.961-27.406H609.961zm193.906 0-10 27.406h150.195v-27.406H803.867zm-747.93 53.262v27.367h84.297v-27.367H55.937zm222.227 0v27.367h215.312s18.012-14.042 23.75-27.367H278.164zm331.797 0v27.367h84.297v-15.234l5.352 15.234h154.414l5.742-15.234v15.234h84.297v-27.367H785.82l-8.398 23.18-8.438-23.18H609.961zM55.937 212.928v27.367h84.297v-27.367H55.937zm222.227 0v27.367h239.062c-5.739-13.281-23.75-27.367-23.75-27.367H278.164zm331.797 0v27.367h84.297v-27.367h-84.297zm99.609 0 10.195 27.367h115.781l9.688-27.367H709.57zm150.195 0v27.367h84.297v-27.367h-84.297zM55.937 266.15v27.366h84.297V266.15H55.937zm222.227 0v27.366h84.297V266.15h-84.297zm166.289 0v27.366h89.648c0-12.915-5.352-27.366-5.352-27.366h-84.296zm165.508 0v27.366h84.297V266.15h-84.297zm118.75 0 9.883 27.366h77.617l9.961-27.366h-97.461zm131.054 0v27.366h84.297V266.15h-84.297zM1.523 319.372v27.406h194.648v-27.406H1.523zm220.703 0v27.406h299.648c6.307-6.275 9.922-27.406 9.922-27.406h-309.57zm333.321 0v27.406h138.711v-27.406H555.547zm192.343 0 10.156 27.406h39.492l9.531-27.406H747.89zm111.875 0v27.406H1000v-27.406H859.765zM1.523 372.633V400h194.648v-27.367H1.523zm220.703 0v27.328H433.75c37.526 0 65.859-27.328 65.859-27.328H222.226zm333.321 0V400h138.711v-27.367H555.547zm211.601 0 9.766 27.29 1.68.038 9.922-27.328h-21.368zm92.617 0V400H1000v-27.367H859.765z"/>
+</svg>
diff --git a/public/providers/ideogram.svg b/public/providers/ideogram.svg
new file mode 100644
index 0000000000..0af6ace536
--- /dev/null
+++ b/public/providers/ideogram.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="24" height="24">
+  <title>Ideogram</title>
+  <defs>
+    <linearGradient id="ig" x1="0" y1="0" x2="24" y2="24" gradientUnits="userSpaceOnUse">
+      <stop offset="0%" stop-color="#7C3AED"/>
+      <stop offset="100%" stop-color="#06B6D4"/>
+    </linearGradient>
+  </defs>
+  <path d="M6 3h12v3h-4v12h4v3H6v-3h4V6H6Z" fill="url(#ig)"/>
+</svg>
\ No newline at end of file
diff --git a/public/providers/iflytek.svg b/public/providers/iflytek.svg
index bad262efe4..4962d9e161 100644
--- a/public/providers/iflytek.svg
+++ b/public/providers/iflytek.svg
@@ -1,5 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
-  <circle cx="16" cy="16" r="14" fill="#0066FF" opacity="0.15"/>
-  <circle cx="16" cy="16" r="14" fill="none" stroke="#0066FF" stroke-width="2"/>
-  <text x="16" y="16" text-anchor="middle" dominant-baseline="central" font-family="system-ui,-apple-system,sans-serif" font-size="11" font-weight="600" fill="#0066FF">IF</text>
-</svg>
+<svg height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>iFlyTekCloud</title><path d="M20.713 6.655c-.414-1.426-1.748-2.472-3.357-2.472a3.62 3.62 0 00-1.7.423C14.62 3.046 12.804 2 10.735 2 7.77 2 5.31 4.16 4.943 6.944 2.138 7.39 0 9.728 0 12.58c0 3.14 2.62 5.68 5.862 5.68 1.61 0 3.08-.646 4.138-1.671.276-.267.529-.557.736-.89a5.02 5.02 0 01-.713.845 8.998 8.998 0 00-1.77 5.39V22a16.682 16.682 0 018.666-2.717h.046c3.035 0 5.633-1.871 6.621-4.499A6.599 6.599 0 0024 12.445c0-2.427-1.31-4.565-3.287-5.79zM6.966 12.869a.836.836 0 01-.851.824.81.81 0 01-.805-.824v-2.183a.81.81 0 01.805-.824c.46 0 .85.379.85.824v2.183zm3.011 1.069a.86.86 0 01-.874.846.86.86 0 01-.873-.846v-4.9a.86.86 0 01.873-.846.86.86 0 01.874.846v4.9zm3.104-1.047c0 .445-.414.824-.874.824s-.85-.379-.85-.824v-2.227c0-.446.367-.824.85-.824.46 0 .873.378.873.824v2.227zm3.149 1.069a.86.86 0 01-.874.846.86.86 0 01-.873-.846v-4.9a.86.86 0 01.873-.846.86.86 0 01.874.846v4.9zm3.08-1.091a.836.836 0 01-.85.824.81.81 0 01-.805-.824v-2.183a.81.81 0 01.805-.824c.46 0 .85.379.85.824v2.183z" fill="#2A80E2"></path></svg>
\ No newline at end of file
diff --git a/public/providers/inference.svg b/public/providers/inference.svg
new file mode 100644
index 0000000000..b53e8e4616
--- /dev/null
+++ b/public/providers/inference.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" fill-rule="evenodd">
+  <title>Inference</title>
+  <path d="M22 21.376h-4.89V2.62H22v18.756zM14.532 21.376h-3.469V2.62h3.469v18.756zM8.764 21.376h-2.66V2.62h2.66v18.756zM3.903 21.376H2V2.62h1.903v18.756z" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/kenari.svg b/public/providers/kenari.svg
new file mode 100644
index 0000000000..454237a527
--- /dev/null
+++ b/public/providers/kenari.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Kenari</title>
+  <circle cx="12" cy="12" r="12" fill="#D97706"/>
+  <text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui">K</text>
+</svg>
diff --git a/public/providers/kimi.svg b/public/providers/kimi.svg
new file mode 100644
index 0000000000..ec12852549
--- /dev/null
+++ b/public/providers/kimi.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Kimi</title>
+  <path d="M21.846 0a1.923 1.923 0 110 3.846H20.15a.226.226 0 01-.227-.226V1.923C19.923.861 20.784 0 21.846 0z"
+        fill="#1783FF" />
+  <path d="M11.065 11.199l7.257-7.2c.137-.136.06-.41-.116-.41H14.3a.164.164 0 00-.117.051l-7.82 7.756c-.122.12-.302.013-.302-.179V3.82c0-.127-.083-.23-.185-.23H3.186c-.103 0-.186.103-.186.23V19.77c0 .128.083.23.186.23h2.69c.103 0 .186-.102.186-.23v-3.25c0-.069.025-.135.069-.178l2.424-2.406a.158.158 0 01.205-.023l6.484 4.772a7.677 7.677 0 003.453 1.283c.108.012.2-.095.2-.23v-3.06c0-.117-.07-.212-.164-.227a5.028 5.028 0 01-2.027-.807l-5.613-4.064c-.117-.078-.132-.279-.028-.381z"
+        fill="#fff" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/kiro.svg b/public/providers/kiro.svg
index 83e2845fbf..0c651b9747 100644
--- a/public/providers/kiro.svg
+++ b/public/providers/kiro.svg
@@ -1 +1 @@
-<svg viewBox="0 0 1200 1200" fill="none" xmlns="http://www.w3.org/2000/svg"><rect width="1200" height="1200" rx="260" fill="#9046ff"/><mask id="a" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="272" y="202" width="655" height="796"><path d="M926.578 202.793H272.637v795.064h653.941z" fill="#fff"/></mask><g mask="url(#a)"><path d="M398.554 818.914c-82.239 182.116 92.923 227.826 222.118 121.242 38.015 119.504 180.38 30.317 231.562-62.361 112.553-204.228 67.084-412.438 55.406-455.421-80.003-292.931-480.017-293.428-548.84 1.491-16.149 51.679-16.398 110.315-25.342 171.186-4.472 30.809-7.951 50.437-19.628 82.734-6.957 18.639-16.15 35.034-31.057 62.86-22.858 43.236-13.169 126.468 105.097 83.238l11.181-4.969z" fill="#fff"/><path d="M636.123 549.353c-32.795 0-37.764-39.256-37.764-62.611 0-21.119 3.727-37.765 10.934-48.449 6.211-9.441 15.404-14.162 26.83-14.162 11.432 0 21.369 4.721 28.324 14.41 7.951 10.933 12.176 27.579 12.176 48.201 0 39.256-15.152 62.611-40.248 62.611zm135.117 0c-32.795 0-37.763-39.256-37.763-62.611 0-21.119 3.726-37.765 10.933-48.449 6.211-9.441 15.404-14.162 26.83-14.162 11.432 0 21.369 4.721 28.324 14.41 7.952 10.933 12.176 27.579 12.176 48.201 0 39.256-15.152 62.611-40.248 62.611z" fill="#000"/></g></svg>
\ No newline at end of file
+<svg height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Kiro</title><path d="M18.8 0H5.2A5.2 5.2 0 000 5.2v13.6A5.2 5.2 0 005.2 24h13.6a5.2 5.2 0 005.2-5.2V5.2A5.2 5.2 0 0018.8 0z" fill="#9046FF"></path><path d="M7.97 16.376c-1.644 3.642 1.86 4.556 4.443 2.424.76 2.39 3.608.607 4.631-1.247 2.251-4.084 1.342-8.249 1.108-9.108-1.6-5.859-9.6-5.869-10.976.03-.323 1.033-.328 2.206-.507 3.423-.09.617-.16 1.009-.393 1.655-.139.373-.323.7-.62 1.257-.458.865-.264 2.53 2.101 1.665l.224-.1h-.01l-.001.001z" fill="#fff"></path><path d="M12.722 10.985c-.656 0-.755-.785-.755-1.252 0-.423.074-.756.218-.97a.61.61 0 01.537-.283c.229 0 .428.095.567.289.159.218.243.55.243.964 0 .785-.303 1.252-.805 1.252h-.005zm2.703 0c-.656 0-.755-.785-.755-1.252 0-.423.074-.756.219-.97a.61.61 0 01.536-.283c.229 0 .428.095.567.289.159.218.243.55.243.964 0 .785-.303 1.252-.805 1.252h-.005z" fill="#000"></path></svg>
\ No newline at end of file
diff --git a/public/providers/lambda.svg b/public/providers/lambda.svg
new file mode 100644
index 0000000000..be9061029b
--- /dev/null
+++ b/public/providers/lambda.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" fill-rule="evenodd">
+  <title>Lambda</title>
+  <path d="M2 2h20v20H2V2zm1.768 18.237h16.459V3.761H3.768v16.476zm3.515-14.91l3.479 6.176-3.871 7.154h2.493l2.58-4.883 2.747 4.883h2.54L9.82 5.324l-2.538.002z" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/leonardo.svg b/public/providers/leonardo.svg
new file mode 100644
index 0000000000..9975016453
--- /dev/null
+++ b/public/providers/leonardo.svg
@@ -0,0 +1 @@
+<svg fill="currentColor" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Leonardo AI</title><path d="M3.3616 10.0592C1.8676 10.9218 1.8676 13.0782 3.3616 13.9408L14.6384 20.4514C16.1324 21.314 18 20.2358 18 19.5107L18 5.4893C18 3.7642 16.1324 2.686 14.6384 3.5485L3.3616 10.0592Z"/></svg>
\ No newline at end of file
diff --git a/public/providers/letta.png b/public/providers/letta.png
new file mode 100644
index 0000000000..100759b999
Binary files /dev/null and b/public/providers/letta.png differ
diff --git a/public/providers/llm7.svg b/public/providers/llm7.svg
new file mode 100644
index 0000000000..d60ff2c7d9
--- /dev/null
+++ b/public/providers/llm7.svg
@@ -0,0 +1 @@
+<svg fill="#7C3AED" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>LLM7</title><circle cx="12" cy="12" r="12"/><text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui">7</text></svg>
diff --git a/public/providers/longcat.svg b/public/providers/longcat.svg
new file mode 100644
index 0000000000..6c05c8ecc2
--- /dev/null
+++ b/public/providers/longcat.svg
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor">
+  <title>LongCat</title>
+  <path clip-rule="evenodd"
+        d="M.507 19.883a.507.507 0 01-.489-.642L4.29 3.745a1.013 1.013 0 011.533-.578l5.622 3.687a1.013 1.013 0 001.11 0L18.2 3.165a1.013 1.013 0 011.532.58l4.25 15.497a.506.506 0 01-.49.64H18.07a6.297 6.297 0 001.53-4.115v-.177a6.09 6.09 0 00-1.513-4.017l-.697-3.495a.438.438 0 00-.694-.266L14.07 9.781a.748.748 0 01-.654.121 5.156 5.156 0 00-2.833 0 .746.746 0 01-.653-.121L7.302 7.81a.435.435 0 00-.688.269l-.675 3.652a5.36 5.36 0 00-1.539 3.76v.333c0 1.474.527 2.9 1.488 4.02l.032.038H.507z"
+        fill="#29E154"
+        fill-rule="evenodd" />
+  <path d="M9.213 16.843h1.52v-3.546h-1.29l-.23 3.546zm5.573 0h-1.52v-3.546h1.29l.23 3.546z" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/meta.svg b/public/providers/meta.svg
new file mode 100644
index 0000000000..45c34b10e5
--- /dev/null
+++ b/public/providers/meta.svg
@@ -0,0 +1,121 @@
+<svg
+      viewBox="0 0 24 24"
+      xmlns="http://www.w3.org/2000/svg"
+    >
+      <title>Meta</title>
+      <path
+        d="M6.897 4h-.024l-.031 2.615h.022c1.715 0 3.046 1.357 5.94 6.246l.175.297.012.02 1.62-2.438-.012-.019a48.763 48.763 0 00-1.098-1.716 28.01 28.01 0 00-1.175-1.629C10.413 4.932 8.812 4 6.896 4z"
+        fill="url(#grad-a)"
+      />
+      <path
+        d="M6.873 4C4.95 4.01 3.247 5.258 2.02 7.17a4.352 4.352 0 00-.01.017l2.254 1.231.011-.017c.718-1.083 1.61-1.774 2.568-1.785h.021L6.896 4h-.023z"
+        fill="url(#grad-b)"
+      />
+      <path
+        d="M2.019 7.17l-.011.017C1.2 8.447.598 9.995.274 11.664l-.005.022 2.534.6.004-.022c.27-1.467.786-2.828 1.456-3.845l.011-.017L2.02 7.17z"
+        fill="url(#grad-c)"
+      />
+      <path
+        d="M2.807 12.264l-2.533-.6-.005.022c-.177.918-.267 1.851-.269 2.786v.023l2.598.233v-.023a12.591 12.591 0 01.21-2.44z"
+        fill="url(#grad-d)"
+      />
+      <path
+        d="M2.677 15.537a5.462 5.462 0 01-.079-.813v-.022L0 14.468v.024a8.89 8.89 0 00.146 1.652l2.535-.585a4.106 4.106 0 01-.004-.022z"
+        fill="url(#grad-e)"
+      />
+      <path
+        d="M3.27 16.89c-.284-.31-.484-.756-.589-1.328l-.004-.021-2.535.585.004.021c.192 1.01.568 1.85 1.106 2.487l.014.017 2.018-1.745a2.106 2.106 0 01-.015-.016z"
+        fill="url(#grad-f)"
+      />
+      <path
+        d="M10.78 9.654c-1.528 2.35-2.454 3.825-2.454 3.825-2.035 3.2-2.739 3.917-3.871 3.917a1.545 1.545 0 01-1.186-.508l-2.017 1.744.014.017C2.01 19.518 3.058 20 4.356 20c1.963 0 3.374-.928 5.884-5.33l1.766-3.13a41.283 41.283 0 00-1.227-1.886z"
+        fill="#0082FB"
+      />
+      <path
+        d="M13.502 5.946l-.016.016c-.4.43-.786.908-1.16 1.416.378.483.768 1.024 1.175 1.63.48-.743.928-1.345 1.367-1.807l.016-.016-1.382-1.24z"
+        fill="url(#grad-g)"
+      />
+      <path
+        d="M20.918 5.713C19.853 4.633 18.583 4 17.225 4c-1.432 0-2.637.787-3.723 1.944l-.016.016 1.382 1.24.016-.017c.715-.747 1.408-1.12 2.176-1.12.826 0 1.6.39 2.27 1.075l.015.016 1.589-1.425-.016-.016z"
+        fill="#0082FB"
+      />
+      <path
+        d="M23.998 14.125c-.06-3.467-1.27-6.566-3.064-8.396l-.016-.016-1.588 1.424.015.016c1.35 1.392 2.277 3.98 2.361 6.971v.023h2.292v-.022z"
+        fill="url(#grad-h)"
+      />
+      <path
+        d="M23.998 14.15v-.023h-2.292v.022c.004.14.006.282.006.424 0 .815-.121 1.474-.368 1.95l-.011.022 1.708 1.782.013-.02c.62-.96.946-2.293.946-3.91 0-.083 0-.165-.002-.247z"
+        fill="url(#grad-i)"
+      />
+      <path
+        d="M21.344 16.52l-.011.02c-.214.402-.519.67-.917.787l.778 2.462a3.493 3.493 0 00.438-.182 3.558 3.558 0 001.366-1.218l.044-.065.012-.02-1.71-1.784z"
+        fill="url(#grad-j)"
+      />
+      <path
+        d="M19.92 17.393c-.262 0-.492-.039-.718-.14l-.798 2.522c.449.153.927.222 1.46.222.492 0 .943-.073 1.352-.215l-.78-2.462c-.167.05-.341.075-.517.073z"
+        fill="url(#grad-k)"
+      />
+      <path
+        d="M18.323 16.534l-.014-.017-1.836 1.914.016.017c.637.682 1.246 1.105 1.937 1.337l.797-2.52c-.291-.125-.573-.353-.9-.731z"
+        fill="url(#grad-l)"
+      />
+      <path
+        d="M18.309 16.515c-.55-.642-1.232-1.712-2.303-3.44l-1.396-2.336-.011-.02-1.62 2.438.012.02.989 1.668c.959 1.61 1.74 2.774 2.493 3.585l.016.016 1.834-1.914a2.353 2.353 0 01-.014-.017z"
+        fill="url(#grad-m)"
+      />
+      <defs>
+        <linearGradient id="grad-a" x1="75.897%" x2="26.312%" y1="89.199%" y2="12.194%">
+          <stop offset=".06%" stop-color="#0867DF" />
+          <stop offset="45.39%" stop-color="#0668E1" />
+          <stop offset="85.91%" stop-color="#0064E0" />
+        </linearGradient>
+        <linearGradient id="grad-b" x1="21.67%" x2="97.068%" y1="75.874%" y2="23.985%">
+          <stop offset="13.23%" stop-color="#0064DF" />
+          <stop offset="99.88%" stop-color="#0064E0" />
+        </linearGradient>
+        <linearGradient id="grad-c" x1="38.263%" x2="60.895%" y1="89.127%" y2="16.131%">
+          <stop offset="1.47%" stop-color="#0072EC" />
+          <stop offset="68.81%" stop-color="#0064DF" />
+        </linearGradient>
+        <linearGradient id="grad-d" x1="47.032%" x2="52.15%" y1="90.19%" y2="15.745%">
+          <stop offset="7.31%" stop-color="#007CF6" />
+          <stop offset="99.43%" stop-color="#0072EC" />
+        </linearGradient>
+        <linearGradient id="grad-e" x1="52.155%" x2="47.591%" y1="58.301%" y2="37.004%">
+          <stop offset="7.31%" stop-color="#007FF9" />
+          <stop offset="100%" stop-color="#007CF6" />
+        </linearGradient>
+        <linearGradient id="grad-f" x1="37.689%" x2="61.961%" y1="12.502%" y2="63.624%">
+          <stop offset="7.31%" stop-color="#007FF9" />
+          <stop offset="100%" stop-color="#0082FB" />
+        </linearGradient>
+        <linearGradient id="grad-g" x1="34.808%" x2="62.313%" y1="68.859%" y2="23.174%">
+          <stop offset="27.99%" stop-color="#007FF8" />
+          <stop offset="91.41%" stop-color="#0082FB" />
+        </linearGradient>
+        <linearGradient id="grad-h" x1="43.762%" x2="57.602%" y1="6.235%" y2="98.514%">
+          <stop offset="0%" stop-color="#0082FB" />
+          <stop offset="99.95%" stop-color="#0081FA" />
+        </linearGradient>
+        <linearGradient id="grad-i" x1="60.055%" x2="39.88%" y1="4.661%" y2="69.077%">
+          <stop offset="6.19%" stop-color="#0081FA" />
+          <stop offset="100%" stop-color="#0080F9" />
+        </linearGradient>
+        <linearGradient id="grad-j" x1="30.282%" x2="61.081%" y1="59.32%" y2="33.244%">
+          <stop offset="0%" stop-color="#027AF3" />
+          <stop offset="100%" stop-color="#0080F9" />
+        </linearGradient>
+        <linearGradient id="grad-k" x1="20.433%" x2="82.112%" y1="50.001%" y2="50.001%">
+          <stop offset="0%" stop-color="#0377EF" />
+          <stop offset="99.94%" stop-color="#0279F1" />
+        </linearGradient>
+        <linearGradient id="grad-l" x1="40.303%" x2="72.394%" y1="35.298%" y2="57.811%">
+          <stop offset=".19%" stop-color="#0471E9" />
+          <stop offset="100%" stop-color="#0377EF" />
+        </linearGradient>
+        <linearGradient id="grad-m" x1="32.254%" x2="68.003%" y1="19.719%" y2="84.908%">
+          <stop offset="27.65%" stop-color="#0867DF" />
+          <stop offset="100%" stop-color="#0471E9" />
+        </linearGradient>
+      </defs>
+    </svg>
\ No newline at end of file
diff --git a/public/providers/metaai.svg b/public/providers/metaai.svg
new file mode 100644
index 0000000000..4d623976fd
--- /dev/null
+++ b/public/providers/metaai.svg
@@ -0,0 +1,49 @@
+<svg
+      viewBox="0 0 24 24"
+      xmlns="http://www.w3.org/2000/svg"
+    >
+      <title>MetaAI</title>
+      <g clipPath="" filter="">
+        <path
+          clip-rule="evenodd"
+          d="M12 0c6.627 0 12 5.373 12 12s-5.373 12-12 12S0 18.627 0 12 5.373 0 12 0zm0 3.627a8.373 8.373 0 100 16.746 8.373 8.373 0 000-16.746z"
+          fill="url(#grad-c)"
+          fill-rule="evenodd"
+        />
+      </g>
+      <defs>
+        <linearGradient gradientUnits="userSpaceOnUse" id="grad-c" x1="24" x2="0" y1="0" y2="24">
+          <stop offset=".13" stop-color="#FF97E3" />
+          <stop offset=".18" stop-color="#D14FE1" />
+          <stop offset=".338" stop-color="#0050E2" />
+          <stop offset=".666" stop-color="#0050E2" />
+          <stop offset=".809" stop-color="#00DDF4" />
+          <stop offset=".858" stop-color="#23F8CC" />
+        </linearGradient>
+        <clipPath id="grad-a">
+          <path d="M0 0h24v24H0z" fill="#fff" />
+        </clipPath>
+        <filter
+          color-interpolation-filters="sRGB"
+          filterUnits="userSpaceOnUse"
+          height="24"
+          id="grad-b"
+          width="24"
+          x="0"
+          y="0"
+        >
+          <feFlood flood-opacity="0" result="BackgroundImageFix" />
+          <feBlend in="SourceGraphic" in2="BackgroundImageFix" result="shape" />
+          <feColorMatrix
+            in="SourceAlpha"
+            result="hardAlpha"
+            values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"
+          />
+          <feOffset />
+          <feGaussianBlur stdDeviation=".75" />
+          <feComposite in2="hardAlpha" k2="-1" k3="1" operator="arithmetic" />
+          <feColorMatrix values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.5 0" />
+          <feBlend in2="shape" result="effect1_innerShadow_674_237" />
+        </filter>
+      </defs>
+    </svg>
\ No newline at end of file
diff --git a/public/providers/minimax.svg b/public/providers/minimax.svg
new file mode 100644
index 0000000000..b1b0a6a2df
--- /dev/null
+++ b/public/providers/minimax.svg
@@ -0,0 +1 @@
+<svg fill="#E73562" role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>MiniMax</title><path d="M11.43 3.92a.86.86 0 1 0-1.718 0v14.236a1.999 1.999 0 0 1-3.997 0V9.022a.86.86 0 1 0-1.718 0v3.87a1.999 1.999 0 0 1-3.997 0V11.49a.57.57 0 0 1 1.139 0v1.404a.86.86 0 0 0 1.719 0V9.022a1.999 1.999 0 0 1 3.997 0v9.134a.86.86 0 0 0 1.719 0V3.92a1.998 1.998 0 1 1 3.996 0v11.788a.57.57 0 1 1-1.139 0zm10.572 3.105a2 2 0 0 0-1.999 1.997v7.63a.86.86 0 0 1-1.718 0V3.923a1.999 1.999 0 0 0-3.997 0v16.16a.86.86 0 0 1-1.719 0V18.08a.57.57 0 1 0-1.138 0v2a1.998 1.998 0 0 0 3.996 0V3.92a.86.86 0 0 1 1.719 0v12.73a1.999 1.999 0 0 0 3.996 0V9.023a.86.86 0 1 1 1.72 0v6.686a.57.57 0 0 0 1.138 0V9.022a2 2 0 0 0-1.998-1.997"/></svg>
\ No newline at end of file
diff --git a/public/providers/mistral.svg b/public/providers/mistral.svg
new file mode 100644
index 0000000000..605b629a38
--- /dev/null
+++ b/public/providers/mistral.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Mistral</title>
+  <path d="M3.428 3.4h3.429v3.428H3.428V3.4zm13.714 0h3.43v3.428h-3.43V3.4z" fill="gold" />
+  <path d="M3.428 6.828h6.857v3.429H3.429V6.828zm10.286 0h6.857v3.429h-6.857V6.828z"
+        fill="#FFAF00" />
+  <path d="M3.428 10.258h17.144v3.428H3.428v-3.428z" fill="#FF8205" />
+  <path d="M3.428 13.686h3.429v3.428H3.428v-3.428zm6.858 0h3.429v3.428h-3.429v-3.428zm6.856 0h3.43v3.428h-3.43v-3.428z"
+        fill="#FA500F" />
+  <path d="M0 17.114h10.286v3.429H0v-3.429zm13.714 0H24v3.429H13.714v-3.429z" fill="#E10500" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/modelscope.svg b/public/providers/modelscope.svg
new file mode 100644
index 0000000000..6caef4bf44
--- /dev/null
+++ b/public/providers/modelscope.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>ModelScope</title>
+  <path d="M4 4v16h4V8l4 7 4-7v12h4V4h-4l-4 8L8 4H4z" fill="#624AFF"/>
+</svg>
diff --git a/public/providers/moonshot.svg b/public/providers/moonshot.svg
new file mode 100644
index 0000000000..b36d4e7e0f
--- /dev/null
+++ b/public/providers/moonshot.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" fill-rule="evenodd">
+  <title>Moonshot (月之暗面)</title>
+  <path d="M1.052 16.916l9.539 2.552a21.007 21.007 0 00.06 2.033l5.956 1.593a11.997 11.997 0 01-5.586.865l-.18-.016-.044-.004-.084-.009-.094-.01a11.605 11.605 0 01-.157-.02l-.107-.014-.11-.016a11.962 11.962 0 01-.32-.051l-.042-.008-.075-.013-.107-.02-.07-.015-.093-.019-.075-.016-.095-.02-.097-.023-.094-.022-.068-.017-.088-.022-.09-.024-.095-.025-.082-.023-.109-.03-.062-.02-.084-.025-.093-.028-.105-.034-.058-.019-.08-.026-.09-.031-.066-.024a6.293 6.293 0 01-.044-.015l-.068-.025-.101-.037-.057-.022-.08-.03-.087-.035-.088-.035-.079-.032-.095-.04-.063-.028-.063-.027a5.655 5.655 0 01-.041-.018l-.066-.03-.103-.047-.052-.024-.096-.046-.062-.03-.084-.04-.086-.044-.093-.047-.052-.027-.103-.055-.057-.03-.058-.032a6.49 6.49 0 01-.046-.026l-.094-.053-.06-.034-.051-.03-.072-.041-.082-.05-.093-.056-.052-.032-.084-.053-.061-.039-.079-.05-.07-.047-.053-.035a7.785 7.785 0 01-.054-.036l-.044-.03-.044-.03a6.066 6.066 0 01-.04-.028l-.057-.04-.076-.054-.069-.05-.074-.054-.056-.042-.076-.057-.076-.059-.086-.067-.045-.035-.064-.052-.074-.06-.089-.073-.046-.039-.046-.039a7.516 7.516 0 01-.043-.037l-.045-.04-.061-.053-.07-.062-.068-.06-.062-.058-.067-.062-.053-.05-.088-.084a13.28 13.28 0 01-.099-.097l-.029-.028-.041-.042-.069-.07-.05-.051-.05-.053a6.457 6.457 0 01-.168-.179l-.08-.088-.062-.07-.071-.08-.042-.049-.053-.062-.058-.068-.046-.056a7.175 7.175 0 01-.027-.033l-.045-.055-.066-.082-.041-.052-.05-.064-.02-.025a11.99 11.99 0 01-1.44-2.402zm-1.02-5.794l11.353 3.037a20.468 20.468 0 00-.469 2.011l10.817 2.894a12.076 12.076 0 01-1.845 2.005L.657 15.923l-.016-.046-.035-.104a11.965 11.965 0 01-.05-.153l-.007-.023a11.896 11.896 0 01-.207-.741l-.03-.126-.018-.08-.021-.097-.018-.081-.018-.09-.017-.084-.018-.094c-.026-.141-.05-.283-.071-.426l-.017-.118-.011-.083-.013-.102a12.01 12.01 0 01-.019-.161l-.005-.047a12.12 12.12 0 01-.034-2.145zm1.593-5.15l11.948 3.196c-.368.605-.705 1.231-1.01 1.875l11.295 3.022c-.142.82-.368 1.612-.668 2.365l-11.55-3.09L.124 10.26l.015-.1.008-.049.01-.067.015-.087.018-.098c.026-.148.056-.295.088-.442l.028-.124.02-.085.024-.097c.022-.09.045-.18.07-.268l.028-.102.023-.083.03-.1.025-.082.03-.096.026-.082.031-.095a11.896 11.896 0 011.01-2.232zm4.442-4.4L17.352 4.59a20.77 20.77 0 00-1.688 1.721l7.823 2.093c.267.852.442 1.744.513 2.665L2.106 5.213l.045-.065.027-.04.04-.055.046-.065.055-.076.054-.072.064-.086.05-.065.057-.073.055-.07.06-.074.055-.069.065-.077.054-.066.066-.077.053-.06.072-.082.053-.06.067-.074.054-.058.073-.078.058-.06.063-.067.168-.17.1-.098.059-.056.076-.071a12.084 12.084 0 012.272-1.677zM12.017 0h.097l.082.001.069.001.054.002.068.002.046.001.076.003.047.002.06.003.054.002.087.005.105.007.144.011.088.007.044.004.077.008.082.008.047.005.102.012.05.006.108.014.081.01.042.006.065.01.207.032.07.012.065.011.14.026.092.018.11.022.046.01.075.016.041.01L14.7.3l.042.01.065.015.049.012.071.017.096.024.112.03.113.03.113.032.05.015.07.02.078.024.073.023.05.016.05.016.076.025.099.033.102.036.048.017.064.023.093.034.11.041.116.045.1.04.047.02.06.024.041.018.063.026.04.018.057.025.11.048.1.046.074.035.075.036.06.028.092.046.091.045.102.052.053.028.049.026.046.024.06.033.041.022.052.029.088.05.106.06.087.051.057.034.053.032.096.059.088.055.098.062.036.024.064.041.084.056.04.027.062.042.062.043.023.017c.054.037.108.075.161.114l.083.06.065.048.056.043.086.065.082.064.04.03.05.041.086.069.079.065.085.071c.712.6 1.353 1.283 1.909 2.031L7.222.994l.062-.027.065-.028.081-.034.086-.035c.113-.045.227-.09.341-.131l.096-.035.093-.033.084-.03.096-.031c.087-.03.176-.058.264-.085l.091-.027.086-.025.102-.03.085-.023.1-.026L9.04.37l.09-.023.091-.022.095-.022.09-.02.098-.021.091-.02.095-.018.092-.018.1-.018.091-.016.098-.017.092-.014.097-.015.092-.013.102-.013.091-.012.105-.012.09-.01.105-.01c.093-.01.186-.018.28-.024l.106-.008.09-.005.11-.006.093-.004.1-.004.097-.002.099-.002.197-.002z" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/morph.svg b/public/providers/morph.svg
new file mode 100644
index 0000000000..474c521785
--- /dev/null
+++ b/public/providers/morph.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Morph</title>
+  <path d="M7.941 2c.23 0 .452.073.638.21.186.136.325.328.397.55l.593 1.814c.073.221.212.413.397.55.186.136.409.21.638.21h2.791c.23 0 .452-.074.638-.21a1.11 1.11 0 00.397-.55l.594-1.815a1.11 1.11 0 01.397-.55c.185-.136.408-.209.637-.209h1.7c.23 0 .453.073.639.21.185.136.324.328.397.55l.652 1.994c.118.361.41.635.77.728l2.957.752c.236.06.446.199.596.394.15.195.23.436.231.684v9.376c0 .248-.081.488-.231.684a1.09 1.09 0 01-.595.394l-2.957.752a1.086 1.086 0 00-.477.263 1.114 1.114 0 00-.293.465l-.653 1.994a1.11 1.11 0 01-.396.55c-.186.136-.41.21-.638.21h-1.702c-.229 0-.452-.073-.637-.21a1.11 1.11 0 01-.397-.55l-.364-1.11a1.131 1.131 0 01.15-1.002 1.074 1.074 0 01.885-.462h2.85c.29 0 .567-.116.772-.325.204-.208.32-.49.32-.785V6.444c0-.294-.116-.577-.32-.785a1.08 1.08 0 00-.771-.326h-3.273c-.29 0-.567.117-.772.326-.204.208-.32.49-.32.785v7.778c0 .295-.114.578-.319.786a1.08 1.08 0 01-.771.325h-2.182a1.08 1.08 0 01-.771-.325 1.122 1.122 0 01-.32-.786V6.444c0-.294-.115-.577-.32-.785a1.081 1.081 0 00-.77-.326H5.454c-.29 0-.567.117-.772.326-.204.208-.32.49-.32.785v11.112c0 .294.116.577.32.785.205.209.482.326.772.326h2.85a1.075 1.075 0 01.885.461 1.122 1.122 0 01.15 1.001l-.364 1.112a1.11 1.11 0 01-.397.55c-.185.136-.408.209-.637.209H6.24c-.229 0-.452-.073-.638-.21a1.11 1.11 0 01-.397-.55l-.652-1.994a1.114 1.114 0 00-.294-.465 1.086 1.086 0 00-.477-.263l-2.956-.752a1.09 1.09 0 01-.595-.394A1.124 1.124 0 010 16.688V7.312c0-.248.081-.489.231-.684.15-.195.36-.334.595-.394l2.957-.753c.178-.045.342-.136.477-.263.134-.127.235-.287.293-.464l.653-1.995a1.11 1.11 0 01.397-.55C5.788 2.075 6.01 2 6.24 2h1.701z"
+        fill="#99D52A" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/nebius.svg b/public/providers/nebius.svg
new file mode 100644
index 0000000000..719baf1544
--- /dev/null
+++ b/public/providers/nebius.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" fill-rule="evenodd">
+  <title>Nebius</title>
+  <path d="M20 2.306v16.797s4-.242 4-4.815V2.306h-4zM4 22.001V5.204s-4 .242-4 4.816V22h4z" />
+  <path d="M16.318 16.51L11.286 4.94c-.824-1.872-2.168-2.926-4.077-2.926-1.908 0-3.211 1.54-3.211 3.19 0 0 2.405-.333 3.68 2.593l5.036 11.57c.821 1.87 2.168 2.926 4.075 2.926 1.905 0 3.211-1.541 3.211-3.19 0 0-2.406.333-3.682-2.594z" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/novita.svg b/public/providers/novita.svg
new file mode 100644
index 0000000000..7c53907792
--- /dev/null
+++ b/public/providers/novita.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Novita</title>
+  <path clip-rule="evenodd"
+        d="M9.167 4.17v5.665L0 19.003h9.167v-5.666l5.666 5.666H24L9.167 4.17z"
+        fill="#23D57C"
+        fill-rule="evenodd" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/nube.svg b/public/providers/nube.svg
new file mode 100644
index 0000000000..96c17ae9d0
--- /dev/null
+++ b/public/providers/nube.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>Nube</title><circle cx="12" cy="12" r="12" fill="#64748B"/><text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui, sans-serif">N</text></svg>
diff --git a/public/providers/nvidia.svg b/public/providers/nvidia.svg
new file mode 100644
index 0000000000..48c7d75d26
--- /dev/null
+++ b/public/providers/nvidia.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" viewBox="35.188 31.512 351.46 258.785"><path fill="#fff" d="M384.195 282.109c0 3.771-2.769 6.302-6.047 6.302v-.023c-3.371.023-6.089-2.508-6.089-6.278 0-3.769 2.718-6.293 6.089-6.293 3.279-.001 6.047 2.523 6.047 6.292zm2.453 0c0-5.175-4.02-8.179-8.5-8.179-4.511 0-8.531 3.004-8.531 8.179 0 5.172 4.021 8.188 8.531 8.188 4.481 0 8.5-3.016 8.5-8.188m-9.91.692h.91l2.109 3.703h2.316l-2.336-3.859c1.207-.086 2.2-.661 2.2-2.286 0-2.019-1.392-2.668-3.75-2.668h-3.411v8.813h1.961v-3.703m.001-1.492v-2.122h1.364c.742 0 1.753.06 1.753.965 0 .985-.523 1.157-1.398 1.157h-1.719M329.406 237.027l10.598 28.993H318.48l10.926-28.993zm-11.35-11.289-24.423 61.88h17.246l3.863-10.934h28.903l3.656 10.934h18.722l-24.605-61.888-23.362.008zm-49.033 61.903h17.497v-61.922l-17.5-.004.003 61.926zm-121.467-61.926-14.598 49.078-13.984-49.074-18.879-.004 19.972 61.926h25.207l20.133-61.926h-17.851zm70.725 13.484h7.52c10.91 0 17.966 4.898 17.966 17.609 0 12.714-7.056 17.613-17.966 17.613h-7.52v-35.222zm-17.35-13.484v61.926h28.366c15.113 0 20.048-2.512 25.384-8.148 3.769-3.957 6.207-12.641 6.207-22.134 0-8.707-2.063-16.468-5.66-21.304-6.481-8.649-15.817-10.34-29.75-10.34h-24.547zm-165.743-.086v62.012h17.645v-47.086l13.672.004c4.527 0 7.754 1.128 9.934 3.457 2.765 2.945 3.894 7.699 3.894 16.395v27.23h17.098v-34.262c0-24.453-15.586-27.75-30.836-27.75H35.188zm137.583.086.007 61.926h17.489v-61.926h-17.496z"/><path fill="#77B900" d="M82.211 102.414s22.504-33.203 67.437-36.638V53.73c-49.769 3.997-92.867 46.149-92.867 46.149s24.41 70.565 92.867 77.026v-12.804c-50.237-6.32-67.437-61.687-67.437-61.687zm67.437 36.223v11.726c-37.968-6.769-48.507-46.237-48.507-46.237s18.23-20.195 48.507-23.47v12.867c-.023 0-.039-.007-.058-.007-15.891-1.907-28.305 12.938-28.305 12.938s6.958 24.991 28.363 32.183m0-107.125V53.73c1.461-.112 2.922-.207 4.391-.257 56.582-1.907 93.449 46.406 93.449 46.406s-42.343 51.488-86.457 51.488c-4.043 0-7.828-.375-11.383-1.005v13.739c3.04.386 6.192.613 9.481.613 41.051 0 70.738-20.965 99.484-45.778 4.766 3.817 24.278 13.103 28.289 17.168-27.332 22.883-91.031 41.329-127.144 41.329-3.481 0-6.824-.211-10.11-.528v19.306H305.68V31.512H149.648zm0 49.144V65.777c1.446-.101 2.903-.179 4.391-.226 40.688-1.278 67.382 34.965 67.382 34.965s-28.832 40.043-59.746 40.043c-4.449 0-8.438-.715-12.028-1.922V93.523c15.84 1.914 19.028 8.911 28.551 24.786l21.18-17.859s-15.461-20.277-41.524-20.277c-2.833-.001-5.544.198-8.206.483"/></svg>
\ No newline at end of file
diff --git a/public/providers/ollama.svg b/public/providers/ollama.svg
new file mode 100644
index 0000000000..96e9e86624
--- /dev/null
+++ b/public/providers/ollama.svg
@@ -0,0 +1,7 @@
+<svg width="646" height="854" viewBox="0 0 646 854" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M140.629 0.239929C132.66 1.52725 123.097 5.69568 116.354 10.845C95.941 26.3541 80.1253 59.2728 73.4435 100.283C70.9302 115.792 69.2138 137.309 69.2138 153.738C69.2138 173.109 71.4819 197.874 74.7309 214.977C75.4665 218.778 75.8343 222.15 75.5278 222.395C75.2826 222.64 72.2788 225.092 68.9072 227.789C57.3827 236.984 44.2029 251.145 35.1304 264.08C17.7209 288.784 6.44151 316.86 1.72133 347.265C-0.117698 359.28 -0.608106 383.555 0.863118 395.57C4.11207 423.278 12.449 446.695 26.7321 468.151L31.391 475.078L30.0424 477.346C20.4794 493.407 12.3264 516.64 8.52575 538.953C5.522 556.608 5.15419 561.328 5.15419 584.99C5.15419 608.837 5.4607 613.557 8.28054 630.047C11.6521 649.786 18.5178 670.689 26.1804 684.605C28.6938 689.141 34.8239 698.581 35.5595 699.072C35.8047 699.194 35.0691 701.462 33.9044 704.098C25.077 723.408 17.537 749.093 14.4106 770.733C12.2038 785.567 11.8973 790.349 11.8973 805.981C11.8973 825.903 13.0007 835.589 17.1692 851.466L17.7822 853.795H44.019H70.3172L68.6007 850.546C57.9957 830.93 57.0149 794.517 66.1487 758.166C70.3172 741.369 75.0374 729.048 83.8647 712.067L89.1366 701.769V695.455C89.1366 689.57 89.014 688.896 87.1137 685.034C85.6424 682.091 83.6808 679.578 80.1866 676.145C74.2404 670.383 69.9494 664.314 66.5165 656.835C51.4365 624.1 48.494 575.489 59.0991 534.049C63.5128 516.762 70.8076 501.376 78.4702 492.978C83.6808 487.215 86.378 480.779 86.378 474.097C86.378 467.17 83.926 461.469 78.4089 455.523C62.5932 438.604 52.8464 418.006 49.3522 394.038C44.3868 359.893 53.3981 322.683 73.8726 293.198C93.9181 264.263 122.055 245.689 153.503 240.724C160.552 239.559 173.732 239.743 181.088 241.092C189.119 242.502 194.145 242.072 199.295 239.62C205.67 236.617 208.858 232.877 212.597 224.295C215.907 216.633 218.482 212.464 225.409 203.821C233.746 193.461 241.776 186.411 254.649 177.89C269.362 168.266 286.097 161.278 302.771 157.906C308.839 156.68 311.659 156.496 323 156.496C334.341 156.496 337.161 156.68 343.229 157.906C367.688 162.872 391.964 175.5 411.335 193.399C415.503 197.261 425.495 209.644 428.683 214.794C429.909 216.816 432.055 221.108 433.403 224.295C437.142 232.877 440.33 236.617 446.705 239.62C451.671 242.011 456.881 242.502 464.605 241.214C476.804 239.13 486.183 239.314 498.137 241.766C538.841 249.98 574.273 283.512 589.966 328.446C603.636 367.862 599.774 409.118 579.422 440.626C575.989 445.96 572.556 450.251 567.591 455.523C556.863 466.986 556.863 481.208 567.53 492.978C585.062 512.165 596.035 559.367 592.724 600.99C590.518 628.453 583.468 653.035 573.782 666.95C572.066 669.402 568.511 673.57 565.813 676.145C562.319 679.578 560.358 682.091 558.886 685.034C556.986 688.896 556.863 689.57 556.863 695.455V701.769L562.135 712.067C570.963 729.048 575.683 741.369 579.851 758.166C588.863 794.027 588.066 829.704 577.767 849.995C576.909 851.711 576.173 853.305 576.173 853.489C576.173 853.673 587.882 853.795 602.226 853.795H628.218L628.892 851.159C629.26 849.75 629.873 847.604 630.179 846.378C630.854 843.681 632.202 835.712 633.306 828.049C634.348 820.325 634.348 791.881 633.306 783.299C629.383 752.158 622.823 727.454 612.096 704.098C610.931 701.462 610.195 699.194 610.44 699.072C610.747 698.888 612.463 696.436 614.302 693.677C627.666 673.448 635.88 648.008 640.049 614.415C641.152 605.158 641.152 565.374 640.049 556.485C637.106 533.559 633.551 517.988 627.666 502.234C625.214 495.675 618.716 481.821 615.958 477.346L614.609 475.078L619.268 468.151C633.551 446.695 641.888 423.278 645.137 395.57C646.608 383.555 646.118 359.28 644.279 347.265C639.497 316.798 628.279 288.845 610.87 264.08C601.797 251.145 588.617 236.984 577.093 227.789C573.721 225.092 570.717 222.64 570.472 222.395C570.166 222.15 570.534 218.778 571.269 214.977C578.687 176.296 578.441 128.053 570.656 90.3524C563.913 57.4951 551.653 31.3808 535.837 16.3008C523.209 4.28578 510.336 -0.863507 494.888 0.11731C459.456 2.20154 430.89 42.9667 419.61 107.21C417.771 117.57 416.178 129.708 416.178 133.018C416.178 134.305 415.932 135.347 415.626 135.347C415.319 135.347 412.929 134.121 410.354 132.589C383.014 116.405 352.608 107.762 323 107.762C293.392 107.762 262.986 116.405 235.646 132.589C233.071 134.121 230.681 135.347 230.374 135.347C230.068 135.347 229.822 134.305 229.822 133.018C229.822 129.585 228.167 117.08 226.39 107.21C216.152 49.5259 192.674 11.3354 161.472 1.71112C157.181 0.423799 144.982 -0.434382 140.629 0.239929ZM151.051 50.139C159.878 57.1273 169.686 77.1114 175.326 99.4863C176.368 103.532 177.471 108.191 177.778 109.907C178.023 111.563 178.697 115.302 179.249 118.183C181.64 131.179 182.743 145.217 182.866 162.32L182.927 179.178L178.697 185.43L174.468 191.744H164.598C153.074 191.744 141.61 193.216 130.637 196.158C126.714 197.139 122.913 198.12 122.178 198.304C121.013 198.549 120.829 198.181 120.155 193.154C116.538 165.875 116.722 135.654 120.707 110.52C125.12 82.5059 135.419 57.1273 145.472 49.6486C147.863 47.8708 148.292 47.9321 151.051 50.139ZM500.589 49.7098C506.658 54.1848 513.34 66.0772 518.305 81.2798C528.297 111.685 531.117 153.431 525.845 193.154C525.171 198.181 524.987 198.549 523.822 198.304C523.087 198.12 519.286 197.139 515.363 196.158C504.39 193.216 492.926 191.744 481.402 191.744H471.532L467.303 185.43L463.073 179.178L463.134 162.32C463.257 138.535 465.464 119.961 470.735 99.3024C476.314 77.1114 486.183 57.1273 494.949 50.139C497.708 47.9321 498.137 47.8708 500.589 49.7098Z" fill="white"/>
+<path d="M313.498 358.237C300.195 359.525 296.579 360.015 290.203 361.303C279.843 363.448 265.989 368.23 256.365 372.95C222.895 389.317 199.846 416.596 192.796 448.166C191.386 454.419 191.202 456.503 191.202 467.047C191.202 477.468 191.386 479.736 192.735 485.682C202.114 526.938 240.12 557.405 289.284 562.983C299.95 564.148 346.049 564.148 356.715 562.983C396.193 558.508 430.154 537.114 445.418 507.076C449.463 499.046 451.425 493.835 453.264 485.682C454.613 479.736 454.797 477.468 454.797 467.047C454.797 456.503 454.613 454.419 453.203 448.166C442.965 402.313 398.461 366.207 343.903 359.341C336.792 358.483 318.157 357.747 313.498 358.237ZM336.424 391.585C354.631 393.547 372.96 400.045 387.672 409.853C395.58 415.125 406.737 426.159 411.518 433.393C417.403 442.342 420.774 451.476 422.307 462.572C422.981 467.66 422.614 471.522 420.774 479.736C417.893 491.996 408.943 504.808 396.867 513.758C391.227 517.865 379.519 523.812 372.347 526.141C358.738 530.493 349.849 531.29 318.095 531.045C297.376 530.861 293.697 530.677 287.751 529.574C267.461 525.773 251.4 517.681 239.753 505.36C230.312 495.429 226.021 486.357 223.692 471.706C222.65 464.901 224.611 453.622 228.596 444.12C233.439 432.534 245.944 418.129 258.327 409.853C272.671 400.29 291.552 393.486 308.9 391.647C315.582 390.911 329.742 390.911 336.424 391.585Z" fill="white"/>
+<path d="M299.584 436.336C294.925 438.849 291.676 445.224 292.657 449.944C293.76 455.032 298.235 460.182 305.223 464.412C308.963 466.68 309.208 466.986 309.392 469.254C309.514 470.603 309.024 474.465 308.35 477.898C307.614 481.269 307.062 484.825 307.062 485.806C307.124 488.442 309.576 492.733 312.15 494.817C314.419 496.656 314.848 496.717 321.223 496.901C327.047 497.085 328.273 496.962 330.602 495.859C336.61 492.916 338.142 487.522 335.935 477.162C334.096 468.519 334.464 467.17 339.062 464.534C343.904 461.714 349.054 456.749 350.586 453.377C353.529 446.941 350.831 439.646 344.333 436.274C342.74 435.477 340.778 435.11 337.897 435.11C333.422 435.11 330.541 436.152 325.269 439.523L322.265 441.424L320.365 440.259C312.58 435.661 311.17 435.11 306.449 435.171C303.078 435.171 301.239 435.477 299.584 436.336Z" fill="white"/>
+<path d="M150.744 365.165C139.894 368.598 131.802 376.567 127.634 387.908C125.611 393.303 124.63 401.824 125.488 406.421C127.511 417.394 136.522 427.386 146.76 430.145C159.633 433.516 169.257 431.309 177.778 422.85C182.743 418.007 185.441 413.777 188.138 406.911C190.099 402.069 190.222 401.211 190.222 394.345L190.283 386.989L187.709 381.717C183.601 373.38 176.184 367.188 167.602 364.92C162.759 363.694 154.974 363.756 150.744 365.165Z" fill="white"/>
+<path d="M478.153 364.982C469.755 367.25 462.276 373.502 458.291 381.717L455.717 386.989L455.778 394.345C455.778 401.211 455.901 402.069 457.862 406.911C460.56 413.777 463.257 418.007 468.222 422.85C476.743 431.309 486.367 433.516 499.241 430.145C506.658 428.183 514.075 421.93 517.631 414.635C520.696 408.444 521.431 403.969 520.451 396.919C518.183 380.797 508.742 369.089 494.704 364.982C490.597 363.756 482.628 363.756 478.153 364.982Z" fill="white"/>
+</svg>
diff --git a/public/providers/omp.png b/public/providers/omp.png
new file mode 100644
index 0000000000..9da36e296a
Binary files /dev/null and b/public/providers/omp.png differ
diff --git a/public/providers/openadapter.svg b/public/providers/openadapter.svg
new file mode 100644
index 0000000000..fc64128946
--- /dev/null
+++ b/public/providers/openadapter.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>OpenAdapter</title>
+  <circle cx="12" cy="12" r="12" fill="#059669"/>
+  <text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui, sans-serif">A</text>
+</svg>
diff --git a/public/providers/openai.svg b/public/providers/openai.svg
new file mode 100644
index 0000000000..b6d542d099
--- /dev/null
+++ b/public/providers/openai.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="256" height="260" preserveAspectRatio="xMidYMid" viewBox="0 0 256 260"><path fill="#fff" d="M239.184 106.203a64.716 64.716 0 0 0-5.576-53.103C219.452 28.459 191 15.784 163.213 21.74A65.586 65.586 0 0 0 52.096 45.22a64.716 64.716 0 0 0-43.23 31.36c-14.31 24.602-11.061 55.634 8.033 76.74a64.665 64.665 0 0 0 5.525 53.102c14.174 24.65 42.644 37.324 70.446 31.36a64.72 64.72 0 0 0 48.754 21.744c28.481.025 53.714-18.361 62.414-45.481a64.767 64.767 0 0 0 43.229-31.36c14.137-24.558 10.875-55.423-8.083-76.483Zm-97.56 136.338a48.397 48.397 0 0 1-31.105-11.255l1.535-.87 51.67-29.825a8.595 8.595 0 0 0 4.247-7.367v-72.85l21.845 12.636c.218.111.37.32.409.563v60.367c-.056 26.818-21.783 48.545-48.601 48.601Zm-104.466-44.61a48.345 48.345 0 0 1-5.781-32.589l1.534.921 51.722 29.826a8.339 8.339 0 0 0 8.441 0l63.181-36.425v25.221a.87.87 0 0 1-.358.665l-52.335 30.184c-23.257 13.398-52.97 5.431-66.404-17.803ZM23.549 85.38a48.499 48.499 0 0 1 25.58-21.333v61.39a8.288 8.288 0 0 0 4.195 7.316l62.874 36.272-21.845 12.636a.819.819 0 0 1-.767 0L41.353 151.53c-23.211-13.454-31.171-43.144-17.804-66.405v.256Zm179.466 41.695-63.08-36.63L161.73 77.86a.819.819 0 0 1 .768 0l52.233 30.184a48.6 48.6 0 0 1-7.316 87.635v-61.391a8.544 8.544 0 0 0-4.4-7.213Zm21.742-32.69-1.535-.922-51.619-30.081a8.39 8.39 0 0 0-8.492 0L99.98 99.808V74.587a.716.716 0 0 1 .307-.665l52.233-30.133a48.652 48.652 0 0 1 72.236 50.391v.205ZM88.061 139.097l-21.845-12.585a.87.87 0 0 1-.41-.614V65.685a48.652 48.652 0 0 1 79.757-37.346l-1.535.87-51.67 29.825a8.595 8.595 0 0 0-4.246 7.367l-.051 72.697Zm11.868-25.58 28.138-16.217 28.188 16.218v32.434l-28.086 16.218-28.188-16.218-.052-32.434Z"/></svg>
\ No newline at end of file
diff --git a/public/providers/openclaw.png b/public/providers/openclaw.png
deleted file mode 100644
index 7ef77ac754..0000000000
Binary files a/public/providers/openclaw.png and /dev/null differ
diff --git a/public/providers/openclaw.svg b/public/providers/openclaw.svg
new file mode 100644
index 0000000000..bf6acb9f51
--- /dev/null
+++ b/public/providers/openclaw.svg
@@ -0,0 +1 @@
+<svg height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>OpenClaw</title><path d="M12 2.568c-6.33 0-9.495 5.275-9.495 9.495 0 4.22 3.165 8.44 6.33 9.494v2.11h2.11v-2.11s1.055.422 2.11 0v2.11h2.11v-2.11c3.165-1.055 6.33-5.274 6.33-9.494S18.33 2.568 12 2.568z" fill="url(#lobe-icons-open-claw-0-_R_0_)"></path><path d="M3.56 9.953C.396 8.898-.66 11.008.396 13.118c1.055 2.11 3.164 1.055 4.22-1.055.632-1.477 0-2.11-1.056-2.11z" fill="url(#lobe-icons-open-claw-1-_R_0_)"></path><path d="M20.44 9.953c3.164-1.055 4.22 1.055 3.164 3.165-1.055 2.11-3.164 1.055-4.22-1.055-.632-1.477 0-2.11 1.056-2.11z" fill="url(#lobe-icons-open-claw-2-_R_0_)"></path><path d="M5.507 1.875c.476-.285 1.036-.233 1.615.037.577.27 1.223.774 1.937 1.488a.316.316 0 01-.447.447c-.693-.693-1.279-1.138-1.757-1.361-.475-.222-.795-.205-1.022-.069a.317.317 0 01-.326-.542zM16.877 1.913c.58-.27 1.14-.323 1.616-.038a.317.317 0 01-.326.542c-.227-.136-.547-.153-1.022.069-.478.223-1.064.668-1.756 1.361a.316.316 0 11-.448-.447c.714-.714 1.36-1.218 1.936-1.487z" fill="#FF4D4D"></path><path d="M8.835 9.109a1.266 1.266 0 100-2.532 1.266 1.266 0 000 2.532zM15.165 9.109a1.266 1.266 0 100-2.532 1.266 1.266 0 000 2.532z" fill="#050810"></path><path d="M9.046 8.16a.527.527 0 100-1.056.527.527 0 000 1.055zM15.376 8.16a.527.527 0 100-1.055.527.527 0 000 1.054z" fill="#00E5CC"></path><defs><linearGradient gradientUnits="userSpaceOnUse" id="lobe-icons-open-claw-0-_R_0_" x1="-.659" x2="27.023" y1=".458" y2="22.855"><stop stop-color="#FF4D4D"></stop><stop offset="1" stop-color="#991B1B"></stop></linearGradient><linearGradient gradientUnits="userSpaceOnUse" id="lobe-icons-open-claw-1-_R_0_" x1="0" x2="4.311" y1="9.672" y2="14.949"><stop stop-color="#FF4D4D"></stop><stop offset="1" stop-color="#991B1B"></stop></linearGradient><linearGradient gradientUnits="userSpaceOnUse" id="lobe-icons-open-claw-2-_R_0_" x1="19.385" x2="24.399" y1="9.953" y2="14.462"><stop stop-color="#FF4D4D"></stop><stop offset="1" stop-color="#991B1B"></stop></linearGradient></defs></svg>
\ No newline at end of file
diff --git a/public/providers/openrouter.svg b/public/providers/openrouter.svg
new file mode 100644
index 0000000000..61033bfc67
--- /dev/null
+++ b/public/providers/openrouter.svg
@@ -0,0 +1,21 @@
+<svg
+  width="512"
+  height="512"
+  viewBox="0 0 512 512"
+  xmlns="http://www.w3.org/2000/svg"
+  fill="#ffff"
+  stroke="#ffff"
+>
+  <g clip-path="url(#clip0_205_3)">
+    <path
+      d="M3 248.945C18 248.945 76 236 106 219C136 202 136 202 198 158C276.497 102.293 332 120.945 423 120.945"
+      stroke-width="90"
+    />
+    <path d="M511 121.5L357.25 210.268L357.25 32.7324L511 121.5Z" />
+    <path
+      d="M0 249C15 249 73 261.945 103 278.945C133 295.945 133 295.945 195 339.945C273.497 395.652 329 377 420 377"
+      stroke-width="90"
+    />
+    <path d="M508 376.445L354.25 287.678L354.25 465.213L508 376.445Z" />
+  </g>
+</svg>
diff --git a/public/providers/openvecta.svg b/public/providers/openvecta.svg
new file mode 100644
index 0000000000..8c843c9f79
--- /dev/null
+++ b/public/providers/openvecta.svg
@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64" role="img" aria-label="OpenVecta">
+  <title>OpenVecta</title>
+  <defs>
+    <linearGradient id="ov-grad" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0%" stop-color="#7C3AED" />
+      <stop offset="100%" stop-color="#A855F7" />
+    </linearGradient>
+  </defs>
+  <rect x="2" y="2" width="60" height="60" rx="14" fill="url(#ov-grad)" />
+  <path d="M14 18 L32 46 L50 18" fill="none" stroke="#FFFFFF" stroke-width="6" stroke-linecap="round" stroke-linejoin="round" />
+  <circle cx="32" cy="40" r="3.5" fill="#FFFFFF" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/orcarouter.svg b/public/providers/orcarouter.svg
new file mode 100644
index 0000000000..62eceb890b
--- /dev/null
+++ b/public/providers/orcarouter.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>OrcaRouter</title><circle cx="12" cy="12" r="12" fill="#0EA5E9"/><text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui, sans-serif">O</text></svg>
diff --git a/public/providers/ovhcloud.png b/public/providers/ovhcloud.png
deleted file mode 100644
index a88d1b448d..0000000000
Binary files a/public/providers/ovhcloud.png and /dev/null differ
diff --git a/public/providers/ovhcloud.svg b/public/providers/ovhcloud.svg
new file mode 100644
index 0000000000..71ec8e5b13
--- /dev/null
+++ b/public/providers/ovhcloud.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" role="img" viewBox="-8.29 -8.29 431.08 79.33"><g fill="#2744a0"><path fill-rule="evenodd" d="M41.06404 62.90648H11.91689C-1.87443 46.03088-3.88064 22.4168 6.86649 3.45635l18.90473 32.83878L46.61337.00177h30.68416L41.08391 62.88721l-.01987.01927zM97.52103 3.59542c10.5236 18.95112 8.55232 42.3844-4.99161 59.31106H63.9416l8.80445-15.55176H61.10727l13.7154-24.1946h11.71837l10.97999-19.5647"/><path d="M126.57284 32.37496c0 13.8002 6.2989 20.3823 17.12757 20.3823 10.82773 0 17.12757-6.5821 17.12757-20.3823 0-13.87205-6.29984-20.45522-17.12757-20.45522-10.82867 0-17.12757 6.58317-17.12757 20.45522zm-4.95401 0c0-16.77464 8.35139-24.8431 22.08158-24.8431 13.73032 0 22.08211 8.06846 22.08211 24.8431 0 16.63079-8.35179 24.77125-22.08211 24.77125-13.7302 0-22.08158-8.14046-22.08158-24.77125m80.26012-22.86143c.212-.56665.91998-1.55622 2.26395-1.55622 1.3453 0 2.40794 1.06144 2.40794 2.4062 0 .42453-.14267.84892-.21333 1.06144l-16.56225 43.66818c-.35333.9906-1.34397 1.62757-2.26395 1.62757-.91997 0-1.91062-.63697-2.26394-1.62757l-16.56225-43.66818c-.07067-.21252-.21333-.63691-.21333-1.06144 0-1.34476 1.06264-2.4062 2.4066-2.4062 1.34397 0 2.05329.98957 2.26528 1.55622l14.36764 38.07825 14.36764-38.07825m14.7223 24.41713V54.3145c0 1.27445-1.06264 2.4062-2.4066 2.4062-1.34397 0-2.40661-1.13175-2.40661-2.4062v-43.951c0-1.2745 1.06264-2.4062 2.4066-2.4062 1.34397 0 2.40661 1.1317 2.40661 2.4062v19.17926h24.63005V10.3635c0-1.2745 1.06264-2.4062 2.40528-2.4062 1.3453 0 2.4066 1.1317 2.4066 2.4062v43.951c0 1.27445-1.0613 2.4062-2.4066 2.4062-1.34264 0-2.40528-1.13175-2.40528-2.4062V33.93066h-24.63005m52.16136-10.89813c6.29985 0 9.76776 3.32538 10.90106 4.88268.35333.49625.49466.84891.49466 1.3453 0 1.2025-.91998 2.05195-2.05195 2.05195-.70798 0-1.20264-.2828-1.69862-.84945-1.06131-1.2025-2.97326-3.32645-7.64515-3.32645-6.5105 0-9.97708 4.1759-9.97708 12.88141 0 8.84725 3.46658 12.95283 9.97708 12.95283 4.10657 0 6.58384-1.84007 8.21047-3.0442.49465-.3542.8493-.49473 1.3453-.49473 1.13197 0 2.05194.92023 2.05194 2.05042 0 .63957-.212 1.13434-.91997 1.76974-1.55596 1.27445-4.95321 3.82282-10.68774 3.82282-9.12777 0-14.5783-5.44934-14.5783-17.05688 0-11.6065 5.45053-16.98544 14.5783-16.98544m22.57944-15.00482V48.4407c0 2.83066.91998 4.03375 2.83193 4.03375 1.13197 0 2.12395.92081 2.12395 2.1239 0 1.20153-.99198 2.12235-2.12395 2.12235-4.74255 0-7.36248-2.82962-7.36248-8.28V8.0277c0-1.20316 1.06264-2.26407 2.2666-2.26407 1.2733 0 2.26395 1.0609 2.26395 2.26408m33.97248 31.99026c0-8.91804-3.75057-12.8814-10.2624-12.8814-6.51051 0-10.26108 3.96336-10.26108 12.8814 0 9.05964 3.75057 12.95283 10.26107 12.95283 6.51184 0 10.26241-3.89319 10.26241-12.95283zm4.59989 0c0 11.60754-5.6612 17.05688-14.8623 17.05688-9.1291 0-14.8623-5.44934-14.8623-17.05688 0-11.6065 5.7332-16.98544 14.8623-16.98544 9.2011 0 14.8623 5.37893 14.8623 16.98544m10.90106-14.29644v18.47194c0 4.60028 1.4853 8.56378 8.63445 8.56378 7.14915 0 8.63445-3.9635 8.63445-8.56378V25.72153c0-1.27344 1.0613-2.26461 2.3346-2.26461 1.20531 0 2.19595.99117 2.19595 2.26461v18.47194c0 6.72372-2.19594 12.88138-13.165 12.88138-10.89973 0-13.16367-6.15766-13.16367-12.88138V25.72153c0-1.27344.99064-2.26461 2.26394-2.26461 1.20397 0 2.26528.99117 2.26528 2.26461m52.02137 7.64408s-2.6906-6.22905-9.34244-6.22905c-6.44117 0-9.97975 4.1759-9.97975 12.88141 0 8.84725 3.46792 12.95283 9.97975 12.95283 5.45053 0 9.34244-3.11451 9.34244-9.83837zm0-5.7328V8.02772c0-1.2745.99064-2.26408 2.26527-2.26408 1.2733 0 2.26395.98957 2.26395 2.26408v35.10472c0 9.34202-5.80253 13.94242-13.87166 13.94242-9.13044 0-14.5103-5.44934-14.5103-17.05688 0-11.6065 5.0972-16.98544 14.2263-16.98544 4.53056 0 7.99848 2.33474 9.62644 4.60029m8.0038-18.50728c-.21467 0-.38133-.16666-.38133-.38172 0-.21466.16666-.38132.38133-.38132h5.0652c.21333 0 .38.16666.38.38132 0 .21506-.16667.38172-.38.38172h-2.12128v6.94623c0 .22653-.18.4052-.40665.4052-.22533 0-.40533-.17867-.40533-.4052V9.12554h-2.13194m9.85442 5.7316l-2.4906-4.63522v5.86172c0 .21466-.17867.39332-.39333.39332-.21333 0-.39333-.17866-.39333-.39332V8.66049c0-.21466.18-.39332.39333-.39332.18 0 .29866.1068.35866.22666l2.88392 5.3972 2.8946-5.3972c.048-.08333.14266-.22666.35732-.22666.21466 0 .39333.17866.39333.39332v7.42315c0 .21466-.17867.39332-.39333.39332-.21466 0-.39332-.17866-.39332-.39332v-5.86172l-2.5026 4.63521c-.08267.15467-.21467.22653-.356.22653-.12 0-.27466-.05986-.35865-.22653"/></g></svg>
\ No newline at end of file
diff --git a/public/providers/perplexity.svg b/public/providers/perplexity.svg
new file mode 100644
index 0000000000..b6e121bbc3
--- /dev/null
+++ b/public/providers/perplexity.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Perplexity</title>
+  <path d="M19.785 0v7.272H22.5V17.62h-2.935V24l-7.037-6.194v6.145h-1.091v-6.152L4.392 24v-6.465H1.5V7.188h2.884V0l7.053 6.494V.19h1.09v6.49L19.786 0zm-7.257 9.044v7.319l5.946 5.234V14.44l-5.946-5.397zm-1.099-.08l-5.946 5.398v7.235l5.946-5.234V8.965zm8.136 7.58h1.844V8.349H13.46l6.105 5.54v2.655zm-8.982-8.28H2.59v8.195h1.8v-2.576l6.192-5.62zM5.475 2.476v4.71h5.115l-5.115-4.71zm13.219 0l-5.115 4.71h5.115v-4.71z"
+        fill="#22B8CD"
+        fill-rule="nonzero" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/picoclaw.svg b/public/providers/picoclaw.svg
new file mode 100644
index 0000000000..c05d253215
--- /dev/null
+++ b/public/providers/picoclaw.svg
@@ -0,0 +1,30 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="#2d6a8a">
+  <title>PicoClaw</title>
+  <!-- Body -->
+  <ellipse cx="12" cy="12.5" rx="5.5" ry="6"/>
+  <!-- Head bump -->
+  <ellipse cx="12" cy="7.5" rx="4" ry="3.5"/>
+  <!-- Antennae -->
+  <path d="M9.5 5.5 Q7 2 5.5 2.5" stroke="#2d6a8a" stroke-width="1" fill="none" stroke-linecap="round"/>
+  <path d="M14.5 5.5 Q17 2 18.5 2.5" stroke="#2d6a8a" stroke-width="1" fill="none" stroke-linecap="round"/>
+  <circle cx="5.2" cy="2.5" r="1" fill="#2d6a8a"/>
+  <circle cx="18.8" cy="2.5" r="1" fill="#2d6a8a"/>
+  <!-- Left claw -->
+  <path d="M5.5 10 Q2 8.5 2 11 Q2 13.5 5 12.5" fill="#e05c5c"/>
+  <!-- Right claw -->
+  <path d="M18.5 10 Q22 8.5 22 11 Q22 13.5 19 12.5" fill="#e05c5c"/>
+  <!-- Tail segments -->
+  <rect x="10" y="18" width="4" height="2" rx="1"/>
+  <rect x="10.5" y="20" width="3" height="1.5" rx=".75"/>
+  <path d="M10 21.5 Q12 23.5 14 21.5" fill="#2d6a8a"/>
+  <!-- Eyes -->
+  <circle cx="10" cy="7" r="1.8" fill="#fff"/>
+  <circle cx="14" cy="7" r="1.8" fill="#fff"/>
+  <circle cx="10.3" cy="6.8" r="1" fill="#0a1929"/>
+  <circle cx="14.3" cy="6.8" r="1" fill="#0a1929"/>
+  <!-- Chip/circuit pattern on body -->
+  <rect x="10" y="11" width="4" height="3" rx=".8" fill="#1a4a6a" opacity=".5"/>
+  <line x1="11" y1="11" x2="11" y2="14" stroke="#4a9aba" stroke-width=".3" opacity=".6"/>
+  <line x1="13" y1="11" x2="13" y2="14" stroke="#4a9aba" stroke-width=".3" opacity=".6"/>
+  <line x1="10" y1="12.5" x2="14" y2="12.5" stroke="#4a9aba" stroke-width=".3" opacity=".6"/>
+</svg>
diff --git a/public/providers/pioneer.svg b/public/providers/pioneer.svg
new file mode 100644
index 0000000000..1197faa1c8
--- /dev/null
+++ b/public/providers/pioneer.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>Pioneer</title><circle cx="12" cy="12" r="12" fill="#EA580C"/><text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui, sans-serif">P</text></svg>
diff --git a/public/providers/poe.svg b/public/providers/poe.svg
new file mode 100644
index 0000000000..cbd9ec4c7d
--- /dev/null
+++ b/public/providers/poe.svg
@@ -0,0 +1 @@
+<svg fill="#5D5CDE" role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Poe</title><path d="M24 12.513V8.36c0-.888-.717-1.608-1.603-1.615h-.013c-.498-.009-1.194-.123-1.688-.619-.44-.439-.584-1.172-.622-1.783l-.001.003c-.002-.014-.002-.03-.003-.044l-.001-.03a1.616 1.616 0 0 0-1.607-1.45H5.54a1.59 1.59 0 0 0-.164.008l-.055.009c-.034.004-.068.008-.102.015l-.069.017c-.028.008-.056.013-.083.022-.024.007-.045.015-.07.024-.026.01-.053.018-.08.03-.021.008-.042.02-.063.029-.027.013-.054.024-.08.038l-.059.034c-.025.015-.052.03-.077.047a.967.967 0 0 0-.061.045c-.021.015-.044.03-.065.05a1.21 1.21 0 0 0-.099.09c-.006.005-.013.01-.018.016l-.014.016a1.59 1.59 0 0 0-.094.102c-.017.02-.03.042-.046.062-.016.021-.033.042-.047.063l-.045.074-.037.062-.036.076a.682.682 0 0 0-.058.143l-.027.075-.02.074a.773.773 0 0 0-.018.078c-.006.03-.009.058-.013.088-.003.022-.008.045-.01.069-.003.022-.003.045-.004.068l-.002-.002c-.036.61-.182 1.345-.62 1.784-.496.495-1.191.61-1.69.618h-.012c-.05 0-.1.003-.147.007a1.27 1.27 0 0 0-.072.012c-.029.004-.057.007-.084.012l-.082.02-.072.018c-.026.009-.052.019-.079.027-.024.009-.048.016-.07.026-.024.01-.048.022-.072.034a.767.767 0 0 0-.072.033l-.068.04-.068.041a1.228 1.228 0 0 0-.072.054c-.018.014-.037.026-.053.04a1.627 1.627 0 0 0-.226.227c-.015.016-.027.036-.041.053a1.398 1.398 0 0 0-.054.074c-.016.022-.028.045-.041.067L.19 7.6c-.012.023-.022.047-.033.07l-.034.073c-.01.024-.017.046-.026.07-.01.027-.02.053-.027.08-.007.023-.012.047-.018.071l-.02.082-.012.084c-.003.024-.009.048-.01.072-.007.052-.01.106-.01.16v4.152c0 .888.717 1.609 1.603 1.616h.01c.5.008 1.196.123 1.69.618.43.43.577 1.143.618 1.746v4.13c0 .524.66.754.986.346l2.333-2.92h11.22c.861 0 1.563-.675 1.611-1.524l.001.003c.037-.61.183-1.344.622-1.783.495-.496 1.19-.61 1.689-.619h.012c.044 0 .088-.003.132-.007l.022-.001A1.613 1.613 0 0 0 24 12.513zm-3.85 1.69c-.502.503-1.215.613-1.717.619H5.566c-.501-.006-1.215-.114-1.717-.618-.408-.409-.565-1.117-.618-1.744V8.415c.052-.627.209-1.337.618-1.745.503-.503 1.216-.613 1.717-.619h12.867c.502.006 1.216.115 1.718.619.409.41.564 1.117.618 1.744v4.041c-.052.63-.209 1.339-.618 1.749zM8.424 7.99c-.892 0-1.615.723-1.615 1.615v1.616a1.615 1.615 0 1 0 3.23 0V9.604c0-.892-.723-1.615-1.615-1.615Zm7.154 0c-.893 0-1.616.723-1.616 1.615v1.616a1.615 1.615 0 1 0 3.231 0V9.604c0-.892-.723-1.615-1.615-1.615z"/></svg>
\ No newline at end of file
diff --git a/public/providers/pollinations.svg b/public/providers/pollinations.svg
new file mode 100644
index 0000000000..83b569419b
--- /dev/null
+++ b/public/providers/pollinations.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" fill-rule="evenodd">
+  <title>Pollinations</title>
+  <path d="M11.823 22.145c.127.192.217.402.276.627.099.336.037.713-.377.725-.279.028-.506-.126-.54-.397-.066-.39.105-.75.299-1.083l.011-.018c.025-.037.057-.073.095-.078h.008c.074-.007.159.122.228.224zm1.596-1.247c.75.31.95 1.246-.084 1.256h-.015c-.52.017-.906-.472-.587-.92.15-.212.417-.42.686-.336zm-3.989-.594c.256.033.512.1.762.16l.037.011c.21.058.458.11.55.297.26.585-.47 1.093-.976 1.103h-.028v-.001c-.413.01-.809-.126-.942-.535-.11-.28-.085-.603.128-.827l.014-.015c.117-.124.282-.212.455-.193zm6.094.237v.014c-.004.302-.148.608-.42.751-.186.093-.417-.01-.588-.15-.171-.147-.283-.356-.382-.568l-.04-.087c-.193-.405.088-.552.405-.627l.04-.01c.058-.012.116-.022.173-.032l.042-.008c.578-.105.792.15.77.717zM2.827 2.991c1.15.86 2.286 1.734 3.376 2.67 2.476 2.166 3.346 5.568 3.452 8.766.048 1.103.108 2.205.199 3.306l.004.04c.019.182.078.563.25.522l.007-.003c.057-.04.086-.123.109-.192.114-.336.194-.693.323-1.026.09-.216.204-.344.377-.411.3-.12.702-.062.87.246.037.05.073.123.11.202l.036.078.02.044.015.03.013.026.013.026c.1.189.223.344.42.264.117-.059.221-.19.319-.283.2-.22.505-.292.713-.053.524.616.5 1.486 0 2.106-.451.585-1.182.7-1.862.586l-.054-.01c-.972-.162-1.555-.96-2.015-1.779l-.03-.055a141.48 141.48 0 00-1.583-2.577l-.03-.045c-.116-.165-.264-.35-.43-.445-.07-.015-.006.127.009.173.467 1.253 1.07 2.425 1.961 3.427l.011.02c.086.168-.045.122-.19.041l-.016-.01-.027-.015-.019-.011a3.561 3.561 0 01-.126-.082l-.075-.05a4.532 4.532 0 01-.78-.67c-.772-.87-1.42-1.838-2.054-2.816l-.375-.58-.165-.255a32.793 32.793 0 00-1.11-1.623c-.415-.567-.89-1.092-1.298-1.666-.774-1.071-1.251-2.312-1.519-3.61-.137-.56-.297-1.114-.438-1.672l-.06-.24c-.094-.38-.166-.784-.129-1.173.083-.894.815-1.97 1.778-1.222zm18.27 14.434c-1.048 1.176-3.299 2.527-4.609 2.154l.002-.002c.014-.019.125-.043.177-.055.838-.192 1.555-.639 2.285-1.058.556-.295 1.048-.682 1.525-1.1l.04-.032c.106-.089.223-.18.352-.214.226-.053.428.11.228.307zM2.012 11.4c1.647.403 2.589 1.718 3.455 3.08l.108.17.226.358c.25.398.502.79.77 1.155.213.305.442.598.666.894.048.058.115.21.05.216h-.011c-.051 0-.127-.062-.172-.106a41.465 41.465 0 01-.727-.698l-.24-.236a26.247 26.247 0 00-1.103-1.032c-.165-.079-.093.137-.027.238.187.286.463.497.695.747.353.352.711.7 1.094 1.018.805.66 1.68 1.232 2.534 1.832l.056.042c.099.074.211.172.205.28-.005.288-1.397.287-1.663.275H7.92c-1.797-.073-3.27-1.012-4.66-2.055l-.138-.105-.097-.073a68.65 68.65 0 01-.287-.22l-.501-.387c-.286-.224-.573-.443-.848-.681C.464 15.3.032 14.098.01 12.882c-.117-1.32.826-1.809 2.003-1.482zm20.708.695l.064.014c.369.078.673.288.899.618.253.37.387.827.28 1.26-.266.87-.806 1.621-1.446 2.26-.15.147-.309.283-.47.418-.178.135-.345.331-.571.376-.19.034-.402-.135-.597-.129-.158 0-.29.092-.41.193-.806.767-1.78 1.286-2.772 1.765l-.186.089-.186.089-.248.117-.017.007c-.189.076-.786.402-.87.234l-.004-.007c-.034-.07.03-.211.091-.298.968-1.244 1.618-2.666 2.246-4.097l.213-.486.255-.576.123-.26c.19-.4.397-.807.726-1.098.77-.65 1.924-.691 2.88-.49zM21.197 4.78c.161.335.22.69.327 1.054.022.084.04.171.04.257v.012a.977.977 0 01-.027.217l-.073.3a7.983 7.983 0 01-.331 1.104c-.32.797-.632 1.597-.942 2.399l-.373.962c-.688 1.776-1.381 3.551-2.15 5.292-.453.953-1.084 1.814-1.791 2.59-.197.227-.453.404-.777.323-.51-.124-.59-.456-.416-.918.187-.546.42-1.08.567-1.636.286-1.186.382-2.408.2-3.628-.094-.72-.458-.813-.943-1.199a.586.586 0 01-.207-.52c.034-.337.158-.684.264-1.01l.015-.046c.353-1.092 1.013-2.015 1.707-2.912l.08-.103.08-.103.162-.206c.12-.154.241-.308.36-.463.222-.296.529-.5.84-.688.48-.32.792-.816 1.258-1.146.566-.437 1.708-.666 2.13.068zM11.21 18.728c.007.54.965.728.996.052v-.013c.037-.614-.95-.599-.996-.04zm-5.78-.884h-.002c.8.623 1.737 1.182 2.757 1.33 0-.02-.09-.059-.123-.076-.876-.411-1.752-.862-2.632-1.254zM.76 14.145l.009.02c.88 1.917 2.523 3.067 4.354 3.903l.055.026.001-.001-.253-.159-.152-.095-.1-.064-.096-.06c-1.466-.93-2.883-1.934-3.767-3.51l-.049-.088c-.048-.083-.047-.07-.002.028zm14.154-1.55c.293.401.325.933.331 1.411v.013a7.8 7.8 0 01-.267 1.831c-.028.081-.05.171-.074.261l-.011.042-.012.04c-.052.18-.122.351-.274.444-.317.166-.444-.222-.414-.482.028-1 .078-2.002.128-3 .016-.199.013-.403.06-.6.02-.077.055-.143.106-.173.163-.077.33.093.427.212zm1.373-9.036c.609.393.956 1.003 1.052 1.716l.005.034a.666.666 0 01-.184.569c-2.37 2.286-3.416 5.563-3.605 8.805l-.026.204c-.045.34-.094.68-.165 1.014-.09.377-.438.46-.66.124-.112-.17-.122-.388-.138-.587a98.335 98.335 0 01-.098-1.872c-.044-.646.108-.898.588-1.298.259-.263.3-.595.232-.955l-.022-.102c-.077-.352-.167-.715-.4-.996-.362-.432-1.06-.554-1.495-.158-.556.515-.644 1.344-.361 2.021l.01.025c.232.546.445 1.108.533 1.695l.009.061c.064.427.05.867-.01 1.293l-.013.096c-.026.193-.042.423-.163.554-.089.1-.257.129-.389.082-.173-.055-.201-.263-.203-.427-.002-.637-.154-1.246-.32-1.852l-.084-.304a17.057 17.057 0 01-.174-.669l-.22-.949c-.2-.87-.396-1.742-.565-2.62-.504-1.985.138-3.798 1.852-4.934.37-.228.792-.434 1.236-.434.573-.004 1.156.34 1.4.88.082.188.093.394.086.597V5.2c-.031.816-.071 1.633-.11 2.45l-.02.412-.013.274c-.023.458-.042.915-.036 1.374.003.113-.005.24.016.347.01.047.023.07.037.06l.003-.001-.002-.002c.028-.024.05-.149.054-.208.019-.184.038-.369.054-.553.102-1.29.162-2.582.28-3.87.075-.899.953-2.621 2.03-1.925zM1.84 3.237c-.33.095-.365.509-.32.804l.02.167c.045.39.099.78.187 1.16l.054.224c.05.203.093.407.078.617-.03.253-.088.499-.007.746.177.7.449 1.363.78 1.999l.014.02c.107.15.073-.046.033-.135l-.195-.482c-.065-.16-.13-.321-.19-.483l-.082-.217c-.165-.446-.307-.895-.203-1.38.082-.268.08-.537-.037-.796-.228-.605-.363-1.25-.23-1.89.23-.935 1.874.88 2.082 1.23.205.29.379.614.512.948.257.655.505 1.304.743 1.964.849 2.276 1.312 4.665 1.713 7.065l.001.001a1.37 1.37 0 00-.011-.274l-.002-.012c-.07-.573-.135-1.15-.209-1.722-.245-2.102-.837-4.132-1.562-6.113l-.037-.103a6.717 6.717 0 00-1.063-1.937l-.023-.027C3.506 4.15 2.44 3.075 1.84 3.237zm5.688 10.665c.119.666.373.617.964.656h.013c.317.03.503-.115.559-.422l.003-.019c.146-.84-.385-1.915-1.262-2.068-.781-.079-.347 1.417-.277 1.853zm.67-1.185c.214.21.4.555.353.899l-.003.011c-.066.216-.397.167-.52.054a.392.392 0 01-.088-.172c-.07-.245-.134-.507-.127-.764.023-.264.264-.158.385-.028zm4.026-2.251c.4.147.491.734.273 1.078-.328.499-1.009.373-.966-.299v-.015c.006-.369.274-.886.693-.764zm7.163-5.23v.01c-.014.173.01.355.028.529.148 1.259.17 2.518-.015 3.775-.04.28-.093.555-.15.832-.024.175-.108.41-.094.571l.002.002c.01.009.036-.032.063-.101.054-.14.092-.3.126-.448.364-1.723.499-3.504.304-5.255-.075-.246-.25-.12-.264.085zm-.962.684c.271.565.321 1.175.35 1.784l.011.278c.008.172.016.342.03.511h.001c.14-.862.114-1.766-.35-2.544l-.02-.035c-.053-.084-.064-.09-.022.006zm2.225-.994c-.021.01-.02.095-.024.133-.027.705-.073 1.37-.086 2.033h.001l.054-.243c.124-.57.231-1.16.103-1.79l-.009-.036c-.01-.04-.023-.09-.039-.097zm-12.524-2.2c.281.257.521.567.68.917.282.646-.196 1.064-.811 1.063h-.032c-.55.015-1.096-.403-1.18-.955l-.002-.02c-.11-.691.705-1.576 1.345-1.005zm5.76-1.494l.007.012c.094.15.17.315.247.475l.017.036c.064.136.131.253.098.395l-.002.01v.001l-.017.064c-.037.139-.087.302-.187.404-.227.264-.684.22-.867-.073l-.009-.015c-.239-.394-.148-1.039.19-1.344.147-.133.41-.141.523.035zM20.337.5c.96.022.681 1.21-.15 1.16a.568.568 0 01-.493-.65c.035-.33.279-.505.61-.51h.033z" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/publicai.svg b/public/providers/publicai.svg
new file mode 100644
index 0000000000..d028fc3c97
--- /dev/null
+++ b/public/providers/publicai.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>PublicAI</title><circle cx="12" cy="12" r="12" fill="#6366F1"/><text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui, sans-serif">P</text></svg>
\ No newline at end of file
diff --git a/public/providers/qiniu.svg b/public/providers/qiniu.svg
new file mode 100644
index 0000000000..492117530c
--- /dev/null
+++ b/public/providers/qiniu.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Qiniu</title>
+  <path d="M12 3a9 9 0 100 18 9 9 0 000-18z" fill="none" stroke="#00A4EE" stroke-width="3"/>
+  <path d="M16 16l3 4.5" fill="none" stroke="#00A4EE" stroke-width="3" stroke-linecap="round"/>
+</svg>
diff --git a/public/providers/qwen.svg b/public/providers/qwen.svg
new file mode 100644
index 0000000000..3a2f756e66
--- /dev/null
+++ b/public/providers/qwen.svg
@@ -0,0 +1 @@
+<svg fill="#ffff" fill-rule="evenodd" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Qwen</title><path d="M12.604 1.34c.393.69.784 1.382 1.174 2.075a.18.18 0 00.157.091h5.552c.174 0 .322.11.446.327l1.454 2.57c.19.337.24.478.024.837-.26.43-.513.864-.76 1.3l-.367.658c-.106.196-.223.28-.04.512l2.652 4.637c.172.301.111.494-.043.77-.437.785-.882 1.564-1.335 2.34-.159.272-.352.375-.68.37-.777-.016-1.552-.01-2.327.016a.099.099 0 00-.081.05 575.097 575.097 0 01-2.705 4.74c-.169.293-.38.363-.725.364-.997.003-2.002.004-3.017.002a.537.537 0 01-.465-.271l-1.335-2.323a.09.09 0 00-.083-.049H4.982c-.285.03-.553-.001-.805-.092l-1.603-2.77a.543.543 0 01-.002-.54l1.207-2.12a.198.198 0 000-.197 550.951 550.951 0 01-1.875-3.272l-.79-1.395c-.16-.31-.173-.496.095-.965.465-.813.927-1.625 1.387-2.436.132-.234.304-.334.584-.335a338.3 338.3 0 012.589-.001.124.124 0 00.107-.063l2.806-4.895a.488.488 0 01.422-.246c.524-.001 1.053 0 1.583-.006L11.704 1c.341-.003.724.032.9.34zm-3.432.403a.06.06 0 00-.052.03L6.254 6.788a.157.157 0 01-.135.078H3.253c-.056 0-.07.025-.041.074l5.81 10.156c.025.042.013.062-.034.063l-2.795.015a.218.218 0 00-.2.116l-1.32 2.31c-.044.078-.021.118.068.118l5.716.008c.046 0 .08.02.104.061l1.403 2.454c.046.081.092.082.139 0l5.006-8.76.783-1.382a.055.055 0 01.096 0l1.424 2.53a.122.122 0 00.107.062l2.763-.02a.04.04 0 00.035-.02.041.041 0 000-.04l-2.9-5.086a.108.108 0 010-.113l.293-.507 1.12-1.977c.024-.041.012-.062-.035-.062H9.2c-.059 0-.073-.026-.043-.077l1.434-2.505a.107.107 0 000-.114L9.225 1.774a.06.06 0 00-.053-.031zm6.29 8.02c.046 0 .058.02.034.06l-.832 1.465-2.613 4.585a.056.056 0 01-.05.029.058.058 0 01-.05-.029L8.498 9.841c-.02-.034-.01-.052.028-.054l.216-.012 6.722-.012z"></path></svg>
\ No newline at end of file
diff --git a/public/providers/recraft.svg b/public/providers/recraft.svg
new file mode 100644
index 0000000000..e5bb701575
--- /dev/null
+++ b/public/providers/recraft.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" fill-rule="evenodd">
+  <title>Recraft</title>
+  <path d="M19.667 8.275c0-4.57-4.15-8.275-9.27-8.275-1.774 0-3.213 3.705-3.213 8.275 0 1.143.09 2.233.253 3.224H4.29L1 23h9.4v-6.447c5.117 0 9.266-3.707 9.266-8.275l.001-.002zm-9.27-6.76c.93 0 1.682 3.028 1.682 6.76 0 3.733-.752 6.76-1.681 6.76-.93 0-1.681-3.027-1.681-6.76 0-3.732.752-6.76 1.68-6.76z" />
+  <path d="M19.848 16.552h-9.44L14.028 23h9.438l-3.618-6.448z" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/replicate.svg b/public/providers/replicate.svg
new file mode 100644
index 0000000000..4637f35378
--- /dev/null
+++ b/public/providers/replicate.svg
@@ -0,0 +1,12 @@
+<svg width="726" height="726" viewBox="0 0 726 726" fill="#ffff" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_1_3)">
+<path d="M726 310.438V392.476H438.068V726H346.302V310.438H726Z" fill="#ffff"/>
+<path d="M726 155.219V237.402H264.845V726H173.078V155.219H726Z" fill="#ffff"/>
+<path d="M726 0V82.1832H91.7664V726H0V0H726Z" fill="#ffff"/>
+</g>
+<defs>
+<clipPath id="clip0_1_3">
+<rect width="726" height="726" fill="#ffff"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/public/providers/requesty.svg b/public/providers/requesty.svg
new file mode 100644
index 0000000000..3b63649d52
--- /dev/null
+++ b/public/providers/requesty.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>Requesty</title><circle cx="12" cy="12" r="12" fill="#9333EA"/><text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui, sans-serif">R</text></svg>
diff --git a/public/providers/roocode.svg b/public/providers/roocode.svg
new file mode 100644
index 0000000000..3ce8ece8d3
--- /dev/null
+++ b/public/providers/roocode.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" fill-rule="evenodd">
+  <title>RooCode</title>
+  <path d="M20.113 5.5l-.442 1.557a.157.157 0 01-.196.106l-7.414-2.157a.16.16 0 00-.143.028l-7.342 5.74a.159.159 0 01-.074.032l-4.37.656a.154.154 0 00-.132.162l.02.245c.005.078.071.14.152.141l5.074.128.058.002 3.75-1.953a.16.16 0 01.164.01l2.657 1.847a.152.152 0 01.066.125l-.023 2.45c0 .032.01.063.028.089l3.737 5.227c.03.04.077.065.129.065h1.182a.153.153 0 00.14-.224l-2.664-4.919a.15.15 0 01.005-.152l1.389-2.169a.156.156 0 01.062-.055l4.965-2.456a.16.16 0 01.158.01l1.418.921a.16.16 0 00.087.026h1.289c.125 0 .2-.136.13-.237l-3.578-5.29c-.074-.109-.246-.082-.282.044z" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/runway.svg b/public/providers/runway.svg
new file mode 100644
index 0000000000..5dc14b1fdf
--- /dev/null
+++ b/public/providers/runway.svg
@@ -0,0 +1,14 @@
+<svg width="300" height="300" viewBox="0 0 300 300" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_1_2)">
+<path d="M212.486 105.22C216.254 116.938 215.261 127.642 207.452 137.312C203.943 141.658 198.973 144.485 189.13 147.005C191.57 149.279 193.809 151.242 195.906 153.347C199.96 157.417 203.986 161.518 207.932 165.693C217.154 175.451 216.804 189.546 210.541 200.693C202.271 215.412 181.191 220.187 168.48 209.238C162.421 204.019 156.733 198.368 150.904 192.884C149.733 191.782 148.681 190.553 147.407 189.205C146.401 192.311 145.751 195.242 144.537 197.918C137.775 212.822 118.698 218.857 103.153 211.198C92.5986 205.997 87.6601 197.087 87.4939 185.832C87.1521 162.69 87.2602 139.539 87.4386 116.393C87.5585 100.838 100.245 87.4862 115.766 87.2205C139.448 86.8152 163.146 86.8725 186.831 87.2132C199.002 87.3883 207.628 93.6476 212.486 105.22ZM125.01 108.086C121.119 105.032 116.875 103.935 112.324 106.343C107.723 108.778 105.575 112.638 105.603 118.003C105.72 140.149 105.625 162.295 105.698 184.441C105.705 186.442 105.972 188.617 106.788 190.405C109.016 195.282 114.992 197.672 120.598 196.281C125.959 194.95 129.101 190.869 129.104 185.111C129.118 162.639 129.062 140.167 129.158 117.695C129.174 113.951 128.015 110.938 125.01 108.086ZM150.442 146.846C149.498 146.891 148.553 146.936 147.39 146.991C147.39 152.27 147.336 157.358 147.443 162.443C147.461 163.291 147.983 164.313 148.597 164.935C158.035 174.501 167.442 184.102 177.083 193.46C178.821 195.148 181.473 196.395 183.878 196.791C188.779 197.599 193.731 194.313 196.144 189.426C198.157 185.348 197.209 180.335 193.55 176.606C185.263 168.162 176.836 159.854 168.643 151.321C165.437 147.981 162.029 146.038 157.259 146.793C155.245 147.112 153.138 146.846 150.442 146.846ZM169.239 105.042C161.272 105.042 153.305 105.042 145.948 105.042C146.614 113.151 147.252 120.934 147.905 128.886C160.176 128.886 172.526 128.917 184.876 128.875C192.21 128.849 196.856 124.101 196.812 116.824C196.77 109.897 191.917 105.095 184.857 105.049C179.869 105.016 174.88 105.042 169.239 105.042Z" fill="#FEFEFE"/>
+<path d="M125.184 108.249C128.015 110.938 129.174 113.951 129.158 117.695C129.062 140.167 129.118 162.639 129.104 185.111C129.101 190.869 125.959 194.95 120.598 196.281C114.992 197.672 109.016 195.282 106.788 190.405C105.972 188.617 105.705 186.442 105.698 184.441C105.625 162.295 105.72 140.149 105.603 118.003C105.575 112.638 107.723 108.778 112.324 106.343C116.875 103.935 121.119 105.032 125.184 108.249Z" fill="black"/>
+<path d="M150.758 146.846C153.138 146.846 155.245 147.112 157.259 146.793C162.029 146.038 165.437 147.981 168.643 151.321C176.836 159.854 185.263 168.162 193.55 176.606C197.209 180.335 198.157 185.348 196.144 189.426C193.731 194.313 188.779 197.599 183.878 196.791C181.473 196.395 178.821 195.148 177.083 193.46C167.442 184.102 158.035 174.501 148.597 164.935C147.983 164.313 147.461 163.291 147.443 162.443C147.336 157.358 147.39 152.27 147.39 146.991C148.553 146.936 149.498 146.891 150.758 146.846Z" fill="black"/>
+<path d="M169.565 105.042C174.88 105.042 179.869 105.016 184.857 105.049C191.917 105.095 196.77 109.897 196.812 116.824C196.857 124.101 192.21 128.849 184.876 128.875C172.526 128.917 160.176 128.886 147.905 128.886C147.252 120.934 146.614 113.151 145.948 105.042C153.305 105.042 161.272 105.042 169.565 105.042Z" fill="black"/>
+<path d="M137.645 300C91.5518 300 45.7852 300 0 300C0 200.02 0 100.04 0 0C99.9541 0 199.927 0 300 0C300 99.9603 300 199.98 300 300C246.028 300 191.999 300 137.645 300ZM211.789 104.298C207.039 92.9544 198.41 86.6939 186.234 86.5187C162.54 86.178 138.833 86.1207 115.141 86.5261C99.6132 86.7918 86.9221 100.146 86.8022 115.705C86.6237 138.855 86.5156 162.011 86.8575 185.157C87.0238 196.414 91.9642 205.326 102.523 210.528C118.074 218.188 137.158 212.152 143.923 197.245C145.137 194.569 145.788 191.637 146.794 188.53C148.069 189.879 149.121 191.108 150.293 192.21C156.124 197.695 161.814 203.348 167.876 208.568C180.592 219.518 201.68 214.743 209.953 200.021C216.218 188.871 216.569 174.774 207.343 165.014C203.396 160.838 199.369 156.736 195.312 152.666C193.215 150.561 190.975 148.597 188.534 146.323C198.38 143.802 203.352 140.974 206.863 136.628C214.675 126.956 215.668 116.25 211.789 104.298Z" fill="black"/>
+</g>
+<defs>
+<clipPath id="clip0_1_2">
+<rect width="300" height="300" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/public/providers/sambanova.svg b/public/providers/sambanova.svg
new file mode 100644
index 0000000000..38afe1b9ee
--- /dev/null
+++ b/public/providers/sambanova.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>SambaNova</title>
+  <path d="M23 23h-1.223V8.028c0-3.118-2.568-5.806-5.744-5.806H8.027c-3.176 0-5.744 2.565-5.744 5.686 0 3.119 2.568 5.684 5.744 5.684h.794c1.346 0 2.445 1.1 2.445 2.444 0 1.346-1.1 2.446-2.445 2.446H1v-1.223h7.761c.671 0 1.223-.551 1.223-1.16 0-.67-.552-1.16-1.223-1.16h-.794C4.177 14.872 1 11.756 1 7.909 1 4.058 4.176 1 8.027 1h8.066C19.88 1 23 4.239 23 8.028V23z"
+        fill="#EE7624" />
+  <path d="M8.884 12.672c1.71.06 3.361 1.588 3.361 3.422 0 1.833-1.528 3.421-3.421 3.421H1v1.223h7.761c2.568 0 4.705-2.077 4.705-4.644 0-.672-.123-1.283-.43-1.894-.245-.551-.67-1.1-1.099-1.528-.489-.429-1.039-.734-1.65-.977-.525-.175-1.048-.193-1.594-.212-.218-.008-.441-.016-.669-.034-.428 0-1.406-.245-1.956-.61a3.369 3.369 0 01-1.223-1.406c-.183-.489-.305-.977-.305-1.528A3.417 3.417 0 017.96 4.482h8.066c1.895 0 3.422 1.65 3.422 3.483v15.032h1.223V8.027c0-2.568-2.077-4.768-4.645-4.768h-8c-2.568 0-4.705 2.077-4.705 4.646 0 .67.123 1.282.43 1.894a4.45 4.45 0 001.099 1.528c.429.428 1.039.734 1.588.976.306.123.611.183.976.246.857.06 1.406.123 1.466.123h.003z"
+        fill="#EE7624" />
+  <path d="M1 23h7.761v-.003c3.85 0 7.03-3.116 7.09-7.026 0-3.79-3.117-6.906-6.967-6.906H8.09c-.672 0-1.222-.552-1.222-1.16 0-.608.487-1.16 1.159-1.16h8.069c.608 0 1.159.611 1.159 1.283v14.97h1.223V8.024c0-1.345-1.1-2.505-2.445-2.505H7.967a2.451 2.451 0 00-2.445 2.445 2.45 2.45 0 002.445 2.445h.794c3.176 0 5.744 2.568 5.744 5.684s-2.568 5.684-5.744 5.684H1V23z"
+        fill="#EE7624" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/searchapi.svg b/public/providers/searchapi.svg
new file mode 100644
index 0000000000..fe1da13449
--- /dev/null
+++ b/public/providers/searchapi.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" fill-rule="evenodd">
+  <title>SearchApi</title>
+  <path d="M12.822 22.133H11.18V14.15h1.643v7.982zm-3.288-4.456A3.128 3.128 0 016.41 20.8H5.59v-1.645h.821c.816 0 1.48-.664 1.48-1.48v-4.41h1.644v4.41zm6.575 0c0 .815.664 1.48 1.48 1.48h.821V20.8h-.821a3.127 3.127 0 01-3.123-3.124v-4.411h1.643v4.41zM12 1c4.08 0 7.396 3.318 7.396 7.396v7.11a1.481 1.481 0 002.96 0V11.56H24v3.947c0 1.722-1.4 3.123-3.123 3.123a3.127 3.127 0 01-3.124-3.123v-7.11A5.76 5.76 0 0012 2.643a5.76 5.76 0 00-5.753 5.752v7.11a3.128 3.128 0 01-3.125 3.124A3.126 3.126 0 010 15.507V11.56h1.644v3.947c0 .815.663 1.48 1.478 1.48.817 0 1.48-.665 1.48-1.48v-7.11C4.603 4.317 7.922 1 12 1zm-1.174 10.56H8.941V8.566h1.885v2.995zm4.232-2.995v2.995h-1.883V8.566h1.883z" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/sensenova.svg b/public/providers/sensenova.svg
index 9bd7ebda11..17f1d82c53 100644
--- a/public/providers/sensenova.svg
+++ b/public/providers/sensenova.svg
@@ -1,5 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
-  <circle cx="16" cy="16" r="14" fill="#0066FF" opacity="0.15"/>
-  <circle cx="16" cy="16" r="14" fill="none" stroke="#0066FF" stroke-width="2"/>
-  <text x="16" y="16" text-anchor="middle" dominant-baseline="central" font-family="system-ui,-apple-system,sans-serif" font-size="11" font-weight="600" fill="#0066FF">SN</text>
-</svg>
+<svg height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>SenseNova</title><path d="M23 8.333h-7.333v7.334H23V8.333z" fill="#06FDB7"></path><path d="M1 1v14.667h7.333V8.333h7.334V1H1z" fill="#5B2AD8"></path><path d="M14.038 4.333h.17l1.459 1.456v.17l-1.63-1.626zM13.224 4.333h.17l2.273 2.268v.17l-2.443-2.438zM12.41 4.333h.17l3.087 3.08v.17l-3.257-3.25zM11.596 4.333h.17l3.9 3.892v.108h-.06l-4.01-4zM10.782 4.333h.17l4.01 4h-.17l-4.01-4zM9.968 4.333h.17l4.009 4h-.17l-4.01-4zM9.154 4.333h.17l4.009 4h-.17l-4.01-4zM8.34 4.333h.17l4.01 4h-.17l-4.01-4zM7.521 4.333h.17l4.01 4h-.17l-4.01-4zM6.707 4.333h.17l4.01 4h-.17l-4.01-4zM5.892 4.333h.17l4.009 4h-.17l-4.01-4zM5.077 4.333h.17l4.01 4h-.17l-4.01-4zM4.333 4.403v-.07h.1l4.01 4h-.11v.06l-4-3.99zM4.333 5.215v-.17l4 3.991v.17l-4-3.99zM4.333 6.027v-.17l4 3.991v.17l-4-3.99zM4.333 6.84v-.17l4 3.99v.17l-4-3.99zM4.333 7.652v-.17l4 3.99v.17l-4-3.99zM4.333 8.464v-.17l4 3.99v.17l-4-3.99zM4.333 9.276v-.17l4 3.991v.17l-4-3.991zM4.333 10.088v-.17l4 3.991v.17l-4-3.991zM4.333 10.9v-.17l4 3.991v.17l-4-3.991zM4.333 11.712v-.17l4 3.991v.134h-.036l-3.964-3.955zM4.333 12.526v-.17l3.318 3.31h-.17l-3.148-3.14zM4.333 13.34v-.169l2.502 2.496h-.17L4.333 13.34zM4.333 14.152v-.169l1.688 1.684h-.17l-1.518-1.514zM4.333 14.965v-.17l.874.872h-.17l-.704-.702zM15.667 5.146l-.815-.813h.17l.645.644v.169z" fill="#06FDB7"></path><path d="M23 15.667h-7.333V23H23v-7.333z" fill="#5B2AD8"></path><path d="M15.667 15.667H8.333V23h7.334v-7.333z" fill="#06FDB7"></path></svg>
\ No newline at end of file
diff --git a/public/providers/snowflake.svg b/public/providers/snowflake.svg
new file mode 100644
index 0000000000..f62ab5f446
--- /dev/null
+++ b/public/providers/snowflake.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Snowflake</title>
+  <path clip-rule="evenodd"
+        d="M23.252 10.365l-2.843 1.636 2.843 1.631a1.47 1.47 0 01.697.903 1.492 1.492 0 01-.15 1.135c-.202.342-.53.591-.912.693a1.498 1.498 0 01-1.132-.15l-5.09-2.924a1.473 1.473 0 01-.68-.851 1.446 1.446 0 01-.068-.485 1.5 1.5 0 01.745-1.248l5.09-2.921a1.496 1.496 0 012.044.547 1.479 1.479 0 01-.544 2.034zm-2.692 7.927l-5.087-2.92a1.477 1.477 0 00-.867-.195 1.478 1.478 0 00-.982.468c-.257.276-.4.639-.403 1.017v5.847A1.49 1.49 0 0014.718 24c.828 0 1.497-.668 1.497-1.491v-3.27l2.849 1.636a1.493 1.493 0 002.044-.544 1.49 1.49 0 00-.548-2.04zm-5.87-5.719l-2.116 2.102a.42.42 0 01-.265.112h-.621a.427.427 0 01-.265-.112l-2.115-2.102a.42.42 0 01-.11-.262v-.62a.43.43 0 01.11-.265l2.114-2.102a.426.426 0 01.264-.11h.623a.422.422 0 01.265.11l2.116 2.102a.43.43 0 01.109.265v.62a.428.428 0 01-.11.262zM13 11.99a.442.442 0 00-.113-.266l-.612-.607a.431.431 0 00-.266-.11h-.024a.426.426 0 00-.264.11l-.612.607a.436.436 0 00-.107.266v.024c0 .085.047.202.107.262l.612.61c.061.06.179.11.264.11h.024a.434.434 0 00.266-.11l.612-.61a.429.429 0 00.112-.262v-.024zM3.436 5.704l5.089 2.924c.274.157.578.219.868.195.375-.026.726-.194.983-.47.256-.275.4-.64.403-1.017V1.489C10.78.667 10.11 0 9.284 0c-.829 0-1.498.667-1.498 1.49v3.27l-2.85-1.639a1.496 1.496 0 00-2.045.546 1.489 1.489 0 00.546 2.037zm11.17 3.119c.29.024.594-.038.866-.195l5.087-2.923a1.474 1.474 0 00.697-.903 1.496 1.496 0 00-.149-1.135 1.496 1.496 0 00-2.044-.545L16.215 4.76V1.489C16.215.667 15.546 0 14.718 0c-.83 0-1.497.667-1.497 1.49v5.845a1.491 1.491 0 001.385 1.487zm-5.213 6.354a1.479 1.479 0 00-.868.194l-5.089 2.92a1.476 1.476 0 00-.696.905 1.498 1.498 0 00.148 1.135 1.496 1.496 0 002.044.543l2.851-1.636v3.27c0 .825.67 1.491 1.498 1.491.826 0 1.496-.667 1.496-1.49v-5.847a1.5 1.5 0 00-.401-1.017 1.477 1.477 0 00-.982-.468zm-1.38-2.74c.05-.156.072-.32.068-.484a1.497 1.497 0 00-.751-1.248l-5.084-2.92a1.499 1.499 0 00-2.045.547 1.481 1.481 0 00.549 2.034l2.841 1.636L.75 13.633a1.47 1.47 0 00-.698.903 1.492 1.492 0 00.15 1.135c.202.343.53.592.912.693.382.102.789.048 1.132-.15l5.086-2.924c.345-.195.577-.505.684-.852z"
+        fill="#249EDC"
+        fill-rule="evenodd" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/stepfun.svg b/public/providers/stepfun.svg
index 2a7196ea47..920e8a607a 100644
--- a/public/providers/stepfun.svg
+++ b/public/providers/stepfun.svg
@@ -1,5 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
-  <circle cx="16" cy="16" r="14" fill="#8B5CF6" opacity="0.15"/>
-  <circle cx="16" cy="16" r="14" fill="none" stroke="#8B5CF6" stroke-width="2"/>
-  <text x="16" y="16" text-anchor="middle" dominant-baseline="central" font-family="system-ui,-apple-system,sans-serif" font-size="11" font-weight="600" fill="#8B5CF6">SF</text>
-</svg>
+<svg height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Stepfun</title><path d="M22.012 0h1.032v.927H24v.968h-.956V3.78h-1.032V1.896h-1.878v-.97h1.878V0zM2.6 12.371V1.87h.969v10.502h-.97zm10.423.66h10.95v.918h-6.208v9.579h-4.742V13.03zM5.629 3.333v12.356H0v4.51h10.386V8L20.859 8l-.003-4.668-15.227.001z" fill="url(#lobe-icons-stepfun-_R_0_)" fill-rule="evenodd"></path><defs><linearGradient gradientUnits="userSpaceOnUse" id="lobe-icons-stepfun-_R_0_" x1="1.646" x2="18.342" y1="1.916" y2="22.091"><stop stop-color="#01A9FF"></stop><stop offset="1" stop-color="#0160FF"></stop></linearGradient></defs></svg>
\ No newline at end of file
diff --git a/public/providers/sumopod.svg b/public/providers/sumopod.svg
new file mode 100644
index 0000000000..3c59edeb45
--- /dev/null
+++ b/public/providers/sumopod.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>Sumopod</title><circle cx="12" cy="12" r="12" fill="#06B6D4"/><text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui, sans-serif">S</text></svg>
diff --git a/public/providers/suno.svg b/public/providers/suno.svg
new file mode 100644
index 0000000000..e2ddb78425
--- /dev/null
+++ b/public/providers/suno.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" class="styles_icon__x_9Ga styles_icon__rC_ZS" viewBox="0 0 122 122"><path fill="currentColor" fill-rule="evenodd" d="M1.773 8.882C0 12.362 0 16.916 0 26.027v69.946c0 9.111 0 13.666 1.773 17.145a16.27 16.27 0 0 0 7.109 7.109C12.362 122 16.916 122 26.027 122h69.946c9.111 0 13.666 0 17.145-1.773a16.27 16.27 0 0 0 7.109-7.109C122 109.639 122 105.084 122 95.973V26.027c0-9.11 0-13.666-1.773-17.145a16.27 16.27 0 0 0-7.109-7.109C109.639 0 105.084 0 95.973 0H26.027C16.917 0 12.36 0 8.882 1.773a16.27 16.27 0 0 0-7.109 7.109M105.733 61c0-24.705-12.517-44.733-27.958-44.733S49.817 36.295 49.817 61h-33.55c0 24.706 12.517 44.733 27.958 44.733S72.183 85.705 72.183 61z" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/public/providers/t3-web.svg b/public/providers/t3-web.svg
new file mode 100644
index 0000000000..9433d12018
--- /dev/null
+++ b/public/providers/t3-web.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>T3 Web</title><circle cx="12" cy="12" r="12" fill="#3B82F6"/><text x="12" y="16" text-anchor="middle" fill="white" font-size="13" font-weight="bold" font-family="system-ui, sans-serif">T3</text></svg>
\ No newline at end of file
diff --git a/public/providers/tavily.svg b/public/providers/tavily.svg
new file mode 100644
index 0000000000..c2475ed2be
--- /dev/null
+++ b/public/providers/tavily.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Tavily</title>
+  <path d="M9.1.503l2.824 4.47a1.078 1.078 0 01-.911 1.655H9.858v6.692h-1.67V0c.35 0 .7.168.912.503z"
+        fill="#8FBCFA" />
+  <path d="M4.453 4.974L7.277.503A1.07 1.07 0 018.189 0v13.32a2.633 2.633 0 00-1.67.48V6.628H5.364c-.85 0-1.366-.936-.912-1.654z"
+        fill="#468BFF" />
+  <path d="M17.041 17.74h-7.028c.423-.457.67-1.049.7-1.67h12.956c0 .35-.168.7-.502.912l-4.472 2.823a1.078 1.078 0 01-1.654-.911v-1.155z"
+        fill="#FDBB11" />
+  <path d="M18.695 12.334l4.47 2.824c.336.212.503.562.503.912H10.713a2.65 2.65 0 00-.493-1.67h6.822v-1.154c0-.85.935-1.366 1.653-.912z"
+        fill="#F6D785" />
+  <path d="M4.394 19.605L.316 23.683a1.07 1.07 0 001 .29l5.158-1.165A1.078 1.078 0 007 20.994l-.816-.816 3.073-3.074a1.61 1.61 0 000-2.276l-.042-.043-4.82 4.82z"
+        fill="#FF9A9D" />
+  <path d="M3.822 17.817l3.073-3.074a1.61 1.61 0 012.277 0l.042.043-4.818 4.819-4.08 4.079a1.07 1.07 0 01-.289-1l1.165-5.158A1.078 1.078 0 013.006 17l.816.817z"
+        fill="#FE363B" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/tencent.svg b/public/providers/tencent.svg
index d1dff98da9..98da272a26 100644
--- a/public/providers/tencent.svg
+++ b/public/providers/tencent.svg
@@ -1,5 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
-  <circle cx="16" cy="16" r="14" fill="#07C160" opacity="0.15"/>
-  <circle cx="16" cy="16" r="14" fill="none" stroke="#07C160" stroke-width="2"/>
-  <text x="16" y="16" text-anchor="middle" dominant-baseline="central" font-family="system-ui,-apple-system,sans-serif" font-size="11" font-weight="600" fill="#07C160">TC</text>
-</svg>
+<svg height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Tencent</title><path d="M9.976 1L24 9.8l-10.587.015L10.723 23H5.489L8.18 9.8H3.244L1 5.4h8.077L9.976 1z" fill="#0052D9" fill-rule="evenodd"></path></svg>
\ No newline at end of file
diff --git a/public/providers/theoldllm.svg b/public/providers/theoldllm.svg
new file mode 100644
index 0000000000..e7cfe21492
--- /dev/null
+++ b/public/providers/theoldllm.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>TheOldLLM</title><circle cx="12" cy="12" r="9" fill="none" stroke="#78716C" stroke-width="3"/></svg>
diff --git a/public/providers/tokenrouter.svg b/public/providers/tokenrouter.svg
new file mode 100644
index 0000000000..8931181409
--- /dev/null
+++ b/public/providers/tokenrouter.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>TokenRouter</title><circle cx="12" cy="12" r="12" fill="#8B5CF6"/><text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui, sans-serif">T</text></svg>
\ No newline at end of file
diff --git a/public/providers/topazlabs.svg b/public/providers/topazlabs.svg
new file mode 100644
index 0000000000..c141a9a36b
--- /dev/null
+++ b/public/providers/topazlabs.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" fill-rule="evenodd">
+  <title>TopazLabs</title>
+  <path d="M2 15.357V22h6.65v-6.643H2zM15.32 15.357V8.714H8.67v6.643h6.65zM22 8.643V2h-6.65v6.643H22z" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/trae.svg b/public/providers/trae.svg
new file mode 100644
index 0000000000..3d048c0c25
--- /dev/null
+++ b/public/providers/trae.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>TRAE</title>
+  <path d="M24 20.541H3.428v-3.426H0V3.4h24V20.54zM3.428 17.115h17.144V6.827H3.428v10.288zm8.573-5.196l-2.425 2.424-2.424-2.424 2.424-2.424 2.425 2.424zm6.857-.001l-2.424 2.423-2.425-2.423 2.425-2.425 2.424 2.425z"
+        fill="#32F08C" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/udio.svg b/public/providers/udio.svg
new file mode 100644
index 0000000000..7bb9b62c3b
--- /dev/null
+++ b/public/providers/udio.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Udio</title>
+  <path d="M15.763 1.02c.212-.021.44.002.654.004l1.21.001c1.68.001 3.373.043 5.052-.025l-.001 8.93v2.652c0 .744.013 1.486-.065 2.227a9.643 9.643 0 01-.585 2.453 8.895 8.895 0 01-3.215 4.14c-.289.201-.602.422-.925.564a10.01 10.01 0 01-2.582.976c-.361.083-.728.131-1.088.216-.381-.311-.725-.694-1.072-1.043l-1.893-1.893c-.722-.716-1.455-1.417-2.171-2.14-.303-.304-.639-.604-.907-.938.106.694.047 1.75.047 2.486.007 1.457.003 2.913-.013 4.37a.906.906 0 01-.046-.035c-.236-.185-.447-.428-.66-.642-.41-.415-.823-.827-1.239-1.237l-2.991-2.979c-.54-.54-1.098-1.07-1.624-1.623-.07-.074-.215-.21-.228-.311a.348.348 0 01.129.001l-.005-.012c.869-.05 1.76-.013 2.63-.013 1.332 0 2.665-.018 3.996.001a597.835 597.835 0 01-6.839-6.807c-.047-.357-.02-.74-.02-1.101l.001-1.915L1.3 1.178c0-.04.01-.075.028-.112.059-.04.104-.038.175-.042.52-.03 1.06 0 1.582.001 1.512 0 3.036.042 4.546-.006.197-.014.397-.011.594-.015l-.003 10.581c.009 1.859.003 3.717-.018 5.575.426-.044.89-.01 1.32-.01h2.772c.964-.007 1.857-.19 2.558-.904.538-.548.764-1.256.88-2 .08-.51.042-1.08.041-1.597l-.002-2.645c-.001-2.994.026-5.99-.01-8.984z"
+        fill="#E30A5D" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/uncloseai.svg b/public/providers/uncloseai.svg
new file mode 100644
index 0000000000..d3cd654cc7
--- /dev/null
+++ b/public/providers/uncloseai.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>UncloseAI</title><circle cx="12" cy="12" r="12" fill="#14B8A6"/><text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui, sans-serif">U</text></svg>
diff --git a/public/providers/upstage.svg b/public/providers/upstage.svg
new file mode 100644
index 0000000000..d9db3f1838
--- /dev/null
+++ b/public/providers/upstage.svg
@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" fill-rule="evenodd">
+  <title>Upstage</title>
+  <path d="M19.763 0l-.373 1.297h2.594L22.354 0h-2.591z" />
+  <path d="M16.192 2.27l-.376 1.298h5.52l.37-1.298h-5.514z" />
+  <path d="M12.897 4.54l-.377 1.298h8.167l.37-1.297h-8.16z" />
+  <path d="M2.85 6.81l-.377 1.298h17.565l.37-1.297H2.85z" />
+  <path d="M3.884 9.081l-.376 1.297H19.39l.37-1.297H3.883z" />
+  <path d="M4.088 24l.376-1.297H1.866L1.5 24h2.588z" />
+  <path d="M7.662 21.73l.376-1.298H2.515L2.15 21.73h5.513z" />
+  <path d="M10.957 19.46l.377-1.298h-8.17l-.367 1.297h8.16z" />
+  <path d="M21.005 17.19l.376-1.298H3.812l-.366 1.297h17.559z" />
+  <path d="M19.967 14.919l.376-1.297H4.461l-.366 1.297h15.872z" />
+  <path d="M18.787 12.649l.376-1.298H4.26l-.366 1.298h14.893z" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/v0.svg b/public/providers/v0.svg
new file mode 100644
index 0000000000..32fcc405fd
--- /dev/null
+++ b/public/providers/v0.svg
@@ -0,0 +1 @@
+<svg height="16" xmlns="http://www.w3.org/2000/svg" stroke-linejoin="round" viewBox="0 0 16 16" width="16"><path clip-rule="evenodd" d="M9.50321 5.5H13.2532C13.3123 5.5 13.3704 5.5041 13.4273 5.51203L9.51242 9.42692C9.50424 9.36912 9.5 9.31006 9.5 9.25L9.5 5.5L8 5.5L8 9.25C8 10.7688 9.23122 12 10.75 12H14.5V10.5L10.75 10.5C10.6899 10.5 10.6309 10.4958 10.5731 10.4876L14.4904 6.57028C14.4988 6.62897 14.5032 6.68897 14.5032 6.75V10.5H16.0032V6.75C16.0032 5.23122 14.772 4 13.2532 4H9.50321V5.5ZM0 5V5.00405L5.12525 11.5307C5.74119 12.3151 7.00106 11.8795 7.00106 10.8822V5H5.50106V9.58056L1.90404 5H0Z" fill="white" fill-rule="evenodd"></path></svg>
\ No newline at end of file
diff --git a/public/providers/veoaifree-web.svg b/public/providers/veoaifree-web.svg
new file mode 100644
index 0000000000..9612e46c71
--- /dev/null
+++ b/public/providers/veoaifree-web.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>VeoAI Free Web</title><circle cx="12" cy="12" r="12" fill="#10B981"/><text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui, sans-serif">V</text></svg>
diff --git a/public/providers/vercel.svg b/public/providers/vercel.svg
new file mode 100644
index 0000000000..75968916c4
--- /dev/null
+++ b/public/providers/vercel.svg
@@ -0,0 +1 @@
+<svg viewBox="0 0 256 222" width="256" height="222" xmlns="http://www.w3.org/2000/svg" preserveAspectRatio="xMidYMid"><path fill="#fff" d="m128 0 128 221.705H0z"/></svg>
\ No newline at end of file
diff --git a/public/providers/vllm.svg b/public/providers/vllm.svg
new file mode 100644
index 0000000000..3adec97b6b
--- /dev/null
+++ b/public/providers/vllm.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>vLLM</title>
+  <path d="M0 4.973h9.324V23L0 4.973z" fill="#FDB515" />
+  <path d="M13.986 4.351L22.378 0l-6.216 23H9.324l4.662-18.649z" fill="#30A2FF" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/volcengine.svg b/public/providers/volcengine.svg
new file mode 100644
index 0000000000..1423adbc65
--- /dev/null
+++ b/public/providers/volcengine.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Volcengine (火山引擎)</title>
+  <path d="M19.44 10.153l-2.936 11.586a.215.215 0 00.214.261h5.87a.215.215 0 00.214-.261l-2.95-11.586a.214.214 0 00-.412 0zM3.28 12.778l-2.275 8.96A.214.214 0 001.22 22h4.532a.212.212 0 00.214-.165.214.214 0 000-.097l-2.276-8.96a.214.214 0 00-.41 0z"
+        fill="#00E5E5" />
+  <path d="M7.29 5.359L3.148 21.738a.215.215 0 00.203.261h8.29a.214.214 0 00.215-.261L7.7 5.358a.214.214 0 00-.41 0z"
+        fill="#006EFF" />
+  <path d="M14.44.15a.214.214 0 00-.41 0L8.366 21.739a.214.214 0 00.214.261H19.9a.216.216 0 00.171-.078.214.214 0 00.044-.183L14.439.15z"
+        fill="#006EFF" />
+  <path d="M10.278 7.741L6.685 21.736a.214.214 0 00.214.264h7.17a.215.215 0 00.214-.264L10.688 7.741a.214.214 0 00-.41 0z"
+        fill="#00E5E5" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/voyage.svg b/public/providers/voyage.svg
new file mode 100644
index 0000000000..76861e9f57
--- /dev/null
+++ b/public/providers/voyage.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Voyage</title>
+  <path d="M5.407 0v.066a.974.974 0 00-.048.245c-.011.11-.016.208-.016.295 0 .339.043.715.128 1.13.097.405.274.912.531 1.524l7.125 16.366L20.011 3.39c.161-.404.333-.846.515-1.327.182-.48.273-.966.273-1.458a1.406 1.406 0 00-.096-.54V0H24v.066c-.204.207-.45.578-.74 1.114-.29.535-.606 1.195-.949 1.982L13.095 24h-1.287L3.075 3.965c-.204-.47-.418-.923-.644-1.36-.214-.437-.418-.83-.61-1.18-.194-.36-.365-.66-.515-.9A5.666 5.666 0 001 .064V0h4.407z"
+        fill="#012E33" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/wafer.svg b/public/providers/wafer.svg
new file mode 100644
index 0000000000..59bebcc119
--- /dev/null
+++ b/public/providers/wafer.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>Wafer</title><circle cx="12" cy="12" r="12" fill="#2563EB"/><text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui, sans-serif">W</text></svg>
diff --git a/public/providers/windsurf.svg b/public/providers/windsurf.svg
new file mode 100644
index 0000000000..8f4b214454
--- /dev/null
+++ b/public/providers/windsurf.svg
@@ -0,0 +1 @@
+<svg width="1024" height="1024" viewBox="0 0 1024 1024" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M897.246 286.869H889.819C850.735 286.808 819.017 318.46 819.017 357.539V515.589C819.017 547.15 792.93 572.716 761.882 572.716C743.436 572.716 725.02 563.433 714.093 547.85L552.673 317.304C539.28 298.16 517.486 286.747 493.895 286.747C457.094 286.747 423.976 318.034 423.976 356.657V515.619C423.976 547.181 398.103 572.746 366.842 572.746C348.335 572.746 329.949 563.463 319.021 547.881L138.395 289.882C134.316 284.038 125.154 286.93 125.154 294.052V431.892C125.154 438.862 127.285 445.619 131.272 451.34L309.037 705.2C319.539 720.204 335.033 731.344 352.9 735.392C397.616 745.557 438.77 711.135 438.77 667.278V508.406C438.77 476.845 464.339 451.279 495.904 451.279H495.995C515.02 451.279 532.857 460.562 543.785 476.145L705.235 706.661C718.659 725.835 739.327 737.218 763.983 737.218C801.606 737.218 833.841 705.9 833.841 667.308V508.376C833.841 476.815 859.41 451.249 890.975 451.249H897.276C901.233 451.249 904.43 448.053 904.43 444.097V294.021C904.43 290.065 901.233 286.869 897.276 286.869H897.246Z" fill="#fff"/></svg>
\ No newline at end of file
diff --git a/public/providers/x5lab.svg b/public/providers/x5lab.svg
new file mode 100644
index 0000000000..0fbb720e4a
--- /dev/null
+++ b/public/providers/x5lab.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>x5lab</title><circle cx="12" cy="12" r="12" fill="#6D28D9"/><text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui, sans-serif">X</text></svg>
diff --git a/public/providers/xai.svg b/public/providers/xai.svg
new file mode 100644
index 0000000000..6f6057d454
--- /dev/null
+++ b/public/providers/xai.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" fill-rule="evenodd">
+  <title>xAI</title>
+  <path d="M6.469 8.776L16.512 23h-4.464L2.005 8.776H6.47zm-.004 7.9l2.233 3.164L6.467 23H2l4.465-6.324zM22 2.582V23h-3.659V7.764L22 2.582zM22 1l-9.952 14.095-2.233-3.163L17.533 1H22z" />
+</svg>
\ No newline at end of file
diff --git a/public/providers/xinference.svg b/public/providers/xinference.svg
new file mode 100644
index 0000000000..d97033d417
--- /dev/null
+++ b/public/providers/xinference.svg
@@ -0,0 +1,53 @@
+<svg
+      viewBox="0 0 24 24"
+      xmlns="http://www.w3.org/2000/svg"
+    >
+      <title>Xinference</title>
+      <path
+        d="M5.223 9.692c.652 1.795 1.925 3.376 3.396 4.573 1.482 1.229 3.254 2.17 5.122 2.653a9.99 9.99 0 002.033.302c1.302.05 2.713-.206 3.758-1.04 1.297-1.036 1.651-2.625 1.318-4.21-.209-.993-.641-1.93-1.205-2.787a10.284 10.284 0 00-.366-.525.008.008 0 01.005-.007h.004c.002 0 .004 0 .006.002l.394.405a17.227 17.227 0 012.484 3.262c.579.993 1.023 2.046 1.255 3.144.369 1.747.07 3.546-1.306 4.777-.724.648-1.655 1.041-2.59 1.235-1.297.267-2.649.228-3.965.007-.669-.112-1.315-.26-1.937-.443-2.576-.756-5.012-2.051-7.143-3.677a20.968 20.968 0 01-3.484-3.296C1.949 12.813 1.046 11.396.487 9.853.12 8.845-.087 7.725.035 6.663c.267-2.306 1.98-3.654 4.174-4.06 1.265-.234 2.594-.186 3.879.037a17.71 17.71 0 013.978 1.192v.004a.006.006 0 01-.004.004h-.004a8.907 8.907 0 00-2.869-.29c-.807.048-1.666.263-2.357.656-1.034.588-1.67 1.463-1.907 2.625a4.567 4.567 0 00-.069 1.1c.025.58.163 1.198.367 1.761z"
+        fill="url(#grad-a)"
+      />
+      <path
+        d="M18.02 7.235a.05.05 0 01-.007.03c-.461.916-.923 1.832-1.386 2.747-.424.837-.745 1.437-.965 1.8a17.877 17.877 0 01-2.98 3.707.027.027 0 01-.03.005 12.678 12.678 0 01-4.205-2.777c-.14-.14-.28-.288-.42-.447a.024.024 0 01-.005-.013c0-.005 0-.01.003-.014a17.718 17.718 0 011.68-2.379 18.27 18.27 0 012.7-2.606c.408-.32 1.39-1.094 2.95-2.323L21.652.002a.008.008 0 01.01 0 .01.01 0 01.004.005.01.01 0 010 .006l-3.648 7.222z"
+        fill="url(#grad-b)"
+      />
+      <path
+        d="M2.027 24c.002 0 .004 0 .005-.002l5.843-4.58a.02.02 0 00.008-.017.02.02 0 00-.01-.016 26.743 26.743 0 01-2.584-1.842h-.006a.014.014 0 00-.005.002.012.012 0 00-.004.005L2.02 23.987a.01.01 0 000 .006c0 .002 0 .004.002.005a.009.009 0 00.006.002z"
+        fill="url(#grad-c)"
+      />
+      <defs>
+        <linearGradient
+          gradientUnits="userSpaceOnUse"
+          id="grad-a"
+          x1=".478"
+          x2="22.985"
+          y1="3.451"
+          y2="19.698"
+        >
+          <stop stop-color="#6F11F4" />
+          <stop offset="1" stop-color="#AA66F1" />
+        </linearGradient>
+        <linearGradient
+          gradientUnits="userSpaceOnUse"
+          id="grad-b"
+          x1="21.676"
+          x2="2.034"
+          y1=".006"
+          y2="23.987"
+        >
+          <stop stop-color="#F52C77" />
+          <stop offset="1" stop-color="#E9A45F" stop-opacity=".996" />
+        </linearGradient>
+        <linearGradient
+          gradientUnits="userSpaceOnUse"
+          id="grad-c"
+          x1="21.676"
+          x2="2.034"
+          y1=".006"
+          y2="23.987"
+        >
+          <stop stop-color="#F52C77" />
+          <stop offset="1" stop-color="#E9A45F" stop-opacity=".996" />
+        </linearGradient>
+      </defs>
+    </svg>
\ No newline at end of file
diff --git a/public/providers/yi.svg b/public/providers/yi.svg
index 8ddc60de6e..8d0c6470b4 100644
--- a/public/providers/yi.svg
+++ b/public/providers/yi.svg
@@ -1,5 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
-  <circle cx="16" cy="16" r="14" fill="#10B981" opacity="0.15"/>
-  <circle cx="16" cy="16" r="14" fill="none" stroke="#10B981" stroke-width="2"/>
-  <text x="16" y="16" text-anchor="middle" dominant-baseline="central" font-family="system-ui,-apple-system,sans-serif" font-size="11" font-weight="600" fill="#10B981">YI</text>
-</svg>
+<svg fill="currentColor" fill-rule="evenodd" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Yi</title><path d="M18.62 13.927c.611 0 1.107.505 1.107 1.128v5.817c0 .623-.496 1.128-1.108 1.128a1.118 1.118 0 01-1.108-1.128v-5.817c0-.623.496-1.128 1.108-1.128zM16.59 3.052a1.094 1.094 0 011.562-.129c.466.404.522 1.116.126 1.59l-5.938 7.111v9.147c0 .624-.496 1.129-1.108 1.129a1.118 1.118 0 01-1.108-1.129v-9.477l.003-.088.01-.087c.015-.232.102-.462.261-.654l6.192-7.413zM2.906 2.256a1.094 1.094 0 011.559.157l4.387 5.45a1.142 1.142 0 01-.155 1.587 1.094 1.094 0 01-1.559-.157l-4.387-5.45a1.144 1.144 0 01.06-1.498l.095-.09z"></path><ellipse cx="20.146" cy="10.692" fill="#00FF25" rx="1.354" ry="1.379"></ellipse></svg>
\ No newline at end of file
diff --git a/public/providers/yuanbao-web.svg b/public/providers/yuanbao-web.svg
new file mode 100644
index 0000000000..1b0cb97f0b
--- /dev/null
+++ b/public/providers/yuanbao-web.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>Yuanbao Web</title><circle cx="12" cy="12" r="12" fill="#DC2626"/><text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui, sans-serif">Y</text></svg>
diff --git a/public/providers/zed-hosted.svg b/public/providers/zed-hosted.svg
new file mode 100644
index 0000000000..2f0c797c3b
--- /dev/null
+++ b/public/providers/zed-hosted.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>Zed Hosted</title><circle cx="12" cy="12" r="12" fill="#0891B2"/><text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui, sans-serif">Z</text></svg>
\ No newline at end of file
diff --git a/public/providers/zenmux-free.svg b/public/providers/zenmux-free.svg
new file mode 100644
index 0000000000..c02ebce19a
--- /dev/null
+++ b/public/providers/zenmux-free.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>ZenmuxFree</title>
+  <circle cx="12" cy="12" r="12" fill="#059669"/>
+  <text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui">Z</text>
+</svg>
diff --git a/public/providers/zenmux.svg b/public/providers/zenmux.svg
new file mode 100644
index 0000000000..853b892d60
--- /dev/null
+++ b/public/providers/zenmux.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Zenmux</title>
+  <circle cx="12" cy="12" r="12" fill="#10B981"/>
+  <text x="12" y="16" text-anchor="middle" fill="white" font-size="14" font-weight="bold" font-family="system-ui">Z</text>
+</svg>
diff --git a/public/providers/zhipu.svg b/public/providers/zhipu.svg
new file mode 100644
index 0000000000..a92eaff077
--- /dev/null
+++ b/public/providers/zhipu.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <title>Zhipu (智谱)</title>
+  <path d="M11.991 23.503a.24.24 0 00-.244.248.24.24 0 00.244.249.24.24 0 00.245-.249.24.24 0 00-.22-.247l-.025-.001zM9.671 5.365a1.697 1.697 0 011.099 2.132l-.071.172-.016.04-.018.054c-.07.16-.104.32-.104.498-.035.71.47 1.279 1.186 1.314h.366c1.309.053 2.338 1.173 2.286 2.523-.052 1.332-1.152 2.38-2.478 2.327h-.174c-.715.018-1.274.64-1.239 1.368 0 .124.018.23.053.337.209.373.54.658.96.8.75.23 1.517-.125 1.9-.782l.018-.035c.402-.64 1.17-.96 1.92-.711.854.284 1.378 1.226 1.099 2.167a1.661 1.661 0 01-2.077 1.102 1.711 1.711 0 01-.907-.711l-.017-.035c-.2-.323-.463-.58-.851-.711l-.056-.018a1.646 1.646 0 00-1.954.746 1.66 1.66 0 01-1.065.764 1.677 1.677 0 01-1.989-1.279c-.209-.906.332-1.83 1.257-2.043a1.51 1.51 0 01.296-.035h.018c.68-.071 1.151-.622 1.116-1.333a1.307 1.307 0 00-.227-.693 2.515 2.515 0 01-.366-1.403 2.39 2.39 0 01.366-1.208c.14-.195.21-.444.227-.693.018-.71-.506-1.261-1.186-1.332l-.07-.018a1.43 1.43 0 01-.299-.07l-.05-.019a1.7 1.7 0 01-1.047-2.114 1.68 1.68 0 012.094-1.101zm-5.575 10.11c.26-.264.639-.367.994-.27.355.096.633.379.728.74.095.362-.007.748-.267 1.013-.402.41-1.053.41-1.455 0a1.062 1.062 0 010-1.482zm14.845-.294c.359-.09.738.024.992.297.254.274.344.665.237 1.025-.107.36-.396.634-.756.718-.551.128-1.1-.22-1.23-.781a1.05 1.05 0 01.757-1.26zm-.064-4.39c.314.32.49.753.49 1.206 0 .452-.176.886-.49 1.206-.315.32-.74.5-1.185.5-.444 0-.87-.18-1.184-.5a1.727 1.727 0 010-2.412 1.654 1.654 0 012.369 0zm-11.243.163c.364.484.447 1.128.218 1.691a1.665 1.665 0 01-2.188.923c-.855-.36-1.26-1.358-.907-2.228a1.68 1.68 0 011.33-1.038c.593-.08 1.183.169 1.547.652zm11.545-4.221c.368 0 .708.2.892.524.184.324.184.724 0 1.048a1.026 1.026 0 01-.892.524c-.568 0-1.03-.47-1.03-1.048 0-.579.462-1.048 1.03-1.048zm-14.358 0c.368 0 .707.2.891.524.184.324.184.724 0 1.048a1.026 1.026 0 01-.891.524c-.569 0-1.03-.47-1.03-1.048 0-.579.461-1.048 1.03-1.048zm10.031-1.475c.925 0 1.675.764 1.675 1.706s-.75 1.705-1.675 1.705-1.674-.763-1.674-1.705c0-.942.75-1.706 1.674-1.706zm-2.626-.684c.362-.082.653-.356.761-.718a1.062 1.062 0 00-.238-1.028 1.017 1.017 0 00-.996-.294c-.547.14-.881.7-.752 1.257.13.558.675.907 1.225.783zm0 16.876c.359-.087.644-.36.75-.72a1.062 1.062 0 00-.237-1.019 1.018 1.018 0 00-.985-.301 1.037 1.037 0 00-.762.717c-.108.361-.017.754.239 1.028.245.263.606.377.953.305l.043-.01zM17.19 3.5a.631.631 0 00.628-.64c0-.355-.279-.64-.628-.64a.631.631 0 00-.628.64c0 .355.28.64.628.64zm-10.38 0a.631.631 0 00.628-.64c0-.355-.28-.64-.628-.64a.631.631 0 00-.628.64c0 .355.279.64.628.64zm-5.182 7.852a.631.631 0 00-.628.64c0 .354.28.639.628.639a.63.63 0 00.627-.606l.001-.034a.62.62 0 00-.628-.64zm5.182 9.13a.631.631 0 00-.628.64c0 .355.279.64.628.64a.631.631 0 00.628-.64c0-.355-.28-.64-.628-.64zm10.38.018a.631.631 0 00-.628.64c0 .355.28.64.628.64a.631.631 0 00.628-.64c0-.355-.279-.64-.628-.64zm5.182-9.148a.631.631 0 00-.628.64c0 .354.279.639.628.639a.631.631 0 00.628-.64c0-.355-.28-.64-.628-.64zm-.384-4.992a.24.24 0 00.244-.249.24.24 0 00-.244-.249.24.24 0 00-.244.249c0 .142.122.249.244.249zM11.991.497a.24.24 0 00.245-.248A.24.24 0 0011.99 0a.24.24 0 00-.244.249c0 .133.108.236.223.247l.021.001zM2.011 6.36a.24.24 0 00.245-.249.24.24 0 00-.244-.249.24.24 0 00-.244.249.24.24 0 00.244.249zm0 11.263a.24.24 0 00-.243.248.24.24 0 00.244.249.24.24 0 00.244-.249.252.252 0 00-.244-.248zm19.995-.018a.24.24 0 00-.245.248.24.24 0 00.245.25.24.24 0 00.244-.25.252.252 0 00-.244-.248z"
+        fill="#3859FF"
+        fill-rule="nonzero" />
+</svg>
\ No newline at end of file
diff --git a/scripts/ad-hoc/cursor-tap.cjs b/scripts/ad-hoc/cursor-tap.cjs
index 0145d6162c..3bb3f94ae4 100644
--- a/scripts/ad-hoc/cursor-tap.cjs
+++ b/scripts/ad-hoc/cursor-tap.cjs
@@ -130,7 +130,7 @@ const req = client.request({
   traceparent: traceParent,
   "user-agent": "connect-es/1.6.1",
   "x-cursor-client-type": "cli",
-  "x-cursor-client-version": "cli-2025.10.21-b2dfaef",
+  "x-cursor-client-version": "cli-2026.07.08-0c04a8a",
   "x-ghost-mode": "true",
   "x-original-request-id": requestId,
   "x-request-id": requestId,
diff --git a/scripts/build/assembleStandalone.mjs b/scripts/build/assembleStandalone.mjs
index 6ee88d58a7..b0d8892b27 100644
--- a/scripts/build/assembleStandalone.mjs
+++ b/scripts/build/assembleStandalone.mjs
@@ -22,6 +22,7 @@
  * scripts/dev/standalone-server-ws.mjs -> outDir/server-ws    Y               Y           -    SHARED (extra module)
  * scripts/dev/peer-stamp.mjs -> outDir/peer-stamp.mjs         Y               Y           -    SHARED (extra module)
  * scripts/dev/responses-ws-proxy.mjs -> outDir/responses-ws-  Y               Y           -    SHARED (extra module)
+ * scripts/dev/head-response-guard.cjs -> outDir/head-respons  Y               Y           -    SHARED (extra module)
  * scripts/build/runtime-env.mjs -> outDir/build/runtime-env   Y               -           -    SHARED (extra module)
  * scripts/build/bootstrap-env.mjs -> outDir/build/bootstrap-  Y               -           -    SHARED (extra module)
  * scripts/dev/healthcheck.mjs -> outDir/healthcheck.mjs       Y               -           -    SHARED (extra module)
@@ -139,6 +140,11 @@ const EXTRA_MODULE_ENTRIES = [
     src: ["scripts", "dev", "http-method-guard.cjs"],
     dest: ["http-method-guard.cjs"],
   },
+  {
+    label: "HEAD response guard (server-ws.mjs dependency)",
+    src: ["scripts", "dev", "head-response-guard.cjs"],
+    dest: ["head-response-guard.cjs"],
+  },
   {
     label: "responses-ws-proxy (server-ws.mjs dependency)",
     src: ["scripts", "dev", "responses-ws-proxy.mjs"],
diff --git a/scripts/build/bootstrap-env.mjs b/scripts/build/bootstrap-env.mjs
index 90ee46ddd6..e3bdd673ec 100644
--- a/scripts/build/bootstrap-env.mjs
+++ b/scripts/build/bootstrap-env.mjs
@@ -173,7 +173,14 @@ export function bootstrapEnv({ dataDirOverride, quiet = false } = {}) {
   const preferredEnvFiltered = Object.fromEntries(
     Object.entries(preferredEnv).filter(([, v]) => typeof v === "string" && v.length > 0)
   );
-  const merged = { ...persisted, ...preferredEnvFiltered, ...process.env };
+  // Filter empty strings from process.env so that Docker `-e KEY=` (which sets an
+  // empty string) does not override real values persisted in server.env or set
+  // in .env. Only shell/Docker vars that the operator actually set should win.
+  // Mirrors the filtering already applied to preferredEnv above. (fixes #6824)
+  const processEnvFiltered = Object.fromEntries(
+    Object.entries(process.env).filter(([, v]) => typeof v === "string" && v.length > 0)
+  );
+  const merged = { ...persisted, ...preferredEnvFiltered, ...processEnvFiltered };
 
   // ── Auto-generate required secrets ────────────────────────────────────────
   let needsPersist = false;
diff --git a/scripts/build/build-next-isolated.mjs b/scripts/build/build-next-isolated.mjs
index 09dc26bb89..463190d430 100644
--- a/scripts/build/build-next-isolated.mjs
+++ b/scripts/build/build-next-isolated.mjs
@@ -129,6 +129,10 @@ export function resolveNextBuildEnv(baseEnv = process.env) {
   // this only in the Docker builder stage (ENV NODE_OPTIONS); the local/native path
   // was left unprotected. Respect an existing --max-old-space-size (Docker already
   // sets one — don't clobber/duplicate) and let OMNIROUTE_BUILD_MEMORY_MB override.
+  // NOTE (#6409): --max-old-space-size only bounds V8's JS heap — it does NOT bound
+  // Turbopack's native (Rust, off-V8-heap) memory, which is the default bundler as of
+  // #6283. On memory-constrained machines, set OMNIROUTE_USE_TURBOPACK=0 (webpack
+  // fallback) instead of raising this heap value; see docs/reference/ENVIRONMENT.md.
   if (!/--max-old-space-size/.test(env.NODE_OPTIONS || "")) {
     // Default 8 GB (was 4 GB): the clean module graph peaks ~3.9 GB during the webpack
     // production pass, which brushed the old 4 GB ceiling on a borderline OOM. 8 GB gives
diff --git a/scripts/check/check-api-docs-refs.mjs b/scripts/check/check-api-docs-refs.mjs
new file mode 100644
index 0000000000..44b4df7609
--- /dev/null
+++ b/scripts/check/check-api-docs-refs.mjs
@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+/**
+ * Combined anti-hallucination gate: OpenAPI paths + docs prose /api refs.
+ *
+ * Existence reasons (both still enforced):
+ * - openapi-routes: invented/obsolete paths in docs/openapi.yaml
+ * - docs-symbols: invented/obsolete /api paths in docs markdown *
+ * Shared walk of src/app/api (lib/apiRoutes.mjs) — one filesystem inventory,
+ * two independent failure messages. Prefer this on docs-gates CI; individual
+ * scripts remain for targeted local runs.
+ */
+import { pathToFileURL } from "node:url";
+import { collectApiRouteFiles, collectApiRouteUrlPaths } from "./lib/apiRoutes.mjs";
+import { runOpenapiRoutesCheck } from "./check-openapi-routes.mjs";
+import { runDocsSymbolsCheck } from "./check-docs-symbols.mjs";
+
+function main() {
+  const implPaths = collectApiRouteUrlPaths();
+  const routeFiles = collectApiRouteFiles();
+
+  const openapi = runOpenapiRoutesCheck({ implPaths });
+  const docs = runDocsSymbolsCheck({ routeFiles });
+
+  if (openapi.ok) console.log(openapi.message);
+  else console.error(openapi.message);
+  if (docs.ok) console.log(docs.message);
+  else console.error(docs.message);
+
+  process.exit(openapi.ok && docs.ok ? 0 : 1);
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] || "").href) main();
diff --git a/scripts/check/check-changelog-integrity.mjs b/scripts/check/check-changelog-integrity.mjs
index b07c3f99f4..edf3ac4442 100644
--- a/scripts/check/check-changelog-integrity.mjs
+++ b/scripts/check/check-changelog-integrity.mjs
@@ -26,12 +26,15 @@
 //     env ALLOW_CHANGELOG_REMOVALS=1  report-only (never fails)
 
 import { execFileSync } from "node:child_process";
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
 const CHANGELOG = "CHANGELOG.md";
+const FRAGMENTS_DIR = "changelog.d";
+const FRAGMENT_SECTIONS = ["features", "fixes", "maintenance"];
+const FRAGMENT_SKIP = new Set(["README.md", ".gitkeep"]);
 
 /** Extract the set of bullet lines (trimmed) from a CHANGELOG text. */
 export function extractBullets(text) {
@@ -56,6 +59,49 @@ export function findLostBullets(baseText, headText) {
   return lost;
 }
 
+/**
+ * Validate changelog FRAGMENTS (changelog.d/<section>/*.md — see changelog.d/README.md).
+ * A fragment must be a well-formed markdown bullet ("- ...") with no merge-conflict
+ * markers, and must live in a known section dir. Returns [{file, error}]. Pure over
+ * the filesystem — unit-tested via a tmp root.
+ */
+export function findInvalidFragments(root = ROOT) {
+  const invalid = [];
+  const base = join(root, FRAGMENTS_DIR);
+  if (!existsSync(base)) return invalid;
+  const entries = readdirSync(base, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.isFile()) {
+      if (!FRAGMENT_SKIP.has(entry.name)) {
+        invalid.push({
+          file: `${FRAGMENTS_DIR}/${entry.name}`,
+          error: `fragments live in a section dir (${FRAGMENT_SECTIONS.join("|")}), not at changelog.d root`,
+        });
+      }
+      continue;
+    }
+    if (!FRAGMENT_SECTIONS.includes(entry.name)) {
+      invalid.push({
+        file: `${FRAGMENTS_DIR}/${entry.name}/`,
+        error: `unknown section dir (expected ${FRAGMENT_SECTIONS.join("|")})`,
+      });
+      continue;
+    }
+    for (const f of readdirSync(join(base, entry.name))) {
+      if (FRAGMENT_SKIP.has(f) || !f.endsWith(".md")) continue;
+      const file = `${FRAGMENTS_DIR}/${entry.name}/${f}`;
+      const text = readFileSync(join(base, entry.name, f), "utf8");
+      const firstContent = text.split("\n").find((l) => l.trim().length > 0);
+      if (!firstContent) invalid.push({ file, error: "empty fragment" });
+      else if (!firstContent.trimStart().startsWith("- "))
+        invalid.push({ file, error: 'fragment must start with a markdown bullet ("- ")' });
+      else if (/^(<{7}|={7}|>{7})/m.test(text))
+        invalid.push({ file, error: "fragment contains merge-conflict markers" });
+    }
+  }
+  return invalid;
+}
+
 function git(args) {
   return execFileSync("git", args, { cwd: ROOT, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
 }
@@ -77,6 +123,16 @@ function resolveBaseRef() {
 }
 
 function main() {
+  // Fragment well-formedness first (changelog.d/ — the fragments pattern makes the
+  // eat-guard below structurally unnecessary for PRs that stop editing CHANGELOG.md).
+  const invalidFragments = findInvalidFragments();
+  if (invalidFragments.length > 0) {
+    console.error(`[changelog-integrity] ${invalidFragments.length} invalid changelog fragment(s):`);
+    for (const { file, error } of invalidFragments) console.error(`  ✗ ${file}: ${error}`);
+    console.error("\nSee changelog.d/README.md for the fragment convention.");
+    return 1;
+  }
+
   const baseRef = resolveBaseRef();
   if (!baseRef) {
     console.log("[changelog-integrity] SKIP — could not resolve a base ref (offline/fresh clone).");
diff --git a/scripts/check/check-cognitive-complexity.mjs b/scripts/check/check-cognitive-complexity.mjs
index 663fd8eb44..0d54bb2b52 100644
--- a/scripts/check/check-cognitive-complexity.mjs
+++ b/scripts/check/check-cognitive-complexity.mjs
@@ -1,32 +1,21 @@
 #!/usr/bin/env node
 // scripts/check/check-cognitive-complexity.mjs
 // Ratchet bloqueante para complexidade cognitiva (sonarjs/cognitive-complexity).
-// Fase 7 INT: promovido de ADVISORY para RATCHET.
-//
-// Roda o ESLint sobre src+open-sse usando um config flat STANDALONE
-// (eslint.sonarjs.config.mjs) que liga APENAS `sonarjs/cognitive-complexity` —
-// mantendo a contagem ISOLADA do orçamento de warnings do lint principal.
-//
-// Lê o baseline de quality-baseline.json (metrics.cognitiveComplexity).
-// Falha com exit 1 se a contagem SUBIR. Suporta --update.
-//
-// Saída canônica: cognitiveComplexity=N  (parseable por collect-metrics.mjs)
-//
-// Uso:
-//   node scripts/check/check-cognitive-complexity.mjs
-//   node scripts/check/check-cognitive-complexity.mjs --quiet   # só a linha canônica
-//   node scripts/check/check-cognitive-complexity.mjs --update  # ratcheta baseline se melhorou
-import { execFileSync } from "node:child_process";
+// Shares ESLint walk with check-complexity via complexityEslintReport.mjs.
 import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
+import {
+  countCognitiveViolations,
+  getComplexityEslintReport,
+} from "./complexityEslintReport.mjs";
+
+// Re-export for existing unit tests.
+export { countCognitiveViolations };
 
 const ROOT = process.cwd();
 const QUIET = process.argv.includes("--quiet");
 const UPDATE = process.argv.includes("--update");
-const CONFIG_PATH = path.join(ROOT, "eslint.sonarjs.config.mjs");
-
-const ESLINT_BIN = path.join(ROOT, "node_modules", ".bin", "eslint");
 
 const BASELINE_PATH = path.resolve(
   process.argv.includes("--baseline")
@@ -34,43 +23,8 @@ const BASELINE_PATH = path.resolve(
     : path.join(ROOT, "config/quality/quality-baseline.json")
 );
 
-const ESLINT_ARGS = [
-  "--no-config-lookup",
-  "--config",
-  CONFIG_PATH,
-  "--format",
-  "json",
-  "src",
-  "open-sse",
-];
-
-/**
- * Parses the ESLint JSON output (array of file results) and counts total
- * `sonarjs/cognitive-complexity` violations.
- *
- * Exported so unit tests can call it directly with synthetic data.
- *
- * @param {Array<{messages: Array<{ruleId: string}>}>} report
- * @returns {number}
- */
-export function countCognitiveViolations(report) {
-  let count = 0;
-  for (const file of report) {
-    for (const msg of file.messages) {
-      if (msg.ruleId === "sonarjs/cognitive-complexity") {
-        count++;
-      }
-    }
-  }
-  return count;
-}
-
 /**
  * Avalia a contagem atual de violações cognitivas contra o baseline.
- * Direction: down (contagem só pode CAIR).
- *
- * Exported for unit testing.
- *
  * @param {number} current
  * @param {number} baseline
  * @returns {{ regressed: boolean, improved: boolean }}
@@ -82,22 +36,6 @@ export function evaluateCognitiveComplexity(current, baseline) {
   };
 }
 
-function runEslint() {
-  let stdout;
-  try {
-    stdout = execFileSync(ESLINT_BIN, ESLINT_ARGS, {
-      encoding: "utf8",
-      maxBuffer: 64 * 1024 * 1024,
-    });
-  } catch (err) {
-    // ESLint exits non-zero when there are lint errors; the JSON report is still
-    // in stdout. Re-throw only if there is no parseable output.
-    stdout = err.stdout ? String(err.stdout) : "";
-    if (!stdout.trim()) throw err;
-  }
-  return JSON.parse(stdout);
-}
-
 function main() {
   if (!fs.existsSync(BASELINE_PATH)) {
     process.stderr.write(
@@ -116,10 +54,9 @@ function main() {
   }
   const baselineValue = baselineMetric.value;
 
-  const report = runEslint();
+  const report = getComplexityEslintReport();
   const count = countCognitiveViolations(report);
 
-  // Canonical machine-readable output consumed by collect-metrics.mjs and shell scripts.
   console.log(`cognitiveComplexity=${count}`);
 
   if (!QUIET) {
diff --git a/scripts/check/check-complexity-ratchets.mjs b/scripts/check/check-complexity-ratchets.mjs
new file mode 100644
index 0000000000..22bcc02fef
--- /dev/null
+++ b/scripts/check/check-complexity-ratchets.mjs
@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+/**
+ * One ESLint walk → both complexity ratchets.
+ *
+ * Existence reasons (unchanged):
+ * - cyclomatic + max-lines vs complexity-baseline.json
+ * - cognitive-complexity vs quality-baseline metrics.cognitiveComplexity
+ *
+ * CI should call this instead of sequential check:complexity + check:cognitive
+ * so PR→release / quality-gate pay for one tree walk, not two.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { evaluateComplexity } from "./check-complexity.mjs";
+import { evaluateCognitiveComplexity } from "./check-cognitive-complexity.mjs";
+import {
+  countCognitiveViolations,
+  countComplexityViolations,
+  getComplexityEslintReport,
+} from "./complexityEslintReport.mjs";
+
+const ROOT = process.cwd();
+const UPDATE = process.argv.includes("--update");
+
+const COMPLEXITY_BASELINE = path.resolve(
+  process.argv.includes("--baseline")
+    ? process.argv[process.argv.indexOf("--baseline") + 1]
+    : path.join(ROOT, "config/quality/complexity-baseline.json")
+);
+const QUALITY_BASELINE = path.join(ROOT, "config/quality/quality-baseline.json");
+
+function main() {
+  if (!fs.existsSync(COMPLEXITY_BASELINE)) {
+    console.error(`[complexity-ratchets] FAIL — complexity-baseline.json ausente.`);
+    process.exit(2);
+  }
+  if (!fs.existsSync(QUALITY_BASELINE)) {
+    console.error(`[complexity-ratchets] FAIL — quality-baseline.json ausente.`);
+    process.exit(2);
+  }
+
+  const report = getComplexityEslintReport();
+  const complexityCount = countComplexityViolations(report);
+  const cognitiveCount = countCognitiveViolations(report);
+
+  // Machine-readable lines for collect-metrics / scripts
+  console.log(`complexity=${complexityCount}`);
+  console.log(`cognitiveComplexity=${cognitiveCount}`);
+
+  const complexityBaseline = JSON.parse(fs.readFileSync(COMPLEXITY_BASELINE, "utf8"));
+  const qualityBaseline = JSON.parse(fs.readFileSync(QUALITY_BASELINE, "utf8"));
+  const cognitiveMetric = qualityBaseline.metrics?.cognitiveComplexity;
+  if (!cognitiveMetric || typeof cognitiveMetric.value !== "number") {
+    console.error(
+      "[complexity-ratchets] FAIL — metrics.cognitiveComplexity ausente em quality-baseline.json."
+    );
+    process.exit(2);
+  }
+
+  const cyc = evaluateComplexity(complexityCount, complexityBaseline.count);
+  const cog = evaluateCognitiveComplexity(cognitiveCount, cognitiveMetric.value);
+
+  if (UPDATE && cyc.improved) {
+    console.log(
+      `[complexity] baseline ratcheado: ${complexityCount} (era ${complexityBaseline.count})`
+    );
+    complexityBaseline.count = complexityCount;
+    fs.writeFileSync(COMPLEXITY_BASELINE, JSON.stringify(complexityBaseline, null, 2) + "\n");
+  }
+  if (UPDATE && cog.improved) {
+    console.log(
+      `[cognitive-complexity] baseline ratcheado: ${cognitiveCount} (era ${cognitiveMetric.value})`
+    );
+    qualityBaseline.metrics.cognitiveComplexity.value = cognitiveCount;
+    fs.writeFileSync(QUALITY_BASELINE, JSON.stringify(qualityBaseline, null, 2) + "\n");
+  }
+
+  let failed = false;
+  if (cyc.regressed) {
+    console.error(
+      `[complexity] REGRESSÃO — ${complexityCount} violações > baseline ${complexityBaseline.count}`
+    );
+    failed = true;
+  } else {
+    console.log(
+      `[complexity] OK — ${complexityCount} violações (baseline ${complexityBaseline.count})`
+    );
+  }
+
+  if (cog.regressed) {
+    console.error(
+      `[cognitive-complexity] REGRESSÃO — ${cognitiveCount} violações > baseline ${cognitiveMetric.value}`
+    );
+    failed = true;
+  } else {
+    console.log(
+      `[cognitive-complexity] OK — ${cognitiveCount} violações (baseline ${cognitiveMetric.value})`
+    );
+  }
+
+  process.exit(failed ? 1 : 0);
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] || "").href) main();
diff --git a/scripts/check/check-complexity.mjs b/scripts/check/check-complexity.mjs
index 2e0c89938b..af79c706dd 100644
--- a/scripts/check/check-complexity.mjs
+++ b/scripts/check/check-complexity.mjs
@@ -1,19 +1,17 @@
 #!/usr/bin/env node
 // scripts/check/check-complexity.mjs
-// Catraca de complexidade de código. Roda o ESLint sobre src+open-sse usando um config
-// flat STANDALONE (eslint.complexity.config.mjs) que liga APENAS duas regras CORE do
-// ESLint — `complexity` (ciclomática) e `max-lines-per-function` (tamanho de função) —
-// e compara a contagem total de violações contra um baseline congelado
-// (complexity-baseline.json). Falha se a contagem SUBIR. Completa a dimensão
-// "complexity" do snapshot de qualidade, ao lado de duplicação/tamanho-de-arquivo.
-//
-// O config dedicado evita poluir a contagem de warnings do lint principal (ratcheada
-// em exatamente 3482): este gate roda isolado, com seu próprio par de regras. --update
-// ratcheta (a contagem só pode CAIR).
+// Catraca de complexidade de código (cyclomatic + max-lines-per-function).
+// Shares one ESLint walk with cognitive-complexity via complexityEslintReport.mjs
+// / eslint.complexity-ratchets.config.mjs. Counts by ruleId so cognitive
+// violations never inflate this baseline.
 import fs from "node:fs";
 import path from "node:path";
-import { execFileSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
+import {
+  ESLINT_ARGS,
+  countComplexityViolations,
+  getComplexityEslintReport,
+} from "./complexityEslintReport.mjs";
 
 const ROOT = process.cwd();
 const BASELINE_PATH = path.resolve(
@@ -22,24 +20,9 @@ const BASELINE_PATH = path.resolve(
     : path.join(ROOT, "config/quality/complexity-baseline.json")
 );
 const UPDATE = process.argv.includes("--update");
-const CONFIG_PATH = path.join(ROOT, "eslint.complexity.config.mjs");
-// Exported for the gate's own unit test (tests/unit/build/check-complexity.test.ts), which
-// locks the scan scope to the one documented in eslint.complexity.config.mjs `files` and in
-// complexity-baseline.json. The positional paths MUST match that scope (src+open-sse+electron+bin)
-// — ESLint flat config only walks the directories passed here, so a `files` glob for bin/electron
-// is inert unless the directory is also passed as a positional argument.
-export const ESLINT_ARGS = [
-  "eslint",
-  "--no-config-lookup",
-  "--config",
-  CONFIG_PATH,
-  "--format",
-  "json",
-  "src",
-  "open-sse",
-  "electron",
-  "bin",
-];
+
+// Re-export for tests that lock scan scope (src+open-sse+electron+bin).
+export { ESLINT_ARGS };
 
 /** Avalia a contagem atual de violações contra o baseline. */
 export function evaluateComplexity(current, baseline) {
@@ -50,20 +33,7 @@ export function evaluateComplexity(current, baseline) {
 }
 
 function measureComplexityCount() {
-  let stdout;
-  try {
-    stdout = execFileSync("npx", ["--yes", ...ESLINT_ARGS], {
-      encoding: "utf8",
-      maxBuffer: 64 * 1024 * 1024,
-    });
-  } catch (err) {
-    // ESLint sai com código !=0 quando há erros (e nossas regras são "error"); o relatório
-    // JSON ainda vai no stdout. Só relançamos se não houver stdout parseável.
-    stdout = err.stdout ? String(err.stdout) : "";
-    if (!stdout.trim()) throw err;
-  }
-  const report = JSON.parse(stdout);
-  return report.reduce((sum, file) => sum + file.errorCount, 0);
+  return countComplexityViolations(getComplexityEslintReport());
 }
 
 function main() {
diff --git a/scripts/check/check-db-rules.mjs b/scripts/check/check-db-rules.mjs
index 6bcfe69c25..d91d7f52c0 100644
--- a/scripts/check/check-db-rules.mjs
+++ b/scripts/check/check-db-rules.mjs
@@ -56,6 +56,7 @@ export const INTENTIONALLY_INTERNAL = new Set([
   "healthCheck", // db-internal: importado por db/core.ts (runDbHealthCheck)
   "jsonMigration", // intentionally-internal: src/app/api/settings/import-json/route.ts
   "migrationRunner", // db-internal: importado por db/core.ts (runMigrations ao inicializar o DB)
+  "modelCapabilityOverrides", // intentionally-internal: src/app/api/model-capability-overrides/route.ts via import direto "@/lib/db/modelCapabilityOverrides" (#6727 — evita empurrar localDb.ts para o cap de 800 linhas)
   "notion", // intentionally-internal: settings/notion API route + open-sse/mcp-server/tools/notionTools.ts
   "obsidian", // intentionally-internal: src/lib/obsidianSync.ts + settings/obsidian route + MCP obsidianTools.ts
   "optimizationSettings", // db-internal: imported by db/core.ts for SQLite PRAGMA application helpers that require the live adapter
@@ -63,6 +64,7 @@ export const INTENTIONALLY_INTERNAL = new Set([
   "prompts", // DEAD? (production): zero callers de produção encontrados; domínio domain/prompts.ts é independente; testado por tests/integration/proxy-pipeline.test.ts
   "providerNodeSelect", // db-internal: importado só por db/providers.ts (selectProviderNodeForConnection — lógica pura de seleção de provider node split do providers.ts, #4421)
   "providerStats", // intentionally-internal: src/app/api/provider-stats/route.ts
+  "proxyLatency", // intentionally-internal: imported directly by src/lib/db/proxies.ts (anti-barrel, #6798)
   "recovery", // intentionally-internal: bin/cli/runtime.mjs (import() dinâmico) + tests
   "schemaColumns", // db-internal: importado só por db/core.ts (ensureProviderConnections/UsageHistory/CallLogsColumns + hasColumn/hasTable/getTableColumns — schema-column reconciliation split do core.ts, #4948)
   "secrets", // intentionally-internal: src/instrumentation-node.ts (import() dinâmico na inicialização)
diff --git a/scripts/check/check-docs-symbols.mjs b/scripts/check/check-docs-symbols.mjs
index e5a97d7934..a3528b2483 100644
--- a/scripts/check/check-docs-symbols.mjs
+++ b/scripts/check/check-docs-symbols.mjs
@@ -19,11 +19,11 @@
 import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
-import { assertNoStale } from "./lib/allowlist.mjs";
+import { reportStaleEntries } from "./lib/allowlist.mjs";
+import { collectApiRouteFiles } from "./lib/apiRoutes.mjs";
 
 const ROOT = process.cwd();
 const DOCS = path.join(ROOT, "docs");
-const API = path.join(ROOT, "src/app/api");
 
 // Padrões que NÃO são rotas internas do OmniRoute (ruído estrutural, não drift).
 // Adicione aqui (com justificativa) em vez da allowlist quando uma categoria gera
@@ -73,10 +73,9 @@ function walk(dir, filter, acc = []) {
   return acc;
 }
 
-export function collectRouteFiles() {
-  return new Set(
-    walk(API, (n) => /^route\.tsx?$/.test(n)).map((p) => path.relative(ROOT, p).replace(/\\/g, "/"))
-  );
+/** @deprecated prefer collectApiRouteFiles from lib/apiRoutes.mjs — re-export for tests. */
+export function collectRouteFiles(root = ROOT) {
+  return collectApiRouteFiles(root);
 }
 
 /** Normaliza um segmento dinâmico ({param} / [param] / [...param] / :param) para wildcard. */
@@ -177,45 +176,67 @@ export function findStaleDocApiRefs(docPathsByFile, routeFiles, allowlist) {
   return misses;
 }
 
-function main() {
-  const routeFiles = collectRouteFiles();
+/**
+ * @param {{ root?: string, routeFiles?: Set<string> }} [opts]
+ * @returns {{ ok: boolean, exitCode: number, message: string }}
+ */
+export function runDocsSymbolsCheck(opts = {}) {
+  const root = opts.root || ROOT;
+  const docsDir = path.join(root, "docs");
+  const routeFiles = opts.routeFiles || collectApiRouteFiles(root);
   // docs/i18n/** são espelhos auto-gerados das docs canônicas — validar só o canônico
   // evita 40× de ruído duplicado (e os mirrors herdam qualquer fix do canônico).
   // docs/superpowers/** são planos internos de implementação (snapshots históricos
   // de intenção — podem citar rotas planejadas/abandonadas), não claims sobre o
   // código atual; fora do escopo do gate (drift surgiu no ciclo v3.8.18).
-  const docFiles = walk(DOCS, (n) => /\.md$/.test(n)).filter((f) => {
-    const rel = path.relative(ROOT, f).replace(/\\/g, "/");
+  const docFiles = walk(docsDir, (n) => /\.md$/.test(n)).filter((f) => {
+    const rel = path.relative(root, f).replace(/\\/g, "/");
     return !rel.startsWith("docs/i18n/") && !rel.startsWith("docs/superpowers/");
   });
   const docPathsByFile = docFiles.map((f) => ({
-    file: path.relative(ROOT, f).replace(/\\/g, "/"),
+    file: path.relative(root, f).replace(/\\/g, "/"),
     paths: extractDocApiPaths(fs.readFileSync(f, "utf8")),
   }));
 
-  // Live misses BEFORE allowlist filtering — used for stale-enforcement.
-  // The paths (not "file → path" strings) are the unit that the allowlist keys on.
   const allMisses = findStaleDocApiRefs(docPathsByFile, routeFiles, new Set());
   const liveMissPaths = allMisses.map((m) => m.split(" → ")[1]);
-  assertNoStale(KNOWN_STALE_DOC_REFS, liveMissPaths, "check-docs-symbols");
-
+  const stale = reportStaleEntries(KNOWN_STALE_DOC_REFS, liveMissPaths, "check-docs-symbols");
   const misses = findStaleDocApiRefs(docPathsByFile, routeFiles, KNOWN_STALE_DOC_REFS);
+
+  const parts = [];
+  if (stale.length) {
+    parts.push(
+      `[check-docs-symbols] ${stale.length} entrada(s) obsoleta(s) na allowlist ` +
+        `— a violação foi corrigida; REMOVA a entrada para travar a correção:\n` +
+        stale.map((e) => `  ✗ ${e}`).join("\n")
+    );
+  }
   if (misses.length) {
-    console.error(
+    parts.push(
       `[check-docs-symbols] ${misses.length} ref(s) /api em docs sem rota real:\n` +
         misses.map((m) => "  ✗ " + m).join("\n") +
         `\n  → crie o route.ts, corrija o path na doc, ou (se for upstream/placeholder)` +
         ` adicione um padrão a IGNORE com justificativa. NÃO adicione à allowlist sem` +
         ` confirmar que é drift pré-existente real.`
     );
-    process.exitCode = 1;
   }
-  if (!process.exitCode) {
-    console.log(
+  if (parts.length) {
+    return { ok: false, exitCode: 1, message: parts.join("\n") };
+  }
+  return {
+    ok: true,
+    exitCode: 0,
+    message:
       `[check-docs-symbols] OK — ${docFiles.length} docs canônicas, ` +
-        `${routeFiles.size} rotas conhecidas, ${KNOWN_STALE_DOC_REFS.size} stale congeladas`
-    );
-  }
+      `${routeFiles.size} rotas conhecidas, ${KNOWN_STALE_DOC_REFS.size} stale congeladas`,
+  };
+}
+
+function main() {
+  const result = runDocsSymbolsCheck();
+  if (result.ok) console.log(result.message);
+  else console.error(result.message);
+  process.exit(result.exitCode);
 }
 
 if (import.meta.url === pathToFileURL(process.argv[1] || "").href) main();
diff --git a/scripts/check/check-env-doc-sync.mjs b/scripts/check/check-env-doc-sync.mjs
index 0ecac07688..197d8ddeb9 100644
--- a/scripts/check/check-env-doc-sync.mjs
+++ b/scripts/check/check-env-doc-sync.mjs
@@ -51,6 +51,9 @@ const IGNORE_FROM_CODE = new Set([
   "CI",
   "GITHUB_ACTIONS",
   "RUNNER_OS",
+  // Quality-gate harness knobs (optional cache/report paths for CI scripts — not product config).
+  "ESLINT_RESULTS_JSON",
+  "COMPLEXITY_ESLINT_REPORT",
   // Agent environment / system execution paths.
   "PROJECT_ROOT",
   "ARTIFACTS_DIR",
@@ -145,6 +148,9 @@ const IGNORE_FROM_CODE = new Set([
   // write-build-sha.mjs to stamp dist/BUILD_SHA — injected by the build, never
   // configured by users in .env.
   "OMNIROUTE_BUILD_SHA",
+  // Listener-owned self-fetch transport signal. The HTTP/HTTPS launchers set
+  // this before application imports; it is not user-configurable product env.
+  "OMNIROUTE_INTERNAL_SCHEME",
   // Source typo / placeholder.
   "OMNIROUT",
   // Static config alias path (the canonical var is OMNIROUTE_PAYLOAD_RULES_PATH).
diff --git a/scripts/check/check-migration-numbering.mjs b/scripts/check/check-migration-numbering.mjs
index 8b81de86fd..5e174bf0dc 100644
--- a/scripts/check/check-migration-numbering.mjs
+++ b/scripts/check/check-migration-numbering.mjs
@@ -47,7 +47,7 @@ export const KNOWN_DUPLICATE_VERSIONS = new Set([
 // números via RENAMED_MIGRATION_COMPATIBILITY em migrationRunner.ts). Congelados
 // para que o gate bloqueie apenas NOVOS buracos inexplicados na sequência.
 // ---------------------------------------------------------------------------
-export const KNOWN_GAPS = new Set(["026", "055"]);
+export const KNOWN_GAPS = new Set(["026", "055", "121"]); // 121: número queimado no ciclo v3.8.47 — 122 (#6909) mergeou antes e 121 nunca aterrissou (validação e2e 2026-07-12)
 
 function pad3(n) {
   return String(n).padStart(3, "0");
diff --git a/scripts/check/check-openapi-coverage.mjs b/scripts/check/check-openapi-coverage.mjs
index cc66d0fc6d..0a53f00159 100644
--- a/scripts/check/check-openapi-coverage.mjs
+++ b/scripts/check/check-openapi-coverage.mjs
@@ -10,9 +10,10 @@
 import fs from "node:fs";
 import path from "node:path";
 import * as yaml from "js-yaml";
+import { apiRoot, collectApiRouteUrlPaths } from "./lib/apiRoutes.mjs";
 
 const ROOT = process.cwd();
-const API_ROOT = path.join(ROOT, "src", "app", "api");
+const API_ROOT = apiRoot(ROOT);
 const OPENAPI_PATH = path.join(ROOT, "docs", "openapi.yaml");
 // Floor recorded on 2026-05-26 for release/v3.8.4: 137/365 routes documented.
 // The original ≥99% target tracks the OpenAPI audit follow-up (#2701);
@@ -21,30 +22,6 @@ const OPENAPI_PATH = path.join(ROOT, "docs", "openapi.yaml");
 // instead of the absolute target. Raise this back to 99 once the backlog clears.
 const THRESHOLD = 36;
 
-function collectRoutePaths(dir) {
-  const entries = fs.readdirSync(dir, { withFileTypes: true });
-  const paths = [];
-  for (const entry of entries) {
-    const fullPath = path.join(dir, entry.name);
-    if (entry.isDirectory()) {
-      paths.push(...collectRoutePaths(fullPath));
-      continue;
-    }
-    if (entry.isFile() && entry.name === "route.ts") {
-      const apiPath = path
-        .dirname(fullPath)
-        .replace(API_ROOT, "")
-        .replace(/\[([^\]]+)\]/g, "{$1}");
-      paths.push(`/api${apiPath}`);
-    }
-  }
-  return paths;
-}
-
-function normalizePath(p) {
-  return p.replace(/\/\[\.\.\.([^\]]+)\]/g, "/{$1}").replace(/\[([^\]]+)\]/g, "{$1}");
-}
-
 if (!fs.existsSync(API_ROOT)) {
   console.error(`[openapi-coverage] FAIL — API root not found: ${API_ROOT}`);
   process.exit(1);
@@ -55,7 +32,7 @@ if (!fs.existsSync(OPENAPI_PATH)) {
   process.exit(1);
 }
 
-const implementedPaths = collectRoutePaths(API_ROOT).map(normalizePath).sort();
+const implementedPaths = collectApiRouteUrlPaths(ROOT).sort();
 const raw = yaml.load(fs.readFileSync(OPENAPI_PATH, "utf-8"));
 const documentedPaths = new Set(Object.keys(raw.paths || {}));
 
diff --git a/scripts/check/check-openapi-routes.mjs b/scripts/check/check-openapi-routes.mjs
index db4db2a702..453f687052 100644
--- a/scripts/check/check-openapi-routes.mjs
+++ b/scripts/check/check-openapi-routes.mjs
@@ -10,10 +10,10 @@ import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import * as yaml from "js-yaml";
-import { assertNoStale } from "./lib/allowlist.mjs";
+import { reportStaleEntries } from "./lib/allowlist.mjs";
+import { apiRoot, collectApiRouteUrlPaths } from "./lib/apiRoutes.mjs";
 
 const ROOT = process.cwd();
-const API_ROOT = path.join(ROOT, "src", "app", "api");
 const OPENAPI_PATH = path.join(ROOT, "docs", "openapi.yaml");
 
 // Entradas da spec sem rota real, congeladas para triagem (catraca: bloqueia NOVAS).
@@ -33,51 +33,68 @@ export function findSpecPathsWithoutRoute(specPaths, implPaths) {
   return specPaths.filter((p) => !impl.has(normalizeParams(p)));
 }
 
-function collectRoutePaths(dir) {
-  const paths = [];
-  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-    const full = path.join(dir, entry.name);
-    if (entry.isDirectory()) {
-      paths.push(...collectRoutePaths(full));
-    } else if (entry.isFile() && entry.name === "route.ts") {
-      const apiPath = path
-        .dirname(full)
-        .replace(API_ROOT, "")
-        .replace(/\/\[\.\.\.([^\]]+)\]/g, "/{$1}")
-        .replace(/\[([^\]]+)\]/g, "{$1}");
-      paths.push(`/api${apiPath}`);
-    }
+/**
+ * @param {{ root?: string, openapiPath?: string, implPaths?: string[] }} [opts]
+ * @returns {{ ok: boolean, exitCode: number, message: string }}
+ */
+export function runOpenapiRoutesCheck(opts = {}) {
+  const root = opts.root || ROOT;
+  const openapiPath = opts.openapiPath || path.join(root, "docs", "openapi.yaml");
+  if (!fs.existsSync(openapiPath)) {
+    return {
+      ok: false,
+      exitCode: 1,
+      message: `[openapi-routes] FAIL — openapi.yaml não encontrado: ${openapiPath}`,
+    };
+  }
+  if (!fs.existsSync(apiRoot(root))) {
+    return {
+      ok: false,
+      exitCode: 1,
+      message: `[openapi-routes] FAIL — API root not found: ${apiRoot(root)}`,
+    };
   }
-  return paths;
-}
 
-function main() {
-  if (!fs.existsSync(OPENAPI_PATH)) {
-    console.error(`[openapi-routes] FAIL — openapi.yaml não encontrado: ${OPENAPI_PATH}`);
-    process.exit(1);
-  }
-  const raw = yaml.load(fs.readFileSync(OPENAPI_PATH, "utf-8"));
+  const raw = yaml.load(fs.readFileSync(openapiPath, "utf-8"));
   const specPaths = Object.keys(raw.paths || {}).filter((p) => p.startsWith("/api"));
-  const implPaths = collectRoutePaths(API_ROOT);
+  const implPaths = opts.implPaths || collectApiRouteUrlPaths(root);
 
-  // Live orphans BEFORE allowlist filtering (needed for stale-enforcement).
   const liveOrphans = findSpecPathsWithoutRoute(specPaths, implPaths);
-  assertNoStale(KNOWN_STALE_SPEC, liveOrphans, "openapi-routes");
-
+  const stale = reportStaleEntries(KNOWN_STALE_SPEC, liveOrphans, "openapi-routes");
   const orphans = liveOrphans.filter((p) => !KNOWN_STALE_SPEC.has(p));
+
+  const parts = [];
+  if (stale.length) {
+    parts.push(
+      `[openapi-routes] ${stale.length} entrada(s) obsoleta(s) na allowlist ` +
+        `— a violação foi corrigida; REMOVA a entrada para travar a correção:\n` +
+        stale.map((e) => `  ✗ ${e}`).join("\n")
+    );
+  }
   if (orphans.length) {
-    console.error(
+    parts.push(
       `[openapi-routes] ${orphans.length} path(s) documentado(s) sem rota real:\n` +
         orphans.map((p) => "  ✗ " + p).join("\n") +
         `\n  → crie a rota, corrija/remova a entrada na spec, ou adicione a KNOWN_STALE_SPEC com justificativa.`
     );
-    process.exitCode = 1;
   }
-  if (!process.exitCode) {
-    console.log(
-      `[openapi-routes] OK — ${specPaths.length} paths na spec, todos com rota real (${implPaths.length} rotas)`
-    );
+  if (parts.length) {
+    return { ok: false, exitCode: 1, message: parts.join("\n") };
   }
+  return {
+    ok: true,
+    exitCode: 0,
+    message: `[openapi-routes] OK — ${specPaths.length} paths na spec, todos com rota real (${implPaths.length} rotas)`,
+  };
+}
+
+function main() {
+  // Keep assertNoStale side-effect path for CLI parity with other gates when
+  // runOpenapiRoutesCheck is not used alone — here we print structured result.
+  const result = runOpenapiRoutesCheck();
+  if (result.ok) console.log(result.message);
+  else console.error(result.message);
+  process.exit(result.exitCode);
 }
 
 if (import.meta.url === pathToFileURL(process.argv[1] || "").href) main();
diff --git a/scripts/check/check-route-guard-membership.ts b/scripts/check/check-route-guard-membership.ts
index 9f21c13d13..c73d9e2667 100644
--- a/scripts/check/check-route-guard-membership.ts
+++ b/scripts/check/check-route-guard-membership.ts
@@ -49,6 +49,7 @@ export const SPAWN_CAPABLE_ROUTE_ROOTS: ReadonlyArray<string> = [
   "src/app/api/mcp",
   "src/app/api/cli-tools/runtime",
   "src/app/api/local", // T-12: 1-click local service launchers (Redis today) — every child here spawns podman/docker (Hard Rules #15 + #17)
+  "src/app/api/skills/collect", // Skill Collector CLI detection: GET .../detect spawns a child process per CLI_TOOL_IDS entry via getCliRuntimeStatus() (Hard Rules #15 + #17, PR #6294 review)
 ];
 
 // Frozen pre-existing exceptions: spawn-capable routes NOT yet classified
diff --git a/scripts/check/check-t11-any-budget.mjs b/scripts/check/check-t11-any-budget.mjs
index d1ae1706c2..3330aa2158 100644
--- a/scripts/check/check-t11-any-budget.mjs
+++ b/scripts/check/check-t11-any-budget.mjs
@@ -22,6 +22,10 @@ const budget = [
   { file: "src/lib/db/prompts.ts", maxAny: 0 },
   { file: "src/lib/db/providers.ts", maxAny: 0 },
   { file: "src/lib/db/settings.ts", maxAny: 0 },
+  // #3512: saveRequestUsage typed with UsageEntry (DB-entity 1:1 interface); the
+  // other any's in this file (getUsageHistory filter, nextCursor cast,
+  // appendRequestLog tokens, getRecentLogs catch) were cleaned in the same pass.
+  { file: "src/lib/usage/usageHistory.ts", maxAny: 0 },
   { file: "open-sse/config/providerRegistry.ts", maxAny: 0 },
   { file: "open-sse/config/providerModels.ts", maxAny: 0 },
   { file: "open-sse/mcp-server/audit.ts", maxAny: 0 },
diff --git a/scripts/check/check-test-discovery.mjs b/scripts/check/check-test-discovery.mjs
index 299e38b207..33a2598ef8 100644
--- a/scripts/check/check-test-discovery.mjs
+++ b/scripts/check/check-test-discovery.mjs
@@ -92,6 +92,9 @@ export const COLLECTORS = [
   { glob: "tests/integration/combo-matrix/*.test.ts", sources: ["package.json"] },
   // Node native runner — test:combo:live (gated real-upstream smoke; RUN_COMBO_LIVE=1 + VPS creds)
   { glob: "tests/integration/combo-live/*.live.test.ts", sources: ["package.json"] },
+  // Node native runner — test:boundary:live (gated real-upstream smoke; RUN_BOUNDARY_LIVE=1,
+  // hits omniroute.vhost2.harre.dynv6.net — never runs unopted in CI)
+  { glob: "tests/boundary/*.live.test.ts", sources: ["package.json"] },
   // Node native runner — test:system
   { glob: "tests/e2e/system-failover.test.ts", sources: ["package.json"] },
   // vitest.mcp.config.ts — test:vitest
diff --git a/scripts/check/check-test-masking.mjs b/scripts/check/check-test-masking.mjs
index 1a2dddf95f..96f67e9d0b 100644
--- a/scripts/check/check-test-masking.mjs
+++ b/scripts/check/check-test-masking.mjs
@@ -59,6 +59,29 @@ export function countExtendedTautologies(src) {
   return count;
 }
 
+/**
+ * (#6404) Narrower sibling of countExtendedTautologies(), deliberately EXCLUDING
+ * `assert.ok(true)`: that pattern is intentionally left to the lenient, diff-only,
+ * new-occurrences-only subcheck 3 above, because ~15 pre-existing, verified-legitimate
+ * uses already exist repo-wide (documented fallbacks like "expected to throw" /
+ * "DB not available, expected" in try/catch branches) — an absolute, always-on scan
+ * against all of them would be a mass false-positive, not a real signal.
+ *
+ * `expect(true).toBe(true)` / `assert.equal(1, 1)` / `assert.strictEqual(1, 1)` have
+ * no such legitimate use anywhere in this codebase (verified zero pre-existing hits
+ * after fixing #6404's playground-api-tab.test.tsx) — a genuinely bare, no-argument
+ * tautology is never a deliberate pattern here, so it is safe to fail on ANY hit,
+ * with or without a PR diff to compare against. See scanBareTautologies() below.
+ */
+export function countBareTautologies(src) {
+  let count = 0;
+  // expect(true).toBe(true)
+  count += (src.match(/\bexpect\s*\(\s*true\s*\)\s*\.\s*toBe\s*\(\s*true\s*\)/g) || []).length;
+  // assert.equal(1, 1) / assert.strictEqual(1, 1) — literal numeric identity
+  count += (src.match(/\bassert\s*\.\s*(?:strict)?[Ee]qual\s*\(\s*1\s*,\s*1\s*\)/g) || []).length;
+  return count;
+}
+
 // ─── (6348) Subcheck 4: inline-reimplemented prod conditions (REPORT-ONLY) ───
 // A test that copies a conditional expression out of production code (instead of
 // importing and exercising the symbol that owns it) is the wrong-shape-contract-test
@@ -296,6 +319,26 @@ export function partitionDeletedRenamed(nameStatusOutput) {
  * Os campos de skip e extTaut são opcionais (default 0) para compatibilidade
  * com chamadas legadas que só passam baseAsserts/headAsserts/baseTaut/headTaut.
  */
+/**
+ * (#6634) `check-test-masking.test.ts` legitimately embeds tautology-pattern string
+ * literals (`assert.ok(true)`, `expect(true).toBe(true)`, `assert.equal(1,1)`) as
+ * FIXTURES to exercise `countBareTautologies()`/`scanBareTautologies()` (#6404). The
+ * diff-based tautology counters (`countTautologies()`/`countExtendedTautologies()`)
+ * are dumb regex scans of raw source text with no awareness that a literal sits
+ * inside a fixture string rather than real assertion code, so any new fixture line
+ * self-trips a HARD "new tautology" flag on the gate's own regression-test file.
+ * Mirrors the exclusion `scanBareTautologies()` already applies for the same reason.
+ *
+ * The exclusion covers the whole `check-test-masking*` gate self-test family — not
+ * just `check-test-masking.test.ts` but sibling regression files such as
+ * `check-test-masking-selfref-6634.test.ts`, which likewise embed tautology-pattern
+ * literals as fixtures/documentation to prove this gate's own behavior.
+ */
+const SELF_TEST_FIXTURE_RE = /(^|\/)check-test-masking(-[\w-]+)?\.test\.tsx?$/;
+function isSelfTestFixtureFile(file) {
+  return SELF_TEST_FIXTURE_RE.test(file);
+}
+
 export function evaluateMasking(perFile, assertReductionAllowlist = new Set()) {
   const flags = [];
   for (const f of perFile) {
@@ -303,6 +346,7 @@ export function evaluateMasking(perFile, assertReductionAllowlist = new Set()) {
     const headSkips = f.headSkips ?? 0;
     const baseExtTaut = f.baseExtTaut ?? 0;
     const headExtTaut = f.headExtTaut ?? 0;
+    const isSelfTestFixture = isSelfTestFixtureFile(f.file);
 
     // The net-assert-REDUCTION signal can be allowlisted per file when the reduction is a
     // verified-legitimate refactor/field-removal (config/quality/test-masking-allowlist.json).
@@ -311,13 +355,13 @@ export function evaluateMasking(perFile, assertReductionAllowlist = new Set()) {
       flags.push(
         `${f.file}: asserts ${f.baseAsserts} → ${f.headAsserts} (REMOÇÃO de ${f.baseAsserts - f.headAsserts} — enfraquecimento?)`
       );
-    if (f.headTaut > f.baseTaut)
+    if (!isSelfTestFixture && f.headTaut > f.baseTaut)
       flags.push(`${f.file}: nova(s) ${f.headTaut - f.baseTaut} tautologia(s) assert.ok(true)`);
     if (headSkips > baseSkips)
       flags.push(
         `${f.file}: ${headSkips - baseSkips} novo(s) .skip/.todo/.only (asserts silenciados sem remoção)`
       );
-    if (headExtTaut > baseExtTaut)
+    if (!isSelfTestFixture && headExtTaut > baseExtTaut)
       flags.push(
         `${f.file}: nova(s) ${headExtTaut - baseExtTaut} tautologia(s) estendida(s) (expect(true).toBe(true) / assert.equal(1,1))`
       );
@@ -325,6 +369,50 @@ export function evaluateMasking(perFile, assertReductionAllowlist = new Set()) {
   return flags;
 }
 
+/**
+ * (#6404) Absolute floor scan for bare tautologies (`expect(true).toBe(true)`,
+ * `assert.equal(1, 1)` / `assert.strictEqual(1, 1)`), independent of PR diffing.
+ *
+ * The subcheck-3 diff logic above (`evaluateMasking`'s `headExtTaut > baseExtTaut`)
+ * only fires for a tautology INTRODUCED within the current PR's own diff, and
+ * `resolveBase()` returns `null` outside CI (no `GITHUB_BASE_SHA`/`GITHUB_BASE_REF`),
+ * so a local `npm run check:test-masking` run silently no-ops — "sem base ref —
+ * pulando" — regardless of what the tests actually contain. That is exactly how
+ * #6404's `expect(true).toBe(true)` in `playground-api-tab.test.tsx` slipped through
+ * for a full release cycle after merging once (the diff-only gate has nothing to
+ * compare a pre-existing, already-merged tautology against, and local runs never
+ * scan repo content at all). This scans every tracked test file's current content,
+ * in or out of PR context, so a stray tautology can never hide once merged.
+ *
+ * Uses `countBareTautologies()` (not `countExtendedTautologies()`) — deliberately
+ * excludes `assert.ok(true)`, which has ~15 verified-legitimate pre-existing uses
+ * repo-wide and stays governed by the lenient, new-occurrence-only diff subcheck.
+ *
+ * `check-test-masking.test.ts` is excluded — its fixtures legitimately embed the
+ * literal pattern as string literals to exercise the count* helpers themselves.
+ */
+export function scanBareTautologies(testFiles, readFile) {
+  const read = readFile || ((f) => fs.readFileSync(f, "utf8"));
+  const flags = [];
+  for (const file of testFiles || []) {
+    if (isSelfTestFixtureFile(file)) continue;
+    let src;
+    try {
+      src = read(file);
+    } catch {
+      continue;
+    }
+    const count = countBareTautologies(src);
+    if (count > 0) {
+      flags.push(
+        `${file}: ${count} tautologia(s) pura(s) (expect(true).toBe(true) / assert.equal(1,1)) — ` +
+          "substitua por um assert real do comportamento observável"
+      );
+    }
+  }
+  return flags;
+}
+
 function git(args) {
   try {
     return execFileSync("git", args, { encoding: "utf8" });
@@ -333,6 +421,15 @@ function git(args) {
   }
 }
 
+/** All git-tracked test files (`.test.ts(x)`/`.spec.ts(x)`), repo-wide — used by the
+ * absolute floor scan so it also covers files untouched by the current diff/PR. */
+function listTrackedTestFiles() {
+  return git(["ls-files"])
+    .split("\n")
+    .map((s) => s.trim())
+    .filter((f) => TEST_RE.test(f));
+}
+
 function resolveBase() {
   if (process.env.GITHUB_BASE_SHA) return process.env.GITHUB_BASE_SHA;
   if (process.env.GITHUB_BASE_REF) return `origin/${process.env.GITHUB_BASE_REF}`;
@@ -340,9 +437,34 @@ function resolveBase() {
 }
 
 function main() {
+  // (#6404) Absolute floor scan — runs unconditionally, PR or not, so a tautology
+  // that is already merged into the base (and thus invisible to the diff-only
+  // subchecks below) or a local pre-push run (which has no PR base to diff
+  // against) still gets caught. See scanBareTautologies() doc comment.
+  let bareTautAllowlist = new Set();
+  try {
+    const raw = JSON.parse(fs.readFileSync("config/quality/test-masking-allowlist.json", "utf8"));
+    bareTautAllowlist = new Set(raw._bareTautologyAllowlist || []);
+  } catch {
+    // no allowlist file — treat as empty
+  }
+  const trackedTestFiles = listTrackedTestFiles().filter((f) => !bareTautAllowlist.has(f));
+  const absoluteTautFlags = scanBareTautologies(trackedTestFiles);
+  if (absoluteTautFlags.length) {
+    console.error(
+      `[test-masking] ${absoluteTautFlags.length} tautologia(s) pura(s) encontradas ` +
+        `(scan absoluto — roda com ou sem contexto de PR):\n` +
+        absoluteTautFlags.map((f) => "  ✗ " + f).join("\n") +
+        `\n  → substitua por um assert real do comportamento observável.`
+    );
+    process.exit(1);
+  }
+
   const base = resolveBase();
   if (!base) {
-    console.log("[test-masking] sem base ref (não é PR) — pulando.");
+    console.log(
+      "[test-masking] sem base ref (não é PR) — pulando checks de diff (scan absoluto de tautologias OK)."
+    );
     return;
   }
 
diff --git a/scripts/check/complexityEslintReport.mjs b/scripts/check/complexityEslintReport.mjs
new file mode 100644
index 0000000000..4c65efa3a3
--- /dev/null
+++ b/scripts/check/complexityEslintReport.mjs
@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+/**
+ * Shared ESLint runner for complexity + cognitive-complexity ratchets.
+ * One tree walk → JSON report; consumers count by ruleId (not errorCount).
+ */
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+const CONFIG_PATH = path.join(ROOT, "eslint.complexity-ratchets.config.mjs");
+
+/** Positional dirs — must match config `files` scopes (see check-complexity tests). */
+export const ESLINT_SCAN_DIRS = ["src", "open-sse", "electron", "bin"];
+
+const ESLINT_BIN = path.join(
+  ROOT,
+  "node_modules",
+  ".bin",
+  process.platform === "win32" ? "eslint.cmd" : "eslint"
+);
+
+/** Args after the eslint binary (tests lock scan dirs on this array). */
+export const ESLINT_ARGS = [
+  "--no-config-lookup",
+  "--config",
+  CONFIG_PATH,
+  "--format",
+  "json",
+  "--cache",
+  "--cache-location",
+  ".eslintcache-complexity",
+  ...ESLINT_SCAN_DIRS,
+];
+
+const COMPLEXITY_RULES = new Set(["complexity", "max-lines-per-function"]);
+
+/**
+ * @param {Array<{messages?: Array<{ruleId?: string}>}>} report
+ * @returns {number}
+ */
+export function countComplexityViolations(report) {
+  let count = 0;
+  for (const file of report) {
+    for (const msg of file.messages || []) {
+      if (COMPLEXITY_RULES.has(msg.ruleId)) count++;
+    }
+  }
+  return count;
+}
+
+/**
+ * @param {Array<{messages?: Array<{ruleId?: string}>}>} report
+ * @returns {number}
+ */
+export function countCognitiveViolations(report) {
+  let count = 0;
+  for (const file of report) {
+    for (const msg of file.messages || []) {
+      if (msg.ruleId === "sonarjs/cognitive-complexity") count++;
+    }
+  }
+  return count;
+}
+
+/**
+ * Run ESLint once (or reuse COMPLEXITY_ESLINT_REPORT / in-process cache).
+ * @returns {Array<object>}
+ */
+export function getComplexityEslintReport() {
+  const fromEnv = process.env.COMPLEXITY_ESLINT_REPORT;
+  if (fromEnv && fs.existsSync(fromEnv)) {
+    return JSON.parse(fs.readFileSync(fromEnv, "utf8"));
+  }
+  if (getComplexityEslintReport._cache) return getComplexityEslintReport._cache;
+
+  let stdout;
+  try {
+    // Prefer local bin (Windows-safe); shell only needed for .cmd shims.
+    stdout = execFileSync(ESLINT_BIN, ESLINT_ARGS, {
+      cwd: ROOT,
+      encoding: "utf8",
+      maxBuffer: 64 * 1024 * 1024,
+      shell: process.platform === "win32",
+    });
+  } catch (err) {
+    stdout = err.stdout ? String(err.stdout) : "";
+    if (!stdout.trim()) throw err;
+  }
+  const report = JSON.parse(stdout);
+  getComplexityEslintReport._cache = report;
+
+  const outDir = path.join(ROOT, ".artifacts");
+  try {
+    fs.mkdirSync(outDir, { recursive: true });
+    fs.writeFileSync(path.join(outDir, "complexity-eslint.json"), stdout);
+  } catch {
+    // best-effort cache for sibling steps / local inspection
+  }
+  return report;
+}
+
+getComplexityEslintReport._cache = null;
diff --git a/scripts/check/lib/apiRoutes.mjs b/scripts/check/lib/apiRoutes.mjs
new file mode 100644
index 0000000000..919c0b6ecf
--- /dev/null
+++ b/scripts/check/lib/apiRoutes.mjs
@@ -0,0 +1,82 @@
+/**
+ * Shared filesystem inventory of Next.js App Router API routes.
+ *
+ * Existence reason: openapi-routes (spec→route), docs-symbols (prose→route),
+ * and openapi-coverage (route→spec %) all need the same walk of src/app/api.
+ * One collector keeps path normalization consistent and avoids triple walks
+ * when a combined gate runs them together.
+ */
+import fs from "node:fs";
+import path from "node:path";
+
+/**
+ * @param {string} [root] repo root
+ * @returns {string} absolute path to src/app/api
+ */
+export function apiRoot(root = process.cwd()) {
+  return path.join(root, "src", "app", "api");
+}
+
+/**
+ * Convert a directory under src/app/api (the folder that contains route.ts)
+ * to an OpenAPI-style /api/... path.
+ * Dynamic segments: [id] → {id}, [...slug] → {slug}.
+ *
+ * @param {string} routeDir absolute directory containing route.ts
+ * @param {string} apiRootAbs absolute src/app/api
+ * @returns {string}
+ */
+export function toApiUrlPath(routeDir, apiRootAbs) {
+  const rel = path.relative(apiRootAbs, routeDir).replace(/\\/g, "/");
+  if (!rel || rel === ".") return "/api";
+  const normalized = rel
+    .replace(/\[\.\.\.([^\]]+)\]/g, "{$1}")
+    .replace(/\[([^\]]+)\]/g, "{$1}");
+  return `/api/${normalized}`;
+}
+
+/**
+ * Walk src/app/api for route.ts(x) → OpenAPI-style URL paths.
+ * @param {string} [root]
+ * @returns {string[]}
+ */
+export function collectApiRouteUrlPaths(root = process.cwd()) {
+  const API = apiRoot(root);
+  if (!fs.existsSync(API)) return [];
+  const out = [];
+  function walk(dir) {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        walk(full);
+      } else if (entry.isFile() && /^route\.tsx?$/.test(entry.name)) {
+        out.push(toApiUrlPath(path.dirname(full), API));
+      }
+    }
+  }
+  walk(API);
+  return out;
+}
+
+/**
+ * Walk src/app/api → relative repo paths to route.ts (docs-symbols resolver).
+ * @param {string} [root]
+ * @returns {Set<string>}
+ */
+export function collectApiRouteFiles(root = process.cwd()) {
+  const API = apiRoot(root);
+  const out = new Set();
+  if (!fs.existsSync(API)) return out;
+  function walk(dir) {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        walk(full);
+      } else if (entry.isFile() && /^route\.tsx?$/.test(entry.name)) {
+        out.add(path.relative(root, full).replace(/\\/g, "/"));
+      }
+    }
+  }
+  walk(API);
+  return out;
+}
diff --git a/scripts/dev/head-response-guard.cjs b/scripts/dev/head-response-guard.cjs
new file mode 100644
index 0000000000..7ecb460439
--- /dev/null
+++ b/scripts/dev/head-response-guard.cjs
@@ -0,0 +1,104 @@
+"use strict";
+
+/**
+ * HEAD response guard (#6400).
+ *
+ * RFC 9110 §9.3.2 requires a HEAD response to carry the same headers/status a
+ * GET would, with ZERO body, and the connection should not leave the client
+ * guessing about when the (bodyless) response is actually finished.
+ *
+ * Next.js 16 handles this correctly for App Router *route handlers*
+ * (`route.ts` exporting `GET`) — `next/dist/server/send-response.js` explicitly
+ * skips piping the `Response.body` when `req.method === 'HEAD'`. But Next's
+ * *page*-rendering pipeline (`next/dist/server/pipe-readable.js` ->
+ * `pipeToNodeResponse`, used for every app-router page/layout render — the
+ * root page, the `not-found` boundary that unmatched paths fall through to,
+ * dashboard pages, etc.) has NO such check: it always pipes the fully
+ * rendered body to the HTTP response regardless of method. Combined with
+ * Node's default keep-alive framing, a HEAD request to any page-rendered path
+ * ends up with the socket only settling once that render finishes — on a
+ * client that doesn't special-case a HEAD response's implicit zero-length
+ * body (observed on Windows/curl in #6400), this reads as "headers arrive,
+ * then it hangs" instead of the RFC-mandated "closes immediately".
+ *
+ * Fix: for every inbound HEAD request, before Next ever sees it, wrap the
+ * Node `ServerResponse` so:
+ *   - Any body bytes written by Next (route handler OR page render) are
+ *     discarded — status code and headers Next computed (auth 401s, 404s,
+ *     200s, etc.) are preserved untouched.
+ *   - The connection is force-closed right after headers flush
+ *     (`Connection: close`), removing any keep-alive ambiguity a client could
+ *     have about whether more bytes are coming.
+ *
+ * This applies globally (valid routes, unmatched/404 paths, authed and
+ * unauthed) because it operates at the Node HTTP transport layer shared by
+ * every request — the same tier as the existing `http-method-guard.cjs` /
+ * `peer-stamp.mjs` wrappers — never inside Next's per-route code.
+ * See: https://github.com/diegosouzapw/OmniRoute/issues/6400
+ */
+
+function isHeadRequest(req) {
+  return typeof req?.method === "string" && req.method.toUpperCase() === "HEAD";
+}
+
+/**
+ * Mutates `res` in place so any body write is discarded and the response
+ * ends (closing the connection) as soon as `.end()` is called, regardless of
+ * what body argument was passed to it.
+ *
+ * @param {import("node:http").ServerResponse} res
+ */
+function suppressBodyAndForceClose(res) {
+  try {
+    // Never leave the client guessing whether the (bodyless) response has
+    // more bytes coming — closing the socket is the unambiguous signal.
+    res.setHeader("Connection", "close");
+  } catch {
+    // Headers may already be flushed in rare re-entrant cases — the write/end
+    // overrides below still guarantee an empty, prompt HEAD response.
+  }
+
+  const originalEnd = res.end.bind(res);
+  let ended = false;
+
+  res.write = function headSuppressedWrite(_chunk, encodingOrCb, cb) {
+    // Discard the body but keep the writable-stream contract: report the
+    // write as flushed (no backpressure) so callers like Next's
+    // `pipeToNodeResponse` never block waiting on a `drain` that would
+    // otherwise never fire, and invoke whichever callback form was passed.
+    if (typeof encodingOrCb === "function") encodingOrCb();
+    else if (typeof cb === "function") cb();
+    return true;
+  };
+
+  res.end = function headSuppressedEnd(chunk, encoding, cb) {
+    if (ended) return res;
+    ended = true;
+    if (typeof chunk === "function") return originalEnd(chunk);
+    if (typeof encoding === "function") return originalEnd(encoding);
+    if (typeof cb === "function") return originalEnd(cb);
+    return originalEnd();
+  };
+}
+
+/**
+ * Wrap a Node request listener so every inbound HEAD request gets the
+ * body-suppression + forced-close treatment before the wrapped listener
+ * (eventually Next.js) runs.
+ *
+ * @param {(req: import("node:http").IncomingMessage, res: import("node:http").ServerResponse) => unknown} listener
+ */
+function wrapRequestListenerWithHeadResponseGuard(listener) {
+  return function headResponseGuardRequestHandler(req, res) {
+    if (isHeadRequest(req)) {
+      suppressBodyAndForceClose(res);
+    }
+    return listener.call(this, req, res);
+  };
+}
+
+module.exports = {
+  isHeadRequest,
+  suppressBodyAndForceClose,
+  wrapRequestListenerWithHeadResponseGuard,
+};
diff --git a/scripts/dev/run-next.mjs b/scripts/dev/run-next.mjs
index 4a402650a8..68eb9d2198 100644
--- a/scripts/dev/run-next.mjs
+++ b/scripts/dev/run-next.mjs
@@ -10,14 +10,13 @@ import { createOmnirouteWsBridge } from "./v1-ws-bridge.mjs";
 import { createResponsesWsProxy } from "./responses-ws-proxy.mjs";
 import { ensurePeerStampToken, stampPeerIp } from "./peer-stamp.mjs";
 import methodGuard from "./http-method-guard.cjs";
+import headResponseGuard from "./head-response-guard.cjs";
 import { ensureNativeSqlite } from "./ensure-native-sqlite.mjs";
-import {
-  isTurbopackCacheCorruption,
-  purgeAllTurbopackCaches,
-} from "./turbopackCacheHeal.mjs";
+import { isTurbopackCacheCorruption, purgeAllTurbopackCaches } from "./turbopackCacheHeal.mjs";
 import { randomUUID } from "node:crypto";
 
 const { maybeHandleDisallowedMethod } = methodGuard;
+const { wrapRequestListenerWithHeadResponseGuard } = headResponseGuard;
 
 // Pre-read DATA_DIR from local .env before bootstrap resolves paths
 if (!process.env.DATA_DIR) {
@@ -69,6 +68,7 @@ for (const [key, value] of Object.entries(mergedEnv)) {
 // '@'` on the `@import "tailwindcss"` line. Force NODE_ENV to track the run
 // mode, exactly like the `next` CLI does.
 process.env.NODE_ENV = dev ? "development" : "production";
+process.env.OMNIROUTE_INTERNAL_SCHEME = "http";
 
 const { dashboardPort } = runtimePorts;
 const hostname = process.env.HOST || "0.0.0.0";
@@ -117,7 +117,8 @@ async function prepareWithHeal() {
   try {
     await nextApp.prepare();
   } catch (error) {
-    const detail = error instanceof Error ? `${error.message}\n${error.stack ?? ""}` : String(error);
+    const detail =
+      error instanceof Error ? `${error.message}\n${error.stack ?? ""}` : String(error);
     if (!useTurbopack || !isTurbopackCacheCorruption(detail)) throw error;
     console.warn(
       "[Next] Turbopack dev cache looks corrupted (Windows mmap / os error 1455 — known upstream bug). Purging and retrying once…"
@@ -143,13 +144,15 @@ async function start() {
     baseUrl: `http://127.0.0.1:${dashboardPort}`,
   });
 
-  const server = http.createServer((req, res) => {
-    if (maybeHandleDisallowedMethod(req, res)) return;
-    // Stamp the real TCP peer IP before Next sees the request, so the authz
-    // middleware can decide LOCAL_ONLY locality without trusting the Host header.
-    stampPeerIp(req);
-    return requestHandler(req, res);
-  });
+  const server = http.createServer(
+    wrapRequestListenerWithHeadResponseGuard((req, res) => {
+      if (maybeHandleDisallowedMethod(req, res)) return;
+      // Stamp the real TCP peer IP before Next sees the request, so the authz
+      // middleware can decide LOCAL_ONLY locality without trusting the Host header.
+      stampPeerIp(req);
+      return requestHandler(req, res);
+    })
+  );
   server.on("upgrade", async (req, socket, head) => {
     try {
       const responsesWsHandled = await responsesWsProxy.handleUpgrade(req, socket, head);
diff --git a/scripts/dev/standalone-server-ws.mjs b/scripts/dev/standalone-server-ws.mjs
index 890caee40f..3d7bd1f0ca 100644
--- a/scripts/dev/standalone-server-ws.mjs
+++ b/scripts/dev/standalone-server-ws.mjs
@@ -5,21 +5,22 @@ import { createResponsesWsProxy } from "./responses-ws-proxy.mjs";
 import { ensurePeerStampToken, wrapRequestListenerWithPeerStamp } from "./peer-stamp.mjs";
 import { maybeHandleWebdav } from "./webdav-handler.mjs";
 import methodGuard from "./http-method-guard.cjs";
+import headResponseGuard from "./head-response-guard.cjs";
 import { resolveTlsOptions, createServerListener } from "./tls-options.mjs";
 
 const originalCreateServer = http.createServer.bind(http);
 const proxiesByPort = new Map();
 const { wrapRequestListenerWithMethodGuard } = methodGuard;
+const { wrapRequestListenerWithHeadResponseGuard } = headResponseGuard;
 
 // Opt-in native HTTPS (#5242). Resolved once at boot: when both OMNIROUTE_TLS_CERT
 // and OMNIROUTE_TLS_KEY point at readable files we terminate TLS on the same
 // listener Next binds to (so WS `upgrade` / request wrappers keep working over
 // TLS). Absent or misconfigured → null → identical plain-HTTP behavior as before.
 const tlsOptions = resolveTlsOptions(process.env);
+process.env.OMNIROUTE_INTERNAL_SCHEME = tlsOptions ? "https" : "http";
 if (tlsOptions) {
-  console.log(
-    `[omniroute][tls] HTTPS enabled — terminating TLS with cert=${tlsOptions.certPath}`
-  );
+  console.log(`[omniroute][tls] HTTPS enabled — terminating TLS with cert=${tlsOptions.certPath}`);
 }
 
 process.env.OMNIROUTE_WS_BRIDGE_SECRET ||= randomUUID();
@@ -49,8 +50,23 @@ function getProxy(server) {
   return proxy;
 }
 
+function deriveLiveWsPath() {
+  const publicUrl = process.env.NEXT_PUBLIC_LIVE_WS_PUBLIC_URL;
+  if (!publicUrl) return "/live-ws";
+  if (!publicUrl.startsWith("ws://") && !publicUrl.startsWith("wss://")) return "/live-ws";
+  try {
+    const parsed = new URL(publicUrl);
+    const pathname = parsed.pathname;
+    return pathname && pathname !== "/" ? pathname : "/live-ws";
+  } catch {
+    return "/live-ws";
+  }
+}
+
+const LIVE_WS_PATH = deriveLiveWsPath();
+
 function proxyLiveWs(req, socket, head) {
-  const targetPort = parseInt(process.env.LIVE_WS_PORT || "20129", 10);
+  const targetPort = parseInt(process.env.LIVE_WS_PORT || "20132", 10);
   const targetSocket = net.connect(targetPort, "127.0.0.1", () => {
     let rawRequest = `${req.method} ${req.url} HTTP/${req.httpVersion}\r\n`;
     for (const [key, val] of Object.entries(req.headers)) {
@@ -74,8 +90,16 @@ function proxyLiveWs(req, socket, head) {
 function wrapUpgradeListener(server, listener) {
   return async function responsesWsAwareUpgrade(req, socket, head) {
     try {
+      // If this server IS the LiveWS server (port 20132), the ws library's
+      // own upgrade handler should process the request directly — proxying
+      // /live-ws back to 127.0.0.1:20132 would create an infinite self-loop.
+      const liveWsPort = parseInt(process.env.LIVE_WS_PORT || "20132", 10);
+      if (getPort(server) === liveWsPort) {
+        return listener.call(this, req, socket, head);
+      }
+
       const url = new URL(req.url || "/", `http://${req.headers.host || "localhost"}`);
-      if (url.pathname === "/live-ws" || url.pathname.startsWith("/live-ws")) {
+      if (url.pathname === LIVE_WS_PATH || url.pathname.startsWith(LIVE_WS_PATH + "/")) {
         proxyLiveWs(req, socket, head);
         return;
       }
@@ -114,8 +138,12 @@ http.createServer = function createServerWithResponsesWs(...args) {
   const lastFnIdx = args.map((a) => typeof a === "function").lastIndexOf(true);
   if (lastFnIdx >= 0) {
     // Method guard runs before Next because Next 16 rejects TRACE while constructing requests.
-    args[lastFnIdx] = wrapRequestListenerWithMethodGuard(
-      wrapRequestListenerWithWebdav(wrapRequestListenerWithPeerStamp(args[lastFnIdx]))
+    // Head-response guard wraps outermost so it sees (and can force-close) every
+    // HEAD request regardless of which inner layer ends up handling it (#6400).
+    args[lastFnIdx] = wrapRequestListenerWithHeadResponseGuard(
+      wrapRequestListenerWithMethodGuard(
+        wrapRequestListenerWithWebdav(wrapRequestListenerWithPeerStamp(args[lastFnIdx]))
+      )
     );
   }
 
@@ -134,8 +162,10 @@ http.createServer = function createServerWithResponsesWs(...args) {
     if (eventName === "request" && typeof listener === "function") {
       return originalOn(
         eventName,
-        wrapRequestListenerWithMethodGuard(
-          wrapRequestListenerWithWebdav(wrapRequestListenerWithPeerStamp(listener))
+        wrapRequestListenerWithHeadResponseGuard(
+          wrapRequestListenerWithMethodGuard(
+            wrapRequestListenerWithWebdav(wrapRequestListenerWithPeerStamp(listener))
+          )
         )
       );
     }
@@ -149,8 +179,10 @@ http.createServer = function createServerWithResponsesWs(...args) {
     if (eventName === "request" && typeof listener === "function") {
       return originalAddListener(
         eventName,
-        wrapRequestListenerWithMethodGuard(
-          wrapRequestListenerWithWebdav(wrapRequestListenerWithPeerStamp(listener))
+        wrapRequestListenerWithHeadResponseGuard(
+          wrapRequestListenerWithMethodGuard(
+            wrapRequestListenerWithWebdav(wrapRequestListenerWithPeerStamp(listener))
+          )
         )
       );
     }
diff --git a/scripts/dev/webdav-handler.mjs b/scripts/dev/webdav-handler.mjs
index 3b0a0893b4..8dfd97b6de 100644
--- a/scripts/dev/webdav-handler.mjs
+++ b/scripts/dev/webdav-handler.mjs
@@ -205,7 +205,7 @@ export function resolveDestinationPath(vaultRoot, destinationHeader) {
 export function verifyBasicAuth(authHeader, expectedUsername, expectedPassword) {
   if (!authHeader || typeof authHeader !== "string") return false;
 
-  const match = /^Basic\s+(.+)$/i.exec(authHeader.trim());
+  const match = /^Basic[ \t]+(\S+)$/i.exec(authHeader.trim()); // linear-time: no overlapping \s+/.+ backtracking (CodeQL js/polynomial-redos #708)
   if (!match) return false;
 
   let decoded;
diff --git a/scripts/i18n/generate-multilang.mjs b/scripts/i18n/generate-multilang.mjs
index 3ad9919f98..39812499e9 100644
--- a/scripts/i18n/generate-multilang.mjs
+++ b/scripts/i18n/generate-multilang.mjs
@@ -97,6 +97,15 @@ const LOCALE_SPECS = [
     readmeName: "中文 (简体)",
     docsName: "中文 (简体)",
   },
+  {
+    code: "zh-TW",
+    googleTl: "zh-TW",
+    label: "ZH-TW",
+    flag: "🇹🇼",
+    languageName: "中文 (繁體)",
+    readmeName: "中文 (繁體)",
+    docsName: "中文 (繁體)",
+  },
   {
     code: "de",
     googleTl: "de",
@@ -414,7 +423,7 @@ const LOCALE_SPECS = [
   },
 ];
 
-const EXISTING_README_CODES = new Set(["pt-BR", "es", "fr", "it", "ru", "zh-CN", "de"]);
+const EXISTING_README_CODES = new Set(["pt-BR", "es", "fr", "it", "ru", "zh-CN", "zh-TW", "de"]);
 const RTL_LOCALES = new Set(["ar", "fa", "he", "ur"]);
 
 const URL_MAX_TEXT_LENGTH = 1800;
diff --git a/scripts/i18n/run-translation.mjs b/scripts/i18n/run-translation.mjs
index 117ba0fd86..ae59d83028 100755
--- a/scripts/i18n/run-translation.mjs
+++ b/scripts/i18n/run-translation.mjs
@@ -25,7 +25,7 @@
  * Backend (configured via env, never committed):
  *   OMNIROUTE_TRANSLATION_API_URL     e.g. https://cloud.omniroute.dev/v1
  *   OMNIROUTE_TRANSLATION_API_KEY     bearer token (kept out of logs)
- *   OMNIROUTE_TRANSLATION_MODEL       e.g. cx/gpt-5.4-mini
+ *   OMNIROUTE_TRANSLATION_MODEL       e.g. cx/gpt-5.6-sol
  *   OMNIROUTE_TRANSLATION_TIMEOUT_MS  optional, default 60000
  *   OMNIROUTE_TRANSLATION_CONCURRENCY optional, default 4
  */
diff --git a/scripts/quality/build-test-impact-map.mjs b/scripts/quality/build-test-impact-map.mjs
index 223d23bf2b..0120f95dc6 100644
--- a/scripts/quality/build-test-impact-map.mjs
+++ b/scripts/quality/build-test-impact-map.mjs
@@ -57,10 +57,14 @@ function sourceDepsOf(entry) {
 // The TIA step runs the selected subset via `node --test`, so it must NOT include
 // vitest files (`.test.tsx`, `open-sse/**/__tests__`, `tests/unit/autoCombo`), nor
 // e2e/integration tests, which can't run under node:test (they 99-false-failed before).
+// Mirror EXACTLY the package.json `test:unit` / `test:unit:ci` globs (incl. memory,
+// usage, combo, dashboard, serial, and *.test.mjs). Drift here → false __RUN_ALL__.
 const testFiles = globSync(
   [
     "tests/unit/*.test.ts",
-    "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,dashboard,db,db-adapters,docs,executors,gamification,guardrails,lib,mcp,runtime,security,services,settings,shared,ui}/**/*.test.ts",
+    "tests/unit/{api,auth,authz,build,cli,cli-helper,combo,compression,correctness,cors,db,db-adapters,docs,gamification,guardrails,lib,mcp,memory,runtime,security,services,settings,shared,ui,usage}/**/*.test.ts",
+    "tests/unit/**/*.test.mjs",
+    "tests/unit/dashboard/**/*.test.ts",
     // Quarentena serial (P0.3): também são node:test — a TIA precisa mapeá-los.
     "tests/unit/serial/**/*.test.ts",
   ],
diff --git a/scripts/quality/classify-pr-changes.mjs b/scripts/quality/classify-pr-changes.mjs
new file mode 100644
index 0000000000..619d5511a1
--- /dev/null
+++ b/scripts/quality/classify-pr-changes.mjs
@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+/**
+ * PR change classification for ci.yml path filters.
+ *
+ * Why this exists (not "skip work for free"):
+ * - code  → typecheck, unit/vitest, lint bag, quality ratchets (code regressions)
+ * - docs  → docs-sync / prose (doc/API contract regressions)
+ * - i18n  → message/UI-key validation (translation regressions)
+ * - workflow → CI definition changes (always treat as code — gates protect the gates)
+ *
+ * Pure docs or pure message-catalog PRs should NOT pay full unit/lint wall time.
+ * Unknown paths default to code (fail-safe: better over-run than under-protect).
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+/**
+ * @param {string[]} files relative paths from git diff
+ * @returns {{ code: boolean, docs: boolean, i18n: boolean, workflow: boolean }}
+ */
+export function classifyPaths(files) {
+  let code = false;
+  let docs = false;
+  let i18n = false;
+  let workflow = false;
+
+  for (const raw of files) {
+    const f = String(raw || "")
+      .trim()
+      .replace(/\\/g, "/");
+    if (!f) continue;
+
+    if (f.startsWith(".github/workflows/") || f === ".zizmor.yml") {
+      workflow = true;
+      // Workflow edits can weaken or remove gates — treat as code.
+      code = true;
+      continue;
+    }
+
+    // Message catalogs only: translation content, not runtime TS.
+    if (f.startsWith("src/i18n/messages/")) {
+      i18n = true;
+      continue;
+    }
+
+    // i18n tooling / non-message i18n source → also code (scripts, config, loaders).
+    if (
+      f.startsWith("scripts/i18n/") ||
+      f === "config/i18n.json" ||
+      f.startsWith("src/i18n/")
+    ) {
+      i18n = true;
+      code = true;
+      continue;
+    }
+
+    if (f.startsWith("docs/") || f.endsWith(".md")) {
+      docs = true;
+      continue;
+    }
+
+    if (
+      f.startsWith("src/") ||
+      f.startsWith("open-sse/") ||
+      f.startsWith("bin/") ||
+      f.startsWith("electron/") ||
+      f.startsWith("tests/") ||
+      f.startsWith("scripts/") ||
+      f.startsWith("db/") ||
+      f.startsWith("config/") ||
+      f === "package.json" ||
+      f === "package-lock.json" ||
+      /^tsconfig.*\.json$/.test(f) ||
+      f.startsWith("next.config.") ||
+      f.startsWith("vitest") ||
+      f.startsWith("playwright.config.")
+    ) {
+      code = true;
+      continue;
+    }
+
+    // Fail-safe: unknown path class → code (do not skip heavy gates by accident).
+    code = true;
+  }
+
+  return { code, docs, i18n, workflow };
+}
+
+function main() {
+  const listPath = process.argv[2];
+  let files;
+  if (listPath && listPath !== "-") {
+    files = fs
+      .readFileSync(listPath, "utf8")
+      .split(/\r?\n/)
+      .map((s) => s.trim())
+      .filter(Boolean);
+  } else {
+    const stdin = fs.readFileSync(0, "utf8");
+    files = stdin
+      .split(/\r?\n/)
+      .map((s) => s.trim())
+      .filter(Boolean);
+  }
+  const c = classifyPaths(files);
+  // GitHub Actions output format (also human-readable key=value).
+  process.stdout.write(
+    `code=${c.code}\ndocs=${c.docs}\ni18n=${c.i18n}\nworkflow=${c.workflow}\n`
+  );
+}
+
+const isMain =
+  process.argv[1] &&
+  path.resolve(fileURLToPath(import.meta.url)) === path.resolve(process.argv[1]);
+
+if (isMain) {
+  main();
+}
diff --git a/scripts/quality/collect-metrics.mjs b/scripts/quality/collect-metrics.mjs
index a1535cbcb0..f02617d2a5 100644
--- a/scripts/quality/collect-metrics.mjs
+++ b/scripts/quality/collect-metrics.mjs
@@ -23,21 +23,41 @@ const out = {};
 // bruto (que driftava +41/+88 por ciclo e era rebaselinado às cegas na release).
 // O aperto do estoque acontece via --prune-suppressions na release.
 function eslintCounts() {
-  let stdout;
-  const args = ["eslint", ".", "--format", "json"];
-  if (fs.existsSync(path.join(cwd, "config/quality/eslint-suppressions.json"))) {
-    args.push("--suppressions-location", "config/quality/eslint-suppressions.json");
+  // Prefer a precomputed JSON report (same existence reason as lint job: inventory
+  // of net-new warnings vs suppressions). Avoids a second cold full-tree ESLint
+  // when CI/local already produced the report.
+  const cached = path.resolve(
+    cwd,
+    process.env.ESLINT_RESULTS_JSON || path.join(".artifacts", "eslint-results.json")
+  );
+  let results;
+  if (fs.existsSync(cached)) {
+    results = JSON.parse(fs.readFileSync(cached, "utf8"));
+  } else {
+    let stdout;
+    const eslintBin = path.join(
+      cwd,
+      "node_modules",
+      ".bin",
+      process.platform === "win32" ? "eslint.cmd" : "eslint"
+    );
+    const args = [".", "--format", "json", "--cache", "--cache-location", ".eslintcache"];
+    if (fs.existsSync(path.join(cwd, "config/quality/eslint-suppressions.json"))) {
+      args.push("--suppressions-location", "config/quality/eslint-suppressions.json");
+    }
+    try {
+      // Prefer local bin (Windows-safe .cmd); shell only when needed for the shim.
+      stdout = execFileSync(eslintBin, args, {
+        encoding: "utf8",
+        maxBuffer: 256 * 1024 * 1024,
+        shell: process.platform === "win32",
+      });
+    } catch (e) {
+      // eslint sai com código != 0 quando há errors; o JSON ainda vem no stdout
+      stdout = e.stdout?.toString() || "[]";
+    }
+    results = JSON.parse(stdout);
   }
-  try {
-    stdout = execFileSync("npx", args, {
-      encoding: "utf8",
-      maxBuffer: 256 * 1024 * 1024,
-    });
-  } catch (e) {
-    // eslint sai com código != 0 quando há errors; o JSON ainda vem no stdout
-    stdout = e.stdout?.toString() || "[]";
-  }
-  const results = JSON.parse(stdout);
   out.eslintWarnings = results.reduce((n, r) => n + (r.warningCount || 0), 0);
   out.eslintErrors = results.reduce((n, r) => n + (r.errorCount || 0), 0);
 }
diff --git a/scripts/quality/run-all-gates.mjs b/scripts/quality/run-all-gates.mjs
index 1a12cf7acf..409c8c1d29 100644
--- a/scripts/quality/run-all-gates.mjs
+++ b/scripts/quality/run-all-gates.mjs
@@ -32,14 +32,14 @@ const GATES = [
   { name: "check:public-creds", cmd: ["node", "scripts/check/check-public-creds.mjs"] },
   { name: "check:error-helper", cmd: ["node", "scripts/check/check-error-helper.mjs"] },
   { name: "check:fetch-targets", cmd: ["node", "scripts/check/check-fetch-targets.mjs"] },
-  { name: "check:openapi-routes", cmd: ["node", "scripts/check/check-openapi-routes.mjs"] },
+  { name: "check:api-docs-refs", cmd: ["node", "scripts/check/check-api-docs-refs.mjs"] },
   { name: "check:deps", cmd: ["node", "scripts/check/check-deps.mjs"] },
 
   // Group C — moderate (<15s)
   { name: "check:db-rules", cmd: ["node", "scripts/check/check-db-rules.mjs"] },
   { name: "check:file-size", cmd: ["node", "scripts/check/check-file-size.mjs"] },
-  { name: "check:complexity", cmd: ["node", "scripts/check/check-complexity.mjs"] },
-  { name: "check:docs-symbols", cmd: ["node", "scripts/check/check-docs-symbols.mjs"] },
+  { name: "check:complexity-ratchets", cmd: ["node", "scripts/check/check-complexity-ratchets.mjs"] },
+  // docs-symbols folded into check:api-docs-refs (Group B)
   { name: "check:known-symbols", cmd: ["node", "--import", "tsx", "scripts/check/check-known-symbols.ts"] },
   { name: "check:route-guard-membership", cmd: ["node", "--import", "tsx", "scripts/check/check-route-guard-membership.ts"] },
   { name: "check:test-discovery", cmd: ["node", "scripts/check/check-test-discovery.mjs"] },
diff --git a/scripts/quality/run-eslint-json.mjs b/scripts/quality/run-eslint-json.mjs
new file mode 100644
index 0000000000..cbefa23e25
--- /dev/null
+++ b/scripts/quality/run-eslint-json.mjs
@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+/**
+ * Single ESLint pass that always writes a JSON report for quality:collect.
+ *
+ * Existence reason: one inventory of net-new issues (vs suppressions) should
+ * feed both the blocking lint gate and the eslintWarnings ratchet — not two
+ * cold full-tree walks on different runners.
+ *
+ * Exit code: ESLint's own (0 = clean, 1 = errors). Warnings do not fail by
+ * default (same as `npm run lint`); pass --max-warnings=0 for lint-guard.
+ */
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+const outFile = path.resolve(
+  root,
+  process.env.ESLINT_RESULTS_JSON || path.join(".artifacts", "eslint-results.json")
+);
+
+fs.mkdirSync(path.dirname(outFile), { recursive: true });
+
+const extra = process.argv.slice(2);
+const eslintBin = path.join(
+  root,
+  "node_modules",
+  ".bin",
+  process.platform === "win32" ? "eslint.cmd" : "eslint"
+);
+const args = [
+  ".",
+  "--cache",
+  "--cache-location",
+  ".eslintcache",
+  "--suppressions-location",
+  "config/quality/eslint-suppressions.json",
+  "--format",
+  "json",
+  "--output-file",
+  outFile,
+  ...extra,
+];
+
+const result = spawnSync(eslintBin, args, {
+  cwd: root,
+  encoding: "utf8",
+  shell: process.platform === "win32",
+  maxBuffer: 256 * 1024 * 1024,
+});
+
+if (result.stdout) process.stdout.write(result.stdout);
+if (result.stderr) process.stderr.write(result.stderr);
+
+if (!fs.existsSync(outFile)) {
+  // ESLint may crash before writing; leave an empty array so collectors don't explode.
+  fs.writeFileSync(outFile, "[]\n");
+}
+
+process.exit(result.status === null ? 1 : result.status);
diff --git a/scripts/quality/select-impacted-tests.mjs b/scripts/quality/select-impacted-tests.mjs
index 709eba4f44..1908e0f3fc 100644
--- a/scripts/quality/select-impacted-tests.mjs
+++ b/scripts/quality/select-impacted-tests.mjs
@@ -9,9 +9,14 @@ const HUB_RE = /(setupPolyfill|tsconfig|package\.json|package-lock\.json|\.env|v
 // step can actually run via `node --test` — i.e. it mirrors the `npm run test:unit` glob.
 // This EXCLUDES vitest files (`.test.tsx`, `tests/unit/autoCombo/**`), e2e and integration
 // tests, and `src/**/__tests__`/`open-sse/**/__tests__`, which can't run under node:test.
+// Keep in sync with package.json test:unit* braces + serial + dashboard + *.test.mjs.
 const UNIT_SUBDIRS =
-  "api|auth|authz|build|cli|cli-helper|compression|correctness|cors|dashboard|db|db-adapters|docs|gamification|guardrails|lib|mcp|runtime|security|services|settings|shared|ui";
-const TEST_RE = new RegExp(`^tests/unit/([^/]+\\.test\\.ts$|(${UNIT_SUBDIRS})/.*\\.test\\.ts$)`);
+  "api|auth|authz|build|cli|cli-helper|combo|compression|correctness|cors|dashboard|db|db-adapters|docs|gamification|guardrails|lib|mcp|memory|runtime|security|services|settings|shared|ui|usage|serial";
+// .ts: top-level + UNIT_SUBDIRS (mirrors package.json brace globs).
+// .mjs: package.json uses tests/unit/**/*.test.mjs (any depth under tests/unit).
+const TEST_RE = new RegExp(
+  `^tests/unit/([^/]+\\.test\\.(ts|mjs)$|(${UNIT_SUBDIRS})/.*\\.test\\.(ts|mjs)$|.*\\.test\\.mjs$)`
+);
 
 export function selectImpacted({ changed, map }) {
   const out = new Set();
@@ -21,11 +26,10 @@ export function selectImpacted({ changed, map }) {
       out.add(f);
       continue;
     }
-    const isSource =
-      f.startsWith("src/") ||
-      f.startsWith("open-sse/") ||
-      f.startsWith("electron/") ||
-      f.startsWith("bin/");
+    // Impact map only indexes imports under src/ + open-sse/. electron/ and bin/
+    // are not unit-mapped; treating them as unmapped used to force __RUN_ALL__ and
+    // a full unit suite for pure CLI/desktop PRs. Package/smoke jobs cover those.
+    const isSource = f.startsWith("src/") || f.startsWith("open-sse/");
     if (!isSource) continue;
     const hits = map.sources[f];
     if (!hits) return ["__RUN_ALL__"];
diff --git a/scripts/quality/validate-release-green.mjs b/scripts/quality/validate-release-green.mjs
index 0b97f661d7..db0933ed67 100644
--- a/scripts/quality/validate-release-green.mjs
+++ b/scripts/quality/validate-release-green.mjs
@@ -33,11 +33,16 @@
 // orchestration lives in the /green-prs + review-prs flows that call it.
 //
 // Usage:
-//   node scripts/quality/validate-release-green.mjs [--json] [--with-build] [--quick] [--hermetic]
+//   node scripts/quality/validate-release-green.mjs [--json] [--with-build] [--quick] [--full-ci] [--hermetic]
 //     --json        emit machine-readable JSON to stdout (report goes to stderr)
 //     --with-build  also run check:pack-artifact (needs a dist/ build — slow)
 //     --quick       skip the slow unit + vitest + integration suites (drift + fast
 //                   gates only)
+//     --full-ci     ALSO run every static gate declared in ci.yml's gate jobs (lint,
+//                   quality-gate, quality-extended, docs-sync-strict, pr-test-policy) —
+//                   read straight from ci.yml so the set never drifts. Catches the whole
+//                   "static base-red" category the curated list missed (v3.8.46: 11 of 16
+//                   leaked reds). Pair with --quick for the fast "1 command, 0 CI layers" pass.
 //     --hermetic    scrub OMNIROUTE_API_KEY/OMNIROUTE_URL from gate env so live
 //                   tests self-skip exactly like CI (dev machines otherwise run
 //                   them against localhost and produce false-positive reds)
@@ -50,6 +55,7 @@ import { promisify } from "node:util";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { parse as parseYaml } from "yaml";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const ROOT = join(__dirname, "..", "..");
@@ -90,7 +96,9 @@ export function firstFailureLine(out) {
     .split("\n")
     .map((l) => l.trim())
     .filter(Boolean);
-  const hit = lines.find((l) => /✖|not ok|AssertionError|error TS|FAIL|Error:|REGRESS/i.test(l));
+  const hit = lines.find((l) =>
+    /✖|✗|not ok|AssertionError|error TS|FAIL|Error:|REGRESS/i.test(l)
+  );
   return (hit || lines[lines.length - 1] || "failed").slice(0, 200);
 }
 
@@ -139,6 +147,76 @@ export function computeVerdict(results) {
   return { releaseGreen: hardFailures.length === 0, hardFailures, drift };
 }
 
+// ─── --full-ci: reproduce the EXACT ci.yml gate set (P0, v3.8.46 post-mortem) ──
+//
+// WHY: the curated HARD/DRIFT lists above are a hand-maintained SUBSET. The v3.8.46
+// release leaked 11 static/gate base-reds (route-validation:t06, docs-counts --strict,
+// docs-symbols, bundle-size --ratchet, test-masking, …) that the pre-flight never ran
+// because they live only in the ci.yml gate JOBS, not in this script. --full-ci reads
+// ci.yml itself and runs every `npm run check:*` / `npm run lint` from those jobs, so the
+// set stays current as gates are added (no drift between this script and CI). One command
+// → zero CI layers for the whole static category.
+
+/** ci.yml jobs whose npm-run gate steps --full-ci reproduces locally. */
+export const FULL_CI_GATE_JOBS = [
+  "lint",
+  "quality-gate",
+  "quality-extended",
+  "docs-sync-strict",
+  "pr-test-policy",
+];
+
+// Gates that cannot run meaningfully in a local working-tree pre-flight:
+//   • check:pr-evidence  — inspects the open PR body (no PR locally)
+//   • check:codeql-ratchet — queries GitHub's code-scanning alerts for the REMOTE main
+//     branch (CodeQL Default Setup only analyzes main/PRs→main; a local run reflects
+//     post-merge server state the pre-flight can't change). Checked on the release PR.
+export const FULL_CI_SKIP = new Set(["check:pr-evidence", "check:codeql-ratchet"]);
+
+// Gates that need a specific env to behave like CI (else they compare against the wrong base).
+export const FULL_CI_ENV = { "check:test-masking": { GITHUB_BASE_REF: "main" } };
+
+/**
+ * Parse a ci.yml text and return the ordered, de-duplicated list of gate commands to run.
+ * Each entry: { id, job, args:["run", <script>, ...("--" + args)], env }.
+ * Only `npm run lint` and `npm run check:*` steps are taken (build/install/test-run npm
+ * scripts are ignored); a `run: |` block is scanned line-by-line so multi-command steps work.
+ * Exported pure (no side effects) so the extraction has a fixture-driven unit test.
+ */
+export function extractCiGates(
+  yamlText,
+  { jobs = FULL_CI_GATE_JOBS, skip = FULL_CI_SKIP, envMap = FULL_CI_ENV } = {}
+) {
+  const doc = parseYaml(yamlText) || {};
+  const gates = [];
+  const seen = new Set();
+  for (const job of jobs) {
+    const steps = doc?.jobs?.[job]?.steps;
+    if (!Array.isArray(steps)) continue;
+    for (const step of steps) {
+      const runStr = typeof step?.run === "string" ? step.run : "";
+      if (!runStr) continue;
+      for (const rawLine of runStr.split("\n")) {
+        const m = rawLine.trim().match(/^npm run (\S+)(?:\s+--\s+(.+?))?\s*$/);
+        if (!m) continue;
+        const script = m[1];
+        if (script !== "lint" && !script.startsWith("check:")) continue; // gates only
+        if (skip.has(script) || seen.has(script)) continue; // dedup + skip non-local
+        seen.add(script);
+        const extra = m[2] ? m[2].split(/\s+/).filter(Boolean) : [];
+        gates.push({
+          id: script,
+          job,
+          // preserve the `--` so args reach the script (npm run x -- --ratchet)
+          args: extra.length ? ["run", script, "--", ...extra] : ["run", script],
+          env: envMap[script],
+        });
+      }
+    }
+  }
+  return gates;
+}
+
 // ─── Orchestration (only when run directly) ─────────────────────────────────
 
 /**
@@ -217,6 +295,7 @@ async function main() {
   const JSON_OUT = args.has("--json");
   const WITH_BUILD = args.has("--with-build");
   const QUICK = args.has("--quick");
+  const FULL_CI = args.has("--full-ci");
   hermetic = args.has("--hermetic");
 
   const results = [];
@@ -322,23 +401,44 @@ async function main() {
   hardCmd("db-rules", "DB rules", npmCmd, ["run", "check:db-rules"]);
   hardCmd("public-creds", "Public creds", npmCmd, ["run", "check:public-creds"]);
 
-  // Cognitive-complexity (drift)
+  // Complexity + cognitive (one ESLint walk; both still recorded as drift)
   {
-    announce("Cognitive complexity (ratchet)");
-    const { out } = run(npmCmd, ["run", "check:cognitive-complexity"]);
-    saveGateLog("cognitive", out);
-    const current = parseCognitiveCount(out);
-    const base = baselineValue("cognitiveComplexity");
-    const over = isDrift(current, base);
+    announce("Complexity + cognitive ratchets (shared ESLint walk)");
+    const { out } = run(npmCmd, ["run", "check:complexity-ratchets"]);
+    saveGateLog("complexity-ratchets", out);
+    const cogCurrent = parseCognitiveCount(out);
+    const cogBase = baselineValue("cognitiveComplexity");
+    const cogOver = isDrift(cogCurrent, cogBase);
+    const cycMatch = /(?:^|\n)complexity=(\d+)/.exec(out);
+    const cycOkMatch = /\[complexity\] OK — (\d+)/.exec(out);
+    const cycRegMatch = /\[complexity\] REGRESSÃO — (\d+)/.exec(out);
+    const cycCurrent = cycMatch
+      ? Number(cycMatch[1])
+      : cycOkMatch
+        ? Number(cycOkMatch[1])
+        : cycRegMatch
+          ? Number(cycRegMatch[1])
+          : null;
+    const cycRegressed = /\[complexity\] REGRESSÃO/.test(out);
     record({
       id: "cognitive-complexity",
       label: "Cognitive complexity (ratchet)",
       kind: "drift",
-      ok: !over,
+      ok: !cogOver,
       detail:
-        current == null
+        cogCurrent == null
           ? "could not parse count"
-          : `${current} vs baseline ${base}${over ? ` (+${current - base} drift → rebaseline at release)` : ""}`,
+          : `${cogCurrent} vs baseline ${cogBase}${cogOver ? ` (+${cogCurrent - cogBase} drift → rebaseline at release)` : ""}`,
+    });
+    record({
+      id: "complexity",
+      label: "Cyclomatic complexity (ratchet)",
+      kind: "drift",
+      ok: !cycRegressed,
+      detail:
+        cycCurrent == null
+          ? firstFailureLine(out) || "measured via check:complexity-ratchets"
+          : `complexity=${cycCurrent} (shared walk with cognitive)${cycRegressed ? " REGRESSED" : ""}`,
     });
   }
 
@@ -380,7 +480,7 @@ async function main() {
   // fast-gates skip and that historically surfaced — one at a time, because the
   // CI Quality Ratchet job is fail-fast — only on the release PR. Running them all
   // here (drift, never blocking) means a single rebaseline pass at release.
-  driftCmd("complexity", "Cyclomatic complexity (ratchet)", npmCmd, ["run", "check:complexity"]);
+  // complexity recorded above with cognitive (check:complexity-ratchets)
   driftCmd("dead-code", "Dead-code (ratchet)", npmCmd, ["run", "check:dead-code"]);
   driftCmd("type-coverage", "Type coverage (ratchet)", npmCmd, ["run", "check:type-coverage"]);
   driftCmd("compression-budget", "Compression budget (ratchet)", npmCmd, [
@@ -474,6 +574,39 @@ async function main() {
     });
   }
 
+  // --full-ci: run every static gate declared in ci.yml's gate jobs (superset of the
+  // curated HARD list above). Combine with --quick to run ONLY these + drift ratchets
+  // (skip the slow suites) — the "1 command, 0 CI layers" pre-flight for the static category.
+  if (FULL_CI) {
+    let gates = [];
+    try {
+      gates = extractCiGates(readFileSync(join(ROOT, ".github/workflows/ci.yml"), "utf8"));
+    } catch (err) {
+      record({
+        id: "full-ci-extract",
+        label: "full-ci: parse .github/workflows/ci.yml",
+        kind: "hard",
+        ok: false,
+        detail: `could not read/parse ci.yml: ${err?.message || err}`,
+      });
+    }
+    const already = new Set(results.map((r) => r.id));
+    process.stderr.write(`\n──── full-ci gates from ci.yml (${gates.length}) ────\n`);
+    for (const g of gates) {
+      // Skip a gate the curated pass already ran with the same id (avoid double-running lint).
+      if (already.has(g.id)) continue;
+      const { code, out } = run(npmCmd, g.args, { env: g.env, timeout: 10 * 60 * 1000 });
+      saveGateLog(`fullci-${g.id.replace(/[^a-z0-9]+/gi, "-")}`, out);
+      record({
+        id: g.id,
+        label: `ci.yml:${g.job} → npm ${g.args.join(" ")}`,
+        kind: "hard",
+        ok: code === 0,
+        detail: code === 0 ? "pass" : firstFailureLine(out),
+      });
+    }
+  }
+
   const { releaseGreen, hardFailures, drift } = computeVerdict(results);
 
   process.stderr.write("\n──────── verdict ────────\n");
diff --git a/scripts/release/aggregate-changelog.mjs b/scripts/release/aggregate-changelog.mjs
new file mode 100644
index 0000000000..7d490045f6
--- /dev/null
+++ b/scripts/release/aggregate-changelog.mjs
@@ -0,0 +1,167 @@
+#!/usr/bin/env node
+// scripts/release/aggregate-changelog.mjs
+//
+// Changelog FRAGMENTS aggregator (towncrier/changesets pattern, adopted 2026-07-09).
+//
+// Why: during a release cycle every PR used to edit the same few lines at the top of
+// CHANGELOG.md (its bullet). In a merge-storm each merge conflicted every sibling
+// (CHANGELOG-eat / DIRTY cascade), forcing a re-sync push + full CI re-run per PR per
+// merge — O(N²) CI runs for N queued PRs. With fragments, a PR adds ONE NEW FILE under
+// changelog.d/<section>/ instead, so two PRs never touch the same file: no conflicts,
+// no eat, no re-sync. This script is the single place fragments become CHANGELOG.md
+// bullets — run by the release captain (or /generate-release) at reconciliation, and
+// safe to run mid-cycle whenever a consolidated view is wanted.
+//
+// Convention:
+//   changelog.d/features/<PR>-<slug>.md     → appended to "### ✨ New Features"
+//   changelog.d/fixes/<PR>-<slug>.md        → appended to "### 🐛 Bug Fixes"
+//   changelog.d/maintenance/<PR>-<slug>.md  → appended to "### 📝 Maintenance"
+//   File content = the exact bullet line(s), starting with "- " (continuation lines
+//   allowed). Credit format stays the repo norm: "(#PR — thanks @user)".
+//
+// Usage:
+//   node scripts/release/aggregate-changelog.mjs [--dry-run]
+//     --dry-run  print the would-be CHANGELOG.md to stdout and list fragments;
+//                touch nothing.
+//
+// On a real run, aggregated fragment files are DELETED (leaving README.md and the
+// .gitkeep placeholders) — the caller commits both the CHANGELOG.md update and the
+// deletions in one commit.
+
+import { readFileSync, writeFileSync, readdirSync, unlinkSync, existsSync } from "node:fs";
+import { dirname, join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const FRAGMENTS_DIR = "changelog.d";
+
+/** Section subdir → the CHANGELOG heading its bullets are appended under. */
+export const SECTIONS = Object.freeze({
+  features: "### ✨ New Features",
+  fixes: "### 🐛 Bug Fixes",
+  maintenance: "### 📝 Maintenance",
+});
+
+const SKIP_FILES = new Set(["README.md", ".gitkeep"]);
+
+/**
+ * Validate one fragment's text. Returns null when OK, or a human-readable error.
+ * Pure — unit-tested.
+ */
+export function validateFragmentText(text) {
+  const body = String(text || "").replace(/^/, "");
+  const lines = body.split("\n");
+  const firstContent = lines.find((l) => l.trim().length > 0);
+  if (!firstContent) return "empty fragment";
+  if (!firstContent.trimStart().startsWith("- ")) {
+    return 'fragment must start with a markdown bullet ("- ")';
+  }
+  if (/^(<{7}|={7}|>{7})/m.test(body)) return "fragment contains merge-conflict markers";
+  return null;
+}
+
+/**
+ * Collect fragments from <root>/changelog.d, sorted by filename per section for a
+ * deterministic output order. Returns { features: [...], fixes: [...],
+ * maintenance: [...], invalid: [{file, error}] } where each valid entry is
+ * { file, text } (text trimmed of trailing whitespace).
+ */
+export function collectFragments(root) {
+  const out = { features: [], fixes: [], maintenance: [], invalid: [] };
+  const base = join(root, FRAGMENTS_DIR);
+  if (!existsSync(base)) return out;
+  for (const section of Object.keys(SECTIONS)) {
+    const dir = join(base, section);
+    if (!existsSync(dir)) continue;
+    const files = readdirSync(dir)
+      .filter((f) => f.endsWith(".md") && !SKIP_FILES.has(f))
+      .sort((a, b) => a.localeCompare(b, undefined, { numeric: true }));
+    for (const f of files) {
+      const file = join(dir, f);
+      const text = readFileSync(file, "utf8").replace(/\s+$/, "");
+      const error = validateFragmentText(text);
+      if (error) out.invalid.push({ file: relative(root, file), error });
+      else out[section].push({ file: relative(root, file), text });
+    }
+  }
+  return out;
+}
+
+/**
+ * Append bullets at the END of a living-section heading's bullet block (before the
+ * next "##"/"###" heading). Operates on the FIRST occurrence of the heading — in this
+ * repo's CHANGELOG the living cycle section always appears first. Pure — unit-tested.
+ * Throws when a needed heading is missing (the release captain adds the heading; the
+ * script never invents structure).
+ */
+export function insertBullets(changelogText, bulletsBySection) {
+  let lines = changelogText.split("\n");
+  for (const [section, heading] of Object.entries(SECTIONS)) {
+    const bullets = (bulletsBySection[section] || []).map((b) => b.text ?? b);
+    if (bullets.length === 0) continue;
+    const headIdx = lines.findIndex((l) => l.trim() === heading);
+    if (headIdx === -1) {
+      throw new Error(
+        `heading "${heading}" not found in CHANGELOG.md — add it to the living section before aggregating ${section} fragments`
+      );
+    }
+    // End of this section's block: last non-empty line before the next heading.
+    let nextHead = lines.length;
+    for (let i = headIdx + 1; i < lines.length; i++) {
+      if (/^##/.test(lines[i])) {
+        nextHead = i;
+        break;
+      }
+    }
+    let insertAt = nextHead;
+    while (insertAt > headIdx + 1 && lines[insertAt - 1].trim() === "") insertAt--;
+    const block = bullets.flatMap((b) => b.split("\n"));
+    lines = [...lines.slice(0, insertAt), ...block, ...lines.slice(insertAt)];
+  }
+  return lines.join("\n");
+}
+
+/**
+ * Aggregate fragments into CHANGELOG.md. Returns a summary object. When dryRun is
+ * true nothing is written or deleted.
+ */
+export function aggregate({ root = ROOT, dryRun = false } = {}) {
+  const collected = collectFragments(root);
+  if (collected.invalid.length > 0) {
+    const detail = collected.invalid.map((i) => `  ✗ ${i.file}: ${i.error}`).join("\n");
+    throw new Error(`invalid changelog fragments:\n${detail}`);
+  }
+  const total = collected.features.length + collected.fixes.length + collected.maintenance.length;
+  const changelogPath = join(root, "CHANGELOG.md");
+  const before = readFileSync(changelogPath, "utf8");
+  const after = total === 0 ? before : insertBullets(before, collected);
+  if (!dryRun && total > 0) {
+    writeFileSync(changelogPath, after);
+    for (const section of Object.keys(SECTIONS)) {
+      for (const { file } of collected[section]) unlinkSync(join(root, file));
+    }
+  }
+  return { total, collected, changed: total > 0, after };
+}
+
+function main() {
+  const dryRun = process.argv.includes("--dry-run");
+  const result = aggregate({ dryRun });
+  if (result.total === 0) {
+    console.log("[aggregate-changelog] no fragments to aggregate — nothing to do.");
+    return 0;
+  }
+  for (const section of Object.keys(SECTIONS)) {
+    for (const { file } of result.collected[section]) {
+      console.log(`[aggregate-changelog] ${dryRun ? "would aggregate" : "aggregated"} ${file}`);
+    }
+  }
+  console.log(
+    `[aggregate-changelog] ${result.total} fragment(s) → CHANGELOG.md${dryRun ? " (dry-run, nothing written)" : " (fragments deleted — commit CHANGELOG.md + deletions together)"}`
+  );
+  return 0;
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  process.exit(main());
+}
diff --git a/scripts/release/list-uncovered-commits.mjs b/scripts/release/list-uncovered-commits.mjs
index ba8127c124..b2a5ae819b 100644
--- a/scripts/release/list-uncovered-commits.mjs
+++ b/scripts/release/list-uncovered-commits.mjs
@@ -55,6 +55,68 @@ export function computeUncovered(commits, changelogRefs) {
   return { covered, uncovered };
 }
 
+// Subdirectories that hold changelog.d fragments (fragments-first, #6783).
+const FRAGMENT_DIRS = ["features", "fixes", "maintenance"];
+
+/**
+ * Read the leading `<N>-` PR/issue number from a changelog.d fragment filename.
+ * Some fragments (e.g. 6708, 6709) carry NO `#N` in their body, so the filename is the only
+ * place the PR number appears — it must still count as covering that PR.
+ * @param {string} filename  bare name or a path ending in the fragment file
+ * @returns {number|null}
+ */
+export function fragmentFilenameRef(filename) {
+  const base = String(filename).replace(/^.*[\\/]/, "");
+  const m = base.match(/^(\d+)-/);
+  return m ? Number(m[1]) : null;
+}
+
+/**
+ * Collect every ref "covered" by changelog.d fragments: the leading `<N>-` of each fragment
+ * filename PLUS every `#N` inside its body.
+ * @param {{name:string, body:string}[]} fragments
+ * @returns {Set<number>}
+ */
+export function fragmentRefs(fragments) {
+  const refs = new Set();
+  for (const f of fragments || []) {
+    const fromName = fragmentFilenameRef(f.name);
+    if (fromName != null) refs.add(fromName);
+    for (const m of String(f.body || "").matchAll(/#(\d+)/g)) refs.add(Number(m[1]));
+  }
+  return refs;
+}
+
+/**
+ * Union of the CHANGELOG scan window refs and the changelog.d fragment refs. Since fragments-first
+ * (#6783) a merged PR's changelog entry usually lives in a fragment and is only folded into
+ * CHANGELOG.md at release time, so scanning CHANGELOG.md alone reports fragment-covered commits as
+ * uncovered (#6857).
+ * @param {string} changelog
+ * @param {string} version
+ * @param {{name:string, body:string}[]} fragments
+ * @returns {Set<number>}
+ */
+export function collectChangelogRefs(changelog, version, fragments) {
+  const refs = changelogRefWindow(changelog, version);
+  for (const r of fragmentRefs(fragments)) refs.add(r);
+  return refs;
+}
+
+/** Read all changelog.d fragment files (name + body) from disk under `root`. */
+export function readChangelogFragments(root) {
+  const out = [];
+  for (const sub of FRAGMENT_DIRS) {
+    const dir = path.join(root, "changelog.d", sub);
+    if (!fs.existsSync(dir)) continue;
+    for (const name of fs.readdirSync(dir)) {
+      if (!name.endsWith(".md") || name === "README.md") continue;
+      out.push({ name, body: fs.readFileSync(path.join(dir, name), "utf8") });
+    }
+  }
+  return out;
+}
+
 /** Read every #N in the version's CHANGELOG section + the [Unreleased] section. */
 export function changelogRefWindow(changelog, version) {
   const esc = version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -85,7 +147,8 @@ function main(argv) {
       })
     : [];
   const changelog = fs.readFileSync(path.join(ROOT, "CHANGELOG.md"), "utf8");
-  const refs = changelogRefWindow(changelog, version);
+  const fragments = readChangelogFragments(ROOT);
+  const refs = collectChangelogRefs(changelog, version, fragments);
   const { covered, uncovered } = computeUncovered(commits, refs);
 
   if (jsonOut) {
diff --git a/scripts/release/merge-train.sh b/scripts/release/merge-train.sh
new file mode 100755
index 0000000000..217a66212e
--- /dev/null
+++ b/scripts/release/merge-train.sh
@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+# scripts/release/merge-train.sh — batch-validate N queued PRs as ONE merged result.
+#
+# Why: in a merge-storm, waiting for each PR's CI after each sibling merge costs
+# O(N²) CI runs. The train merges every queued PR into a throwaway worktree cut from
+# the release tip, runs the full fast-gates parity suite ONCE on the final result, and
+# prints the evidence block that authorizes `gh pr merge --squash --admin` for each
+# train member (merge-gates.md §7 — owner-approved policy extension of §4, 2026-07-09).
+#
+# Designed for the 32-core runner box (192.168.0.113) or any checkout with
+# node_modules. It only READS from origin — it never pushes, never merges PRs, never
+# touches other worktrees, and never uses `git stash` (Hard Rule #22a).
+#
+# Usage:
+#   scripts/release/merge-train.sh [--plan] <base-branch> <PR#> [<PR#>...]
+#     --plan   print the planned steps and exit 0 (no worktree, no network) — used by
+#              the unit test and for a quick sanity read.
+#
+# Exit codes: 0 = suite green (evidence printed); 1 = usage error; 2 = suite red;
+#             PRs whose merge conflicts are EJECTED (reported, train continues).
+set -euo pipefail
+
+PLAN=0
+if [ "${1:-}" = "--plan" ]; then
+  PLAN=1
+  shift
+fi
+
+if [ $# -lt 2 ]; then
+  echo "usage: $0 [--plan] <base-branch> <PR#> [<PR#>...]" >&2
+  exit 1
+fi
+
+BASE="$1"
+shift
+PRS=("$@")
+for N in "${PRS[@]}"; do
+  case "$N" in
+    ''|*[!0-9]*) echo "error: PR number '$N' is not numeric" >&2; exit 1 ;;
+  esac
+done
+
+ROOT="$(git rev-parse --show-toplevel 2>/dev/null || true)"
+SUITE=(
+  "npm run typecheck:core"
+  "node scripts/check/check-file-size.mjs"
+  "node scripts/check/check-complexity.mjs"
+  "node scripts/check/check-cognitive-complexity.mjs"
+  "node scripts/check/check-changelog-integrity.mjs"
+  "TEST_SHARD=1/2 npm run test:unit:ci:shard"
+  "TEST_SHARD=2/2 npm run test:unit:ci:shard"
+  "npm run test:vitest"
+)
+
+if [ "$PLAN" = "1" ]; then
+  echo "[merge-train] PLAN — base=origin/${BASE} prs=${PRS[*]}"
+  echo "[merge-train] 1. worktree add .claude/worktrees/merge-train-<ts> --detach origin/${BASE}"
+  for N in "${PRS[@]}"; do
+    echo "[merge-train] 2. fetch origin pull/${N}/head && merge (conflict → EJECT #${N}, continue)"
+  done
+  i=3
+  for c in "${SUITE[@]}"; do
+    echo "[merge-train] ${i}. ${c}"
+    i=$((i + 1))
+  done
+  echo "[merge-train] ${i}. green → print --admin evidence per PR; red → exit 2 (bisect + eject)"
+  echo "[merge-train] ${i}. teardown: git worktree remove --force (trap EXIT)"
+  exit 0
+fi
+
+if [ -z "$ROOT" ]; then
+  echo "error: not inside a git checkout" >&2
+  exit 1
+fi
+
+TS="$(date +%Y%m%d-%H%M%S)"
+WT="$ROOT/.claude/worktrees/merge-train-$TS"
+LOG="$WT-suite.log"
+
+cleanup() {
+  git -C "$ROOT" worktree remove --force "$WT" 2>/dev/null || true
+}
+trap cleanup EXIT
+
+echo "[merge-train] fetching origin/${BASE}…"
+git -C "$ROOT" fetch origin "$BASE" --quiet
+git -C "$ROOT" worktree add --detach "$WT" "origin/$BASE" --quiet
+# reuse the main checkout's node_modules (same convention as dev worktrees)
+[ -e "$WT/node_modules" ] || ln -s "$ROOT/node_modules" "$WT/node_modules"
+
+EJECTED=()
+BOARDED=()
+for N in "${PRS[@]}"; do
+  echo "[merge-train] boarding #${N}…"
+  if ! git -C "$WT" fetch origin "pull/${N}/head" --quiet; then
+    echo "[merge-train] ✗ #${N} EJECTED — could not fetch pull/${N}/head"
+    EJECTED+=("$N")
+    continue
+  fi
+  if git -C "$WT" merge FETCH_HEAD --no-edit --quiet >/dev/null 2>&1; then
+    BOARDED+=("$N")
+  else
+    git -C "$WT" merge --abort 2>/dev/null || true
+    echo "[merge-train] ✗ #${N} EJECTED — merge conflict vs the train (route it through the normal §5 path)"
+    EJECTED+=("$N")
+  fi
+done
+
+if [ ${#BOARDED[@]} -eq 0 ]; then
+  echo "[merge-train] no PR boarded — nothing to validate." >&2
+  exit 1
+fi
+
+TIP="$(git -C "$WT" rev-parse HEAD)"
+EJ_MSG=""
+[ ${#EJECTED[@]} -gt 0 ] && EJ_MSG=" — ejected: ${EJECTED[*]}"
+echo "[merge-train] train tip ${TIP} — boarded: ${BOARDED[*]}${EJ_MSG}"
+echo "[merge-train] running parity suite (log: ${LOG})…"
+
+for c in "${SUITE[@]}"; do
+  echo "[merge-train] ▶ ${c}"
+  if ! (cd "$WT" && eval "$c") >>"$LOG" 2>&1; then
+    echo "[merge-train] ✗ SUITE RED at: ${c}" >&2
+    echo "[merge-train] tail of ${LOG}:" >&2
+    tail -30 "$LOG" >&2
+    echo "[merge-train] bisect: re-run the failing gate on intermediate train commits, eject the offender, re-run." >&2
+    exit 2
+  fi
+done
+
+echo "[merge-train] ✅ SUITE GREEN on ${TIP}"
+echo "[merge-train] evidence line for each PR (paste before gh pr merge --squash --admin):"
+for N in "${BOARDED[@]}"; do
+  echo "  #${N}: Validated in local merge-train ${LOG} on $(hostname) @ ${TIP} (suite green)"
+done
+[ ${#EJECTED[@]} -gt 0 ] && echo "[merge-train] ejected (need the normal path): ${EJECTED[*]}"
+exit 0
diff --git a/scripts/start-ws-server.mjs b/scripts/start-ws-server.mjs
index 9b0d1068c3..f76693d3cb 100644
--- a/scripts/start-ws-server.mjs
+++ b/scripts/start-ws-server.mjs
@@ -7,9 +7,9 @@
  *   node scripts/start-ws-server.mjs
  *
  * Environment variables:
- *   LIVE_WS_PORT       — WebSocket server port (default: 20129)
+ *   LIVE_WS_PORT       — WebSocket server port (default: 20132)
  *   LIVE_WS_HOST       — WebSocket server host (default: 127.0.0.1)
- *   OMNIROUTE_DISABLE_LIVE_WS — Set to "1" or "true" to disable
+ *   OMNIROUTE_ENABLE_LIVE_WS — Set to "0" or "false" to disable
  */
 
 import { spawnSync } from "node:child_process";
@@ -59,11 +59,16 @@ export function buildSidecarSpawn(scriptUrl, env = process.env) {
 }
 
 async function main() {
+  // The operator disable gate only applies to the OUTER invocation: the bootstrapped
+  // child is re-spawned with OMNIROUTE_ENABLE_LIVE_WS="0" purely to stop liveServer.ts
+  // auto-starting on import (this script owns startup), so honoring the gate there
+  // made the standalone script exit 0 without ever listening (#6072 regression).
   if (
-    process.env.OMNIROUTE_DISABLE_LIVE_WS === "1" ||
-    process.env.OMNIROUTE_DISABLE_LIVE_WS === "true"
+    process.env[BOOTSTRAPPED_ENV] !== "1" &&
+    (process.env.OMNIROUTE_ENABLE_LIVE_WS === "0" ||
+      process.env.OMNIROUTE_ENABLE_LIVE_WS?.toLowerCase() === "false")
   ) {
-    console.log("[LiveWS] Disabled via OMNIROUTE_DISABLE_LIVE_WS");
+    console.log("[LiveWS] Disabled via OMNIROUTE_ENABLE_LIVE_WS");
     process.exit(0);
   }
 
@@ -80,7 +85,7 @@ async function main() {
 
   const { startLiveDashboardServer } = await import("../src/server/ws/liveServer.ts");
 
-  const port = parseInt(process.env.LIVE_WS_PORT || "20129", 10);
+  const port = parseInt(process.env.LIVE_WS_PORT || "20132", 10);
   const host = process.env.LIVE_WS_HOST || "127.0.0.1";
 
   console.log(`[LiveWS] Starting dashboard WebSocket server on ${host}:${port}...`);
diff --git a/scripts/vps/release-runner-down.sh b/scripts/vps/release-runner-down.sh
index dd27087cad..f65e0ace8e 100755
--- a/scripts/vps/release-runner-down.sh
+++ b/scripts/vps/release-runner-down.sh
@@ -10,6 +10,17 @@ VM_ID="${VM_ID:-113}"
 REPO="${REPO:-diegosouzapw/OmniRoute}"
 SSH="ssh -o BatchMode=yes -o ConnectTimeout=8"
 
+# 0) Always-on mode. When the repo var VPS_ALWAYS_ON=true, the VM 113 is a DEDICATED,
+# 24/7 CI host (32c/24GB, exclusive to this project) — the day-to-day quality.yml PRs
+# (PR→release/**) route to it too, not just release CI. In that mode the release MUST NOT
+# tear the VM down or flip USE_VPS_RUNNER off, or every subsequent PR would fall back to
+# ubuntu-latest until the next release. Teardown/flag-off is the LEGACY on-demand-per-release
+# model only. (Set/unset with: gh variable set VPS_ALWAYS_ON --body true|false.)
+if [ "$(gh variable get VPS_ALWAYS_ON --repo "$REPO" 2>/dev/null)" = "true" ]; then
+  echo "[release-runner] VPS_ALWAYS_ON=true — dedicated 24/7 host; leaving VM $VM_ID up and USE_VPS_RUNNER=true."
+  exit 0
+fi
+
 # 1) Volta o CI para ubuntu-latest ANTES de derrubar a VM (evita jobs presos).
 echo "[release-runner] USE_VPS_RUNNER=false (CI volta ao GitHub-hosted)."
 gh variable set USE_VPS_RUNNER --repo "$REPO" --body "false" >/dev/null 2>&1 || true
diff --git a/skills/README.md b/skills/README.md
index 6fa1823d0e..1cab48496b 100644
--- a/skills/README.md
+++ b/skills/README.md
@@ -5,10 +5,10 @@ consume OmniRoute via OpenAI-compatible REST in one fetch.
 
 ## Entry points
 
-| Type | Skill | Manifest |
-| ---- | ----- | -------- |
+| Type | Skill                                       | Manifest                                 |
+| ---- | ------------------------------------------- | ---------------------------------------- |
 | API  | Authentication (start here for REST access) | [omni-auth/SKILL.md](omni-auth/SKILL.md) |
-| CLI  | Serve (start here for CLI access) | [cli-serve/SKILL.md](cli-serve/SKILL.md) |
+| CLI  | Serve (start here for CLI access)           | [cli-serve/SKILL.md](cli-serve/SKILL.md) |
 
 ## How agents discover capabilities
 
@@ -24,57 +24,58 @@ See [`docs/frameworks/AGENT-SKILLS.md`](../docs/frameworks/AGENT-SKILLS.md) for
 Each manifest URL follows the pattern:
 `https://raw.githubusercontent.com/diegosouzapw/OmniRoute/main/skills/<id>/SKILL.md`
 
-| ID | Name | Description |
-| -- | ---- | ----------- |
-| `omni-auth` | Authentication | Manage API key authentication and session tokens. Start here to authenticate requests via Bearer token, obtain session cookies, and configure login requirements. |
-| `omni-providers` | Providers | Manage provider connections, API keys, OAuth flows, and connection tests. List, add, update, remove, and test AI provider integrations (OpenAI, Anthropic, Gemini, and 160+). |
-| `omni-models` | Models | Query available AI models across all configured providers. List models, resolve model aliases, and browse the full model catalog including provider-specific variants. |
-| `omni-combos-routing` | Combos & Routing | Create and manage routing combos with 14 strategies (priority, weighted, round-robin, Auto-combo, etc.). Configure fallback chains, test routing outcomes, and retrieve combo metrics. |
-| `omni-api-keys` | API Keys | Create, list, rotate, and revoke OmniRoute API keys. Control per-key scopes, spending limits, and expiration. |
-| `omni-usage-logs` | Usage & Logs | Access detailed call logs and usage analytics. Filter by provider, model, time range, status, and cost. Export logs and aggregate token usage. |
-| `omni-budget` | Budget & Rate Limits | Configure spending limits, token quotas, and rate-limit policies per API key or globally. Inspect current consumption and enforce cost controls. |
-| `omni-settings` | Settings | Read and update global application settings: system prompts, thinking budget, IP filters, payload rules, combo defaults, and require-login configuration. |
-| `omni-proxies` | Proxy Configuration | Configure HTTP/HTTPS/SOCKS proxies for upstream provider requests. Set per-provider or global proxy rules, test connectivity, and manage proxy rotation. |
-| `omni-cache` | Cache | Manage the LLM response cache. View cache statistics, clear entries, configure TTL policies, and control semantic-similarity caching thresholds. |
-| `omni-compression` | Compression | Configure RTK, Caveman, and stacked compression modes. Manage language packs, custom rules, and test prompt compression reducing tokens by 60–90%. |
-| `omni-context-rtk` | Context & RTK | Configure RTK filters, context engineering rules, and context relay settings. Test compression with real prompt samples and manage context transformation pipelines. |
-| `omni-resilience` | Resilience & Monitoring | Monitor provider health, circuit-breaker states, p50/p95/p99 latency metrics, and budget guard alerts. Inspect connection cooldowns and model lockouts in real time. |
-| `omni-cli-tools` | CLI Tools | Manage CLI tool integrations exposed via the API. List, configure, and invoke CLI tool plugins that extend OmniRoute's automation surface. |
-| `omni-tunnels` | Tunnels | Create and manage secure tunnels (ngrok, Cloudflare Tunnel, custom) to expose OmniRoute to the internet or share access with remote agents and CI pipelines. |
-| `omni-sync-cloud` | Cloud Sync | Synchronise OmniRoute configuration, provider connections, and settings to/from cloud storage. Manage cloud worker authentication and remote backup targets. |
-| `omni-db-backups` | Database & Backups | Trigger system backups, restore from backup files, and manage the SQLite database lifecycle. Supports export, import, and incremental snapshot strategies. |
-| `omni-webhooks` | Webhooks | Register, list, test, and remove webhook endpoints. Configure event subscriptions (request.completed, provider.error, budget.exceeded, etc.) and manage delivery retries. |
-| `omni-mcp` | MCP Server | Connect to the OmniRoute MCP server (37 tools, 3 transports: SSE/stdio/HTTP). Covers routing, cache, compression, memory, skills, providers, and audit tools across 16 permission scopes. |
-| `omni-agents-a2a` | Agents & A2A Protocol | Interact with OmniRoute via JSON-RPC 2.0 agent-to-agent protocol. 6 built-in A2A skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report, list-capabilities. |
-| `omni-version-manager` | Version Manager | Install, start, stop, restart, and update embedded services (9Router, CLIProxyAPI). Monitor service status, retrieve logs, and configure auto-start. |
-| `omni-inference` | Inference (OpenAI-compatible) | The core OpenAI-compatible inference endpoints: chat completions, embeddings, images, audio (TTS/STT), moderations, rerank, and the Responses API. |
+| ID                     | Name                          | Description                                                                                                                                                                                    |
+| ---------------------- | ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `omni-auth`            | Authentication                | Manage API key authentication and session tokens. Start here to authenticate requests via Bearer token, obtain session cookies, and configure login requirements.                              |
+| `omni-providers`       | Providers                     | Manage provider connections, API keys, OAuth flows, and connection tests. List, add, update, remove, and test AI provider integrations (OpenAI, Anthropic, Gemini, and 160+).                  |
+| `omni-models`          | Models                        | Query available AI models across all configured providers. List models, resolve model aliases, and browse the full model catalog including provider-specific variants.                         |
+| `omni-combos-routing`  | Combos & Routing              | Create and manage routing combos with 14 strategies (priority, weighted, round-robin, Auto-combo, etc.). Configure fallback chains, test routing outcomes, and retrieve combo metrics.         |
+| `omni-api-keys`        | API Keys                      | Create, list, rotate, and revoke OmniRoute API keys. Control per-key scopes, spending limits, and expiration.                                                                                  |
+| `omni-usage-logs`      | Usage & Logs                  | Access detailed call logs and usage analytics. Filter by provider, model, time range, status, and cost. Export logs and aggregate token usage.                                                 |
+| `omni-budget`          | Budget & Rate Limits          | Configure spending limits, token quotas, and rate-limit policies per API key or globally. Inspect current consumption and enforce cost controls.                                               |
+| `omni-settings`        | Settings                      | Read and update global application settings: system prompts, thinking budget, IP filters, payload rules, combo defaults, and require-login configuration.                                      |
+| `omni-proxies`         | Proxy Configuration           | Configure HTTP/HTTPS/SOCKS proxies for upstream provider requests. Set per-provider or global proxy rules, test connectivity, and manage proxy rotation.                                       |
+| `omni-cache`           | Cache                         | Manage the LLM response cache. View cache statistics, clear entries, configure TTL policies, and control semantic-similarity caching thresholds.                                               |
+| `omni-compression`     | Compression                   | Configure RTK, Caveman, and stacked compression modes. Manage language packs, custom rules, and test prompt compression reducing tokens by 60–90%.                                             |
+| `omni-context-rtk`     | Context & RTK                 | Configure RTK filters, context engineering rules, and context relay settings. Test compression with real prompt samples and manage context transformation pipelines.                           |
+| `omni-resilience`      | Resilience & Monitoring       | Monitor provider health, circuit-breaker states, p50/p95/p99 latency metrics, and budget guard alerts. Inspect connection cooldowns and model lockouts in real time.                           |
+| `omni-cli-tools`       | CLI Tools                     | Manage CLI tool integrations exposed via the API. List, configure, and invoke CLI tool plugins that extend OmniRoute's automation surface.                                                     |
+| `omni-tunnels`         | Tunnels                       | Create and manage secure tunnels (ngrok, Cloudflare Tunnel, custom) to expose OmniRoute to the internet or share access with remote agents and CI pipelines.                                   |
+| `omni-sync-cloud`      | Cloud Sync                    | Synchronise OmniRoute configuration, provider connections, and settings to/from cloud storage. Manage cloud worker authentication and remote backup targets.                                   |
+| `omni-db-backups`      | Database & Backups            | Trigger system backups, restore from backup files, and manage the SQLite database lifecycle. Supports export, import, and incremental snapshot strategies.                                     |
+| `omni-webhooks`        | Webhooks                      | Register, list, test, and remove webhook endpoints. Configure event subscriptions (request.completed, provider.error, budget.exceeded, etc.) and manage delivery retries.                      |
+| `omni-mcp`             | MCP Server                    | Connect to the OmniRoute MCP server (37 tools, 3 transports: SSE/stdio/HTTP). Covers routing, cache, compression, memory, skills, providers, and audit tools across 16 permission scopes.      |
+| `omni-agents-a2a`      | Agents & A2A Protocol         | Interact with OmniRoute via JSON-RPC 2.0 agent-to-agent protocol. 6 built-in A2A skills: smart-routing, quota-management, provider-discovery, cost-analysis, health-report, list-capabilities. |
+| `omni-version-manager` | Version Manager               | Install, start, stop, restart, and update embedded services (9Router, CLIProxyAPI). Monitor service status, retrieve logs, and configure auto-start.                                           |
+| `omni-inference`       | Inference (OpenAI-compatible) | The core OpenAI-compatible inference endpoints: chat completions, embeddings, images, audio (TTS/STT), moderations, rerank, and the Responses API.                                             |
 
 ---
 
-## CLI Skills (20)
+## CLI Skills (21)
 
-| ID | Name | Description |
-| -- | ---- | ----------- |
-| `cli-serve` | CLI: Serve | Start, stop, and restart the OmniRoute server from the CLI. Manage daemon mode, port configuration, auto-recovery, system tray integration, and the dashboard open shortcut. |
-| `cli-health` | CLI: Health | Check server health, component status, and live metrics from the CLI. Run `health`, `health components`, and `health watch` for a real-time dashboard of circuit breakers and provider status. |
-| `cli-providers` | CLI: Providers | Manage provider connections from the CLI: list available/configured providers, add, test, test-all, validate, rotate API keys, and view per-provider metrics. |
-| `cli-keys` | CLI: API Keys | Create, list, rotate, and revoke OmniRoute API keys from the CLI. Manage OAuth flows for provider authentication and inspect key scopes and expiration. |
-| `cli-models` | CLI: Models | Query available AI models, list model aliases, and browse the full model catalog from the CLI. Filter by provider, search by capability, and resolve model name variants. |
-| `cli-chat` | CLI: Chat | Send chat completions, stream responses, and start an interactive REPL session from the CLI. Supports all OmniRoute providers, combo routing, and system prompt configuration. |
-| `cli-routing` | CLI: Routing & Combos | Create, list, update, and delete routing combos from the CLI. Test routing strategies, inspect combo metrics, and configure fallback chains interactively. |
-| `cli-resilience` | CLI: Resilience & Quotas | Inspect and manage circuit-breaker states, connection cooldowns, quota limits, and backoff levels from the CLI. Reset stuck providers and configure resilience thresholds. |
-| `cli-compression` | CLI: Compression | Configure and test prompt compression from the CLI. Manage RTK filters, Caveman rules, stacked compression modes, and preview compression output with real prompts. |
-| `cli-contexts` | CLI: Contexts & Sessions | Manage context engineering configurations, RTK filter sets, and conversation sessions from the CLI. Apply context-relay settings and inspect active context pipelines. |
-| `cli-cost-usage` | CLI: Cost & Usage | View cost breakdowns, token usage, and call logs from the CLI. Filter by provider, model, or date range. Export usage reports and inspect per-connection spending. |
-| `cli-mcp` | CLI: MCP | Inspect the MCP server status, list registered tools and scopes, run tool invocations, and manage MCP audit logs from the CLI. |
-| `cli-a2a` | CLI: A2A Protocol | Interact with the OmniRoute A2A server from the CLI. Send tasks, inspect skill execution history, and test the JSON-RPC 2.0 agent-to-agent protocol interactively. |
-| `cli-tunnel` | CLI: Tunnels | Start and stop tunnel connections (ngrok, Cloudflare, custom) from the CLI. Inspect active tunnel URLs, configure authentication, and test external reachability. |
-| `cli-backup-sync` | CLI: Backup & Sync | Backup and restore OmniRoute data from the CLI. Trigger incremental snapshots, sync to cloud storage, manage backup schedules, and restore from archive files. |
-| `cli-policy-audit` | CLI: Policy & Audit | Inspect audit logs, manage access policies, view telemetry data, and review request history from the CLI. Filter by event type, user, or time range for compliance workflows. |
-| `cli-batches` | CLI: Batches & Files | Submit and monitor batch inference jobs from the CLI. Upload and manage files for batch processing, retrieve results, and integrate batch pipelines with CI/CD workflows. |
-| `cli-eval` | CLI: Evals | Create and run evaluation suites, watch live benchmark progress, view scorecards, compare model performance, and integrate eval runs with CI workflows from the CLI. |
-| `cli-plugins-skills` | CLI: Plugins, Skills & Memory | Manage Omni Skills (list, install, test, remove), plugins (create, configure), and persistent memory (search, add, clear) from the CLI. |
-| `cli-setup` | CLI: Setup & Config | Run initial setup, configure global CLI settings, manage environment variables, check for updates, and configure autostart via the CLI setup and config commands. |
+| ID                    | Name                          | Description                                                                                                                                                                                    |
+| --------------------- | ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `cli-serve`           | CLI: Serve                    | Start, stop, and restart the OmniRoute server from the CLI. Manage daemon mode, port configuration, auto-recovery, system tray integration, and the dashboard open shortcut.                   |
+| `cli-health`          | CLI: Health                   | Check server health, component status, and live metrics from the CLI. Run `health`, `health components`, and `health watch` for a real-time dashboard of circuit breakers and provider status. |
+| `cli-providers`       | CLI: Providers                | Manage provider connections from the CLI: list available/configured providers, add, test, test-all, validate, rotate API keys, and view per-provider metrics.                                  |
+| `cli-keys`            | CLI: API Keys                 | Create, list, rotate, and revoke OmniRoute API keys from the CLI. Manage OAuth flows for provider authentication and inspect key scopes and expiration.                                        |
+| `cli-models`          | CLI: Models                   | Query available AI models, list model aliases, and browse the full model catalog from the CLI. Filter by provider, search by capability, and resolve model name variants.                      |
+| `cli-chat`            | CLI: Chat                     | Send chat completions, stream responses, and start an interactive REPL session from the CLI. Supports all OmniRoute providers, combo routing, and system prompt configuration.                 |
+| `cli-routing`         | CLI: Routing & Combos         | Create, list, update, and delete routing combos from the CLI. Test routing strategies, inspect combo metrics, and configure fallback chains interactively.                                     |
+| `cli-resilience`      | CLI: Resilience & Quotas      | Inspect and manage circuit-breaker states, connection cooldowns, quota limits, and backoff levels from the CLI. Reset stuck providers and configure resilience thresholds.                     |
+| `cli-compression`     | CLI: Compression              | Configure and test prompt compression from the CLI. Manage RTK filters, Caveman rules, stacked compression modes, and preview compression output with real prompts.                            |
+| `cli-contexts`        | CLI: Contexts & Sessions      | Manage context engineering configurations, RTK filter sets, and conversation sessions from the CLI. Apply context-relay settings and inspect active context pipelines.                         |
+| `cli-cost-usage`      | CLI: Cost & Usage             | View cost breakdowns, token usage, and call logs from the CLI. Filter by provider, model, or date range. Export usage reports and inspect per-connection spending.                             |
+| `cli-mcp`             | CLI: MCP                      | Inspect the MCP server status, list registered tools and scopes, run tool invocations, and manage MCP audit logs from the CLI.                                                                 |
+| `cli-a2a`             | CLI: A2A Protocol             | Interact with the OmniRoute A2A server from the CLI. Send tasks, inspect skill execution history, and test the JSON-RPC 2.0 agent-to-agent protocol interactively.                             |
+| `cli-tunnel`          | CLI: Tunnels                  | Start and stop tunnel connections (ngrok, Cloudflare, custom) from the CLI. Inspect active tunnel URLs, configure authentication, and test external reachability.                              |
+| `cli-backup-sync`     | CLI: Backup & Sync            | Backup and restore OmniRoute data from the CLI. Trigger incremental snapshots, sync to cloud storage, manage backup schedules, and restore from archive files.                                 |
+| `cli-policy-audit`    | CLI: Policy & Audit           | Inspect audit logs, manage access policies, view telemetry data, and review request history from the CLI. Filter by event type, user, or time range for compliance workflows.                  |
+| `cli-batches`         | CLI: Batches & Files          | Submit and monitor batch inference jobs from the CLI. Upload and manage files for batch processing, retrieve results, and integrate batch pipelines with CI/CD workflows.                      |
+| `cli-eval`            | CLI: Evals                    | Create and run evaluation suites, watch live benchmark progress, view scorecards, compare model performance, and integrate eval runs with CI workflows from the CLI.                           |
+| `cli-plugins-skills`  | CLI: Plugins, Skills & Memory | Manage Omni Skills (list, install, test, remove), plugins (create, configure), and persistent memory (search, add, clear) from the CLI.                                                        |
+| `cli-setup`           | CLI: Setup & Config           | Run initial setup, configure global CLI settings, manage environment variables, check for updates, and configure autostart via the CLI setup and config commands.                              |
+| `cli-skill-collector` | CLI: Skill Collector          | Detect installed coding CLI tools, search GitHub for matching agent skills, and plan their installation into the detected tools' skill directories.                                            |
 
 ---
 
@@ -87,6 +88,7 @@ https://raw.githubusercontent.com/diegosouzapw/OmniRoute/main/skills/<id>/SKILL.
 ```
 
 Examples:
+
 - API entry: `https://raw.githubusercontent.com/diegosouzapw/OmniRoute/main/skills/omni-auth/SKILL.md`
 - CLI entry: `https://raw.githubusercontent.com/diegosouzapw/OmniRoute/main/skills/cli-serve/SKILL.md`
 
diff --git a/src/app/(dashboard)/dashboard/api-manager/ApiManagerPageClient.tsx b/src/app/(dashboard)/dashboard/api-manager/ApiManagerPageClient.tsx
index c5e09dbc1d..67e0c1e43e 100644
--- a/src/app/(dashboard)/dashboard/api-manager/ApiManagerPageClient.tsx
+++ b/src/app/(dashboard)/dashboard/api-manager/ApiManagerPageClient.tsx
@@ -25,6 +25,8 @@ import { SELF_ACCOUNT_QUOTA_SCOPE, SELF_USAGE_SCOPE } from "@/shared/constants/s
 import { extractApiErrorMessage } from "@/shared/http/apiErrorMessage";
 import { hasProviderQuotaBypassScope } from "@/shared/constants/apiKeyPolicyScopes";
 import { UsageLimitSettings } from "./components/UsageLimitSettings";
+import { ChaosModeAccessToggle } from "./components/ChaosModeAccessToggle";
+import { BypassProviderQuotaToggle } from "./components/BypassProviderQuotaToggle";
 
 // Constants for validation
 const MAX_KEY_NAME_LENGTH = 200;
@@ -125,6 +127,7 @@ interface ApiKey {
   streamDefaultMode?: StreamDefaultMode;
   disableNonPublicModels?: boolean;
   allowUsageCommand?: boolean;
+  chaosModeEnabled?: boolean;
   usageLimitEnabled?: boolean;
   dailyUsageLimitUsd?: number | null;
   weeklyUsageLimitUsd?: number | null;
@@ -518,7 +521,8 @@ export default function ApiManagerPageClient() {
             const res = await fetch(`/api/keys/${encodeURIComponent(key.id)}/devices`);
             if (!res.ok) return [key.id, 0] as const;
             const data = await res.json();
-            const count = typeof data?.count === "number" && Number.isFinite(data.count) ? data.count : 0;
+            const count =
+              typeof data?.count === "number" && Number.isFinite(data.count) ? data.count : 0;
             return [key.id, count] as const;
           } catch {
             return [key.id, 0] as const;
@@ -791,7 +795,8 @@ export default function ApiManagerPageClient() {
     usageLimitEnabled: boolean,
     dailyUsageLimitUsd: number | null,
     weeklyUsageLimitUsd: number | null,
-    blockedModels: string[]
+    blockedModels: string[],
+    chaosModeEnabled: boolean
   ) => {
     if (!editingKey || !editingKey.id) return;
 
@@ -862,6 +867,7 @@ export default function ApiManagerPageClient() {
           usageLimitEnabled,
           dailyUsageLimitUsd,
           weeklyUsageLimitUsd,
+          chaosModeEnabled,
         }),
       });
 
@@ -1645,7 +1651,8 @@ const PermissionsModal = memo(function PermissionsModal({
     usageLimitEnabled: boolean,
     dailyUsageLimitUsd: number | null,
     weeklyUsageLimitUsd: number | null,
-    blockedModels: string[]
+    blockedModels: string[],
+    chaosModeEnabled: boolean
   ) => void;
 }) {
   const t = useTranslations("apiManager");
@@ -1731,6 +1738,7 @@ const PermissionsModal = memo(function PermissionsModal({
   const [usageCommandEnabled, setUsageCommandEnabled] = useState(
     apiKey?.allowUsageCommand === true
   );
+  const [chaosModeEnabled, setChaosModeEnabled] = useState(apiKey?.chaosModeEnabled === true);
   const [usageLimitEnabled, setUsageLimitEnabled] = useState(apiKey?.usageLimitEnabled === true);
   const [dailyUsageLimitUsd, setDailyUsageLimitUsd] = useState(
     typeof apiKey?.dailyUsageLimitUsd === "number" && apiKey.dailyUsageLimitUsd > 0
@@ -1935,7 +1943,8 @@ const PermissionsModal = memo(function PermissionsModal({
       usageLimitEnabled,
       parseUsdLimitInput(dailyUsageLimitUsd),
       parseUsdLimitInput(weeklyUsageLimitUsd),
-      blockedModels
+      blockedModels,
+      chaosModeEnabled
     );
   }, [
     onSave,
@@ -1974,6 +1983,7 @@ const PermissionsModal = memo(function PermissionsModal({
     parseUsdLimitInput,
     blockedClaudeCodeFamilies,
     initialBlockedModels,
+    chaosModeEnabled,
     apiKey?.scopes,
     t,
   ]);
@@ -2563,30 +2573,17 @@ const PermissionsModal = memo(function PermissionsModal({
           />
         </div>
 
+        {/* Chaos Mode Access Toggle */}
+        <ChaosModeAccessToggle
+          enabled={chaosModeEnabled}
+          onToggle={() => setChaosModeEnabled((prev) => !prev)}
+        />
+
         {/* Advanced Provider Quota Policy Override */}
-        <div className="flex items-start justify-between gap-3 p-3 rounded-lg border border-amber-500/20 bg-amber-500/5">
-          <div className="flex flex-col gap-1 pr-2">
-            <p className="text-sm font-medium text-text-main">Bypass provider quota cutoffs</p>
-            <p className="text-xs text-text-muted">
-              Allows this key to ignore upstream provider/account cutoff policy during routing. API
-              key USD quotas still apply.
-            </p>
-          </div>
-          <button
-            type="button"
-            role="switch"
-            aria-checked={bypassProviderQuotaPolicyEnabled}
-            onClick={() => setBypassProviderQuotaPolicyEnabled((prev) => !prev)}
-            className={`inline-flex shrink-0 items-center gap-1.5 px-2.5 py-1.5 rounded-md text-xs font-semibold transition-colors ${
-              bypassProviderQuotaPolicyEnabled
-                ? "bg-amber-500/15 text-amber-700 dark:text-amber-300 border border-amber-500/30"
-                : "bg-black/5 dark:bg-white/5 text-text-muted border border-border"
-            }`}
-          >
-            <span className="material-symbols-outlined text-[14px]">alt_route</span>
-            {bypassProviderQuotaPolicyEnabled ? tc("enabled") : tc("disabled")}
-          </button>
-        </div>
+        <BypassProviderQuotaToggle
+          enabled={bypassProviderQuotaPolicyEnabled}
+          onToggle={() => setBypassProviderQuotaPolicyEnabled((prev) => !prev)}
+        />
 
         {/* Disable Non-Public Models Toggle */}
         <div className="flex items-start justify-between gap-3 p-3 rounded-lg border border-border bg-surface/40">
diff --git a/src/app/(dashboard)/dashboard/api-manager/components/BypassProviderQuotaToggle.tsx b/src/app/(dashboard)/dashboard/api-manager/components/BypassProviderQuotaToggle.tsx
new file mode 100644
index 0000000000..76ccbd25d4
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/api-manager/components/BypassProviderQuotaToggle.tsx
@@ -0,0 +1,45 @@
+"use client";
+
+import { useTranslations } from "next-intl";
+
+/**
+ * "Bypass provider quota cutoffs" toggle for the API Key permissions modal.
+ * Extracted out of ApiManagerPageClient.tsx (frozen god-file — see
+ * config/quality/file-size-baseline.json) following the same pattern as
+ * UsageLimitSettings.tsx — pure UI move, no behavior change.
+ */
+export function BypassProviderQuotaToggle({
+  enabled,
+  onToggle,
+}: {
+  enabled: boolean;
+  onToggle: () => void;
+}) {
+  const tc = useTranslations("common");
+
+  return (
+    <div className="flex items-start justify-between gap-3 p-3 rounded-lg border border-amber-500/20 bg-amber-500/5">
+      <div className="flex flex-col gap-1 pr-2">
+        <p className="text-sm font-medium text-text-main">Bypass provider quota cutoffs</p>
+        <p className="text-xs text-text-muted">
+          Allows this key to ignore upstream provider/account cutoff policy during routing. API key
+          USD quotas still apply.
+        </p>
+      </div>
+      <button
+        type="button"
+        role="switch"
+        aria-checked={enabled}
+        onClick={onToggle}
+        className={`inline-flex shrink-0 items-center gap-1.5 px-2.5 py-1.5 rounded-md text-xs font-semibold transition-colors ${
+          enabled
+            ? "bg-amber-500/15 text-amber-700 dark:text-amber-300 border border-amber-500/30"
+            : "bg-black/5 dark:bg-white/5 text-text-muted border border-border"
+        }`}
+      >
+        <span className="material-symbols-outlined text-[14px]">alt_route</span>
+        {enabled ? tc("enabled") : tc("disabled")}
+      </button>
+    </div>
+  );
+}
diff --git a/src/app/(dashboard)/dashboard/api-manager/components/ChaosModeAccessToggle.tsx b/src/app/(dashboard)/dashboard/api-manager/components/ChaosModeAccessToggle.tsx
new file mode 100644
index 0000000000..30cf2d228e
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/api-manager/components/ChaosModeAccessToggle.tsx
@@ -0,0 +1,45 @@
+"use client";
+
+import { useTranslations } from "next-intl";
+
+/**
+ * Chaos Mode access toggle for the API Key permissions modal — gates a single
+ * API key's ability to call the Chaos Mode dispatch endpoints
+ * (`POST /api/chaos/run`, `POST /api/skills/collect/chaos`) via the
+ * `chaosModeEnabled` permission. Extracted out of ApiManagerPageClient.tsx
+ * (frozen god-file — see config/quality/file-size-baseline.json) following the
+ * same pattern as UsageLimitSettings.tsx.
+ */
+export function ChaosModeAccessToggle({
+  enabled,
+  onToggle,
+}: {
+  enabled: boolean;
+  onToggle: () => void;
+}) {
+  const tChaos = useTranslations("chaosConfig");
+  const tc = useTranslations("common");
+
+  return (
+    <div className="flex items-start justify-between gap-3 p-3 rounded-lg border border-amber-500/20 bg-amber-500/5">
+      <div className="flex flex-col gap-1">
+        <p className="text-sm font-medium text-text-main">{tChaos("keyPermission")}</p>
+        <p className="text-xs text-text-muted">{tChaos("keyPermissionDesc")}</p>
+      </div>
+      <button
+        type="button"
+        role="switch"
+        aria-checked={enabled}
+        onClick={onToggle}
+        className={`inline-flex shrink-0 items-center gap-1.5 px-2.5 py-1.5 rounded-md text-xs font-semibold transition-colors ${
+          enabled
+            ? "bg-amber-500/15 text-amber-700 dark:text-amber-300 border border-amber-500/30"
+            : "bg-black/5 dark:bg-white/5 text-text-muted border border-border"
+        }`}
+      >
+        <span className="material-symbols-outlined text-[14px]">blender</span>
+        {tChaos("pageTitle")} - {enabled ? tc("enabled") : tc("disabled")}
+      </button>
+    </div>
+  );
+}
diff --git a/src/app/(dashboard)/dashboard/chaos/ChaosConfigPageClient.tsx b/src/app/(dashboard)/dashboard/chaos/ChaosConfigPageClient.tsx
new file mode 100644
index 0000000000..ef74806adc
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/chaos/ChaosConfigPageClient.tsx
@@ -0,0 +1,107 @@
+/**
+ * /dashboard/chaos — Chaos Mode Configuration Page
+ *
+ * Allows users to:
+ * - Enable/disable chaos mode globally
+ * - Set default mode (parallel/collaborative)
+ * - Override provider models for chaos mode
+ * - Set custom system prompt and max tokens
+ * - Configure timeout
+ * - Test chaos mode with a simple task
+ *
+ * State + handlers live in useChaosConfigPage.ts and the JSX sections are
+ * split into ./components/* — this file stays a thin composition/render
+ * function under the complexity/size ratchet
+ * (config/quality/complexity-baseline.json).
+ */
+"use client";
+
+import { useChaosConfigPage } from "./useChaosConfigPage";
+import { ChaosModeSelector } from "./components/ChaosModeSelector";
+import { ChaosTestResultsPanel } from "./components/ChaosTestResultsPanel";
+import { ChaosProviderOverridesPanel } from "./components/ChaosProviderOverridesPanel";
+import { ChaosBasicSettingsFields } from "./components/ChaosBasicSettingsFields";
+import { ChaosConfigActionsBar } from "./components/ChaosConfigActionsBar";
+import { ChaosStatusMessage } from "./components/ChaosStatusMessage";
+
+export default function ChaosConfigPage() {
+  const {
+    t,
+    config,
+    setConfig,
+    availableProviders,
+    loading,
+    saving,
+    testing,
+    testResult,
+    message,
+    saveConfig,
+    resetConfig,
+    testChaos,
+    addOverride,
+    updateOverride,
+    removeOverride,
+  } = useChaosConfigPage();
+
+  if (loading) {
+    return (
+      <div className="flex items-center justify-center h-64">
+        <div className="text-text-muted animate-pulse">{t("loadingProviderModels")}</div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="max-w-3xl mx-auto p-4 sm:p-6 space-y-6">
+      {/* Header */}
+      <div>
+        <h1 className="text-2xl font-bold text-text-main">{t("pageTitle")}</h1>
+        <p className="text-sm text-text-muted mt-1">{t("pageSubtitle")}</p>
+      </div>
+
+      {/* Status Message */}
+      <ChaosStatusMessage message={message} />
+
+      {/* Enable toggle + timeout + max tokens + system prompt */}
+      <ChaosBasicSettingsFields
+        settings={config}
+        onChange={(patch) => setConfig((prev) => ({ ...prev, ...patch }))}
+      />
+
+      {/* Default Mode Selector */}
+      <ChaosModeSelector
+        mode={config.defaultMode}
+        onChange={(defaultMode) => setConfig((prev) => ({ ...prev, defaultMode }))}
+        label={t("mode")}
+        parallelLabel={t("modeParallel")}
+        parallelDesc={t("modeParallelDesc")}
+        collaborativeLabel={t("modeCollaborative")}
+        collaborativeDesc={t("modeCollaborativeDesc")}
+      />
+
+      <ChaosConfigActionsBar
+        saving={saving}
+        testing={testing}
+        testDisabled={!config.enabled}
+        onSave={saveConfig}
+        onReset={resetConfig}
+        onTest={testChaos}
+      />
+
+      {/* Test Results */}
+      {testResult && <ChaosTestResultsPanel result={testResult} />}
+
+      {/* Provider Overrides */}
+      <ChaosProviderOverridesPanel
+        overrides={config.providerOverrides}
+        availableProviders={availableProviders}
+        title={t("providerOverrides")}
+        description={t("providerOverridesDesc")}
+        addLabel={t("addProvider")}
+        onAdd={addOverride}
+        onUpdate={updateOverride}
+        onRemove={removeOverride}
+      />
+    </div>
+  );
+}
diff --git a/src/app/(dashboard)/dashboard/chaos/chaosPageTypes.ts b/src/app/(dashboard)/dashboard/chaos/chaosPageTypes.ts
new file mode 100644
index 0000000000..66e6006ed3
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/chaos/chaosPageTypes.ts
@@ -0,0 +1,28 @@
+import type { ChaosProviderOverride } from "./components/ChaosProviderOverridesPanel";
+
+export interface ChaosProviderInfo {
+  id: string;
+  name: string;
+  provider: string;
+  defaultModel: string | null;
+}
+
+export interface ChaosPageConfig {
+  enabled: boolean;
+  defaultMode: "parallel" | "collaborative";
+  providerOverrides: ChaosProviderOverride[];
+  systemPrompt?: string;
+  timeoutMs: number;
+  maxTokens: number;
+}
+
+export const DEFAULT_CHAOS_PAGE_CONFIG: ChaosPageConfig = {
+  enabled: false,
+  defaultMode: "parallel",
+  providerOverrides: [],
+  systemPrompt: "",
+  timeoutMs: 120_000,
+  maxTokens: 4096,
+};
+
+export type ChaosPageMessage = { type: "success" | "error"; text: string } | null;
diff --git a/src/app/(dashboard)/dashboard/chaos/components/ChaosBasicSettingsFields.tsx b/src/app/(dashboard)/dashboard/chaos/components/ChaosBasicSettingsFields.tsx
new file mode 100644
index 0000000000..33f84d7ac8
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/chaos/components/ChaosBasicSettingsFields.tsx
@@ -0,0 +1,122 @@
+"use client";
+
+import { useTranslations } from "next-intl";
+
+export interface ChaosBasicSettings {
+  enabled: boolean;
+  timeoutMs: number;
+  maxTokens: number;
+  systemPrompt?: string;
+}
+
+function ChaosSystemPromptField({
+  value,
+  onChange,
+}: {
+  value: string | undefined;
+  onChange: (value: string) => void;
+}) {
+  const t = useTranslations("chaosConfig");
+  return (
+    <div className="p-3 rounded-lg border border-border bg-surface/40">
+      <p className="text-sm font-medium text-text-main">{t("systemPrompt")}</p>
+      <p className="text-xs text-text-muted mb-2">{t("systemPromptDesc")}</p>
+      <textarea
+        value={value || ""}
+        onChange={(e) => onChange(e.target.value)}
+        rows={3}
+        className="w-full px-3 py-1.5 rounded-md border border-border bg-surface text-sm text-text-main resize-y"
+        placeholder="Optional: override the default chaos mode system prompt..."
+      />
+    </div>
+  );
+}
+
+/**
+ * Enable toggle + timeout + max tokens + system prompt fields for the Chaos
+ * Mode config page. Extracted out of ChaosConfigPageClient.tsx to keep the
+ * page component under the complexity/size ratchet
+ * (config/quality/complexity-baseline.json).
+ */
+export function ChaosBasicSettingsFields({
+  settings,
+  onChange,
+}: {
+  settings: ChaosBasicSettings;
+  onChange: (patch: Partial<ChaosBasicSettings>) => void;
+}) {
+  const t = useTranslations("chaosConfig");
+
+  return (
+    <>
+      {/* Enable/Disable Toggle */}
+      <div className="flex items-start justify-between gap-3 p-3 rounded-lg border border-border bg-surface/40">
+        <div className="flex flex-col gap-1">
+          <p className="text-sm font-medium text-text-main">{t("enableChaos")}</p>
+          <p className="text-xs text-text-muted">{t("enableChaosDesc")}</p>
+        </div>
+        <button
+          type="button"
+          role="switch"
+          aria-checked={settings.enabled}
+          onClick={() => onChange({ enabled: !settings.enabled })}
+          className={`inline-flex shrink-0 items-center gap-1.5 px-2.5 py-1.5 rounded-md text-xs font-semibold transition-colors ${
+            settings.enabled
+              ? "bg-amber-500/15 text-amber-700 dark:text-amber-300 border border-amber-500/30"
+              : "bg-black/5 dark:bg-white/5 text-text-muted border border-border"
+          }`}
+        >
+          <span className="material-symbols-outlined text-[14px]">
+            {settings.enabled ? "toggle_on" : "toggle_off"}
+          </span>
+          {settings.enabled ? "Enabled" : "Disabled"}
+        </button>
+      </div>
+
+      {/* Timeout */}
+      <div className="p-3 rounded-lg border border-border bg-surface/40">
+        <p className="text-sm font-medium text-text-main">{t("timeout")}</p>
+        <p className="text-xs text-text-muted mb-2">{t("timeoutDesc")}</p>
+        <input
+          type="number"
+          min={5000}
+          max={600000}
+          step={5000}
+          value={settings.timeoutMs}
+          onChange={(e) =>
+            onChange({
+              timeoutMs: Math.max(5000, Math.min(600000, Number(e.target.value) || 120000)),
+            })
+          }
+          className="w-full px-3 py-1.5 rounded-md border border-border bg-surface text-sm text-text-main"
+        />
+      </div>
+
+      {/* Max Tokens */}
+      <div className="p-3 rounded-lg border border-border bg-surface/40">
+        <p className="text-sm font-medium text-text-main">Max Tokens</p>
+        <p className="text-xs text-text-muted mb-2">
+          Maximum tokens per model response. Higher values cost more and take longer.
+        </p>
+        <input
+          type="number"
+          min={256}
+          max={128000}
+          step={256}
+          value={settings.maxTokens}
+          onChange={(e) =>
+            onChange({
+              maxTokens: Math.max(256, Math.min(128000, Number(e.target.value) || 4096)),
+            })
+          }
+          className="w-full px-3 py-1.5 rounded-md border border-border bg-surface text-sm text-text-main"
+        />
+      </div>
+
+      <ChaosSystemPromptField
+        value={settings.systemPrompt}
+        onChange={(systemPrompt) => onChange({ systemPrompt })}
+      />
+    </>
+  );
+}
diff --git a/src/app/(dashboard)/dashboard/chaos/components/ChaosConfigActionsBar.tsx b/src/app/(dashboard)/dashboard/chaos/components/ChaosConfigActionsBar.tsx
new file mode 100644
index 0000000000..8cbc3d3960
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/chaos/components/ChaosConfigActionsBar.tsx
@@ -0,0 +1,74 @@
+"use client";
+
+import { useTranslations } from "next-intl";
+
+/**
+ * Save/Reset + Test-run action buttons for the Chaos Mode config page.
+ * Extracted out of ChaosConfigPageClient.tsx to keep the page component under
+ * the complexity/size ratchet (config/quality/complexity-baseline.json).
+ */
+export function ChaosConfigActionsBar({
+  saving,
+  testing,
+  testDisabled,
+  onSave,
+  onReset,
+  onTest,
+}: {
+  saving: boolean;
+  testing: boolean;
+  testDisabled: boolean;
+  onSave: () => void;
+  onReset: () => void;
+  onTest: () => void;
+}) {
+  const t = useTranslations("chaosConfig");
+
+  return (
+    <>
+      {/* Actions */}
+      <div className="flex gap-3">
+        <button
+          type="button"
+          onClick={onSave}
+          disabled={saving}
+          className="flex items-center gap-2 px-4 py-2 rounded-lg bg-primary text-white text-sm font-semibold hover:opacity-90 disabled:opacity-50"
+        >
+          {saving ? (
+            <span className="material-symbols-outlined text-[16px] animate-spin">sync</span>
+          ) : (
+            <span className="material-symbols-outlined text-[16px]">save</span>
+          )}
+          {t("saveConfig")}
+        </button>
+        <button
+          type="button"
+          onClick={onReset}
+          disabled={saving}
+          className="flex items-center gap-2 px-4 py-2 rounded-lg border border-border text-text-muted text-sm hover:bg-black/5 dark:hover:bg-white/5 disabled:opacity-50"
+        >
+          <span className="material-symbols-outlined text-[16px]">restart_alt</span>
+          {t("configReset")}
+        </button>
+      </div>
+
+      {/* Test Button */}
+      <div className="p-3 rounded-lg border border-border bg-surface/40">
+        <p className="text-sm font-medium text-text-main mb-2">{t("testButton")}</p>
+        <button
+          type="button"
+          onClick={onTest}
+          disabled={testing || testDisabled}
+          className="flex items-center gap-2 px-4 py-2 rounded-lg bg-amber-500/15 text-amber-700 dark:text-amber-300 border border-amber-500/30 text-sm font-semibold hover:bg-amber-500/25 disabled:opacity-50"
+        >
+          {testing ? (
+            <span className="material-symbols-outlined text-[16px] animate-spin">sync</span>
+          ) : (
+            <span className="material-symbols-outlined text-[16px]">play_arrow</span>
+          )}
+          {testing ? "Running..." : t("testButton")}
+        </button>
+      </div>
+    </>
+  );
+}
diff --git a/src/app/(dashboard)/dashboard/chaos/components/ChaosModeSelector.tsx b/src/app/(dashboard)/dashboard/chaos/components/ChaosModeSelector.tsx
new file mode 100644
index 0000000000..b74f8fc51c
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/chaos/components/ChaosModeSelector.tsx
@@ -0,0 +1,60 @@
+"use client";
+
+/**
+ * Parallel / Collaborative mode selector for the Chaos Mode config page.
+ * Extracted out of ChaosConfigPageClient.tsx to keep the page component under
+ * the complexity/size ratchet (config/quality/complexity-baseline.json).
+ */
+export function ChaosModeSelector({
+  mode,
+  onChange,
+  label,
+  parallelLabel,
+  parallelDesc,
+  collaborativeLabel,
+  collaborativeDesc,
+}: {
+  mode: "parallel" | "collaborative";
+  onChange: (mode: "parallel" | "collaborative") => void;
+  label: string;
+  parallelLabel: string;
+  parallelDesc: string;
+  collaborativeLabel: string;
+  collaborativeDesc: string;
+}) {
+  return (
+    <div className="p-3 rounded-lg border border-border bg-surface/40">
+      <p className="text-sm font-medium text-text-main mb-2">{label}</p>
+      <div className="flex gap-2">
+        <button
+          type="button"
+          onClick={() => onChange("parallel")}
+          className={`flex-1 px-3 py-2 rounded-md text-xs font-semibold transition-all ${
+            mode === "parallel"
+              ? "bg-primary text-white"
+              : "bg-black/5 dark:bg-white/5 text-text-muted hover:bg-black/10 dark:hover:bg-white/10"
+          }`}
+        >
+          <span className="material-symbols-outlined text-[16px] align-middle mr-1">
+            call_split
+          </span>
+          {parallelLabel}
+          <p className="text-[10px] opacity-70 mt-0.5">{parallelDesc}</p>
+        </button>
+        <button
+          type="button"
+          onClick={() => onChange("collaborative")}
+          className={`flex-1 px-3 py-2 rounded-md text-xs font-semibold transition-all ${
+            mode === "collaborative"
+              ? "bg-primary text-white"
+              : "bg-black/5 dark:bg-white/5 text-text-muted hover:bg-black/10 dark:hover:bg-white/10"
+          }`}
+        >
+          <span className="material-symbols-outlined text-[16px] align-middle mr-1">merge</span>
+          {collaborativeLabel}
+          <p className="text-[10px] opacity-70 mt-0.5">{collaborativeDesc}</p>
+        </button>
+      </div>
+    </div>
+  );
+}
diff --git a/src/app/(dashboard)/dashboard/chaos/components/ChaosProviderOverridesPanel.tsx b/src/app/(dashboard)/dashboard/chaos/components/ChaosProviderOverridesPanel.tsx
new file mode 100644
index 0000000000..c6967f8a50
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/chaos/components/ChaosProviderOverridesPanel.tsx
@@ -0,0 +1,156 @@
+"use client";
+
+export interface ChaosProviderInfo {
+  id: string;
+  name: string;
+  provider: string;
+  defaultModel: string | null;
+}
+
+export interface ChaosProviderOverride {
+  providerId: string;
+  modelId?: string;
+  enabled: boolean;
+}
+
+type UpdateOverride = (index: number, field: keyof ChaosProviderOverride, value: any) => void;
+
+function ChaosProviderOverrideRow({
+  override,
+  index,
+  availableProviders,
+  onUpdate,
+  onRemove,
+}: {
+  override: ChaosProviderOverride;
+  index: number;
+  availableProviders: ChaosProviderInfo[];
+  onUpdate: UpdateOverride;
+  onRemove: (index: number) => void;
+}) {
+  return (
+    <div className="flex items-center gap-2 p-2 rounded-md bg-black/5 dark:bg-white/5">
+      {/* Provider dropdown with available options */}
+      <div className="flex-1 relative">
+        <input
+          type="text"
+          list={`provider-list-${index}`}
+          placeholder="Provider ID (type or select)"
+          value={override.providerId}
+          onChange={(e) => onUpdate(index, "providerId", e.target.value)}
+          className="w-full px-2 py-1 rounded border border-border bg-surface text-xs text-text-main"
+        />
+        <datalist id={`provider-list-${index}`}>
+          {availableProviders.map((p) => (
+            <option key={p.id} value={p.provider} />
+          ))}
+        </datalist>
+      </div>
+      <input
+        type="text"
+        placeholder="Model ID (optional)"
+        value={override.modelId || ""}
+        onChange={(e) => onUpdate(index, "modelId", e.target.value)}
+        className="flex-1 px-2 py-1 rounded border border-border bg-surface text-xs text-text-main"
+      />
+      <button
+        type="button"
+        onClick={() => onUpdate(index, "enabled", !override.enabled)}
+        className={`px-2 py-1 rounded text-xs ${
+          override.enabled ? "bg-green-500/10 text-green-600" : "bg-red-500/10 text-red-600"
+        }`}
+      >
+        {override.enabled ? "ON" : "OFF"}
+      </button>
+      <button
+        type="button"
+        onClick={() => onRemove(index)}
+        className="px-2 py-1 rounded text-xs text-red-500 hover:bg-red-500/10"
+      >
+        <span className="material-symbols-outlined text-[14px]">close</span>
+      </button>
+    </div>
+  );
+}
+
+function ChaosAvailableProvidersHint({ availableProviders }: { availableProviders: ChaosProviderInfo[] }) {
+  if (availableProviders.length === 0) return null;
+  return (
+    <details className="text-xs text-text-muted">
+      <summary className="cursor-pointer hover:text-text-main">
+        Available providers ({availableProviders.length})
+      </summary>
+      <div className="mt-1 flex flex-wrap gap-1">
+        {availableProviders.map((p) => (
+          <span key={p.id} className="px-1.5 py-0.5 rounded bg-black/5 dark:bg-white/5">
+            {p.provider}
+            {p.defaultModel && <span className="opacity-60 ml-1">({p.defaultModel})</span>}
+          </span>
+        ))}
+      </div>
+    </details>
+  );
+}
+
+/**
+ * Per-provider model override editor for the Chaos Mode config page.
+ * Extracted out of ChaosConfigPageClient.tsx to keep the page component under
+ * the complexity/size ratchet (config/quality/complexity-baseline.json).
+ */
+export function ChaosProviderOverridesPanel({
+  overrides,
+  availableProviders,
+  title,
+  description,
+  addLabel,
+  onAdd,
+  onUpdate,
+  onRemove,
+}: {
+  overrides: ChaosProviderOverride[];
+  availableProviders: ChaosProviderInfo[];
+  title: string;
+  description: string;
+  addLabel: string;
+  onAdd: () => void;
+  onUpdate: UpdateOverride;
+  onRemove: (index: number) => void;
+}) {
+  return (
+    <div className="p-3 rounded-lg border border-border bg-surface/40 space-y-3">
+      <div className="flex items-center justify-between">
+        <div>
+          <p className="text-sm font-medium text-text-main">{title}</p>
+          <p className="text-xs text-text-muted">{description}</p>
+        </div>
+        <button
+          type="button"
+          onClick={onAdd}
+          className="flex items-center gap-1 px-2 py-1 rounded-md text-xs font-semibold bg-primary/10 text-primary hover:bg-primary/20"
+        >
+          <span className="material-symbols-outlined text-[14px]">add</span>
+          {addLabel}
+        </button>
+      </div>
+
+      {overrides.length === 0 && (
+        <p className="text-xs text-text-muted italic">
+          No overrides — all active providers will participate with their default models
+        </p>
+      )}
+
+      {overrides.map((override, idx) => (
+        <ChaosProviderOverrideRow
+          key={idx}
+          override={override}
+          index={idx}
+          availableProviders={availableProviders}
+          onUpdate={onUpdate}
+          onRemove={onRemove}
+        />
+      ))}
+
+      <ChaosAvailableProvidersHint availableProviders={availableProviders} />
+    </div>
+  );
+}
diff --git a/src/app/(dashboard)/dashboard/chaos/components/ChaosStatusMessage.tsx b/src/app/(dashboard)/dashboard/chaos/components/ChaosStatusMessage.tsx
new file mode 100644
index 0000000000..f5ac9faa60
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/chaos/components/ChaosStatusMessage.tsx
@@ -0,0 +1,23 @@
+"use client";
+
+import type { ChaosPageMessage } from "../chaosPageTypes";
+
+/**
+ * Success/error status banner for the Chaos Mode config page. Extracted out
+ * of ChaosConfigPageClient.tsx to keep the page component under the
+ * complexity/size ratchet (config/quality/complexity-baseline.json).
+ */
+export function ChaosStatusMessage({ message }: { message: ChaosPageMessage }) {
+  if (!message) return null;
+  return (
+    <div
+      className={`p-3 rounded-lg text-sm font-medium ${
+        message.type === "success"
+          ? "bg-green-500/10 text-green-700 dark:text-green-300 border border-green-500/20"
+          : "bg-red-500/10 text-red-700 dark:text-red-300 border border-red-500/20"
+      }`}
+    >
+      {message.text}
+    </div>
+  );
+}
diff --git a/src/app/(dashboard)/dashboard/chaos/components/ChaosTestResultsPanel.tsx b/src/app/(dashboard)/dashboard/chaos/components/ChaosTestResultsPanel.tsx
new file mode 100644
index 0000000000..38a0d54d2b
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/chaos/components/ChaosTestResultsPanel.tsx
@@ -0,0 +1,66 @@
+"use client";
+
+export interface ChaosModelResult {
+  providerId: string;
+  providerName: string;
+  modelId: string;
+  status: "success" | "error" | "skipped";
+  content: string | null;
+  error?: string;
+  durationMs: number;
+}
+
+export interface ChaosTestResult {
+  task: string;
+  mode: string;
+  startedAt: string;
+  totalProviders: number;
+  totalResults: number;
+  models: ChaosModelResult[];
+  summary?: string;
+}
+
+/**
+ * Test-run results panel for the Chaos Mode config page. Extracted out of
+ * ChaosConfigPageClient.tsx to keep the page component under the
+ * complexity/size ratchet (config/quality/complexity-baseline.json).
+ */
+export function ChaosTestResultsPanel({ result }: { result: ChaosTestResult }) {
+  return (
+    <div className="p-3 rounded-lg border border-border bg-surface/40 space-y-3">
+      <h3 className="text-sm font-bold text-text-main">
+        Test Results — {result.mode} mode ({result.totalProviders} providers)
+      </h3>
+      <div className="text-xs text-text-muted">
+        Started: {new Date(result.startedAt).toLocaleTimeString()}
+      </div>
+      {result.models.map((model, idx) => (
+        <div
+          key={idx}
+          className={`p-2 rounded-md text-xs ${
+            model.status === "success"
+              ? "bg-green-500/5 border border-green-500/20"
+              : "bg-red-500/5 border border-red-500/20"
+          }`}
+        >
+          <div className="font-medium text-text-main">
+            [{idx + 1}] {model.providerName} / {model.modelId}
+            <span className="ml-2 text-text-muted">({model.durationMs}ms)</span>
+            <span
+              className={`ml-2 ${model.status === "success" ? "text-green-500" : "text-red-500"}`}
+            >
+              {model.status}
+            </span>
+          </div>
+          {model.status === "success" && model.content && (
+            <div className="mt-1 text-text-muted line-clamp-3 whitespace-pre-wrap">
+              {model.content.slice(0, 300)}
+              {model.content.length > 300 ? "..." : ""}
+            </div>
+          )}
+          {model.error && <div className="mt-1 text-red-500">{model.error}</div>}
+        </div>
+      ))}
+    </div>
+  );
+}
diff --git a/src/app/(dashboard)/dashboard/chaos/page.tsx b/src/app/(dashboard)/dashboard/chaos/page.tsx
new file mode 100644
index 0000000000..3831c11f97
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/chaos/page.tsx
@@ -0,0 +1,12 @@
+/**
+ * /dashboard/chaos/page.tsx — Chaos Mode Configuration
+ */
+import ChaosConfigPageClient from "./ChaosConfigPageClient";
+
+export const metadata = {
+  title: "Chaos Mode — OmniRoute",
+};
+
+export default function Page() {
+  return <ChaosConfigPageClient />;
+}
diff --git a/src/app/(dashboard)/dashboard/chaos/useChaosConfigData.ts b/src/app/(dashboard)/dashboard/chaos/useChaosConfigData.ts
new file mode 100644
index 0000000000..878b523018
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/chaos/useChaosConfigData.ts
@@ -0,0 +1,96 @@
+"use client";
+
+import { useEffect, useMemo, useState } from "react";
+import {
+  DEFAULT_CHAOS_PAGE_CONFIG,
+  type ChaosPageConfig,
+  type ChaosProviderInfo,
+} from "./chaosPageTypes";
+
+function pickProviderName(conn: any): string {
+  return conn.provider || conn.name || conn.id || "";
+}
+
+function toProviderInfo(conn: any, providerName: string): ChaosProviderInfo {
+  return {
+    id: conn.id,
+    name: conn.name || conn.provider || providerName,
+    provider: conn.provider || providerName,
+    defaultModel: conn.defaultModel || null,
+  };
+}
+
+/** Extract a deduplicated ChaosProviderInfo[] from the /api/providers connections payload. */
+function extractProvidersFromPayload(payload: unknown): ChaosProviderInfo[] {
+  const allConnections = (payload as any)?.connections || (payload as any)?.data || payload;
+  if (!Array.isArray(allConnections)) return [];
+
+  const extracted: ChaosProviderInfo[] = [];
+  const seenProvider = new Set<string>();
+  for (const conn of allConnections) {
+    const providerName = pickProviderName(conn);
+    if (!providerName || seenProvider.has(providerName.toLowerCase())) continue;
+    seenProvider.add(providerName.toLowerCase());
+    extracted.push(toProviderInfo(conn, providerName));
+  }
+  return extracted;
+}
+
+/** Fetch the persisted chaos config, or null on failure (caller keeps the default). */
+async function fetchChaosConfig(): Promise<ChaosPageConfig | null> {
+  const res = await fetch("/api/chaos/config");
+  if (!res.ok) return null;
+  const data = await res.json();
+  return data.config || DEFAULT_CHAOS_PAGE_CONFIG;
+}
+
+/** Fetch active provider connections, or [] on failure/empty. */
+async function fetchChaosProviders(): Promise<ChaosProviderInfo[]> {
+  const res = await fetch("/api/providers");
+  if (!res.ok) return [];
+  const data = await res.json();
+  return extractProvidersFromPayload(data);
+}
+
+/**
+ * Chaos config + provider-connection data loading for the Chaos Mode config
+ * page. Extracted out of the page component to keep it under the
+ * complexity/size ratchet (config/quality/complexity-baseline.json).
+ */
+export function useChaosConfigData() {
+  const [config, setConfig] = useState<ChaosPageConfig>(DEFAULT_CHAOS_PAGE_CONFIG);
+  const [providers, setProviders] = useState<ChaosProviderInfo[]>([]);
+  const [loading, setLoading] = useState(true);
+
+  // Build a unique list of provider names from active connections for the dropdown
+  const availableProviders = useMemo(() => {
+    const seen = new Set<string>();
+    return providers.filter((p) => {
+      const key = p.provider || p.name || p.id;
+      if (seen.has(key)) return false;
+      seen.add(key);
+      return true;
+    });
+  }, [providers]);
+
+  // Fetch current config + providers on mount
+  useEffect(() => {
+    async function load() {
+      try {
+        const [nextConfig, nextProviders] = await Promise.all([
+          fetchChaosConfig(),
+          fetchChaosProviders(),
+        ]);
+        if (nextConfig) setConfig(nextConfig);
+        if (nextProviders.length > 0) setProviders(nextProviders);
+      } catch (err) {
+        console.error("[chaos] Failed to load config", err);
+      } finally {
+        setLoading(false);
+      }
+    }
+    load();
+  }, []);
+
+  return { config, setConfig, availableProviders, loading };
+}
diff --git a/src/app/(dashboard)/dashboard/chaos/useChaosConfigPage.ts b/src/app/(dashboard)/dashboard/chaos/useChaosConfigPage.ts
new file mode 100644
index 0000000000..23dde15e85
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/chaos/useChaosConfigPage.ts
@@ -0,0 +1,72 @@
+"use client";
+
+import { useCallback } from "react";
+import type { ChaosProviderOverride } from "./components/ChaosProviderOverridesPanel";
+import { useChaosConfigData } from "./useChaosConfigData";
+import { useChaosConfigPersistence } from "./useChaosConfigPersistence";
+import { useChaosTestRun } from "./useChaosTestRun";
+
+export type { ChaosProviderInfo, ChaosPageConfig } from "./chaosPageTypes";
+export { DEFAULT_CHAOS_PAGE_CONFIG } from "./chaosPageTypes";
+
+/**
+ * All state + handlers for the Chaos Mode config page
+ * (src/app/(dashboard)/dashboard/chaos/ChaosConfigPageClient.tsx). Composes
+ * useChaosConfigData/useChaosConfigPersistence/useChaosTestRun so the page
+ * component itself stays a thin render function under the complexity/size
+ * ratchet (config/quality/complexity-baseline.json).
+ */
+export function useChaosConfigPage() {
+  const { config, setConfig, availableProviders, loading } = useChaosConfigData();
+  const { t, saving, message, setMessage, saveConfig, resetConfig } = useChaosConfigPersistence(
+    config,
+    setConfig
+  );
+  const { testing, testResult, testChaos } = useChaosTestRun(config, setMessage);
+
+  const addOverride = useCallback(() => {
+    setConfig((prev) => ({
+      ...prev,
+      providerOverrides: [...prev.providerOverrides, { providerId: "", modelId: "", enabled: true }],
+    }));
+  }, [setConfig]);
+
+  const updateOverride = useCallback(
+    (index: number, field: keyof ChaosProviderOverride, value: any) => {
+      setConfig((prev) => {
+        const overrides = [...prev.providerOverrides];
+        overrides[index] = { ...overrides[index], [field]: value };
+        return { ...prev, providerOverrides: overrides };
+      });
+    },
+    [setConfig]
+  );
+
+  const removeOverride = useCallback(
+    (index: number) => {
+      setConfig((prev) => ({
+        ...prev,
+        providerOverrides: prev.providerOverrides.filter((_, i) => i !== index),
+      }));
+    },
+    [setConfig]
+  );
+
+  return {
+    t,
+    config,
+    setConfig,
+    availableProviders,
+    loading,
+    saving,
+    testing,
+    testResult,
+    message,
+    saveConfig,
+    resetConfig,
+    testChaos,
+    addOverride,
+    updateOverride,
+    removeOverride,
+  };
+}
diff --git a/src/app/(dashboard)/dashboard/chaos/useChaosConfigPersistence.ts b/src/app/(dashboard)/dashboard/chaos/useChaosConfigPersistence.ts
new file mode 100644
index 0000000000..a3616b544b
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/chaos/useChaosConfigPersistence.ts
@@ -0,0 +1,65 @@
+"use client";
+
+import { useCallback, useState, type Dispatch, type SetStateAction } from "react";
+import { useTranslations } from "next-intl";
+import type { ChaosPageConfig, ChaosPageMessage } from "./chaosPageTypes";
+
+/**
+ * Save / reset persistence for the Chaos Mode config page. Extracted out of
+ * the page component to keep it under the complexity/size ratchet
+ * (config/quality/complexity-baseline.json).
+ */
+export function useChaosConfigPersistence(
+  config: ChaosPageConfig,
+  setConfig: Dispatch<SetStateAction<ChaosPageConfig>>
+) {
+  const t = useTranslations("chaosConfig");
+  const [saving, setSaving] = useState(false);
+  const [message, setMessage] = useState<ChaosPageMessage>(null);
+
+  const saveConfig = useCallback(async () => {
+    setSaving(true);
+    setMessage(null);
+    try {
+      const res = await fetch("/api/chaos/config", {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(config),
+      });
+
+      if (res.ok) {
+        const data = await res.json();
+        setConfig(data.config);
+        setMessage({ type: "success", text: t("configSaved") });
+      } else {
+        setMessage({ type: "error", text: t("configError") });
+      }
+    } catch {
+      setMessage({ type: "error", text: t("configError") });
+    } finally {
+      setSaving(false);
+    }
+  }, [config, setConfig, t]);
+
+  const resetConfig = useCallback(async () => {
+    setSaving(true);
+    setMessage(null);
+    try {
+      const res = await fetch("/api/chaos/config", { method: "DELETE" });
+      if (res.ok) {
+        const data = await res.json();
+        setConfig(data.config);
+        setMessage({ type: "success", text: "Config reset to defaults" });
+      } else {
+        const err = await res.json().catch(() => ({ error: "Reset failed" }));
+        setMessage({ type: "error", text: err.error || "Reset failed" });
+      }
+    } catch {
+      setMessage({ type: "error", text: "Failed to reset config" });
+    } finally {
+      setSaving(false);
+    }
+  }, [setConfig]);
+
+  return { t, saving, message, setMessage, saveConfig, resetConfig };
+}
diff --git a/src/app/(dashboard)/dashboard/chaos/useChaosTestRun.ts b/src/app/(dashboard)/dashboard/chaos/useChaosTestRun.ts
new file mode 100644
index 0000000000..092c9620f4
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/chaos/useChaosTestRun.ts
@@ -0,0 +1,48 @@
+"use client";
+
+import { useCallback, useState } from "react";
+import { useTranslations } from "next-intl";
+import type { ChaosTestResult } from "./components/ChaosTestResultsPanel";
+import type { ChaosPageConfig, ChaosPageMessage } from "./chaosPageTypes";
+
+/**
+ * "Test Chaos Mode" run trigger for the Chaos Mode config page. Extracted out
+ * of the page component to keep it under the complexity/size ratchet
+ * (config/quality/complexity-baseline.json).
+ */
+export function useChaosTestRun(config: ChaosPageConfig, setMessage: (message: ChaosPageMessage) => void) {
+  const t = useTranslations("chaosConfig");
+  const [testing, setTesting] = useState(false);
+  const [testResult, setTestResult] = useState<ChaosTestResult | null>(null);
+
+  const testChaos = useCallback(async () => {
+    setTesting(true);
+    setTestResult(null);
+    setMessage(null);
+    try {
+      const res = await fetch("/api/chaos/run", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          task: t("testTask"),
+          mode: config.defaultMode,
+          maxTokens: config.maxTokens,
+        }),
+      });
+
+      if (res.ok) {
+        const data: ChaosTestResult = await res.json();
+        setTestResult(data);
+      } else {
+        const err = await res.json().catch(() => ({ error: "Unknown error" }));
+        setMessage({ type: "error", text: err.error || "Test failed" });
+      }
+    } catch (err: any) {
+      setMessage({ type: "error", text: err.message || "Test failed" });
+    } finally {
+      setTesting(false);
+    }
+  }, [config.defaultMode, config.maxTokens, setMessage, t]);
+
+  return { testing, testResult, testChaos };
+}
diff --git a/src/app/(dashboard)/dashboard/cli-code/components/CodexToolCard.tsx b/src/app/(dashboard)/dashboard/cli-code/components/CodexToolCard.tsx
index 8abb015c9a..a8b352cdaf 100644
--- a/src/app/(dashboard)/dashboard/cli-code/components/CodexToolCard.tsx
+++ b/src/app/(dashboard)/dashboard/cli-code/components/CodexToolCard.tsx
@@ -8,6 +8,7 @@ import { useTranslations } from "next-intl";
 import ProviderIcon from "@/shared/components/ProviderIcon";
 import { normalizeCodexBaseUrl } from "@/shared/utils/codexBaseUrl";
 import { isApplyDisabled, isResetDisabled } from "./codexButtonState";
+import { CODEX_DEFAULT_MODELS } from "./codexToolOptions";
 
 export default function CodexToolCard({
   tool,
@@ -28,14 +29,7 @@ export default function CodexToolCard({
   const [message, setMessage] = useState(null);
   const [showInstallGuide, setShowInstallGuide] = useState(false);
   const [selectedApiKey, setSelectedApiKey] = useState("");
-  const [selectedModel, setSelectedModel] = useState("gpt-5.5");
-  const CODEX_DEFAULT_MODELS = [
-    "gpt-5.5",
-    "gpt-5.3-codex",
-    "gpt-5.4",
-    "gpt-5.1-codex-max",
-    "gpt-5.1-codex-mini",
-  ];
+  const [selectedModel, setSelectedModel] = useState("gpt-5.6-sol");
   const [modelMappings, setModelMappings] = useState<Record<string, string>>({});
   const [reasoningEffort, setReasoningEffort] = useState("xhigh");
   const [wireApi, setWireApi] = useState("chat");
@@ -595,7 +589,7 @@ openai_base_url = "${getEffectiveBaseUrl()}"
                     type="text"
                     value={selectedModel}
                     onChange={(e) => setSelectedModel(e.target.value)}
-                    placeholder="gpt-5.5"
+                    placeholder="gpt-5.6-sol"
                     className="flex-1 px-2 py-1.5 bg-surface rounded border border-border text-xs focus:outline-none focus:ring-1 focus:ring-primary/50"
                   />
                   {selectedModel && (
@@ -627,6 +621,8 @@ openai_base_url = "${getEffectiveBaseUrl()}"
                     <option value="medium">Medium</option>
                     <option value="high">High</option>
                     <option value="xhigh">XHigh</option>
+                    <option value="max">Max</option>
+                    <option value="ultra">Ultra</option>
                   </select>
                 </div>
 
diff --git a/src/app/(dashboard)/dashboard/cli-code/components/codexToolOptions.ts b/src/app/(dashboard)/dashboard/cli-code/components/codexToolOptions.ts
new file mode 100644
index 0000000000..3d653c71dc
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/cli-code/components/codexToolOptions.ts
@@ -0,0 +1,9 @@
+export const CODEX_DEFAULT_MODELS = [
+  "gpt-5.6-sol",
+  "gpt-5.6-terra",
+  "gpt-5.6-luna",
+  "gpt-5.5",
+  "gpt-5.3-codex",
+  "gpt-5.1-codex-max",
+  "gpt-5.1-codex-mini",
+] as const;
diff --git a/src/app/(dashboard)/dashboard/combos/ReasoningTokenBufferToggle.tsx b/src/app/(dashboard)/dashboard/combos/ReasoningTokenBufferToggle.tsx
new file mode 100644
index 0000000000..643658346e
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/combos/ReasoningTokenBufferToggle.tsx
@@ -0,0 +1,52 @@
+import Tooltip from "@/shared/components/Tooltip";
+
+type TranslationFn = {
+  (key: string): string;
+  has?: (key: string) => boolean;
+};
+
+type Props = {
+  config: Record<string, any>;
+  setConfig: (config: Record<string, any>) => void;
+  t: TranslationFn;
+};
+
+function getI18nOrFallback(t: TranslationFn, key: string, fallback: string): string {
+  try {
+    if (typeof t.has === "function" && t.has(key)) return t(key);
+  } catch {}
+  return fallback;
+}
+
+export default function ReasoningTokenBufferToggle({ config, setConfig, t }: Props) {
+  return (
+    <div className="flex items-center gap-2 py-1">
+      <input
+        type="checkbox"
+        id="reasoningTokenBufferEnabled"
+        data-testid="combo-reasoning-token-buffer-enabled"
+        checked={config.reasoningTokenBufferEnabled !== false}
+        onChange={(e) => setConfig({ ...config, reasoningTokenBufferEnabled: e.target.checked })}
+        className="w-3.5 h-3.5 rounded border border-black/20 dark:border-white/20 accent-primary cursor-pointer"
+      />
+      <label
+        htmlFor="reasoningTokenBufferEnabled"
+        className="text-xs text-text-muted cursor-pointer select-none"
+      >
+        {getI18nOrFallback(t, "reasoningTokenBuffer", "Reasoning token buffer")}
+      </label>
+      <Tooltip
+        position="bottom"
+        content={getI18nOrFallback(
+          t,
+          "advancedHelp.reasoningTokenBuffer",
+          "When enabled (default), OmniRoute may increase max_tokens for reasoning-capable models so they have headroom to think. Turn this off if you need this combo to preserve the client's exact max_tokens."
+        )}
+      >
+        <span className="material-symbols-outlined text-[12px] text-text-muted cursor-help">
+          help
+        </span>
+      </Tooltip>
+    </div>
+  );
+}
diff --git a/src/app/(dashboard)/dashboard/combos/page.tsx b/src/app/(dashboard)/dashboard/combos/page.tsx
index c5c068000c..a91ac0c7f3 100644
--- a/src/app/(dashboard)/dashboard/combos/page.tsx
+++ b/src/app/(dashboard)/dashboard/combos/page.tsx
@@ -15,6 +15,7 @@ import Tooltip from "@/shared/components/Tooltip";
 import { useCopyToClipboard } from "@/shared/hooks/useCopyToClipboard";
 import { FieldLabelWithHelp, WeightTotalBar } from "./parts";
 import { ResponseValidationEditor, type ResponseValidationValue } from "./ResponseValidationEditor";
+import ReasoningTokenBufferToggle from "./ReasoningTokenBufferToggle";
 import { pickDisplayValue } from "@/shared/utils/maskEmail";
 import useEmailPrivacyStore from "@/store/emailPrivacyStore";
 import { useNotificationStore } from "@/store/notificationStore";
@@ -217,10 +218,6 @@ function sanitizeComboRuntimeConfig(config) {
   );
 }
 
-// Build the next combo config when a Fusion tuning field changes. Prunes empty /
-// non-finite entries and drops the whole `fusionTuning` object when no field is
-// set, so an empty `{}` is never persisted (sanitizeComboRuntimeConfig keeps any
-// non-null object as-is).
 function updateFusionTuning(config, field, rawValue) {
   const value = rawValue === "" ? undefined : Number(rawValue);
   const next = { ...(config.fusionTuning || {}), [field]: value };
@@ -522,9 +519,7 @@ function getStrategyBadgeClass(strategy) {
 function getI18nOrFallback(t, key, fallback) {
   try {
     if (typeof t.has === "function" && t.has(key)) return t(key);
-  } catch {
-    // Some translations require ICU variables; fallback keeps optional helper text safe.
-  }
+  } catch {}
   return fallback;
 }
 
@@ -1023,7 +1018,6 @@ export default function CombosPage() {
 
   return (
     <div className="flex flex-col gap-6">
-      {/* Header */}
       <div className="flex flex-col gap-3 md:flex-row md:items-center md:justify-between">
         <div>
           <h1 className="text-2xl font-semibold">{t("title")}</h1>
@@ -2063,7 +2057,6 @@ function ComboFormModal({ isOpen, combo, onClose, onSave, activeProviders, combo
     }
   }, [builderStage, comboBuilderStages]);
 
-  // DnD state
   const hasPricingForModel = useCallback(
     (modelValue) => {
       const parsed = parseQualifiedModel(modelValue);
@@ -2752,9 +2745,7 @@ function ComboFormModal({ isOpen, combo, onClose, onSave, activeProviders, combo
       saveData.description = null;
     }
 
-    // Include config only if any values are set
     const configToSave = sanitizeComboRuntimeConfig(config);
-    // Add round-robin specific fields to config
     if (strategy === "round-robin") {
       if (config.concurrencyPerModel !== undefined)
         configToSave.concurrencyPerModel = config.concurrencyPerModel;
@@ -3740,7 +3731,6 @@ function ComboFormModal({ isOpen, combo, onClose, onSave, activeProviders, combo
                       />
                     </div>
                   </div>
-                  {/* failoverBeforeRetry + maxSetRetries + setRetryDelayMs */}
                   <div className="grid grid-cols-2 gap-2 pt-2 border-t border-black/5 dark:border-white/5">
                     <div className="col-span-2">
                       <div className="flex items-center gap-2 py-1">
@@ -3776,6 +3766,9 @@ function ComboFormModal({ isOpen, combo, onClose, onSave, activeProviders, combo
                         </Tooltip>
                       </div>
                     </div>
+                    <div className="col-span-2">
+                      <ReasoningTokenBufferToggle config={config} setConfig={setConfig} t={t} />
+                    </div>
                     <div>
                       <FieldLabelWithHelp
                         label={t("maxSetRetries")}
@@ -4097,7 +4090,7 @@ function ComboFormModal({ isOpen, combo, onClose, onSave, activeProviders, combo
                         <input
                           type="text"
                           value={config.handoffModel ?? ""}
-                          placeholder="codex/gpt-5.4"
+                          placeholder="codex/gpt-5.6-sol"
                           onChange={(e) =>
                             setConfig({
                               ...config,
@@ -4166,7 +4159,11 @@ function ComboFormModal({ isOpen, combo, onClose, onSave, activeProviders, combo
                       </div>
                       <div>
                         <FieldLabelWithHelp
-                          label={getI18nOrFallback(t, "fusionStragglerGraceMs", "Straggler grace (ms)")}
+                          label={getI18nOrFallback(
+                            t,
+                            "fusionStragglerGraceMs",
+                            "Straggler grace (ms)"
+                          )}
                           help={getI18nOrFallback(
                             t,
                             "fusionStragglerGraceMsHelp",
@@ -4181,7 +4178,9 @@ function ComboFormModal({ isOpen, combo, onClose, onSave, activeProviders, combo
                           value={config.fusionTuning?.stragglerGraceMs ?? ""}
                           placeholder="8000"
                           onChange={(e) =>
-                            setConfig(updateFusionTuning(config, "stragglerGraceMs", e.target.value))
+                            setConfig(
+                              updateFusionTuning(config, "stragglerGraceMs", e.target.value)
+                            )
                           }
                           className="w-full text-xs py-1.5 px-2 rounded border border-black/10 dark:border-white/10 bg-transparent focus:border-primary focus:outline-none"
                         />
@@ -4580,7 +4579,6 @@ function ComboFormModal({ isOpen, combo, onClose, onSave, activeProviders, combo
             </div>
           )}
 
-          {/* Actions */}
           {isExpertMode ? (
             <div className="flex gap-2 pt-1">
               <Button onClick={onClose} variant="ghost" fullWidth size="sm">
diff --git a/src/app/(dashboard)/dashboard/compression/studio/CompareView.tsx b/src/app/(dashboard)/dashboard/compression/studio/CompareView.tsx
index df4bf66169..985e1800ef 100644
--- a/src/app/(dashboard)/dashboard/compression/studio/CompareView.tsx
+++ b/src/app/(dashboard)/dashboard/compression/studio/CompareView.tsx
@@ -115,7 +115,7 @@ export function CompareView({ text }: CompareViewProps) {
       </div>
       <table className="w-full text-xs">
         <thead>
-          <tr className="text-left opacity-60"><th>Engine</th><th>Savings</th><th>Retenção</th><th>Out tok</th><th>Fidelidade</th></tr>
+          <tr className="text-left opacity-60"><th>Engine</th><th>Savings</th><th>Retention</th><th>Out tok</th><th>Fidelity</th></tr>
         </thead>
         <tbody>
           {rows.map((r) => {
diff --git a/src/app/(dashboard)/dashboard/compression/studio/PlaygroundInput.tsx b/src/app/(dashboard)/dashboard/compression/studio/PlaygroundInput.tsx
index 9c3977a7b1..0cadf7a356 100644
--- a/src/app/(dashboard)/dashboard/compression/studio/PlaygroundInput.tsx
+++ b/src/app/(dashboard)/dashboard/compression/studio/PlaygroundInput.tsx
@@ -20,7 +20,7 @@ export function PlaygroundInput({ text, onText, active, onToggleActive, onRun, l
       </label>
       <label className="flex items-center gap-2 text-sm">
         <input type="checkbox" data-testid="risk-toggle" checked={riskGate} onChange={onToggleRisk} />
-        Proteger conteúdo sensível (risk-gate)
+        Protect sensitive content (risk-gate)
       </label>
       <label className="flex items-center gap-1 text-xs">
         <input type="checkbox" data-testid="quantum-toggle" checked={quantumLock} onChange={onToggleQuantum} />
diff --git a/src/app/(dashboard)/dashboard/context/combos/CompressionHub.tsx b/src/app/(dashboard)/dashboard/context/combos/CompressionHub.tsx
index 736dbf05ed..7265782bb3 100644
--- a/src/app/(dashboard)/dashboard/context/combos/CompressionHub.tsx
+++ b/src/app/(dashboard)/dashboard/context/combos/CompressionHub.tsx
@@ -248,15 +248,14 @@ export default function CompressionHub() {
         </div>
       </div>
 
-      {/* ── Compressão delegada ao provedor ── */}
+      {/* ── Provider-delegated compression ── */}
       <div className="flex flex-col gap-3">
-        <h2 className="text-sm font-semibold text-text-main">Compressão delegada ao provedor</h2>
+        <h2 className="text-sm font-semibold text-text-main">Provider-delegated compression</h2>
         <div className="flex items-center gap-3 rounded-lg border border-border bg-bg p-4">
           <div className="min-w-0 flex-1">
             <p className="text-sm font-semibold text-text-main">Context Editing (Claude)</p>
             <p className="text-xs text-text-muted">
-              Deixa o próprio provedor limpar blocos antigos de tool-use no servidor, sem reescrever
-              a mensagem.
+              Lets the provider clear old tool-use blocks server-side, without rewriting the message.
             </p>
           </div>
           <Toggle
@@ -270,9 +269,7 @@ export default function CompressionHub() {
         <div className="flex items-start gap-2 rounded-lg border border-amber-500/40 bg-amber-500/5 px-3 py-2 text-xs text-amber-500">
           <span className="material-symbols-outlined text-[16px]">info</span>
           <span>
-            Hoje disponível apenas para Claude (Anthropic). É um modo delegado: o próprio provedor
-            limpa blocos antigos de tool-use no servidor — não reescrevemos a mensagem. Não afeta
-            outros provedores.
+            Currently available for Claude (Anthropic) only. It is a delegated mode: the provider clears old tool-use blocks server-side — we do not rewrite the message. Does not affect other providers.
           </span>
         </div>
       </div>
diff --git a/src/app/(dashboard)/dashboard/context/omniglyph/OmniglyphContextPageClient.tsx b/src/app/(dashboard)/dashboard/context/omniglyph/OmniglyphContextPageClient.tsx
new file mode 100644
index 0000000000..cd7613ea66
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/context/omniglyph/OmniglyphContextPageClient.tsx
@@ -0,0 +1,264 @@
+"use client";
+
+// OmniglyphContextPageClient — the dedicated detail screen for the "omniglyph"
+// context-as-image compression engine. Four sections: economics (measured savings),
+// a real before→after (dense text vs the rendered PNG page), the fail-closed gate
+// flow, and the enable control (wired to /api/settings/compression, preview engine).
+//
+// Engine-facing copy is hardcoded English (matches the catalog convention — engine
+// text stays deterministic, not i18n). The sample in ./sampleData.ts is a REAL render
+// from the omniglyph package, not a mockup.
+//
+// Card/Toggle are imported from their direct module paths (not the @/shared/components
+// barrel) — the barrel pulls a Node-only module that hangs vitest/jsdom.
+import { useEffect, useState } from "react";
+import Card from "@/shared/components/Card";
+import Toggle from "@/shared/components/Toggle";
+import { SAMPLE_BEFORE_TEXT, SAMPLE_PAGE_PNG_DATA_URI, SAMPLE_METRICS } from "./sampleData";
+
+interface CompressionConfigLite {
+  engines?: Record<string, { enabled: boolean; level?: string }>;
+}
+
+type EngineMap = Record<string, { enabled: boolean; level?: string }>;
+
+/** The measured fail-closed gate chain, in evaluation order. Every no-op is telemetered
+ *  as `skip:<reason>`; the engine only fires when all pass. */
+const GATES: ReadonlyArray<{ label: string; pass: string; why: string }> = [
+  {
+    label: "Model",
+    pass: "claude-fable-5",
+    why: "Only Fable 5 reads dense pages at 100% (measured, n=30). GPT-5.5 and Gemini 2.5-flash are blocked.",
+  },
+  {
+    label: "Transport",
+    pass: "direct Anthropic",
+    why: "Aggregators resample images and destroy legibility — only the direct route is authoritative.",
+  },
+  {
+    label: "Format",
+    pass: "native Claude",
+    why: "The body must be Claude-format (never a system role inside messages).",
+  },
+  {
+    label: "Profitable",
+    pass: "dense enough",
+    why: "The exact 28px-patch cost gate decides per request; small or sparse text passes through untouched.",
+  },
+];
+
+const ECONOMICS: ReadonlyArray<{ value: string; label: string }> = [
+  { value: "~10×", label: "fewer tokens on the converted block" },
+  { value: "59–70%", label: "end-to-end savings (measured)" },
+  { value: "1456", label: "image tokens for a 1568×728 page (~28k chars)" },
+  { value: "100%", label: "reading accuracy on Fable 5 (n=30)" },
+];
+
+// Section components are split out of the page component so each function stays
+// under the complexity gate's 80-line cap; the page composes them.
+
+function PageHeader() {
+  return (
+    <div className="flex flex-col gap-2">
+      <div className="flex items-center gap-3">
+        <h1 className="text-2xl font-semibold">OmniGlyph</h1>
+        <span className="rounded-full border border-amber-500/40 bg-amber-500/10 px-2 py-0.5 text-xs font-medium text-amber-600 dark:text-amber-400">
+          Preview
+        </span>
+      </div>
+      <p className="max-w-2xl text-sm text-text-muted">
+        Context-as-image compression. Renders the system prompt, tool docs and dense history as
+        compact PNG pages that Claude Fable 5 reads instead of the text — image tokens are billed by
+        dimensions, not characters, so the converted block costs ~10× less. Direct Anthropic route
+        only.
+      </p>
+    </div>
+  );
+}
+
+function EconomicsCard() {
+  return (
+    <Card className="p-6">
+      <h2 className="mb-4 text-lg font-semibold">The economics</h2>
+      <div className="grid grid-cols-2 gap-4 sm:grid-cols-4">
+        {ECONOMICS.map((e) => (
+          <div key={e.label} className="flex flex-col gap-1">
+            <span className="text-2xl font-semibold tabular-nums">{e.value}</span>
+            <span className="text-xs text-text-muted">{e.label}</span>
+          </div>
+        ))}
+      </div>
+    </Card>
+  );
+}
+
+function BeforeAfterCard() {
+  return (
+    <Card className="p-6">
+      <div className="mb-1 flex items-baseline justify-between">
+        <h2 className="text-lg font-semibold">Before → after</h2>
+        <span className="text-sm font-medium text-emerald-600 dark:text-emerald-400">
+          −{SAMPLE_METRICS.savingsPct}% tokens on this block
+        </span>
+      </div>
+      <p className="mb-4 text-xs text-text-muted">
+        A real render of {SAMPLE_METRICS.beforeChars} characters of dense tool docs — not a mockup.
+      </p>
+      <div className="grid gap-4 md:grid-cols-2">
+        <div className="flex flex-col gap-2">
+          <span className="text-xs font-medium uppercase tracking-wide text-text-muted">
+            Text · ≈ {SAMPLE_METRICS.textTokens} tokens
+          </span>
+          <pre className="max-h-60 overflow-auto rounded border border-black/10 bg-black/5 p-3 text-[11px] leading-relaxed dark:border-white/10 dark:bg-white/5">
+            {SAMPLE_BEFORE_TEXT}
+          </pre>
+        </div>
+        <div className="flex flex-col gap-2">
+          <span className="text-xs font-medium uppercase tracking-wide text-text-muted">
+            Rendered page · ≈ {SAMPLE_METRICS.imageTokens} tokens
+          </span>
+          <div className="overflow-auto rounded border border-black/10 bg-white p-3 dark:border-white/10">
+            {/* eslint-disable-next-line @next/next/no-img-element -- data URI, no loader needed */}
+            <img
+              src={SAMPLE_PAGE_PNG_DATA_URI}
+              alt={`Rendered dense page, ${SAMPLE_METRICS.pageWidth}×${SAMPLE_METRICS.pageHeight}px`}
+              width={SAMPLE_METRICS.pageWidth}
+              height={SAMPLE_METRICS.pageHeight}
+              className="max-w-full"
+            />
+          </div>
+        </div>
+      </div>
+    </Card>
+  );
+}
+
+function GatesCard() {
+  return (
+    <Card className="p-6">
+      <h2 className="mb-1 text-lg font-semibold">When it fires</h2>
+      <p className="mb-4 text-xs text-text-muted">
+        Fail-closed: every gate must pass, or the request passes through untouched (each skip is
+        telemetered as <code>skip:&lt;reason&gt;</code>).
+      </p>
+      <ol className="flex flex-col gap-3">
+        {GATES.map((g, i) => (
+          <li key={g.label} className="flex gap-3">
+            <span className="mt-0.5 flex h-6 w-6 shrink-0 items-center justify-center rounded-full bg-black/5 text-xs font-semibold tabular-nums dark:bg-white/10">
+              {i + 1}
+            </span>
+            <div className="flex flex-col">
+              <span className="text-sm font-medium">
+                {g.label} — <span className="text-emerald-600 dark:text-emerald-400">{g.pass}</span>
+              </span>
+              <span className="text-xs text-text-muted">{g.why}</span>
+            </div>
+          </li>
+        ))}
+      </ol>
+    </Card>
+  );
+}
+
+function EnableCard(props: {
+  enabled: boolean;
+  disabled: boolean;
+  status: "" | "saved" | "error";
+  onToggle: (next: boolean) => void;
+}) {
+  return (
+    <Card className="p-6">
+      <div className="flex items-start justify-between gap-4">
+        <div className="flex flex-col gap-1">
+          <h2 className="text-lg font-semibold">Enable the engine</h2>
+          <p className="max-w-xl text-sm text-text-muted">
+            Runs last in the stack (after RTK/Caveman clean the text, OmniGlyph images the residual)
+            and also standalone via the <code>omniglyph</code> mode. Preview — off by default until
+            the end-to-end validation lands.
+          </p>
+          <span className="mt-1 h-4 text-xs text-text-muted" aria-live="polite">
+            {props.status === "saved"
+              ? "Saved."
+              : props.status === "error"
+                ? "Could not save."
+                : ""}
+          </span>
+        </div>
+        <span data-testid="omniglyph-enable-toggle">
+          <Toggle
+            size="md"
+            checked={props.enabled}
+            onChange={props.onToggle}
+            disabled={props.disabled}
+            ariaLabel="Enable the OmniGlyph engine"
+          />
+        </span>
+      </div>
+    </Card>
+  );
+}
+
+export default function OmniglyphContextPageClient() {
+  const [engines, setEngines] = useState<EngineMap>({});
+  const [enabled, setEnabled] = useState(false);
+  const [loading, setLoading] = useState(true);
+  const [saving, setSaving] = useState(false);
+  const [status, setStatus] = useState<"" | "saved" | "error">("");
+
+  useEffect(() => {
+    fetch("/api/settings/compression")
+      .then((r) => (r.ok ? r.json() : null))
+      .then((data: CompressionConfigLite | null) => {
+        const e = data?.engines ?? {};
+        setEngines(e);
+        setEnabled(e.omniglyph?.enabled === true);
+      })
+      .catch(() => {})
+      .finally(() => setLoading(false));
+  }, []);
+
+  // Persist the FULL engines map (the store keeps it as one JSON row — a partial patch
+  // of a single engine would drop the others). Mirrors CompressionPanel.setEngine.
+  const toggle = async (next: boolean) => {
+    setEnabled(next);
+    const nextEngines: EngineMap = {
+      ...engines,
+      omniglyph: { ...(engines.omniglyph ?? { enabled: false }), enabled: next },
+    };
+    setEngines(nextEngines);
+    setSaving(true);
+    setStatus("");
+    try {
+      const res = await fetch("/api/settings/compression", {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ engines: nextEngines }),
+      });
+      if (res.ok) {
+        setStatus("saved");
+        setTimeout(() => setStatus(""), 2000);
+      } else {
+        setStatus("error");
+      }
+    } catch {
+      setStatus("error");
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  return (
+    <div className="mx-auto flex max-w-4xl flex-col gap-6 p-6" data-testid="omniglyph-page">
+      <PageHeader />
+      <EconomicsCard />
+      <BeforeAfterCard />
+      <GatesCard />
+      <EnableCard
+        enabled={enabled}
+        disabled={loading || saving}
+        status={status}
+        onToggle={toggle}
+      />
+    </div>
+  );
+}
diff --git a/src/app/(dashboard)/dashboard/context/omniglyph/page.tsx b/src/app/(dashboard)/dashboard/context/omniglyph/page.tsx
new file mode 100644
index 0000000000..9f5dfc6e89
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/context/omniglyph/page.tsx
@@ -0,0 +1,5 @@
+import OmniglyphContextPageClient from "./OmniglyphContextPageClient";
+
+export default function OmniglyphContextPage() {
+  return <OmniglyphContextPageClient />;
+}
diff --git a/src/app/(dashboard)/dashboard/context/omniglyph/sampleData.ts b/src/app/(dashboard)/dashboard/context/omniglyph/sampleData.ts
new file mode 100644
index 0000000000..60d8d58c82
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/context/omniglyph/sampleData.ts
@@ -0,0 +1,31 @@
+// Amostra REAL para o painel "antes → depois": um bloco denso de tool-defs/config
+// (1015 chars) renderizado pelo pacote omniglyph em uma página PNG 438×120.
+// Números medidos: 254 tokens de texto → 84 tokens de imagem (billing 28px + 4/bloco)
+// = 66,9% de economia, dentro da faixa medida de 59–70% ponta a ponta.
+// Gerado offline via renderTextToImages — não é mockup, é a saída real da engine.
+
+export const SAMPLE_BEFORE_TEXT = `## Tool: search_records(query, filters?, limit=50)
+Searches the ledger. filters: {status:"ok"|"pending"|"failed", since:ISO8601, region}.
+Returns [{id, status, attempt, region, ts, checksum}]. Rate: 20 rps. Auth: bearer.
+## Tool: apply_patch(recordId, patch, dryRun=false)
+Mutates one record. patch is RFC-6902 JSON Patch. dryRun returns the diff only.
+Idempotency-Key header required. 409 on version conflict; retry with fresh read.
+## Config
+retry: {base_ms:300, factor:2, max:5}. circuit_breaker:{threshold:5, reset_s:30}.
+regions: [us-east, us-west, eu-central, sa-east]. default_region: sa-east.
+REGISTRO-A: {"id":"a3f8c2d19b4e","status":"ok","attempt":1,"region":"sa-east"}
+REGISTRO-B: {"id":"7b1e4409ccde","status":"pending","attempt":3,"region":"eu-central"}
+REGISTRO-C: {"id":"2d909e99f1b3","status":"failed","attempt":5,"region":"us-west"}
+Notes: never expose checksum in logs; redact bearer; prefer read-modify-write with
+Idempotency-Key; on 429 honor Retry-After; treat 408/500/502/503/504 as retryable.`;
+
+export const SAMPLE_PAGE_PNG_DATA_URI = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAbYAAAB4CAAAAAC794jcAAARnElEQVR4nO1di5LjOA7j//+0rm4nlgAQlCXb2Unuoqp1py2KL5CiaGd6o/3GF4742wr8xpXxg+0rxw+2rxwrsC1Cu0YW5tN8wUEX1aLgm5Zk8d63jHhd43X557f/jkSzyGqZaotrTGALuRutpfAYUv8xLcoQ+JLxR/8+4G6Miyz5Y3h0ktevgDWSJLrX5aD783lwsSAMpQyrasVgFSllvxw3l22HXd2lQJkMHwvBS2ZC7h05EPYC+kn0pGUtuf8VEJRZcSTaK2S+Pd3WYRtLwCMDGIHt8FIDN3e+kf3PxEZBhK0T+92gmxAoCeZJ7a8c5SZZw5ayqICNJ3R34k0SvBgMhYOtAUGulQO2Qd7RHjH6/bC5bIPaxjEt5WX4WmCT2gZ0uENFYiXpgVl1XEZqgmZQBF90kQyhTfeLUXtcdTmEnorOmez2vVVub17xOWOuu511bo3ic16sJ5t14pK5HE0CtkZP7hmMFRx5Yptn+vbhdKpS5HHYTKU6I64+Id02bGEY9BVR01awVYakJkiqT7HMMk0+plpEhUvaJNYktUParUUKCPZ/0YU1ZToK0tHyBQsf9TMUhCFDdEbhBjZoQsU2dqflR4uj/7RHao/xOEnY5nRU/LIVU1WDJty9Z7qwfNwIXkHEL5BSgFiFur2o35DbhZpWRYb4DzABCyHUBvYp6c+URJAhYqtWDJ8Hsa/1sUqQg/BwKFayUdyFAcYMXn+44kIVmmgHG6tGeZlgA2kjC90DHNSSYONso1TozhlOULGVkgVsiHjTX9kRVQZSVDXVq4BNeatuYkT/QcR1tqEuySPoixyX/J/HOHk46WVhq2zH+FXYlO1JKyYPHBs/SOz39CkhZJsGX+BFujBx38g5rnCJOLxfnTHY1Z1kWxjbUlSoSyBTqTLnS1hN+2IyC7XNWf/AWO/dzvjcWCs/Kwkm2za4PzAMK+e/uik51wefMRTkq26we+j5sjm/8/tWIub6YwoZLgu6bHBzyT+jbnr1urwHtkV4qvueLBtz4hIN32qkg9yKygsDa994r8EVLb+t6kpx5p63WN0W6f6O814O+pNmhlWZKBQgCESiP6Xm44FdOOsp1PmK6WxfiqoVpp7CJic1uiA1nBH8oQnMTgzIKUgCLs2UqJ87ugOriW2vX/lgidt+ho3tIIqAhsP6qnIslV1UJ50zJ2NsksF9EaUh+abDkzwXzNAwaDT74hdz2KbNjBIWsMFp9biewAbxf2ggpspB2ZkqZuU4z+2y63bzoIik+G8gx2yScjAFRZpRNAWZ3B4bCeihEtE7STh4UNdyJ3rwX9gkrY2C0/g1Vri4WaPk2aBAOQIPH5Xwd0TYidJ3rLdYPcKp5BxOSK4/a2aOZU4Q2MZFtHEK+9jiSo2mYmaBw1kD4aKbZCq7DT/N0DsHlqjNCWqVw2IIlcS2TDumeybBxrm98J7Ydwub05Szun8t8ynoEr9VDVvTzNhZ+ZFDd/r22gIi0cw5zCbOc/41rZvcnF+hw0lW6uR34nbsD1vfk+S2i6uzVoOgo4a0JtKutEhur/kJDbdivigbNb4UN5dtelxLJ6TQWTpUwSmHTjytsV+burmRvDN+TFJfEGjH5X8ctrEkTmHDvk1gw9YkdRoVbI4fkwA/15FDjrWRvV8O29b3JME3sus0cM0MtkYTHrauScmvkbLRqV225ZjIrxG/apTZVn5Pkrq6NmiIX27KwGdc2/I9wWTCTxQaliBdZzP6p1FTvxO1q1rL9jKejs34bciK9GGF24XW6ztRS2pHOfMAc7397/lsIvJKMJWzE/bmScWufFmku8l1dksaWR8SrTz2OW7my6DGTRfr7ESkUWKerldh47K+xXSmCXyxybRJ4jksDC1XJbesARKnDVjTswpp2qRlGOTjtNSQywM9Hz1bhdLJjojSOaR+9iTnzSXY2GI5qFin0b3Kr+pak+VEbmGDg70c3WMwyLCVIo26cwPJJcXLSLPWfYXIMd2HjZlAm5SedNOxOuEuDs+w1Q0Y7XuQvMi+h3lDrQ4m3ZEU/7d7vqGBRPLARGHjXYOlvw82+gR+sUEW6VLAVjdg5PrsTbS0GQ1q2Fo2poTN7ZRioIWNneS2pwXYts/AFDd9s+E2Cbd5Jh4GVa2YIG8bsIN13kO4OgReIKSDGbPDb/d8BRfMTzCBncNqURBCOPWpdej2QL4x/jVBF8eFnu8vCo/yl9Pbi0yvsbi1bF9OLi6l6LlOmjQZj9n6ZXtpJ7oCm6uml2FTMlPAwvpih2lBQcX1EmyRYTPED8LWenmYdnDwiU8Peg+bN6l8tOtH5CrniBtWHiZOx+pCGrEbVXjUX6w7s/6u9AErD+4VU01HiPV5EzY53bvTpTsmFmfm8etZN4SCIk0k2LK/ZkybMgVnor3Dw5x2ekZK3qBwaTDrnKOuM266CFtEARveI2L+1Hi2JRKUW/yzs6b82rgXPZ9K2IagCLKtgg2zTWDL6h56Cjq4QeJuIGujJTXcjrMNG1rfwCqytBnP+Xs50sgPfZnCxm5pwJYY2T0TBQXbtg0b8oFbau8CbP1GViPbsQibKTQUrxQPfH45uZc4Z7nAgL4tKI3fywf9gjghbNBYofZCR/cCF2OzxbCpkmJvg9kE2yhrAlsqxUvQlUTz1a56Xu98rq57+5gq9jc7vTVsP9av/6/j2K9hY0xx5Gr0b/zV0U8z8BWgsdWn6vLLu88YLtv0DGie0v7G3x0LsNHR+AfbR4xyk3Sw/c4mnzLqI4lta37Z9hljC4bfieRThuJQ47L0b4rP5ZnW4gFGp9QziZ4TPX+sV0S6s6xLJfUCj+lTk/VHZuY5lGNvXXIqJeqnQNW9fdh6SdiCbeWP15ZGb5QheS7m3iYNQnxYRy+W6MEkNQ+GCzw5FH6DFS7wT87VPvMmjx7RExm/6NJHqGxvXsGKN9E+azV/38YO24FNTo2OSQS41L10c+0Dfo2K9OxPjK00WdEZjg8DfbKD3q0h5JRtElGRX8CiMF1ROowj10jjE56E3+GwxW1y5GX5Nklhw1fDtDegwAGayzYHG0kS2Ax7CxtgQd7MsCHnI53oDUWCDa30sJEmZC45TIWQw/ZhQ0c2Fzg5SskZ4jyb+IKTgU12m2K/TbvJBdjgV9GffCIrmihkYQtlgg6rou3KJtlxkrdJ7PBUlUgsRChfZF+gkjGObH2bEcO5UsEmyZxZe5HB31QWEpLBhuvbR/mHAK2bYFQjx6LDSBd1WIqfGjY7oclaJO/Vs9PdFfst5Mb/ouCagLH0ui4XG4CVJQ/jdId4f20Ox/4h77rXkZto8D5GU/YLsj8YtpKFu12zvwbAw7Dp9xka79nF4ST3SrSR4wIkljZJw1+aRqajJsr4mk+cXqswK/qZZBQuNnzuoU0N7o8jqObfVyRrA1aMWy9GxjOWOM6IUWpxcAuzFn8WWgWvoLeKLIhsnngop+xcg/sDDi9yXGMdZQkoH4HfiXRJ4IijJO5q4B+B1D/L2DBFcPGI61KrDBtmWwnbzEObGtwfeubsh1BSqtgkTU5gEkDoEXFwk5GIMY9C7kX+ldTzmZpZovjBRNJaYZt4aEuD+4P06b/w04Cq93JbPz54olkoCa/kmxDnqjnCnL9My02elGKrVSukhQjnFmvqoU0NHgAv7TLnPFcL65Z2d0zZE7R7LNA/9/fYseLOeAL54sjx+kVL14kSOu9YRUVtiKOaMNs/T+SphTeOteUzQduhMLYGPeMeJZX+CnTLngcje5GwXhplSVkdM5FqykfABh8MuXrjCmzb6TOKJVoR8inSHSu7dfBZeemGRm3rn6SSHs/CHavZ/2tgIjdPcB8Iwl8BRvHGGkx63KzuSRt3F7aX3Rj6E9iyUemrlMFiqNizcSqIjnNJ3awJRzakU1RBj3lN7UYkvVOUTjs41cAo7Nq4zW1ybJKAEnClkIZexMorfA0nMHGznMWkZXPVH7dayV5nW1E2yGDsJq0BZnNZ6OBA3YU27hJs3ZEWNpttzqg6RdJDjhHGIpKcUQtRfm6fSdlGaUjZNuLSMApZ25Ut9iNZTK4jyZrW6wMl62mELJS2K28ItMXzjMQXh2DjEKTeKO86o/3hCoeZCXLZO6xQYwZjD2gsl7EMYNAGAy9orZEUL66MTXLL4gEeZyL+JS41hZl5sIO71gDcl3net11V7G4DYJnOV/gtd0zMuJRjvzMwcoNV3OnbNMjAll4SWcf0vS5TIlK8vQ021f46bNIZWOpl1SZLs4uxHDe6S5/u9W1Y7XtZQ7bSwfGFzd3p26Ap4xqDYars1xs6cMS1hg4ZUNGjNDqDbbVvG9W4dbKhozsBAIPBb7DVP52RRGoYst9kj6aMDr34PosXdz0Ov7ylofNHTHtARrnggb2+jdVd6dtEGe5jAqNP4shUkUhKy0lXHYnHRA4co+leQ5eDZbWhu/xWkWDDWM+wpcjIm6Sik62TGKIwwX1WFKqE+LCcYJC8SftENiBYF9PQka9Ih/OGTvJILBfhYr3SLvZtvElqKNi+rS+jGoG7cXUoUr/u9G0jXsHABhuG0XSvofPSYHreObqGrq8NVSjBdm98bN82X+Xi6wIrVxLe5hFuAO7zOu/b1ryTg+lWA8D+k133g1s26tFqqp2+TYMJDIrjhjlWt7HVJn79MtaPiRuwSU14Djb63wG5fJtpNR/JnTOqvb5tYlDZt1Gd8PeOGOJ+TCNg533bwQ81rTvCrZatqVarLRvW2cbar7+DA9hW+zbWfKtvi57/ofdaPgXZLYlVCE0cVk2yvCVjlHmP3UMh37LlDWe/ZXNrxWk1bhCB7AlQP/VtxEAMss6mnAhMGw5V5eJZidJy0rXGdatc63lwJtje17INZLmB3XkHlzfJDJvNNqf/zMLhE/qUCazNSQjnZIUxWxRJlCYBZduIVcc8eG1Xvtijkv7dnZgKKa2rgVLW+ja1Q8LDN1uDc+ML3zvY6ykIWbGgWd9G2YbEvrncaNn0AR/p1hn4+BB1cReKJGgK273xsX3bM5xPdiq59ZwzzhuAuSoPDq2LF9etUq7E7Qm7hZWOBFJrc2WfmErWvf5TYIvJb8sSbsO2tK6Cbe77cvZ86dj+j+qVnhx2Om5m3DM1LOCGC9asUFaugGsBqlTLzwlyAUmV1FQ5petnh2yHsmpQpEjzoKQA14m0xnTGyAo2OZoFzMO93DKzytKGyAE0zQZNSK/Ke4CsLVVrLfdAeZZXVFaaBsyxOnydmze2Q2YLUNNECVuj/iT/lRH0K33qXqazE+mdYetr4VgosDUyV2BzjxqxxYoCNszypiaQX7tFmQ5n89c6NRaCjQZWfRaTLy3bgg3nkkGHm1uyhQMUol5IUG7rP1Oj5mDD14QhnHNCpmwzGhBhiG0hdIW0loQHLSZgFLbBeR+24ZHct6EbuXYAG+5ypEwySUuhSrMHtf46EKu7Jq1ZpopALp58MSnA6wKbK464x43uj/jTFh/kp4HTMXEO24PjaX7KfqkZ3eb6Bp7A/Q2Nba4SJzRvE36NMGZB6SYmMlfJN9muyopqolwu286OStNcNoJg6zpZeJJZvRBchC0rxI90r99b8ccjsDXd+tNLLWm78rE1b8bS7vRTBp2ZRQYV8MG5lpsLFyrAEycKwWnk7j2qya7nU4vAB62pHVPY4CSkHQjpCIeYoQlbMFiim2P8DCVJxzBmEI4fPZ13GuRlfFZ9seiHsW7Mnz429B5whHt2LTqYjjOlRWliCzbXgbwCI8GW27hgzqkbdfmUL62voP5J5PJh3XVhsEwefPR78qChIWjpHr0QO+7ZtZpe6Gz7dzsh7zrJDmzom4ac0M3O9Y2yPMNGMbQGG6Zos3IBNmarsMmKZLTsCuW9tkInPhDFnEU5DU8GOENq22viuErbpYAHO7CvEthS9AXScT1HzvwqUUHgfowSNhko77O4w6ISm+7RF4hnaymlqZwSIbqB37dxApSw7UyAaHfvPFLujJUe6JoGbtWde8tyL3V17/Xyb7xp/GD7yvGD7SvHD7avHP8Bh0wwGCFjP7EAAAAASUVORK5CYII=";
+
+export const SAMPLE_METRICS = {
+  beforeChars: 1015,
+  pageWidth: 438,
+  pageHeight: 120,
+  textTokens: 254,
+  imageTokens: 84,
+  savingsPct: 66.9,
+} as const;
diff --git a/src/app/(dashboard)/dashboard/logs/page.tsx b/src/app/(dashboard)/dashboard/logs/page.tsx
index 4b88afde7e..d7051f8612 100644
--- a/src/app/(dashboard)/dashboard/logs/page.tsx
+++ b/src/app/(dashboard)/dashboard/logs/page.tsx
@@ -46,9 +46,13 @@ export default function LogsPage() {
     return () => document.removeEventListener("mousedown", handleClickOutside);
   }, []);
 
-  // initial id from URL (synchronously on client) so child can open on mount
-  const initialId =
-    typeof window !== "undefined" ? new URL(window.location.href).searchParams.get("id") : null;
+  // initial id from URL (synchronously on client) so child can open on mount.
+  // Read once via lazy state: window.location lags router.replace() by one
+  // render, so re-reading it on every render flips this prop mid-session and
+  // re-triggers the child's deep-link effect right when the modal closes.
+  const [initialId] = useState(() =>
+    typeof window !== "undefined" ? new URL(window.location.href).searchParams.get("id") : null
+  );
 
   async function handleExport(hours: number) {
     setExporting(true);
diff --git a/src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx b/src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx
index 85777f71c1..d77beeb16c 100644
--- a/src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx
+++ b/src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx
@@ -7,7 +7,7 @@
 // (fallback to the canonical vocabulary), resolved by `resolveReasoningControls`.
 
 import type { PlaygroundParams } from "./ParamSliders";
-import type { ReasoningControlSpec } from "./reasoningControls";
+import type { ReasoningControlSpec } from "./reasoningControlUtils";
 
 interface ReasoningControlsProps {
   spec: ReasoningControlSpec;
diff --git a/src/app/(dashboard)/dashboard/playground/components/StudioConfigPane.tsx b/src/app/(dashboard)/dashboard/playground/components/StudioConfigPane.tsx
index 0efa69f6e0..73e43b8165 100644
--- a/src/app/(dashboard)/dashboard/playground/components/StudioConfigPane.tsx
+++ b/src/app/(dashboard)/dashboard/playground/components/StudioConfigPane.tsx
@@ -2,7 +2,8 @@
 
 // src/app/(dashboard)/dashboard/playground/components/StudioConfigPane.tsx
 
-import { useEffect, useState } from "react";
+import { useEffect, useMemo, useState } from "react";
+import { useTranslations } from "next-intl";
 import ParamSliders, { type PlaygroundParams } from "./ParamSliders";
 import type { PlaygroundEndpoint } from "@/lib/playground/codeExport";
 import { endpointToPath } from "@/lib/playground/codeExport";
@@ -15,12 +16,12 @@ import {
   CLAUDE_CODE_COMPATIBLE_PREFIX,
   OPENAI_COMPATIBLE_PREFIX,
 } from "@/shared/constants/providers";
-import { pickDefaultModel, resolveModelFilterKey } from "./modelSelection";
+import { filterModelsByQuery, pickDefaultModel, resolveModelFilterKey } from "./modelSelection";
 import ReasoningControls from "./ReasoningControls";
 import {
   resolveReasoningControls,
   type ReasoningControlSpec,
-} from "./reasoningControls";
+} from "./reasoningControlUtils";
 
 export interface ConfigState {
   endpoint: PlaygroundEndpoint;
@@ -63,7 +64,11 @@ const ENDPOINT_OPTIONS: Array<{ value: PlaygroundEndpoint; label: string }> = [
  *   - SLOT_IMPROVE: ImprovePromptButton will be injected here
  */
 export default function StudioConfigPane({ configState, setConfigState }: StudioConfigPaneProps) {
+  const t = useTranslations("common");
   const [collapsed, setCollapsed] = useState(false);
+  // #4086: search/filter query for the Model dropdown — flat provider catalogs (e.g.
+  // 50+ OpenRouter models) made the plain <select> unusable without scrolling.
+  const [modelQuery, setModelQuery] = useState("");
   const {
     provider,
     setProvider,
@@ -91,6 +96,17 @@ export default function StudioConfigPane({ configState, setConfigState }: Studio
   const { availableModels, modelCapabilities, loading: loadingModels } =
     useAvailableModels(modelFilterKey);
 
+  // #4086: filter the dropdown by the search query, but always keep the currently selected
+  // model in the list even when it doesn't match — otherwise typing a query would silently
+  // change the active selection out from under the user.
+  const filteredModels = useMemo(() => {
+    const filtered = filterModelsByQuery(availableModels, modelQuery);
+    if (configState.model && !filtered.includes(configState.model)) {
+      return [configState.model, ...filtered];
+    }
+    return filtered;
+  }, [availableModels, modelQuery, configState.model]);
+
   // #6241: resolve the reasoning controls for the currently selected model from the capability
   // flags the /models catalog exposes (supportsThinking / effort_tiers).
   const reasoningSpec = resolveReasoningControls(modelCapabilities[configState.model]);
@@ -207,18 +223,30 @@ export default function StudioConfigPane({ configState, setConfigState }: Studio
             Model
           </label>
           {availableModels.length > 0 ? (
-            <select
-              value={configState.model}
-              onChange={(e) => update("model", e.target.value)}
-              disabled={loadingModels}
-              className="w-full text-xs bg-surface border border-border rounded px-2 py-1.5 focus:outline-none focus:ring-1 focus:ring-primary text-text-main"
-            >
-              {availableModels.map((m) => (
-                <option key={m} value={m}>
-                  {m}
-                </option>
-              ))}
-            </select>
+            <>
+              {availableModels.length > 1 && (
+                <input
+                  type="text"
+                  value={modelQuery}
+                  onChange={(e) => setModelQuery(e.target.value)}
+                  placeholder={t("search")}
+                  aria-label={t("search")}
+                  className="w-full text-xs bg-surface border border-border rounded px-2 py-1.5 focus:outline-none focus:ring-1 focus:ring-primary text-text-main"
+                />
+              )}
+              <select
+                value={configState.model}
+                onChange={(e) => update("model", e.target.value)}
+                disabled={loadingModels}
+                className="w-full text-xs bg-surface border border-border rounded px-2 py-1.5 focus:outline-none focus:ring-1 focus:ring-primary text-text-main"
+              >
+                {filteredModels.map((m) => (
+                  <option key={m} value={m}>
+                    {m}
+                  </option>
+                ))}
+              </select>
+            </>
           ) : (
             <input
               type="text"
diff --git a/src/app/(dashboard)/dashboard/playground/components/modelSelection.ts b/src/app/(dashboard)/dashboard/playground/components/modelSelection.ts
index c4d74f1c7c..8a200d04d7 100644
--- a/src/app/(dashboard)/dashboard/playground/components/modelSelection.ts
+++ b/src/app/(dashboard)/dashboard/playground/components/modelSelection.ts
@@ -12,6 +12,8 @@
 //
 // These pure helpers encode the fix and are unit-tested directly.
 
+import { matchesSearch } from "@/shared/utils/turkishText";
+
 /**
  * Resolve the catalog-namespace key used to filter the model list for a provider.
  * - Built-in providers ("openai", "anthropic", …) filter by their id.
@@ -44,3 +46,15 @@ export function pickDefaultModel(
   if (currentModel && availableModels.includes(currentModel)) return null;
   return availableModels[0];
 }
+
+/**
+ * Filter the model dropdown list by a free-text search query (#4086 — the raw Playground
+ * model `<select>` had no way to narrow a long list, e.g. 50+ OpenRouter models).
+ * Accent/case-insensitive, Turkish-safe substring match against the model id (see
+ * `matchesSearch` — raw `toLowerCase().includes()` mangles İ/ı). An empty/whitespace query
+ * returns the full list unchanged.
+ */
+export function filterModelsByQuery(models: string[], query: string): string[] {
+  if (!query.trim()) return models;
+  return models.filter((m) => matchesSearch(m, query));
+}
diff --git a/src/app/(dashboard)/dashboard/playground/components/reasoningControls.ts b/src/app/(dashboard)/dashboard/playground/components/reasoningControlUtils.ts
similarity index 100%
rename from src/app/(dashboard)/dashboard/playground/components/reasoningControls.ts
rename to src/app/(dashboard)/dashboard/playground/components/reasoningControlUtils.ts
diff --git a/src/app/(dashboard)/dashboard/playground/components/tabs/ChatTab.tsx b/src/app/(dashboard)/dashboard/playground/components/tabs/ChatTab.tsx
index 8a0c3512f5..7e31060ee4 100644
--- a/src/app/(dashboard)/dashboard/playground/components/tabs/ChatTab.tsx
+++ b/src/app/(dashboard)/dashboard/playground/components/tabs/ChatTab.tsx
@@ -9,7 +9,7 @@ import { useStreamMetrics } from "../../hooks/useStreamMetrics";
 import { getModelPricing } from "@/lib/playground/types";
 import type { ConfigState } from "../StudioConfigPane";
 import type { StreamMetrics } from "@/shared/schemas/playground";
-import { buildReasoningRequestFields } from "../reasoningControls";
+import { buildReasoningRequestFields } from "../reasoningControlUtils";
 
 interface Message {
   role: "system" | "user" | "assistant";
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/ProviderDetailPageClient.tsx b/src/app/(dashboard)/dashboard/providers/[id]/ProviderDetailPageClient.tsx
index e460af15d7..0862282ba2 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/ProviderDetailPageClient.tsx
+++ b/src/app/(dashboard)/dashboard/providers/[id]/ProviderDetailPageClient.tsx
@@ -39,12 +39,13 @@ import { useModelVisibilityHandlers } from "./hooks/useModelVisibilityHandlers";
 import { useModelCompatState } from "./hooks/useModelCompatState";
 import { useConnectionGate } from "./hooks/useConnectionGate";
 import { useProviderNodeActions } from "./hooks/useProviderNodeActions";
-import ProviderPlaygroundPanel from "./components/ProviderPlaygroundPanel";
+import ProviderExtraPanels from "./components/ProviderExtraPanels";
 import ProviderModelsSection from "./components/ProviderModelsSection";
 import CustomModelsSection from "./components/CustomModelsSection";
 import ConnectionsListPanel from "./components/ConnectionsListPanel";
 import CoolingConnectionsPanel from "./components/CoolingConnectionsPanel";
 import ConnectionsHeaderToolbar from "./components/ConnectionsHeaderToolbar";
+import ProviderAccountRoutingCard from "../../settings/components/ProviderAccountRoutingCard";
 import ZedImportCard from "./components/ZedImportCard";
 import ProviderPageHeader from "./components/ProviderPageHeader";
 import CompatibleNodeCard from "./components/CompatibleNodeCard";
@@ -82,10 +83,7 @@ export default function ProviderDetailPageClient() {
     isAnthropicCompatibleProvider(providerId) && !isClaudeCodeCompatibleProvider(providerId);
   const isCompatible = isOpenAICompatible || isAnthropicCompatible || isCcCompatible;
   const isAnthropicProtocolCompatible = isAnthropicCompatible || isCcCompatible;
-  // #5420: hide model listing for tool-only providers (web search / web fetch),
-  // not just `-search`-suffixed ids. Declared serviceKinds come from the static
-  // provider catalog (e.g. firecrawl → ["webFetch"]); compatible providers resolve
-  // to null here and fall through to the empty-kinds check (model listing stays on).
+  // #5420: hide model listing for tool-only providers, not just `-search` ids.
   const declaredServiceKinds = (
     resolveDashboardProviderInfo(providerId) as { serviceKinds?: readonly string[] } | null
   )?.serviceKinds;
@@ -223,8 +221,6 @@ export default function ProviderDetailPageClient() {
   // Prefer synced API-discovered models when available, then merge built-ins
   // and user-managed custom models without duplicating IDs.
   const models = useMemo(() => {
-    // Universal: merge built-in registry models with API-synced models and
-    // user-managed custom models for ALL providers (was previously Gemini-only).
     // Synced models keep their full property spread so provider-specific fields
     // (e.g. Gemini's `supportedGenerationMethods`) survive into the table.
     const builtInModels = registryModels.map((model) => ({
@@ -488,6 +484,7 @@ export default function ProviderDetailPageClient() {
       )}
       {!isUpstreamProxyProvider && !isFreeNoAuth && (
         <Card>
+          <ProviderAccountRoutingCard providerKey={providerId} connectionCount={connections.length} />
           <ConnectionsHeaderToolbar
             providerId={providerId}
             providerInfo={providerInfo}
@@ -696,8 +693,8 @@ export default function ProviderDetailPageClient() {
       {/* Search provider info */}
       {isSearchProvider && <SearchProviderCard providerId={providerId} t={t} />}
 
-      {/* Playground panel — rendered for providers that declare serviceKinds */}
-      <ProviderPlaygroundPanel providerId={providerId} />
+      {/* Playground + param filters — extracted to components/ProviderExtraPanels.tsx (#6649) */}
+      <ProviderExtraPanels providerId={providerId} />
 
       {/* Modals — Phase 1t.5: extracted to components/ProviderModalsPanel.tsx */}
       <ProviderModalsPanel
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/__tests__/phase1e.test.tsx b/src/app/(dashboard)/dashboard/providers/[id]/__tests__/phase1e.test.tsx
index a65bad6019..bee9371593 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/__tests__/phase1e.test.tsx
+++ b/src/app/(dashboard)/dashboard/providers/[id]/__tests__/phase1e.test.tsx
@@ -227,6 +227,68 @@ describe("PassthroughModelRow — render smoke test", () => {
   });
 });
 
+describe("PassthroughModelsSection — catalog model fallback", () => {
+  let container: HTMLElement;
+  let root: ReturnType<typeof createRoot>;
+
+  beforeEach(() => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    root = createRoot(container);
+  });
+
+  afterEach(() => {
+    act(() => {
+      root.unmount();
+    });
+    container.remove();
+  });
+
+  it("renders built-in catalog models even when no models were imported", async () => {
+    const { default: PassthroughModelsSection } =
+      await import("../components/PassthroughModelsSection");
+
+    await act(async () => {
+      root.render(
+        <PassthroughModelsSection
+          providerAlias="synthetic"
+          providerId="synthetic"
+          connectionId=""
+          modelAliases={{}}
+          catalogModels={[
+            {
+              id: "hf:zai-org/GLM-5.2",
+              name: "zai-org/GLM-5.2",
+              aliases: ["syn:large:text"],
+            },
+          ]}
+          availableModels={[]}
+          customModels={[]}
+          description="Synthetic accepts provider-native model IDs."
+          inputLabel="Model ID"
+          inputPlaceholder="hf:zai-org/GLM-5.2"
+          copied={undefined}
+          onCopy={vi.fn()}
+          onSetAlias={vi.fn().mockResolvedValue(undefined)}
+          onDeleteAlias={vi.fn()}
+          t={(k) => k}
+          effectiveModelNormalize={() => false}
+          effectiveModelPreserveDeveloper={() => true}
+          getUpstreamHeadersRecord={() => ({})}
+          saveModelCompatFlags={vi.fn().mockResolvedValue(undefined)}
+          isModelHidden={() => false}
+          onToggleHidden={vi.fn().mockResolvedValue(undefined)}
+          onBulkToggleHidden={vi.fn().mockResolvedValue(undefined)}
+        />
+      );
+    });
+
+    expect(container.textContent).toContain("synthetic/syn:large:text");
+    expect(container.textContent).toContain("syn:large:text");
+    expect(container.textContent).toContain("Built-in");
+  });
+});
+
 describe("ModelVisibilityToolbar — render smoke test", () => {
   let container: HTMLElement;
   let root: ReturnType<typeof createRoot>;
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/components/ConnectionsHeaderToolbar.tsx b/src/app/(dashboard)/dashboard/providers/[id]/components/ConnectionsHeaderToolbar.tsx
index 7a336bb49a..2fe7c8d0e3 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/components/ConnectionsHeaderToolbar.tsx
+++ b/src/app/(dashboard)/dashboard/providers/[id]/components/ConnectionsHeaderToolbar.tsx
@@ -247,17 +247,22 @@ export default function ConnectionsHeaderToolbar({
         )}
         {!isCompatible ? (
           <>
-            {isCommandCode ? (
+            {isCommandCode || providerId === "clinepass" ? (
               <>
                 <Button
                   size="sm"
                   icon="open_in_new"
                   loading={
-                    commandCodeAuthState.phase === "starting" ||
-                    commandCodeAuthState.phase === "polling" ||
-                    commandCodeAuthState.phase === "applying"
+                    isCommandCode &&
+                    (commandCodeAuthState.phase === "starting" ||
+                      commandCodeAuthState.phase === "polling" ||
+                      commandCodeAuthState.phase === "applying")
+                  }
+                  onClick={() =>
+                    gateConnectionFlow(
+                      isCommandCode ? handleOpenCommandCodeConnect : openPrimaryAddFlow
+                    )
                   }
-                  onClick={() => gateConnectionFlow(handleOpenCommandCodeConnect)}
                 >
                   Connect
                 </Button>
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/components/CustomModelsSection.tsx b/src/app/(dashboard)/dashboard/providers/[id]/components/CustomModelsSection.tsx
index 2e03d808bf..76b861739d 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/components/CustomModelsSection.tsx
+++ b/src/app/(dashboard)/dashboard/providers/[id]/components/CustomModelsSection.tsx
@@ -49,6 +49,19 @@ function targetFormatLabel(value: string, t: (key: string) => string): string {
   return key ? t(key) : value;
 }
 
+/**
+ * #4125: parse the free-text "Context Window Override" field. Blank → no override
+ * (`value: null`, not an error). A non-empty value must be a positive whole number of
+ * tokens; anything else is rejected. Pulled out of saveEdit so its own branching stays
+ * off that handler's cyclomatic complexity.
+ */
+function parseContextWindowOverrideInput(raw: string): { value: number | null; invalid: boolean } {
+  const trimmed = raw.trim();
+  if (!trimmed) return { value: null, invalid: false };
+  if (!/^\d+$/.test(trimmed) || Number(trimmed) <= 0) return { value: null, invalid: true };
+  return { value: Number(trimmed), invalid: false };
+}
+
 // ---------------------------------------------------------------------------
 // Component
 // ---------------------------------------------------------------------------
@@ -82,6 +95,9 @@ export default function CustomModelsSection({
   const [newTargetFormat, setNewTargetFormat] = useState("");
   const [savingModelId, setSavingModelId] = useState<string | null>(null);
   const [togglingModelId, setTogglingModelId] = useState<string | null>(null);
+  // #4125: manual context-window override (Feature 5004 table) — free text so the
+  // field can be left blank (no override) without fighting a number input's "0".
+  const [editingContextWindowOverride, setEditingContextWindowOverride] = useState("");
 
   const customMap = useMemo(() => buildCompatMap(customModels), [customModels]);
   const overrideMap = useMemo(() => buildCompatMap(modelCompatOverrides), [modelCompatOverrides]);
@@ -183,6 +199,9 @@ export default function CustomModelsSection({
         : ["chat"]
     );
     setEditingTargetFormat(model.targetFormat || "");
+    setEditingContextWindowOverride(
+      typeof model.contextWindowOverride === "number" ? String(model.contextWindowOverride) : ""
+    );
   };
 
   const cancelEdit = () => {
@@ -190,6 +209,7 @@ export default function CustomModelsSection({
     setEditingApiFormat("chat-completions");
     setEditingEndpoints(["chat"]);
     setEditingTargetFormat("");
+    setEditingContextWindowOverride("");
     setSavingModelId(null);
   };
 
@@ -225,13 +245,10 @@ export default function CustomModelsSection({
     }
   };
 
-  const saveEdit = async (modelId: string) => {
-    if (!editingModelId || editingModelId !== modelId) return;
-    if (!editingEndpoints.length) {
-      notify.error("Select at least one supported endpoint");
-      return;
-    }
-
+  // Split out of saveEdit (which only validates + delegates) so the #4125 context-window
+  // validation stays a single early-return in the caller instead of adding a branch to
+  // this already-large PUT/fetch/error-handling body.
+  const performSaveEdit = async (modelId: string, contextWindowOverride: number | null) => {
     setSavingModelId(modelId);
     try {
       const model = customModels.find((m) => m.id === modelId);
@@ -249,6 +266,8 @@ export default function CustomModelsSection({
           // as optional. Sending an empty string would fail Zod's enum check,
           // so we omit it entirely when the user picks "Default (auto)".
           ...(editingTargetFormat ? { targetFormat: editingTargetFormat } : {}),
+          // #4125: manual context-window override — number to set, null to clear.
+          contextWindowOverride,
         }),
       });
 
@@ -271,6 +290,22 @@ export default function CustomModelsSection({
     }
   };
 
+  const saveEdit = async (modelId: string) => {
+    if (!editingModelId || editingModelId !== modelId) return;
+    if (!editingEndpoints.length) {
+      notify.error("Select at least one supported endpoint");
+      return;
+    }
+
+    const contextOverride = parseContextWindowOverrideInput(editingContextWindowOverride);
+    if (contextOverride.invalid) {
+      notify.error(t("contextWindowOverrideInvalid"));
+      return;
+    }
+
+    await performSaveEdit(modelId, contextOverride.value);
+  };
+
   return (
     <div className="mt-6 pt-6 border-t border-border">
       <h3 className="text-sm font-semibold mb-3 flex items-center gap-2">
@@ -439,6 +474,14 @@ export default function CustomModelsSection({
                         {`→ ${targetFormatLabel(model.targetFormat, t)}`}
                       </span>
                     )}
+                    {typeof model.contextWindowOverride === "number" && (
+                      <span
+                        className="text-[10px] px-1.5 py-0.5 rounded-full bg-orange-500/15 text-orange-400 font-medium"
+                        title={t("contextWindowOverrideHint")}
+                      >
+                        {`🪟 ${model.contextWindowOverride.toLocaleString()}`}
+                      </span>
+                    )}
                     {model.supportedEndpoints?.includes("embeddings") && (
                       <span className="text-[10px] px-1.5 py-0.5 rounded-full bg-purple-500/15 text-purple-400 font-medium">
                         {`📐 ${t("supportedEndpointEmbeddings")}`}
@@ -521,6 +564,20 @@ export default function CustomModelsSection({
                             <option value="antigravity">{t("targetFormatAntigravity")}</option>
                           </select>
                         </div>
+                        <div className="w-[10rem] shrink-0 min-w-0">
+                          <label className="text-xs text-text-muted mb-1 block">
+                            {t("contextWindowOverrideLabel")}
+                          </label>
+                          <input
+                            type="text"
+                            inputMode="numeric"
+                            value={editingContextWindowOverride}
+                            onChange={(e) => setEditingContextWindowOverride(e.target.value)}
+                            placeholder={t("contextWindowOverridePlaceholder")}
+                            title={t("contextWindowOverrideHint")}
+                            className="w-full px-2.5 py-2 text-xs border border-border rounded-lg bg-background text-text-main focus:outline-none focus:border-primary"
+                          />
+                        </div>
                         <div className="flex min-w-0 flex-1 flex-wrap items-center gap-x-3 gap-y-1 overflow-x-auto overflow-y-visible [scrollbar-width:thin]">
                           <span className="text-xs text-text-muted shrink-0">
                             {t("supportedEndpointsLabel")}
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/components/EmptyConnectionsPlaceholder.tsx b/src/app/(dashboard)/dashboard/providers/[id]/components/EmptyConnectionsPlaceholder.tsx
index 24478d2f7d..af06a7a2cd 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/components/EmptyConnectionsPlaceholder.tsx
+++ b/src/app/(dashboard)/dashboard/providers/[id]/components/EmptyConnectionsPlaceholder.tsx
@@ -55,16 +55,21 @@ export default function EmptyConnectionsPlaceholder({
       <p className="text-sm text-text-muted mb-4">{t("addFirstConnectionHint")}</p>
       {!isCompatible && (
         <div className="flex items-center justify-center gap-2">
-          {isCommandCode ? (
+          {isCommandCode || providerId === "clinepass" ? (
             <>
               <Button
                 icon="open_in_new"
                 loading={
-                  commandCodeAuthState.phase === "starting" ||
-                  commandCodeAuthState.phase === "polling" ||
-                  commandCodeAuthState.phase === "applying"
+                  isCommandCode &&
+                  (commandCodeAuthState.phase === "starting" ||
+                    commandCodeAuthState.phase === "polling" ||
+                    commandCodeAuthState.phase === "applying")
+                }
+                onClick={() =>
+                  gateConnectionFlow(
+                    isCommandCode ? handleOpenCommandCodeConnect : openPrimaryAddFlow
+                  )
                 }
-                onClick={() => gateConnectionFlow(handleOpenCommandCodeConnect)}
               >
                 Connect
               </Button>
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/components/ModelCompatPopover.tsx b/src/app/(dashboard)/dashboard/providers/[id]/components/ModelCompatPopover.tsx
index 0943cb63a0..0a008286ca 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/components/ModelCompatPopover.tsx
+++ b/src/app/(dashboard)/dashboard/providers/[id]/components/ModelCompatPopover.tsx
@@ -26,12 +26,54 @@ function recordToHeaderRows(rec: Record<string, string>, genId: () => string): H
   return entries.map(([name, value]) => ({ id: genId(), name, value }));
 }
 
+function parseCommaList(text: string): string[] {
+  return text
+    ? text
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean)
+    : [];
+}
+
+interface ParamFilterConfigLike {
+  block?: string[];
+  allow?: string[];
+  models?: Record<string, unknown>;
+  autoLearn?: boolean;
+}
+
+// Builds the PUT body for the model-level block/allow save. Extracted so the
+// caller's async handler stays simple — this is pure payload-shaping logic.
+function buildModelParamFilterPayload(
+  current: ParamFilterConfigLike | null | undefined,
+  modelId: string,
+  blockText: string,
+  allowText: string
+) {
+  const updatedModels: Record<string, unknown> = { ...(current?.models ?? {}) };
+  const block = parseCommaList(blockText);
+  const allow = parseCommaList(allowText);
+  if (block.length > 0 || allow.length > 0) {
+    updatedModels[modelId] = { block, allow };
+  } else {
+    delete updatedModels[modelId];
+  }
+  return {
+    block: current?.block ?? [],
+    allow: current?.allow ?? [],
+    models: Object.keys(updatedModels).length > 0 ? updatedModels : undefined,
+    autoLearn: current?.autoLearn ?? false,
+  };
+}
+
 // ---------------------------------------------------------------------------
 // Props
 // ---------------------------------------------------------------------------
 
 export interface ModelCompatPopoverProps {
   t: (key: string) => string;
+  providerId: string;
+  modelId: string;
   effectiveModelNormalize: (protocol: string) => boolean;
   effectiveModelPreserveDeveloper: (protocol: string) => boolean;
   getUpstreamHeadersRecord: (protocol: string) => Record<string, string>;
@@ -65,6 +107,10 @@ export default function ModelCompatPopover({
   const [open, setOpen] = useState(false);
   const [protocol, setProtocol] = useState<string>(MODEL_COMPAT_PROTOCOL_KEYS[0]);
   const [headerRows, setHeaderRows] = useState<HeaderDraftRow[]>([]);
+  const [blockText, setBlockText] = useState("");
+  const [allowText, setAllowText] = useState("");
+  const [paramDirty, setParamDirty] = useState(false);
+  const [paramSaving, setParamSaving] = useState(false);
   const [valuePeekRowId, setValuePeekRowId] = useState<string | null>(null);
   const [valueFocusRowId, setValueFocusRowId] = useState<string | null>(null);
   const ref = useRef<HTMLDivElement>(null);
@@ -118,6 +164,44 @@ export default function ModelCompatPopover({
     // eslint-disable-next-line react-hooks/exhaustive-deps -- see above
   }, [open, protocol]);
 
+  // Load model-level block/allow from param-filters API
+  useEffect(() => {
+    if (!open) return;
+    (async () => {
+      try {
+        const res = await fetch(`/api/providers/${providerId}/param-filters`);
+        const data = await res.json();
+        const modelCfg = data?.models?.[modelId];
+        setBlockText(modelCfg ? (modelCfg.block ?? []).join(", ") : "");
+        setAllowText(modelCfg ? (modelCfg.allow ?? []).join(", ") : "");
+      } catch {
+        setBlockText("");
+        setAllowText("");
+      }
+      setParamDirty(false);
+    })();
+  }, [open]);
+
+  const saveModelParamFilters = useCallback(async () => {
+    if (!paramDirty) return;
+    setParamSaving(true);
+    try {
+      const res = await fetch(`/api/providers/${providerId}/param-filters`);
+      const current = await res.json();
+      const payload = buildModelParamFilterPayload(current, modelId, blockText, allowText);
+      await fetch(`/api/providers/${providerId}/param-filters`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(payload),
+      });
+      setParamDirty(false);
+    } catch {
+      // Silently ignore save error
+    } finally {
+      setParamSaving(false);
+    }
+  }, [paramDirty, blockText, allowText]);
+
   useEffect(() => {
     setValuePeekRowId(null);
     setValueFocusRowId(null);
@@ -266,6 +350,48 @@ export default function ModelCompatPopover({
                 )}
               </div>
 
+              {/* Param filters — model-level block/allow (#6625) */}
+              <div className="mt-4 space-y-2.5">
+                <label className="block text-[11px] font-semibold text-text-main">
+                  {t("compatParamFiltersLabel") ?? "Param Filters"}
+                </label>
+                <div>
+                  <input
+                    type="text"
+                    value={blockText}
+                    onChange={(e) => {
+                      setBlockText(e.target.value);
+                      setParamDirty(true);
+                    }}
+                    onBlur={() => saveModelParamFilters()}
+                    placeholder="thinking, … (comma-separated)"
+                    disabled={disabled}
+                    className="mb-1 w-full rounded-lg border border-zinc-200 bg-white px-2.5 py-1.5 text-[11px] font-mono text-text-main placeholder:text-text-muted focus:border-primary focus:outline-none focus:ring-1 focus:ring-primary/30 dark:border-zinc-600 dark:bg-zinc-900"
+                  />
+                  <p className="text-[10px] text-text-muted">
+                    {t("compatBlockedParamsHint") ?? "Blocked params (stripped from requests)"}
+                    {paramSaving && " ● saving…"}
+                  </p>
+                </div>
+                <div>
+                  <input
+                    type="text"
+                    value={allowText}
+                    onChange={(e) => {
+                      setAllowText(e.target.value);
+                      setParamDirty(true);
+                    }}
+                    onBlur={() => saveModelParamFilters()}
+                    placeholder="reasoning, … (comma-separated)"
+                    disabled={disabled}
+                    className="mb-1 w-full rounded-lg border border-zinc-200 bg-white px-2.5 py-1.5 text-[11px] font-mono text-text-main placeholder:text-text-muted focus:border-primary focus:outline-none focus:ring-1 focus:ring-primary/30 dark:border-zinc-600 dark:bg-zinc-900"
+                  />
+                  <p className="text-[10px] text-text-muted">
+                    {t("compatAllowedParamsHint") ?? "Allowed params (re-added after deny)"}
+                  </p>
+                </div>
+              </div>
+
               <div className="mt-4 rounded-lg border-2 border-zinc-200 bg-zinc-100 p-3 dark:border-zinc-600 dark:bg-zinc-900">
                 <label className="block text-[11px] font-semibold text-text-main mb-1">
                   {t("compatUpstreamHeadersLabel")}
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/components/ModelRow.tsx b/src/app/(dashboard)/dashboard/providers/[id]/components/ModelRow.tsx
index 79e3d658e7..8580acccc8 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/components/ModelRow.tsx
+++ b/src/app/(dashboard)/dashboard/providers/[id]/components/ModelRow.tsx
@@ -285,6 +285,7 @@ export interface ModelRowProps {
 export default function ModelRow({
   model,
   fullModel,
+  provider,
   alias,
   copied,
   onCopy,
@@ -445,6 +446,8 @@ export default function ModelRow({
         )}
         <ModelCompatPopover
           t={t}
+          providerId={provider}
+          modelId={model.id}
           effectiveModelNormalize={(p) => effectiveModelNormalize(model.id, p)}
           effectiveModelPreserveDeveloper={(p) => effectiveModelPreserveDeveloper(model.id, p)}
           getUpstreamHeadersRecord={getUpstreamHeadersRecord}
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/components/PassthroughModelRow.tsx b/src/app/(dashboard)/dashboard/providers/[id]/components/PassthroughModelRow.tsx
index b7c17f8907..edbc55f93d 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/components/PassthroughModelRow.tsx
+++ b/src/app/(dashboard)/dashboard/providers/[id]/components/PassthroughModelRow.tsx
@@ -21,6 +21,7 @@ import { ModelSourceBadge, type ModelCompatSavePatch } from "./ModelRow";
 export interface PassthroughModelRowProps {
   modelId: string;
   fullModel: string;
+  provider: string;
   alias?: string | null;
   source?: string;
   isFree?: boolean;
@@ -64,6 +65,7 @@ export default function PassthroughModelRow({
   effectiveModelPreserveDeveloper,
   getUpstreamHeadersRecord,
   saveModelCompatFlags,
+  provider,
   compatDisabled,
   onToggleHidden,
   togglingHidden,
@@ -223,6 +225,8 @@ export default function PassthroughModelRow({
           )}
           <ModelCompatPopover
             t={t}
+            providerId={provider}
+            modelId={modelId}
             effectiveModelNormalize={(p) => effectiveModelNormalize(modelId, p)}
             effectiveModelPreserveDeveloper={(p) => effectiveModelPreserveDeveloper(modelId, p)}
             getUpstreamHeadersRecord={getUpstreamHeadersRecord}
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/components/PassthroughModelsSection.tsx b/src/app/(dashboard)/dashboard/providers/[id]/components/PassthroughModelsSection.tsx
index 857281e3bc..ea36db0671 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/components/PassthroughModelsSection.tsx
+++ b/src/app/(dashboard)/dashboard/providers/[id]/components/PassthroughModelsSection.tsx
@@ -48,6 +48,7 @@ export type ModelCompatSavePatchPassthrough = {
 export interface PassthroughModelsSectionProps {
   providerAlias: string;
   modelAliases: Record<string, string>;
+  catalogModels?: CompatModelRow[];
   availableModels?: CompatModelRow[];
   customModels?: CompatModelRow[];
   description: string;
@@ -80,6 +81,11 @@ export interface PassthroughModelsSectionProps {
   onAutoHideFailedChange?: (v: boolean) => void;
 }
 
+function getDefaultModelAlias(model: CompatModelRow): string | null {
+  const [firstAlias] = model.aliases || [];
+  return typeof firstAlias === "string" && firstAlias.trim() ? firstAlias.trim() : null;
+}
+
 // ---------------------------------------------------------------------------
 // Component
 // ---------------------------------------------------------------------------
@@ -87,6 +93,7 @@ export interface PassthroughModelsSectionProps {
 export default function PassthroughModelsSection({
   providerAlias,
   modelAliases,
+  catalogModels = [],
   availableModels = [],
   customModels = [],
   description,
@@ -237,11 +244,13 @@ export default function PassthroughModelsSection({
 
     const addModel = (model: CompatModelRow, source: string) => {
       if (!model?.id || seenModelIds.has(model.id)) return;
-      const fullModel = fullModelByModelId.get(model.id) || `${providerAlias}/${model.id}`;
+      const defaultAlias = getDefaultModelAlias(model);
+      const fullModel =
+        fullModelByModelId.get(model.id) || `${providerAlias}/${defaultAlias || model.id}`;
       rows.push({
         modelId: model.id,
         fullModel,
-        alias: aliasByModelId.get(model.id) || null,
+        alias: aliasByModelId.get(model.id) || defaultAlias,
         displayName: model.name || model.id,
         source,
         isFree:
@@ -258,6 +267,10 @@ export default function PassthroughModelsSection({
       addModel(model, "imported");
     }
 
+    for (const model of catalogModels) {
+      addModel(model, "system");
+    }
+
     for (const model of customModels) {
       addModel(
         model,
@@ -291,6 +304,7 @@ export default function PassthroughModelsSection({
     return rows;
   }, [
     availableModels,
+    catalogModels,
     customModelMap,
     customModels,
     isModelHidden,
@@ -413,6 +427,7 @@ export default function PassthroughModelsSection({
                 key={fullModel as string}
                 modelId={modelId}
                 fullModel={fullModel}
+                provider={providerId}
                 alias={alias}
                 source={source}
                 isFree={isFree}
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/components/ProviderExtraPanels.tsx b/src/app/(dashboard)/dashboard/providers/[id]/components/ProviderExtraPanels.tsx
new file mode 100644
index 0000000000..05b318dca3
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/providers/[id]/components/ProviderExtraPanels.tsx
@@ -0,0 +1,21 @@
+"use client";
+
+// Groups the provider detail page's "extra" sections — playground + param
+// filters — behind a single import/render call from ProviderDetailPageClient.tsx.
+// Extracted so the frozen host file stays within the file-size ratchet
+// (#6649 review follow-up: keeps ProviderDetailPageClient.tsx at its ≤784 cap).
+
+import ProviderPlaygroundPanel from "./ProviderPlaygroundPanel";
+import ProviderParamFilterSection from "./ProviderParamFilterSection";
+
+export default function ProviderExtraPanels({ providerId }: { providerId: string }) {
+  return (
+    <>
+      {/* Playground panel — rendered for providers that declare serviceKinds */}
+      <ProviderPlaygroundPanel providerId={providerId} />
+
+      {/* Param filters — denylist/allowlist config per provider/model (#6625) */}
+      <ProviderParamFilterSection providerId={providerId} />
+    </>
+  );
+}
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/components/ProviderModelsSection.tsx b/src/app/(dashboard)/dashboard/providers/[id]/components/ProviderModelsSection.tsx
index 1b252b209e..d642fcf6f8 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/components/ProviderModelsSection.tsx
+++ b/src/app/(dashboard)/dashboard/providers/[id]/components/ProviderModelsSection.tsx
@@ -306,6 +306,7 @@ export default function ProviderModelsSection({
         <PassthroughModelsSection
           providerAlias={providerAlias}
           modelAliases={modelAliases}
+          catalogModels={models}
           availableModels={syncedAvailableModels}
           customModels={modelMeta.customModels}
           description={passthroughDescription}
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/components/ProviderParamFilterSection.tsx b/src/app/(dashboard)/dashboard/providers/[id]/components/ProviderParamFilterSection.tsx
new file mode 100644
index 0000000000..323df12322
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/providers/[id]/components/ProviderParamFilterSection.tsx
@@ -0,0 +1,348 @@
+"use client";
+
+/**
+ * ProviderParamFilterSection — Denylist/allowlist config for provider-level
+ * request parameter filtering (#6625).
+ *
+ * Renders a card on the provider detail page where operators can configure
+ * which request params to strip (block) or selectively re-add (allow) before
+ * sending to the upstream provider.
+ */
+
+import { useState, useEffect, useCallback } from "react";
+import { useTranslations } from "next-intl";
+import { useNotificationStore } from "@/store/notificationStore";
+
+interface ProviderParamFilterSectionProps {
+  providerId: string;
+}
+
+interface ParamFilterConfig {
+  block: string[];
+  allow: string[];
+  models?: Record<string, { block?: string[]; allow?: string[] }>;
+  autoLearn: boolean;
+}
+
+function parseCommaList(value: string): string[] {
+  return value
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+}
+
+function formatCommaList(arr: string[]): string {
+  return arr.join(", ");
+}
+
+// ---------------------------------------------------------------------------
+// Fetch helpers — isolate the HTTP + response-shape concerns so the
+// component's handlers stay focused on state transitions + user feedback.
+// ---------------------------------------------------------------------------
+
+async function fetchParamFilterConfig(providerId: string): Promise<ParamFilterConfig> {
+  const res = await fetch(`/api/providers/${providerId}/param-filters`);
+  const data = await res.json();
+  return {
+    block: Array.isArray(data.block) ? data.block : [],
+    allow: Array.isArray(data.allow) ? data.allow : [],
+    autoLearn: typeof data.autoLearn === "boolean" ? data.autoLearn : false,
+  };
+}
+
+async function throwOnErrorResponse(res: Response): Promise<void> {
+  if (res.ok) return;
+  const errData = await res.json().catch(() => ({}));
+  throw new Error(errData.error || `HTTP ${res.status}`);
+}
+
+async function putParamFilterConfig(providerId: string, body: ParamFilterConfig): Promise<void> {
+  const res = await fetch(`/api/providers/${providerId}/param-filters`, {
+    method: "PUT",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  await throwOnErrorResponse(res);
+}
+
+async function deleteParamFilterConfig(providerId: string): Promise<void> {
+  const res = await fetch(`/api/providers/${providerId}/param-filters`, { method: "DELETE" });
+  await throwOnErrorResponse(res);
+}
+
+function errorMessage(err: unknown): string {
+  return err instanceof Error ? err.message : String(err);
+}
+
+// ---------------------------------------------------------------------------
+// State hook — owns config load/save/reset so the component body stays JSX-only.
+// ---------------------------------------------------------------------------
+
+type Translate = (key: string, values?: Record<string, string>) => string;
+
+// Wraps a raw state setter so updating the draft value also marks the form
+// dirty — used for the three form-local draft fields below.
+function useDirtySetter<T>(setValue: (value: T) => void, setDirty: (value: boolean) => void) {
+  return useCallback(
+    (value: T) => {
+      setValue(value);
+      setDirty(true);
+    },
+    [setValue, setDirty]
+  );
+}
+
+function useProviderParamFilterConfig(providerId: string, t: Translate) {
+  const notify = useNotificationStore();
+  const [, setConfig] = useState<ParamFilterConfig>({ block: [], allow: [], autoLearn: false });
+  const [loading, setLoading] = useState(true);
+  const [saving, setSaving] = useState(false);
+  const [dirty, setDirty] = useState(false);
+  const [blockText, setBlockTextState] = useState("");
+  const [allowText, setAllowTextState] = useState("");
+  const [autoLearn, setAutoLearnState] = useState(false);
+
+  const setBlockText = useDirtySetter(setBlockTextState, setDirty);
+  const setAllowText = useDirtySetter(setAllowTextState, setDirty);
+  const setAutoLearn = useDirtySetter(setAutoLearnState, setDirty);
+
+  const loadConfig = useCallback(async () => {
+    setLoading(true);
+    try {
+      const cfg = await fetchParamFilterConfig(providerId);
+      setConfig(cfg);
+      setBlockTextState(formatCommaList(cfg.block));
+      setAllowTextState(formatCommaList(cfg.allow));
+      setAutoLearnState(cfg.autoLearn);
+    } catch (err) {
+      notify.notify(t("paramFiltersLoadError", { error: errorMessage(err) }), "error");
+    } finally {
+      setLoading(false);
+    }
+  }, [providerId, notify, t]);
+
+  useEffect(() => {
+    loadConfig();
+  }, [loadConfig]);
+
+  const handleSave = useCallback(async () => {
+    setSaving(true);
+    try {
+      const body: ParamFilterConfig = {
+        block: parseCommaList(blockText),
+        allow: parseCommaList(allowText),
+        autoLearn,
+      };
+      await putParamFilterConfig(providerId, body);
+      setConfig(body);
+      setDirty(false);
+      notify.notify(t("paramFiltersSaveSuccess"), "success");
+    } catch (err) {
+      notify.notify(t("paramFiltersSaveError", { error: errorMessage(err) }), "error");
+    } finally {
+      setSaving(false);
+    }
+  }, [providerId, blockText, allowText, autoLearn, notify, t]);
+
+  const handleReset = useCallback(async () => {
+    setSaving(true);
+    try {
+      await deleteParamFilterConfig(providerId);
+      setConfig({ block: [], allow: [], autoLearn: false });
+      setBlockTextState("");
+      setAllowTextState("");
+      setAutoLearnState(false);
+      setDirty(false);
+      notify.notify(t("paramFiltersResetSuccess"), "success");
+    } catch (err) {
+      notify.notify(t("paramFiltersResetError", { error: errorMessage(err) }), "error");
+    } finally {
+      setSaving(false);
+    }
+  }, [providerId, notify, t]);
+
+  return {
+    loading,
+    saving,
+    dirty,
+    blockText,
+    allowText,
+    autoLearn,
+    setBlockText,
+    setAllowText,
+    setAutoLearn,
+    handleSave,
+    handleReset,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Presentational sub-components
+// ---------------------------------------------------------------------------
+
+function ParamFilterSectionSkeleton() {
+  return (
+    <div className="rounded-xl border border-border bg-white p-5 dark:bg-zinc-950">
+      <div className="h-5 w-48 animate-pulse rounded bg-zinc-200 dark:bg-zinc-800" />
+      <div className="mt-4 h-20 animate-pulse rounded bg-zinc-100 dark:bg-zinc-900" />
+    </div>
+  );
+}
+
+function ParamFilterSectionHeader({ t }: { t: (key: string) => string }) {
+  return (
+    <>
+      <h2 className="text-base font-semibold text-text-main mb-1">
+        {t("paramFiltersSectionTitle")}
+      </h2>
+      <p className="text-xs text-text-muted mb-4 leading-relaxed">
+        {t.rich("paramFiltersSectionHint", {
+          code: (chunks) => (
+            <code className="text-xs bg-zinc-100 dark:bg-zinc-800 px-1 rounded">{chunks}</code>
+          ),
+        })}
+      </p>
+    </>
+  );
+}
+
+interface ParamListFieldProps {
+  label: string;
+  hint: string;
+  value: string;
+  placeholder: string;
+  onChange: (value: string) => void;
+}
+
+function ParamListField({ label, hint, value, placeholder, onChange }: ParamListFieldProps) {
+  return (
+    <div className="mb-3">
+      <label className="block text-xs font-medium text-text-muted mb-1.5">{label}</label>
+      <input
+        type="text"
+        value={value}
+        onChange={(e) => onChange(e.target.value)}
+        placeholder={placeholder}
+        className="w-full rounded-lg border border-border bg-white px-3 py-2 text-xs text-text-main placeholder:text-text-muted focus:outline-none focus:ring-1 focus:ring-primary dark:bg-zinc-900"
+      />
+      <p className="text-[11px] text-text-muted mt-1">{hint}</p>
+    </div>
+  );
+}
+
+interface AutoLearnToggleProps {
+  t: (key: string) => string;
+  checked: boolean;
+  onChange: (checked: boolean) => void;
+}
+
+function AutoLearnToggle({ t, checked, onChange }: AutoLearnToggleProps) {
+  return (
+    <div className="mb-4">
+      <label className="flex items-center gap-2 cursor-pointer">
+        <input
+          type="checkbox"
+          checked={checked}
+          onChange={(e) => onChange(e.target.checked)}
+          className="rounded border-border text-primary focus:ring-primary"
+        />
+        <span className="text-xs font-medium text-text-main">
+          {t("paramFiltersAutoLearnLabel")}
+        </span>
+      </label>
+      <p className="text-[11px] text-text-muted mt-1 ml-5">{t("paramFiltersAutoLearnHint")}</p>
+    </div>
+  );
+}
+
+interface ParamFilterActionsProps {
+  t: (key: string) => string;
+  saving: boolean;
+  dirty: boolean;
+  onSave: () => void;
+  onReset: () => void;
+}
+
+function ParamFilterActions({ t, saving, dirty, onSave, onReset }: ParamFilterActionsProps) {
+  return (
+    <div className="flex items-center gap-2">
+      <button
+        type="button"
+        onClick={onSave}
+        disabled={saving || !dirty}
+        className="inline-flex items-center gap-1.5 rounded-lg bg-primary px-3 py-1.5 text-xs font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-50 transition-colors"
+      >
+        {saving ? (
+          <span className="material-symbols-outlined text-sm animate-spin">progress_activity</span>
+        ) : (
+          <span className="material-symbols-outlined text-sm">save</span>
+        )}
+        {saving ? t("paramFiltersSaving") : t("paramFiltersSaveChanges")}
+      </button>
+      <button
+        type="button"
+        onClick={onReset}
+        disabled={saving}
+        className="inline-flex items-center gap-1.5 rounded-lg border border-border px-3 py-1.5 text-xs font-medium text-text-muted hover:text-text-main hover:border-primary/40 disabled:opacity-50 transition-colors"
+      >
+        <span className="material-symbols-outlined text-sm">delete</span>
+        {t("paramFiltersResetToDefault")}
+      </button>
+    </div>
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Component
+// ---------------------------------------------------------------------------
+
+export default function ProviderParamFilterSection({
+  providerId,
+}: ProviderParamFilterSectionProps) {
+  const t = useTranslations("providers");
+  const {
+    loading,
+    saving,
+    dirty,
+    blockText,
+    allowText,
+    autoLearn,
+    setBlockText,
+    setAllowText,
+    setAutoLearn,
+    handleSave,
+    handleReset,
+  } = useProviderParamFilterConfig(providerId, t);
+
+  if (loading) {
+    return <ParamFilterSectionSkeleton />;
+  }
+
+  return (
+    <div className="rounded-xl border border-border bg-white p-5 dark:bg-zinc-950">
+      <ParamFilterSectionHeader t={t} />
+      <ParamListField
+        label={t("paramFiltersBlockedLabel")}
+        hint={t("paramFiltersBlockedHint")}
+        value={blockText}
+        placeholder="thinking, reasoning_budget, … (comma-separated)"
+        onChange={setBlockText}
+      />
+      <ParamListField
+        label={t("paramFiltersAllowedLabel")}
+        hint={t("paramFiltersAllowedHint")}
+        value={allowText}
+        placeholder="reasoning, … (comma-separated)"
+        onChange={setAllowText}
+      />
+      <AutoLearnToggle t={t} checked={autoLearn} onChange={setAutoLearn} />
+      <ParamFilterActions
+        t={t}
+        saving={saving}
+        dirty={dirty}
+        onSave={handleSave}
+        onReset={handleReset}
+      />
+    </div>
+  );
+}
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/components/modals/AddApiKeyModal.tsx b/src/app/(dashboard)/dashboard/providers/[id]/components/modals/AddApiKeyModal.tsx
index eaeeef2931..03da3e4797 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/components/modals/AddApiKeyModal.tsx
+++ b/src/app/(dashboard)/dashboard/providers/[id]/components/modals/AddApiKeyModal.tsx
@@ -1,7 +1,7 @@
 "use client";
 import { useState, useEffect, useRef } from "react";
 import { useTranslations } from "next-intl";
-import { Button, Badge, Input, Modal, Toggle } from "@/shared/components";
+import { Button, Badge, Input, Modal, Toggle, TALL_MODAL_PROPS } from "@/shared/components";
 import {
   providerAllowsOptionalApiKey,
   supportsBulkApiKey,
@@ -215,27 +215,26 @@ export default function AddApiKeyModal({
         "Session credential validation failed. Sign in again, copy a fresh credential, and try again."
       )
     : t("apiKeyValidationFailed");
-
-  // Normalize the raw credential field(s) into the single value stored as `apiKey`.
-  // command-code providers extract a key from a pasted blob (#5088); Modal joins its
-  // Token ID + Token Secret into `id:secret` (#5446); everyone else uses the field verbatim.
-  const resolveCredentialInput = () => {
-    if (isCommandCode) return extractCommandCodeCredentialInput(formData.apiKey);
-    if (isModal) return combineModalCredential(formData.apiKey, formData.tokenSecret);
-    return formData.apiKey;
-  };
+  const validationBadge = validationResult ? validationBadgeProps(validationResult) : null;
+  // Normalize raw credential field(s) into the single value stored as `apiKey`
+  // (#5088 command-code extract; #5446 Modal id:secret join; else verbatim).
+  const resolveCredentialInput = () =>
+    isCommandCode
+      ? extractCommandCodeCredentialInput(formData.apiKey)
+      : isModal
+        ? combineModalCredential(formData.apiKey, formData.tokenSecret)
+        : formData.apiKey;
 
   const handleValidate = async () => {
     setValidating(true);
     setSaveError(null);
     try {
-      const credentialInput = resolveCredentialInput();
       const res = await fetch("/api/providers/validate", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
           provider,
-          apiKey: credentialInput,
+          apiKey: resolveCredentialInput(),
           validationModelId: formData.validationModelId || undefined,
           customUserAgent: formData.customUserAgent.trim() || undefined,
           baseUrl: formData.baseUrl.trim() || undefined,
@@ -245,11 +244,10 @@ export default function AddApiKeyModal({
       });
       const data = await res.json();
       const ok = !!data.valid;
-      setValidationResult(ok ? "success" : data.unsupported ? "unsupported" : "failed");
-      // #5088: surface the detailed reason the backend returns (e.g. a TLS/EACCES
-      // environment error for claude-web/chatgpt-web) instead of only a bare
-      // "invalid" badge — otherwise the real cause is hidden and users are stuck.
-      if (!ok && typeof data.error === "string" && data.error) {
+      const unsupported = !!data.unsupported;
+      setValidationResult(ok ? "success" : unsupported ? "unsupported" : "failed");
+      // #5088: surface backend reason (e.g. TLS/EACCES) instead of bare "invalid".
+      if (!ok && !unsupported && typeof data.error === "string" && data.error) {
         setSaveError(data.error);
       }
     } catch {
@@ -444,6 +442,8 @@ export default function AddApiKeyModal({
       isOpen={isOpen}
       title={getAddCredentialModalTitle(t, providerDisplayName, webSessionCredential)}
       onClose={onClose}
+      size="lg"
+      {...TALL_MODAL_PROPS}
     >
       <div className="flex flex-col gap-4">
         {webProviderHostLink && (
@@ -757,9 +757,9 @@ export default function AddApiKeyModal({
                 hint={t("searchEngineIdHint")}
               />
             )}
-            {validationResult && (
-              <Badge variant={validationBadgeProps(validationResult).variant}>
-                {t(validationBadgeProps(validationResult).labelKey)}
+            {validationBadge && (
+              <Badge variant={validationBadge.variant}>
+                {providerText(t, validationBadge.labelKey, validationBadge.fallback)}
               </Badge>
             )}
             {saveError && (
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/components/modals/EditConnectionModal.tsx b/src/app/(dashboard)/dashboard/providers/[id]/components/modals/EditConnectionModal.tsx
index cb79879226..bbbbc99ba6 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/components/modals/EditConnectionModal.tsx
+++ b/src/app/(dashboard)/dashboard/providers/[id]/components/modals/EditConnectionModal.tsx
@@ -51,11 +51,7 @@ import { useOpenRouterPresetControl } from "../OpenRouterPresetInput";
 import WebSessionCredentialGuide from "../WebSessionCredentialGuide";
 import CcCompatibleRequestDefaultsFields from "./CcCompatibleRequestDefaultsFields";
 import { assignEditApiKeyProviderSpecificData } from "./connectionProviderSpecificData";
-import {
-  isM365TierCapableProvider,
-  normalizeM365TierValue,
-  type M365TierValue,
-} from "./m365Tier";
+import { isM365TierCapableProvider, normalizeM365TierValue, type M365TierValue } from "./m365Tier";
 import QuotaScrapingFields, { EMPTY_QUOTA_SCRAPING_FIELDS } from "./QuotaScrapingFields";
 import GlmTeamQuotaFields, { EMPTY_GLM_TEAM_QUOTA_FIELDS } from "./GlmTeamQuotaFields";
 
@@ -99,6 +95,8 @@ export default function EditConnectionModal({
   const t = useTranslations("providers");
   const notify = useNotificationStore();
   const provider = connection?.provider || providerId;
+  const connectionAuthType = connection?.authType;
+  const connectionProviderSpecificData = connection?.providerSpecificData;
   const showFreeModelsToggle = providerHasFreeModels(provider);
   const [formData, setFormData] = useState({
     name: "",
@@ -134,12 +132,12 @@ export default function EditConnectionModal({
     antigravityClientProfile: "ide",
     blockExtraUsage:
       provider === "claude"
-        ? isClaudeExtraUsageBlockEnabled(provider, connection?.providerSpecificData)
+        ? isClaudeExtraUsageBlockEnabled(provider, connectionProviderSpecificData)
         : false,
-    passthroughModels: connection?.providerSpecificData?.passthroughModels === true,
-    disableCooling: connection?.providerSpecificData?.disableCooling === true,
-    importFreeModelsOnly: connection?.providerSpecificData?.importFreeModelsOnly === true,
-    m365Tier: normalizeM365TierValue(connection?.providerSpecificData?.tier) as M365TierValue,
+    passthroughModels: connectionProviderSpecificData?.passthroughModels === true,
+    disableCooling: connectionProviderSpecificData?.disableCooling === true,
+    importFreeModelsOnly: connectionProviderSpecificData?.importFreeModelsOnly === true,
+    m365Tier: normalizeM365TierValue(connectionProviderSpecificData?.tier) as M365TierValue,
   });
   const [testing, setTesting] = useState(false);
   const [testResult, setTestResult] = useState(null);
@@ -169,11 +167,11 @@ export default function EditConnectionModal({
   // providerSpecificData.baseUrl.
   const isConfigurableBaseUrl = isBaseUrlConfigurableProvider(provider);
   const isBaseUrlOverrideEligible =
-    connection?.authType !== "oauth" && isBaseUrlOverrideEligibleProvider(provider);
+    !!connection && connectionAuthType !== "oauth" && isBaseUrlOverrideEligibleProvider(provider);
   const [showBaseUrlOverride, setShowBaseUrlOverride] = useState(
     () =>
-      typeof connection?.providerSpecificData?.baseUrl === "string" &&
-      connection.providerSpecificData.baseUrl.trim().length > 0
+      typeof connectionProviderSpecificData?.baseUrl === "string" &&
+      connectionProviderSpecificData.baseUrl.trim().length > 0
   );
   const usesBaseUrl = isConfigurableBaseUrl || (isBaseUrlOverrideEligible && showBaseUrlOverride);
   const defaultBaseUrl = getProviderBaseUrlDefault(provider);
diff --git a/src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts b/src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts
index aa8499e839..4345d11962 100644
--- a/src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts
+++ b/src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts
@@ -64,6 +64,7 @@ export type CompatByProtocolMap = Partial<
 export type CompatModelRow = {
   id?: string;
   name?: string;
+  /** optional registry aliases for display/import */ aliases?: readonly string[];
   source?: string;
   apiFormat?: string;
   supportedEndpoints?: string[];
@@ -74,10 +75,10 @@ export type CompatModelRow = {
   upstreamHeaders?: Record<string, string>;
   compatByProtocol?: CompatByProtocolMap;
   /** #2905: per-model upstream wire-format override. */ targetFormat?: string;
+  /** #4125: manual context-window override (tokens), when set. */ contextWindowOverride?: number;
 };
 
 export type CompatModelMap = Map<string, CompatModelRow>;
-
 export type HeaderDraftRow = { id: string; name: string; value: string };
 
 // ---------------------------------------------------------------------------
@@ -85,7 +86,6 @@ export type HeaderDraftRow = { id: string; name: string; value: string };
 // outside the .tsx). Returns the i18n key for a targetFormat value, or null when the
 // value is unknown (the caller then renders the raw value verbatim).
 // ---------------------------------------------------------------------------
-
 const TARGET_FORMAT_BADGE_I18N_KEYS: Record<string, string> = {
   openai: "compatProtocolOpenAI",
   "openai-responses": "compatProtocolOpenAIResponses",
@@ -120,20 +120,16 @@ export function providerText(
   return fallback;
 }
 
-/**
- * #5442 — Badge variant + i18n label key for an add-credential validation result.
- * A provider with no live validator returns `unsupported` (Save still succeeds);
- * previously the modal only had success/failed states, so it rendered a red
- * "Invalid" badge for those providers even though saving worked (LMArena, PiAPI…).
- * "unsupported" now maps to a neutral `info` badge ("N/A"), not "Invalid".
- */
+/** #5442 — badge for add-credential validation; unsupported → neutral N/A (not red Invalid). */
 export function validationBadgeProps(result: string): {
   variant: "success" | "error" | "info";
   labelKey: string;
+  fallback: string;
 } {
-  if (result === "success") return { variant: "success", labelKey: "valid" };
-  if (result === "unsupported") return { variant: "info", labelKey: "notApplicable" };
-  return { variant: "error", labelKey: "invalid" };
+  if (result === "success") return { variant: "success", labelKey: "valid", fallback: "Valid" };
+  if (result === "unsupported")
+    return { variant: "info", labelKey: "notApplicable", fallback: "N/A" };
+  return { variant: "error", labelKey: "invalid", fallback: "Invalid" };
 }
 
 /** A single model's outcome from a `/api/models/test-all` response. */
@@ -441,7 +437,8 @@ export function getWebSessionCredentialHint(
     return providerText(
       t,
       requirement.hintKey,
-      "Open the provider's web session in DevTools, copy the required credential(s), and paste them in the fields below.",
+      requirement.hintFallback ??
+        "Open the provider's web session in DevTools, copy the required credential(s), and paste them in the fields below.",
       values
     );
   }
@@ -701,6 +698,7 @@ export const CODEX_REASONING_STRENGTH_OPTIONS = [
   { value: "medium", label: "Medium" },
   { value: "high", label: "High" },
   { value: "xhigh", label: "XHigh" },
+  { value: "max", label: "Max" },
 ];
 
 export const CODEX_ACCOUNT_SERVICE_TIER_VALUES: CodexServiceTier[] = [
diff --git a/src/app/(dashboard)/dashboard/providers/components/ProviderCard.tsx b/src/app/(dashboard)/dashboard/providers/components/ProviderCard.tsx
index 23a990abf5..d290f07be0 100644
--- a/src/app/(dashboard)/dashboard/providers/components/ProviderCard.tsx
+++ b/src/app/(dashboard)/dashboard/providers/components/ProviderCard.tsx
@@ -42,6 +42,15 @@ const KIND_LABEL: Record<string, string> = {
   music: "Music",
 };
 
+/** Maps a compatible-provider `apiType` to its `KIND_LABEL` key (#6936: non-chat
+ * apiTypes — audio/embeddings/image — were falling through to the "Chat" badge). */
+const COMPATIBLE_API_TYPE_KIND: Record<string, string> = {
+  "audio-transcriptions": "stt",
+  "audio-speech": "tts",
+  "images-generations": "image",
+  embeddings: "embedding",
+};
+
 interface ProviderCardProps {
   providerId: string;
   provider: {
@@ -319,7 +328,10 @@ export default function ProviderCard({
                 ))}
                 {isCompatible && (
                   <Badge variant="default" size="sm">
-                    {provider.apiType === "responses" ? t("responses") : t("chat")}
+                    {provider.apiType === "responses"
+                      ? t("responses")
+                      : (KIND_LABEL[COMPATIBLE_API_TYPE_KIND[provider.apiType ?? ""] ?? ""] ??
+                        t("chat"))}
                   </Badge>
                 )}
                 {isCcCompatible && (
diff --git a/src/app/(dashboard)/dashboard/providers/components/__tests__/providerCardAudioBadge.test.tsx b/src/app/(dashboard)/dashboard/providers/components/__tests__/providerCardAudioBadge.test.tsx
new file mode 100644
index 0000000000..71850594aa
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/providers/components/__tests__/providerCardAudioBadge.test.tsx
@@ -0,0 +1,94 @@
+import React from "react";
+import { createRoot } from "react-dom/client";
+import { act } from "react";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import ProviderCard from "../ProviderCard";
+
+vi.mock("next-intl", () => ({ useTranslations: () => (k: string) => k }));
+vi.mock("@/shared/components/ProviderTestSlideOver", () => ({ default: () => null }));
+vi.mock("@/shared/components/ProviderIcon", () => ({ default: () => null }));
+
+describe("ProviderCard — #6936 audio-transcriptions provider badge", () => {
+  let container: HTMLDivElement | null = null;
+
+  afterEach(() => {
+    if (container) {
+      document.body.removeChild(container);
+      container = null;
+    }
+  });
+
+  it("does NOT label an audio-transcriptions compatible node as Chat", () => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    const root = createRoot(container);
+    act(() => {
+      root.render(
+        <ProviderCard
+          providerId="openai-compatible-speaches-stt"
+          provider={{
+            id: "openai-compatible-speaches-stt",
+            name: "Speaches-stt",
+            apiType: "audio-transcriptions",
+            serviceKinds: [],
+          }}
+          stats={{ total: 1, connected: 1, error: 0, warning: 0 }}
+          authType="apikey"
+          onToggle={() => {}}
+        />
+      );
+    });
+    const text = (container.textContent || "").toLowerCase();
+    expect(text).not.toContain("chat");
+    expect(text).toContain("stt");
+  });
+
+  it("labels an audio-speech compatible node as TTS", () => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    const root = createRoot(container);
+    act(() => {
+      root.render(
+        <ProviderCard
+          providerId="openai-compatible-speaches-tts"
+          provider={{
+            id: "openai-compatible-speaches-tts",
+            name: "Speaches-tts",
+            apiType: "audio-speech",
+            serviceKinds: [],
+          }}
+          stats={{ total: 1, connected: 1, error: 0, warning: 0 }}
+          authType="apikey"
+          onToggle={() => {}}
+        />
+      );
+    });
+    const text = (container.textContent || "").toLowerCase();
+    expect(text).not.toContain("chat");
+    expect(text).toContain("tts");
+  });
+
+  it("still labels a plain chat compatible node as Chat", () => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    const root = createRoot(container);
+    act(() => {
+      root.render(
+        <ProviderCard
+          providerId="openai-compatible-plain"
+          provider={{
+            id: "openai-compatible-plain",
+            name: "Plain-chat",
+            apiType: "chat",
+            serviceKinds: [],
+          }}
+          stats={{ total: 1, connected: 1, error: 0, warning: 0 }}
+          authType="apikey"
+          onToggle={() => {}}
+        />
+      );
+    });
+    const text = (container.textContent || "").toLowerCase();
+    expect(text).toContain("chat");
+  });
+});
diff --git a/src/app/(dashboard)/dashboard/providers/providerPageUtils.ts b/src/app/(dashboard)/dashboard/providers/providerPageUtils.ts
index b7b9f4d354..762a9bb629 100644
--- a/src/app/(dashboard)/dashboard/providers/providerPageUtils.ts
+++ b/src/app/(dashboard)/dashboard/providers/providerPageUtils.ts
@@ -71,6 +71,8 @@ export function shouldShowFirstProviderHint(
 
 type ProviderRecord<TProvider = Record<string, unknown>> = Record<string, TProvider>;
 
+const OAUTH_CARD_API_KEY_CONNECTION_PROVIDER_IDS = new Set(["kiro", "amazon-q"]);
+
 /**
  * Whether a provider connection should be counted on a provider card rendered in
  * the given section. Dual-auth providers (qoder, opencode, codebuddy-cn, …) are
@@ -85,8 +87,11 @@ export function connectionMatchesProviderCard(
 ): boolean {
   if (!conn || conn.provider !== providerId) return false;
   if (cardAuthType === "free") return true;
-  if (supportsApiKeyOnFreeProvider(providerId)) {
-    return conn.authType === "oauth" || conn.authType === "apikey";
+  if (
+    supportsApiKeyOnFreeProvider(providerId) ||
+    OAUTH_CARD_API_KEY_CONNECTION_PROVIDER_IDS.has(providerId)
+  ) {
+    return conn.authType === "oauth" || conn.authType === "apikey" || conn.authType === "api_key";
   }
   return conn.authType === cardAuthType;
 }
@@ -364,7 +369,7 @@ const PROVIDER_PAGE_FETCH_TIMEOUT_MS = 20_000;
  * page paints from whatever data arrived (matching the fast `/api/providers`).
  */
 export async function loadProviderPageData(
-  fetchImpl: typeof fetch = (globalThis.fetch as typeof fetch),
+  fetchImpl: typeof fetch = globalThis.fetch as typeof fetch,
   timeoutMs: number = PROVIDER_PAGE_FETCH_TIMEOUT_MS
 ): Promise<ProviderPageData> {
   const safeJson = async (url: string, init?: RequestInit): Promise<any | null> => {
diff --git a/src/app/(dashboard)/dashboard/settings/ai/page.tsx b/src/app/(dashboard)/dashboard/settings/ai/page.tsx
index c7402e6e08..561f493749 100644
--- a/src/app/(dashboard)/dashboard/settings/ai/page.tsx
+++ b/src/app/(dashboard)/dashboard/settings/ai/page.tsx
@@ -10,6 +10,7 @@ import ClaudeFastModeTab from "../components/ClaudeFastModeTab";
 import MemorySkillsTab from "../components/MemorySkillsTab";
 import ModelsDevSyncTab from "../components/ModelsDevSyncTab";
 import UsageTokenBufferTab from "../components/UsageTokenBufferTab";
+import ModelCapabilityOverridesTab from "../components/ModelCapabilityOverridesTab";
 
 export default function SettingsAiPage() {
   const t = useTranslations("settings");
@@ -24,6 +25,7 @@ export default function SettingsAiPage() {
       <CodexFastTierTab />
       <ClaudeFastModeTab />
       <MemorySkillsTab />
+      <ModelCapabilityOverridesTab />
       <ModelsDevSyncTab />
     </div>
   );
diff --git a/src/app/(dashboard)/dashboard/settings/components/CodexFastTierTab.tsx b/src/app/(dashboard)/dashboard/settings/components/CodexFastTierTab.tsx
index 94af28bdf1..fe595b0421 100644
--- a/src/app/(dashboard)/dashboard/settings/components/CodexFastTierTab.tsx
+++ b/src/app/(dashboard)/dashboard/settings/components/CodexFastTierTab.tsx
@@ -13,7 +13,12 @@ type TierValue = "default" | "priority" | "flex";
 // Fast-eligible Codex models per OpenAI ~/.codex/models_cache.json (service_tiers: priority).
 // Other future Fast-eligible slugs can be added here without code changes once the user
 // opts them in via the checkbox UI.
-const CODEX_FAST_TIER_CATALOG: readonly string[] = ["gpt-5.5", "gpt-5.4"];
+const CODEX_FAST_TIER_CATALOG: readonly string[] = [
+  "gpt-5.6-sol",
+  "gpt-5.6-terra",
+  "gpt-5.6-luna",
+  "gpt-5.5",
+];
 
 export default function CodexFastTierTab() {
   const [enabled, setEnabled] = useState(false);
diff --git a/src/app/(dashboard)/dashboard/settings/components/ComboDefaultsTab.tsx b/src/app/(dashboard)/dashboard/settings/components/ComboDefaultsTab.tsx
index 8544506287..285f830131 100644
--- a/src/app/(dashboard)/dashboard/settings/components/ComboDefaultsTab.tsx
+++ b/src/app/(dashboard)/dashboard/settings/components/ComboDefaultsTab.tsx
@@ -292,8 +292,7 @@ export default function ComboDefaultsTab() {
 
   // Filtered provider list — excludes already-added ones, filtered by search query
   const filteredProviders = availableProviders.filter(
-    (p) =>
-      !providerOverrides[p.provider] && matchesSearch(p.provider, searchQuery)
+    (p) => !providerOverrides[p.provider] && matchesSearch(p.provider, searchQuery)
   );
 
   const handleDropdownKeyDown = (e: React.KeyboardEvent) => {
@@ -637,7 +636,7 @@ export default function ComboDefaultsTab() {
               label={translateOrFallback(t, "contextRelaySummaryModel", "Summary Model")}
               type="text"
               value={comboDefaults.handoffModel ?? ""}
-              placeholder="codex/gpt-5.4"
+              placeholder="codex/gpt-5.6-sol"
               onChange={(e) =>
                 setComboDefaults((prev) => ({
                   ...prev,
diff --git a/src/app/(dashboard)/dashboard/settings/components/ModelCapabilityOverridesTab.tsx b/src/app/(dashboard)/dashboard/settings/components/ModelCapabilityOverridesTab.tsx
new file mode 100644
index 0000000000..04d182b6b5
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/settings/components/ModelCapabilityOverridesTab.tsx
@@ -0,0 +1,428 @@
+"use client";
+
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { useTranslations } from "next-intl";
+import { Card, Button } from "@/shared/components";
+import { matchesSearch } from "@/shared/utils/turkishText";
+
+type ModelOverrideKey = "max_token";
+type StatusTone = "success" | "error" | "info";
+
+type ModelOverrideTarget = {
+  target: string;
+  provider: string;
+  modelId: string;
+  label: string;
+};
+
+interface PricingCatalogModel {
+  id: string;
+  name: string;
+}
+
+interface PricingCatalogProvider {
+  id: string;
+  alias: string;
+  models: PricingCatalogModel[];
+}
+
+interface ModelCapabilityOverride {
+  target: string;
+  key: ModelOverrideKey;
+  value: number;
+}
+
+interface StatusMessage {
+  tone: StatusTone;
+  message: string;
+}
+
+function statusClassName(tone: StatusTone) {
+  if (tone === "success") return "bg-emerald-500/10 border-emerald-500/20 text-emerald-400";
+  if (tone === "error") return "bg-red-500/10 border-red-500/20 text-red-400";
+  return "bg-sky-500/10 border-sky-500/20 text-sky-400";
+}
+
+function useModelCapabilityOverridesData() {
+  const t = useTranslations("settings");
+  const [catalog, setCatalog] = useState<Record<string, PricingCatalogProvider>>({});
+  const [overrides, setOverrides] = useState<ModelCapabilityOverride[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [statusMessage, setStatusMessage] = useState<StatusMessage | null>(null);
+
+  const showStatus = useCallback((tone: StatusTone, message: string) => {
+    setStatusMessage({ tone, message });
+    window.setTimeout(() => setStatusMessage(null), 4000);
+  }, []);
+
+  const loadData = useCallback(async () => {
+    setLoading(true);
+    try {
+      const [catalogRes, overridesRes] = await Promise.all([
+        fetch("/api/pricing/models"),
+        fetch("/api/model-capability-overrides"),
+      ]);
+      if (catalogRes.ok)
+        setCatalog((await catalogRes.json()) as Record<string, PricingCatalogProvider>);
+      if (overridesRes.ok) {
+        const payload = (await overridesRes.json()) as { overrides?: ModelCapabilityOverride[] };
+        setOverrides(payload.overrides || []);
+      }
+    } catch (error) {
+      console.error("Failed to load model capability overrides:", error);
+      showStatus("error", t("modelOverrideLoadFailed"));
+    } finally {
+      setLoading(false);
+    }
+  }, [showStatus, t]);
+
+  const saveOverride = useCallback(
+    async (target: string, key: ModelOverrideKey, value: number) => {
+      try {
+        const response = await fetch("/api/model-capability-overrides", {
+          method: "PATCH",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ target, key, value }),
+        });
+        if (!response.ok) throw new Error(t("modelOverrideSaveFailed"));
+        const payload = (await response.json()) as { overrides?: ModelCapabilityOverride[] };
+        setOverrides(payload.overrides || []);
+        showStatus("success", t("modelOverrideSaved"));
+      } catch (error: any) {
+        showStatus("error", error?.message || t("modelOverrideSaveFailed"));
+      }
+    },
+    [showStatus, t]
+  );
+
+  const removeOverride = useCallback(
+    async (target: string, key: ModelOverrideKey) => {
+      try {
+        const params = new URLSearchParams({ target, key });
+        const response = await fetch(`/api/model-capability-overrides?${params.toString()}`, {
+          method: "DELETE",
+        });
+        if (!response.ok) throw new Error(t("modelOverrideRemoveFailed"));
+        const payload = (await response.json()) as { overrides?: ModelCapabilityOverride[] };
+        setOverrides(payload.overrides || []);
+        showStatus("info", t("modelOverrideRemoved"));
+      } catch (error: any) {
+        showStatus("error", error?.message || t("modelOverrideRemoveFailed"));
+      }
+    },
+    [showStatus, t]
+  );
+
+  useEffect(() => {
+    void loadData();
+  }, [loadData]);
+
+  return { catalog, overrides, loading, statusMessage, saveOverride, removeOverride };
+}
+
+function toTargets(catalog: Record<string, PricingCatalogProvider>): ModelOverrideTarget[] {
+  return Object.values(catalog).flatMap((provider) =>
+    provider.models.map((model) => ({
+      target: `${provider.id}/${model.id}`,
+      provider: provider.id,
+      modelId: model.id,
+      label: `${provider.id}/${model.id}`,
+    }))
+  );
+}
+
+export default function ModelCapabilityOverridesTab() {
+  const t = useTranslations("settings");
+  const { catalog, overrides, loading, statusMessage, saveOverride, removeOverride } =
+    useModelCapabilityOverridesData();
+  const targets = useMemo(() => toTargets(catalog), [catalog]);
+
+  if (loading) return <div className="text-sm text-text-muted animate-pulse">{t("loading")}</div>;
+
+  return (
+    <div className="space-y-3">
+      <ModelCapabilityOverridesPanel
+        targets={targets}
+        overrides={overrides}
+        onSave={(target, key, value) => void saveOverride(target, key, value)}
+        onRemove={(target, key) => void removeOverride(target, key)}
+      />
+      {statusMessage && <StatusMessageBanner status={statusMessage} />}
+    </div>
+  );
+}
+
+function StatusMessageBanner({ status }: { status: StatusMessage }) {
+  return (
+    <div className={`px-3 py-2 rounded-lg border text-sm ${statusClassName(status.tone)}`}>
+      {status.message}
+    </div>
+  );
+}
+
+function ModelCapabilityOverridesPanel({
+  targets,
+  overrides,
+  onSave,
+  onRemove,
+}: {
+  targets: ModelOverrideTarget[];
+  overrides: ModelCapabilityOverride[];
+  onSave: (target: string, key: ModelOverrideKey, value: number) => void;
+  onRemove: (target: string, key: ModelOverrideKey) => void;
+}) {
+  const [selectedTarget, setSelectedTarget] = useState("");
+  const [search, setSearch] = useState("");
+  const filteredTargets = useFilteredTargets(targets, search);
+  const activeTarget = selectedTarget || filteredTargets[0]?.target || "";
+  const activeOverrides = overrides.filter((entry) => entry.target === activeTarget);
+
+  return (
+    <Card className="p-4">
+      <ModelOverridesHeader count={overrides.length} />
+      <div className="grid grid-cols-1 lg:grid-cols-[minmax(260px,0.9fr)_minmax(360px,1.1fr)] gap-4">
+        <ModelOverrideTargetList
+          activeTarget={activeTarget}
+          filteredTargets={filteredTargets}
+          overrides={overrides}
+          search={search}
+          setSearch={setSearch}
+          setSelectedTarget={setSelectedTarget}
+        />
+        <ModelOverrideEditor
+          activeOverrides={activeOverrides}
+          activeTarget={activeTarget}
+          onRemove={onRemove}
+          onSave={onSave}
+        />
+      </div>
+    </Card>
+  );
+}
+
+function useFilteredTargets(targets: ModelOverrideTarget[], search: string) {
+  return useMemo(() => {
+    const query = search.trim();
+    const source = query
+      ? targets.filter((entry) =>
+          [entry.label, entry.target, entry.provider, entry.modelId].some((candidate) =>
+            matchesSearch(candidate, query)
+          )
+        )
+      : targets;
+    return source.slice(0, 80);
+  }, [search, targets]);
+}
+
+function ModelOverridesHeader({ count }: { count: number }) {
+  const t = useTranslations("settings");
+  return (
+    <div className="flex items-start justify-between gap-3 mb-3">
+      <div>
+        <h3 className="text-sm font-bold flex items-center gap-2">
+          <span className="material-symbols-outlined text-[18px] text-primary">tune</span>
+          {t("modelOverridesTitle")}
+        </h3>
+        <p className="text-xs text-text-muted mt-1">{t("modelOverridesDesc")}</p>
+      </div>
+      <span className="text-[10px] px-2 py-1 rounded-md border border-border bg-bg-subtle text-text-muted">
+        {count} {t("configured")}
+      </span>
+    </div>
+  );
+}
+
+function ModelOverrideTargetList({
+  activeTarget,
+  filteredTargets,
+  overrides,
+  search,
+  setSearch,
+  setSelectedTarget,
+}: {
+  activeTarget: string;
+  filteredTargets: ModelOverrideTarget[];
+  overrides: ModelCapabilityOverride[];
+  search: string;
+  setSearch: (value: string) => void;
+  setSelectedTarget: (value: string) => void;
+}) {
+  const t = useTranslations("settings");
+  return (
+    <div className="rounded-lg border border-border/50 overflow-hidden">
+      <div className="p-2 border-b border-border/50 bg-bg-subtle/40">
+        <input
+          type="text"
+          value={search}
+          onChange={(event) => setSearch(event.target.value)}
+          placeholder={t("searchModelOverrideTargets")}
+          className="w-full px-3 py-2 text-xs bg-bg-base border border-border rounded-md focus:outline-none focus:border-primary"
+        />
+      </div>
+      <div className="max-h-56 overflow-y-auto divide-y divide-border/40">
+        {filteredTargets.map((entry) => (
+          <ModelOverrideTargetButton
+            key={entry.target}
+            active={entry.target === activeTarget}
+            count={overrides.filter((override) => override.target === entry.target).length}
+            entry={entry}
+            onSelect={setSelectedTarget}
+          />
+        ))}
+      </div>
+    </div>
+  );
+}
+
+function ModelOverrideTargetButton({
+  active,
+  count,
+  entry,
+  onSelect,
+}: {
+  active: boolean;
+  count: number;
+  entry: ModelOverrideTarget;
+  onSelect: (target: string) => void;
+}) {
+  return (
+    <button
+      type="button"
+      onClick={() => onSelect(entry.target)}
+      className={`w-full px-3 py-2 text-left text-xs flex items-center justify-between gap-2 hover:bg-bg-hover/50 ${
+        active ? "bg-primary/10 text-primary" : "text-text-main"
+      }`}
+    >
+      <span className="truncate font-mono">{entry.label}</span>
+      {count > 0 && (
+        <span className="shrink-0 text-[10px] px-1.5 py-0.5 rounded bg-amber-500/15 text-amber-400">
+          {count}
+        </span>
+      )}
+    </button>
+  );
+}
+
+function ModelOverrideEditor({
+  activeOverrides,
+  activeTarget,
+  onRemove,
+  onSave,
+}: {
+  activeOverrides: ModelCapabilityOverride[];
+  activeTarget: string;
+  onRemove: (target: string, key: ModelOverrideKey) => void;
+  onSave: (target: string, key: ModelOverrideKey, value: number) => void;
+}) {
+  const t = useTranslations("settings");
+  return (
+    <div className="rounded-lg border border-border/50 p-3 flex flex-col gap-3">
+      <div>
+        <p className="text-[10px] uppercase tracking-wide text-text-muted font-semibold mb-1">
+          {t("selectedModel")}
+        </p>
+        <p className="text-xs font-mono break-all">{activeTarget || t("none")}</p>
+      </div>
+      <ModelOverrideForm activeTarget={activeTarget} onSave={onSave} />
+      <ModelOverrideRows activeOverrides={activeOverrides} onRemove={onRemove} />
+    </div>
+  );
+}
+
+function ModelOverrideForm({
+  activeTarget,
+  onSave,
+}: {
+  activeTarget: string;
+  onSave: (target: string, key: ModelOverrideKey, value: number) => void;
+}) {
+  const t = useTranslations("settings");
+  const [key, setKey] = useState<ModelOverrideKey>("max_token");
+  const [value, setValue] = useState("");
+  const numericValue = Number(value);
+  const saveDisabled = !activeTarget || !Number.isInteger(numericValue) || numericValue <= 0;
+
+  return (
+    <div className="flex flex-col sm:flex-row gap-2">
+      <select
+        value={key}
+        onChange={(event) => setKey(event.target.value as ModelOverrideKey)}
+        className="sm:w-40 px-2 py-2 text-xs bg-bg-base border border-border rounded-md focus:outline-none focus:border-primary"
+      >
+        <option value="max_token">max_token</option>
+      </select>
+      <input
+        type="number"
+        min="1"
+        step="1"
+        value={value}
+        onChange={(event) => setValue(event.target.value)}
+        placeholder={t("modelOverrideValuePlaceholder")}
+        className="flex-1 px-3 py-2 text-xs bg-bg-base border border-border rounded-md focus:outline-none focus:border-primary"
+      />
+      <Button
+        variant="primary"
+        size="sm"
+        disabled={saveDisabled}
+        onClick={() => {
+          onSave(activeTarget, key, numericValue);
+          setValue("");
+        }}
+      >
+        {t("addKeyValue")}
+      </Button>
+    </div>
+  );
+}
+
+function ModelOverrideRows({
+  activeOverrides,
+  onRemove,
+}: {
+  activeOverrides: ModelCapabilityOverride[];
+  onRemove: (target: string, key: ModelOverrideKey) => void;
+}) {
+  const t = useTranslations("settings");
+  return (
+    <div className="rounded-md border border-border/40 overflow-hidden">
+      {activeOverrides.length === 0 ? (
+        <div className="px-3 py-4 text-xs text-text-muted text-center">{t("noModelOverrides")}</div>
+      ) : (
+        <div className="divide-y divide-border/40">
+          {activeOverrides.map((override) => (
+            <ModelOverrideRow
+              key={`${override.target}:${override.key}`}
+              override={override}
+              onRemove={onRemove}
+            />
+          ))}
+        </div>
+      )}
+    </div>
+  );
+}
+
+function ModelOverrideRow({
+  override,
+  onRemove,
+}: {
+  override: ModelCapabilityOverride;
+  onRemove: (target: string, key: ModelOverrideKey) => void;
+}) {
+  const t = useTranslations("settings");
+  return (
+    <div className="px-3 py-2 flex items-center justify-between gap-2 text-xs">
+      <div className="flex items-center gap-2 min-w-0">
+        <span className="font-mono px-1.5 py-0.5 rounded bg-bg-subtle">{override.key}</span>
+        <span className="font-semibold tabular-nums">{override.value}</span>
+      </div>
+      <button
+        type="button"
+        onClick={() => onRemove(override.target, override.key)}
+        className="text-red-400 hover:bg-red-500/10 rounded px-2 py-1"
+      >
+        {t("remove")}
+      </button>
+    </div>
+  );
+}
diff --git a/src/app/(dashboard)/dashboard/settings/components/PricingTab.tsx b/src/app/(dashboard)/dashboard/settings/components/PricingTab.tsx
index bde7ff2fb2..eb0a62d654 100644
--- a/src/app/(dashboard)/dashboard/settings/components/PricingTab.tsx
+++ b/src/app/(dashboard)/dashboard/settings/components/PricingTab.tsx
@@ -437,10 +437,6 @@ export default function PricingTab() {
     }
   }, [loadData, showStatus, t]);
 
-  const selectProviderFilter = useCallback((alias: string) => {
-    setSelectedProvider((previous) => (previous === alias ? null : alias));
-  }, []);
-
   if (loading) {
     return (
       <div className="flex items-center justify-center py-16">
diff --git a/src/app/(dashboard)/dashboard/settings/components/ProviderAccountRoutingCard.tsx b/src/app/(dashboard)/dashboard/settings/components/ProviderAccountRoutingCard.tsx
new file mode 100644
index 0000000000..40bd288f7e
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/settings/components/ProviderAccountRoutingCard.tsx
@@ -0,0 +1,132 @@
+"use client";
+
+import { useCallback, useEffect, useState } from "react";
+import { Input, Select } from "@/shared/components";
+import { useTranslations } from "next-intl";
+import { ACCOUNT_FALLBACK_STRATEGY_VALUES } from "@/shared/constants/routingStrategies";
+
+type ProviderStrategyOverride = {
+  fallbackStrategy?: string;
+  stickyRoundRobinLimit?: number;
+};
+
+type Props = {
+  providerKey: string;
+  connectionCount: number;
+};
+
+const STRATEGY_OPTIONS = ACCOUNT_FALLBACK_STRATEGY_VALUES.filter((v) =>
+  ["fill-first", "round-robin", "priority", "p2c", "random", "least-used"].includes(v)
+);
+
+function clampProviderStickyLimit(raw: string): number {
+  const val = parseInt(raw, 10);
+  return Math.min(10, Math.max(1, Number.isNaN(val) ? 3 : val));
+}
+
+/** Loads/saves the per-provider account-routing override. Extracted out of the
+ * component body to keep ProviderAccountRoutingCard's own render function small. */
+function useProviderAccountRoutingState(providerKey: string) {
+  const [strategy, setStrategy] = useState<string>("");
+  const [stickyLimit, setStickyLimit] = useState("3");
+  const [busy, setBusy] = useState(false);
+
+  const load = useCallback(async () => {
+    const res = await fetch("/api/settings", { cache: "no-store" });
+    if (!res.ok) return;
+    const data = await res.json();
+    const override = ((data?.providerStrategies || {}) as Record<string, ProviderStrategyOverride>)[
+      providerKey
+    ];
+    setStrategy(override?.fallbackStrategy || "");
+    setStickyLimit(
+      override?.stickyRoundRobinLimit != null ? String(override.stickyRoundRobinLimit) : ""
+    );
+  }, [providerKey]);
+
+  useEffect(() => {
+    load().catch(console.error);
+  }, [load]);
+
+  const save = useCallback(
+    async (nextStrategy: string, nextSticky: string) => {
+      setBusy(true);
+      try {
+        const res = await fetch("/api/settings", { cache: "no-store" });
+        if (!res.ok) throw new Error("Failed to fetch current settings");
+        const data = await res.json();
+        const current = (data?.providerStrategies || {}) as Record<
+          string,
+          ProviderStrategyOverride
+        >;
+        const override: ProviderStrategyOverride = {};
+        if (nextStrategy) override.fallbackStrategy = nextStrategy;
+        if (nextStrategy === "round-robin" && nextSticky !== "") {
+          override.stickyRoundRobinLimit = clampProviderStickyLimit(nextSticky);
+        }
+        const updated = { ...current };
+        if (Object.keys(override).length === 0) delete updated[providerKey];
+        else updated[providerKey] = override;
+        const patchRes = await fetch("/api/settings", {
+          method: "PATCH",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ providerStrategies: updated }),
+        });
+        if (!patchRes.ok) throw new Error("Failed to save provider routing settings");
+      } catch (e) {
+        console.error(e);
+      } finally {
+        setBusy(false);
+      }
+    },
+    [providerKey]
+  );
+
+  return { strategy, setStrategy, stickyLimit, setStickyLimit, busy, save };
+}
+
+export default function ProviderAccountRoutingCard({ providerKey, connectionCount }: Props) {
+  const t = useTranslations("settings");
+  const { strategy, setStrategy, stickyLimit, setStickyLimit, busy, save } =
+    useProviderAccountRoutingState(providerKey);
+
+  if (connectionCount < 2) return null;
+
+  return (
+    <div className="mb-4 rounded-lg border border-border/60 bg-black/[0.02] dark:bg-white/[0.02] p-3">
+      <p className="text-sm font-medium">{t("providerAccountRoutingTitle")}</p>
+      <p className="text-xs text-text-muted mb-3">{t("providerAccountRoutingDesc")}</p>
+      <div className="grid grid-cols-1 sm:grid-cols-2 gap-3">
+        <Select
+          label={t("providerRoutingStrategy")}
+          disabled={busy}
+          value={strategy}
+          onChange={(e) => {
+            const v = e.target.value;
+            setStrategy(v);
+            save(v, stickyLimit).catch(console.error);
+          }}
+        >
+          <option value="">{t("providerRoutingInheritGlobal")}</option>
+          {STRATEGY_OPTIONS.map((opt) => (
+            <option key={opt} value={opt}>
+              {opt}
+            </option>
+          ))}
+        </Select>
+        {strategy === "round-robin" && (
+          <Input
+            label={t("stickyLimit")}
+            type="number"
+            min={1}
+            max={10}
+            disabled={busy}
+            value={stickyLimit || "3"}
+            onChange={(e) => setStickyLimit(e.target.value)}
+            onBlur={() => save(strategy, stickyLimit).catch(console.error)}
+          />
+        )}
+      </div>
+    </div>
+  );
+}
\ No newline at end of file
diff --git a/src/app/(dashboard)/dashboard/settings/components/ProxyRegistryManager.tsx b/src/app/(dashboard)/dashboard/settings/components/ProxyRegistryManager.tsx
index 9e064eeeee..6f7cfc6189 100644
--- a/src/app/(dashboard)/dashboard/settings/components/ProxyRegistryManager.tsx
+++ b/src/app/(dashboard)/dashboard/settings/components/ProxyRegistryManager.tsx
@@ -2,26 +2,16 @@
 
 import { useCallback, useEffect, useMemo, useState } from "react";
 import { useTranslations } from "next-intl";
+import { z } from "zod";
 import { Button, Card, Modal } from "@/shared/components";
 import { useProxyBatchOperations } from "./useProxyBatchOperations";
 import { ProxyStatusBadge } from "./ProxyStatusBadge";
 import { ProxyHealthCell } from "./ProxyHealthCell";
 import { ProxyBatchActions } from "./ProxyBatchActions";
 import { ProxyCheckboxCell } from "./ProxyCheckboxCell";
-
-type ProxyItem = {
-  id: string;
-  name: string;
-  type: string;
-  host: string;
-  port: number;
-  username?: string | null;
-  password?: string | null;
-  region?: string | null;
-  notes?: string | null;
-  status?: string;
-  family?: string;
-};
+import { parseBulkImportText, type ParsedProxyEntry, type ParseError } from "./parseBulkProxyImport";
+import { POOL_STRATEGY_OPTIONS, isPoolStrategy, type PoolStrategy } from "./proxyStrategyOptions";
+import type { ProxyItem } from "./proxyRegistryTypes";
 
 type UsageInfo = {
   count: number;
@@ -44,23 +34,6 @@ type TestResult = {
   error?: string;
 };
 
-type ParsedProxyEntry = {
-  name: string;
-  host: string;
-  port: number;
-  username: string;
-  password: string;
-  type: string;
-  region: string;
-  status: string;
-  notes: string;
-};
-
-type ParseError = {
-  line: number;
-  reason: string;
-};
-
 const EMPTY_FORM = {
   id: "",
   name: "",
@@ -76,85 +49,53 @@ const EMPTY_FORM = {
 };
 
 const BULK_IMPORT_TEMPLATE = `# Proxy Bulk Import
-# Format: NAME|HOST|PORT|USERNAME|PASSWORD|TYPE|REGION|STATUS|NOTES
-# Required: NAME, HOST, PORT
-# Optional: USERNAME, PASSWORD, TYPE (http|https|socks5, default: socks5), REGION, STATUS (active|inactive, default: active), NOTES
+# ─────────────────────────────────────────────────────────────────────────────
+# FORMAT 1 — Pipe-delimited (full control):
+#   NAME|HOST|PORT|USERNAME|PASSWORD|TYPE|REGION|STATUS|NOTES
+#   Required: NAME, HOST, PORT
+#   Optional: USERNAME, PASSWORD, TYPE (http|https|socks5, default: socks5), REGION, STATUS (active|inactive, default: active), NOTES
+#
+# FORMAT 2 — Shorthand (one proxy per line, no pipe needed):
+#   ip:port                          → no auth, type defaults to socks5
+#   ip:port:user:pass                → with auth
+#   user:pass@ip:port                → with auth (@-style)
+#   user:pass:ip:port                 → with auth (user-pass-first)
+#   protocol://ip:port               → explicit protocol
+#   protocol://user:pass@ip:port     → explicit protocol + auth
+#
+# FORMAT 3 — Protocol header mode:
+#   Put a bare protocol (http, https, socks5) on its own line to set
+#   the default type for all subsequent shorthand lines that don't
+#   include an explicit protocol:// prefix.
+#
 # Lines starting with # are ignored. Existing proxies (same host+port) will be updated.
 #
-# SOCKS5 examples:
+# ─────────────────────────────────────────────────────────────────────────────
+# Pipe-delimited examples:
 # proxy-us|138.99.147.218|50101|myuser|mypass|socks5|US-East|active|US production proxy
 # proxy-eu|200.234.177.62|50101|myuser|mypass|socks5|EU-West
-#
-# HTTP/HTTPS examples:
 # http-proxy|10.0.0.50|8080|||http||active|Internal HTTP proxy
-# https-proxy|proxy.example.com|443|admin|secret123|https|US|active
-`;
+#
+# Shorthand examples:
+# 138.99.147.218:50101
+# 138.99.147.218:50101:myuser:mypass
+# myuser:mypass@138.99.147.218:50101
+# myuser:mypass:138.99.147.218:50101
+# http://10.0.0.50:8080
+# https://admin:secret123@proxy.example.com:443
+#
+# Protocol header mode example:
+# socks5
+# 138.99.147.218:50101:myuser:mypass
+# 200.234.177.62:50101:otheruser:otherpass
+#`;
 
-const VALID_TYPES = new Set(["http", "https", "socks5"]);
-const VALID_STATUSES = new Set(["active", "inactive"]);
 
-function parseBulkImportText(text: string): {
-  entries: ParsedProxyEntry[];
-  errors: ParseError[];
-  skipped: number;
-} {
-  const lines = text.split("\n");
-  const entries: ParsedProxyEntry[] = [];
-  const errors: ParseError[] = [];
-  let skipped = 0;
-
-  for (let i = 0; i < lines.length; i++) {
-    const raw = lines[i].trim();
-    if (!raw || raw.startsWith("#")) {
-      skipped++;
-      continue;
-    }
-
-    const parts = raw.split("|").map((p) => p.trim());
-    const [name, host, portStr, username, password, type, region, status, notes] = parts;
-    const lineNum = i + 1;
-
-    if (!name) {
-      errors.push({ line: lineNum, reason: "bulkImportErrorMissingName" });
-      continue;
-    }
-    if (!host) {
-      errors.push({ line: lineNum, reason: "bulkImportErrorMissingHost" });
-      continue;
-    }
-    const port = Number(portStr);
-    if (!portStr || isNaN(port) || port < 1 || port > 65535) {
-      errors.push({ line: lineNum, reason: "bulkImportErrorInvalidPort" });
-      continue;
-    }
-    const normalizedType = (type || "socks5").toLowerCase();
-    if (!VALID_TYPES.has(normalizedType)) {
-      errors.push({ line: lineNum, reason: "bulkImportErrorInvalidType" });
-      continue;
-    }
-    const normalizedStatus = (status || "active").toLowerCase();
-    if (!VALID_STATUSES.has(normalizedStatus)) {
-      errors.push({ line: lineNum, reason: "bulkImportErrorInvalidStatus" });
-      continue;
-    }
-
-    entries.push({
-      name,
-      host,
-      port,
-      username: username || "",
-      password: password || "",
-      type: normalizedType,
-      region: region || "",
-      status: normalizedStatus,
-      notes: notes || "",
-    });
-  }
-
-  return { entries, errors, skipped };
-}
-
-export default function ProxyRegistryManager() {
+export default function ProxyRegistryManager({
+  onRedeployRelay,
+}: {
+  onRedeployRelay?: (proxy: ProxyItem) => void;
+} = {}) {
   const t = useTranslations("proxyRegistry");
   const [items, setItems] = useState<ProxyItem[]>([]);
   const [loading, setLoading] = useState(false);
@@ -168,6 +109,10 @@ export default function ProxyRegistryManager() {
   const [healthById, setHealthById] = useState<Record<string, HealthInfo>>({});
   const [testById, setTestById] = useState<Record<string, TestResult | null>>({});
   const [testingId, setTestingId] = useState<string | null>(null);
+  const [repairingId, setRepairingId] = useState<string | null>(null);
+  const [repairErrorById, setRepairErrorById] = useState<Record<string, string>>({});
+  const [relayTested, setRelayTested] = useState<number | null>(null);
+  const [relayAlive, setRelayAlive] = useState<number | null>(null);
   const [migrating, setMigrating] = useState(false);
   const [bulkOpen, setBulkOpen] = useState(false);
   const [bulkSaving, setBulkSaving] = useState(false);
@@ -180,16 +125,12 @@ export default function ProxyRegistryManager() {
   const [poolOpen, setPoolOpen] = useState(false);
   const [poolScope, setPoolScope] = useState("provider");
   const [poolScopeId, setPoolScopeId] = useState("");
-  const [poolStrategy, setPoolStrategy] = useState<"round-robin" | "random" | "sticky">(
-    "round-robin"
-  );
+  const [poolStrategy, setPoolStrategy] = useState<PoolStrategy>("round-robin");
   const [poolMembers, setPoolMembers] = useState<string[]>([]);
   const [poolAddProxyId, setPoolAddProxyId] = useState("");
   const [poolLoading, setPoolLoading] = useState(false);
-  const [poolSaving, setPoolSaving] = useState(false);
   const [poolLoaded, setPoolLoaded] = useState(false);
-
-  // Bulk Import state
+  const [poolSaving, setPoolSaving] = useState(false);
   const [bulkImportOpen, setBulkImportOpen] = useState(false);
   const [bulkImportText, setBulkImportText] = useState(BULK_IMPORT_TEMPLATE);
   const [bulkImportParsed, setBulkImportParsed] = useState<ParsedProxyEntry[]>([]);
@@ -261,6 +202,11 @@ export default function ProxyRegistryManager() {
         setItems([]);
         return;
       }
+      const stats = data?.relayProbeStats;
+      if (stats && typeof stats.tested === "number" && typeof stats.alive === "number") {
+        setRelayTested(stats.tested);
+        setRelayAlive(stats.alive);
+      }
       const loaded: ProxyItem[] = Array.isArray(data?.items) ? data.items : [];
       setItems(loaded);
       const ids = loaded.map((p) => p.id).filter(Boolean);
@@ -396,6 +342,51 @@ export default function ProxyRegistryManager() {
     }
   };
 
+  const repairRelayResponseSchema = z.object({
+    repaired: z.boolean().optional(),
+    mode: z.enum(["noop", "recovered", "redeploy"]).optional(),
+    error: z.object({ message: z.string() }).optional(),
+  });
+
+  const handleRepairRelay = async (item: ProxyItem) => {
+    if (repairingId || !item.relayInfo?.isRelay) return;
+    setRepairingId(item.id);
+    setRepairErrorById((prev) => {
+      const next = { ...prev };
+      delete next[item.id];
+      return next;
+    });
+    try {
+      const res = await fetch(`/api/settings/proxies/${item.id}/repair-relay`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ id: item.id }),
+      });
+      const parsed = repairRelayResponseSchema.safeParse(await res.json());
+      const data = parsed.success ? parsed.data : {};
+      if (!res.ok) {
+        if (res.status === 409 && onRedeployRelay) {
+          onRedeployRelay(item);
+          return;
+        }
+        const message =
+          res.status === 409
+            ? t("relayRepairRedeployRequired")
+            : data.error?.message || t("relayRepairFailed");
+        setRepairErrorById((prev) => ({ ...prev, [item.id]: message }));
+        return;
+      }
+      if (data.repaired) {
+        await load();
+      }
+    } catch (e: unknown) {
+      const message = e instanceof Error ? e.message : t("relayRepairFailed");
+      setRepairErrorById((prev) => ({ ...prev, [item.id]: message }));
+    } finally {
+      setRepairingId(null);
+    }
+  };
+
   const handleSave = async () => {
     if (!(form.name || "").trim() || !(form.host || "").trim()) {
       setError(t("errorNameHostRequired"));
@@ -406,6 +397,7 @@ export default function ProxyRegistryManager() {
     setError(null);
 
     const normalizedUsername = (form.username || "").trim();
+
     const normalizedPassword = (form.password || "").trim();
 
     const payload: Record<string, unknown> = {
@@ -569,11 +561,7 @@ export default function ProxyRegistryManager() {
         ? payload.members
         : [];
       setPoolMembers(members.map((m) => m.proxyId));
-      setPoolStrategy(
-        ["round-robin", "random", "sticky"].includes(payload?.strategy)
-          ? payload.strategy
-          : "round-robin"
-      );
+      setPoolStrategy(isPoolStrategy(payload?.strategy) ? payload.strategy : "round-robin");
       setPoolLoaded(true);
     } catch (e: any) {
       setError(e?.message || t("poolLoadFailed"));
@@ -638,7 +626,7 @@ export default function ProxyRegistryManager() {
     }
   };
 
-  const handlePoolStrategyChange = async (strategy: "round-robin" | "random" | "sticky") => {
+  const handlePoolStrategyChange = async (strategy: PoolStrategy) => {
     const previous = poolStrategy;
     setPoolStrategy(strategy);
     setError(null);
@@ -813,6 +801,11 @@ export default function ProxyRegistryManager() {
             {error}
           </div>
         )}
+        {relayTested !== null && relayAlive !== null && (
+          <div className="mb-3 px-3 py-2 rounded border border-border/60 bg-surface-alt text-xs text-text-muted">
+            {t("relayProbeSummary", { tested: relayTested, alive: relayAlive })}
+          </div>
+        )}
 
         {loading ? (
           <div className="text-sm text-text-muted">{t("loading")}</div>
@@ -889,6 +882,33 @@ export default function ProxyRegistryManager() {
                           >
                             {t("test")}
                           </Button>
+                          {item.relayInfo?.isRelay &&
+                            (item.relayInfo.repairMode === "redeploy" ||
+                              item.relayInfo.repairMode === "recovered") && (
+                              <Button
+                                size="sm"
+                                variant="ghost"
+                                icon="build"
+                                onClick={() => void handleRepairRelay(item)}
+                                loading={repairingId === item.id}
+                                title={t("relayRepairTooltip")}
+                              >
+                                {t("repair")}
+                              </Button>
+                            )}
+                          {item.relayInfo?.isRelay && item.relayInfo.authMissing && (
+                            <span className="ml-1 rounded bg-amber-500/15 px-1.5 py-0.5 text-[10px] font-medium text-amber-400">
+                              {t("relayAuthMissing")}
+                            </span>
+                          )}
+                          {repairErrorById[item.id] && (
+                            <span
+                              className="ml-1 text-[10px] text-red-400"
+                              title={repairErrorById[item.id]}
+                            >
+                              {t("relayRepairError")}
+                            </span>
+                          )}
                           <Button
                             size="sm"
                             variant="ghost"
@@ -1151,7 +1171,9 @@ export default function ProxyRegistryManager() {
             </div>
             {poolScope !== "global" && (
               <div>
-                <label className="text-xs text-text-muted mb-1 block">{t("poolScopeIdLabel")}</label>
+                <label className="text-xs text-text-muted mb-1 block">
+                  {t("poolScopeIdLabel")}
+                </label>
                 <input
                   className="w-full px-3 py-2 rounded bg-bg-subtle border border-border"
                   value={poolScopeId}
@@ -1183,20 +1205,22 @@ export default function ProxyRegistryManager() {
           {poolLoaded && (
             <>
               <div>
-                <label className="text-xs text-text-muted mb-1 block">{t("poolStrategyLabel")}</label>
+                <label className="text-xs text-text-muted mb-1 block">
+                  {t("poolStrategyLabel")}
+                </label>
                 <select
                   className="w-full px-3 py-2 rounded bg-bg-subtle border border-border"
                   value={poolStrategy}
                   onChange={(e) =>
-                    handlePoolStrategyChange(
-                      e.target.value as "round-robin" | "random" | "sticky"
-                    )
+                    handlePoolStrategyChange(e.target.value as "round-robin" | "random" | "sticky")
                   }
                   data-testid="proxy-registry-pool-strategy"
                 >
-                  <option value="round-robin">{t("strategyRoundRobin")}</option>
-                  <option value="random">{t("strategyRandom")}</option>
-                  <option value="sticky">{t("strategySticky")}</option>
+                  {POOL_STRATEGY_OPTIONS.map((opt) => (
+                    <option key={opt.value} value={opt.value}>
+                      {t(opt.labelKey)}
+                    </option>
+                  ))}
                 </select>
                 <p className="text-xs text-text-muted mt-1">{t("poolStrategyHint")}</p>
               </div>
diff --git a/src/app/(dashboard)/dashboard/settings/components/RoutingStrategyCard.tsx b/src/app/(dashboard)/dashboard/settings/components/RoutingStrategyCard.tsx
new file mode 100644
index 0000000000..20e9efe6bd
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/settings/components/RoutingStrategyCard.tsx
@@ -0,0 +1,282 @@
+"use client";
+
+import { useCallback, useEffect, useState } from "react";
+import { Card, Input, Toggle } from "@/shared/components";
+import { useTranslations } from "next-intl";
+
+type RoutingSettings = {
+  fallbackStrategy?: string;
+  stickyRoundRobinLimit?: number | string;
+  comboStrategy?: string;
+  comboStickyRoundRobinLimit?: number | string;
+};
+
+type Translate = ReturnType<typeof useTranslations>;
+
+async function patchSettings(body: Record<string, unknown>) {
+  const res = await fetch("/api/settings", {
+    method: "PATCH",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  if (!res.ok) throw new Error("settings patch failed");
+  return res.json();
+}
+
+async function patchComboDefaultsStrategy(strategy: string) {
+  const res = await fetch("/api/settings/combo-defaults", {
+    method: "PATCH",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ comboDefaults: { strategy } }),
+  });
+  if (!res.ok) throw new Error("combo-defaults patch failed");
+}
+
+function numericLimit(value: number | string | undefined, fallback: number): number {
+  const n = typeof value === "number" ? value : parseInt(String(value), 10);
+  return Number.isFinite(n) ? n : fallback;
+}
+
+/** Loads/persists the routing-strategy settings and tracks loading/busy state.
+ * Extracted out of the component body to keep RoutingStrategyCard's own render
+ * function under the complexity/size gate. */
+function useRoutingStrategySettings() {
+  const [settings, setSettings] = useState<RoutingSettings>({
+    fallbackStrategy: "fill-first",
+    stickyRoundRobinLimit: 3,
+    comboStrategy: "fallback",
+    comboStickyRoundRobinLimit: 1,
+  });
+  const [loading, setLoading] = useState(true);
+  const [busy, setBusy] = useState(false);
+
+  const load = useCallback(async () => {
+    setLoading(true);
+    try {
+      const res = await fetch("/api/settings", { cache: "no-store" });
+      if (!res.ok) return;
+      const data = await res.json();
+      setSettings({
+        fallbackStrategy: data?.fallbackStrategy || "fill-first",
+        stickyRoundRobinLimit: data?.stickyRoundRobinLimit ?? 3,
+        comboStrategy: data?.comboStrategy || "fallback",
+        comboStickyRoundRobinLimit: data?.comboStickyRoundRobinLimit ?? 1,
+      });
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    load().catch(console.error);
+  }, [load]);
+
+  const run = useCallback(async (fn: () => Promise<void>) => {
+    setBusy(true);
+    try {
+      await fn();
+    } catch (e) {
+      console.error(e);
+    } finally {
+      setBusy(false);
+    }
+  }, []);
+
+  return { settings, setSettings, loading, busy, run };
+}
+
+type SectionProps = {
+  t: Translate;
+  busy: boolean;
+  settings: RoutingSettings;
+  setSettings: React.Dispatch<React.SetStateAction<RoutingSettings>>;
+  run: (fn: () => Promise<void>) => Promise<void>;
+};
+
+function AccountRoundRobinSection({ t, busy, settings, setSettings, run }: SectionProps) {
+  const accountRoundRobin = settings.fallbackStrategy === "round-robin";
+  return (
+    <>
+      <div className="flex items-start sm:items-center justify-between gap-4">
+        <div className="flex-1 min-w-0">
+          <p className="font-medium text-sm sm:text-base">{t("accountRoundRobin")}</p>
+          <p className="text-xs sm:text-sm text-text-muted">{t("accountRoundRobinDesc")}</p>
+        </div>
+        <Toggle
+          checked={accountRoundRobin}
+          disabled={busy}
+          onChange={() =>
+            run(async () => {
+              const next = accountRoundRobin ? "fill-first" : "round-robin";
+              const updated = await patchSettings({ fallbackStrategy: next });
+              setSettings((prev) => ({ ...prev, fallbackStrategy: updated.fallbackStrategy || next }));
+            })
+          }
+        />
+      </div>
+
+      {accountRoundRobin && (
+        <div className="flex items-start sm:items-center justify-between gap-4 pt-2 border-t border-border/50">
+          <div className="flex-1 min-w-0">
+            <p className="font-medium text-sm sm:text-base">{t("stickyLimit")}</p>
+            <p className="text-xs sm:text-sm text-text-muted">{t("stickyLimitDesc")}</p>
+          </div>
+          <Input
+            type="number"
+            min={1}
+            max={10}
+            disabled={busy}
+            className="w-16 sm:w-20 text-center shrink-0"
+            value={settings.stickyRoundRobinLimit ?? 3}
+            onChange={(e) => setSettings((prev) => ({ ...prev, stickyRoundRobinLimit: e.target.value }))}
+            onBlur={() =>
+              run(async () => {
+                const limit = Math.min(
+                  10,
+                  Math.max(1, parseInt(String(settings.stickyRoundRobinLimit), 10) || 3)
+                );
+                const updated = await patchSettings({ stickyRoundRobinLimit: limit });
+                setSettings((prev) => ({
+                  ...prev,
+                  stickyRoundRobinLimit: updated.stickyRoundRobinLimit ?? limit,
+                }));
+              })
+            }
+          />
+        </div>
+      )}
+    </>
+  );
+}
+
+function ComboRoundRobinSection({ t, busy, settings, setSettings, run }: SectionProps) {
+  const comboRoundRobin = settings.comboStrategy === "round-robin";
+  return (
+    <>
+      <div className="flex items-start sm:items-center justify-between gap-4 pt-4 border-t border-border/50">
+        <div className="flex-1 min-w-0">
+          <p className="font-medium text-sm sm:text-base">{t("comboRoundRobin")}</p>
+          <p className="text-xs sm:text-sm text-text-muted">{t("comboRoundRobinDesc")}</p>
+        </div>
+        <Toggle
+          checked={comboRoundRobin}
+          disabled={busy}
+          onChange={() =>
+            run(async () => {
+              const next = comboRoundRobin ? "fallback" : "round-robin";
+              const defaultComboStrategy = next === "round-robin" ? "round-robin" : "priority";
+              await patchComboDefaultsStrategy(defaultComboStrategy);
+              const updated = await patchSettings({ comboStrategy: next });
+              setSettings((prev) => ({ ...prev, comboStrategy: updated.comboStrategy || next }));
+            })
+          }
+        />
+      </div>
+
+      {comboRoundRobin && (
+        <div className="flex items-center justify-between pt-2 border-t border-border/50">
+          <div>
+            <p className="font-medium">{t("comboStickyLimit")}</p>
+            <p className="text-sm text-text-muted">{t("comboStickyLimitDesc")}</p>
+          </div>
+          <Input
+            type="number"
+            min={1}
+            max={100}
+            disabled={busy}
+            className="w-20 text-center"
+            value={settings.comboStickyRoundRobinLimit ?? 1}
+            onChange={(e) =>
+              setSettings((prev) => ({ ...prev, comboStickyRoundRobinLimit: e.target.value }))
+            }
+            onBlur={() =>
+              run(async () => {
+                const limit = Math.min(
+                  100,
+                  Math.max(1, parseInt(String(settings.comboStickyRoundRobinLimit), 10) || 1)
+                );
+                const updated = await patchSettings({ comboStickyRoundRobinLimit: limit });
+                setSettings((prev) => ({
+                  ...prev,
+                  comboStickyRoundRobinLimit: updated.comboStickyRoundRobinLimit ?? limit,
+                }));
+              })
+            }
+          />
+        </div>
+      )}
+    </>
+  );
+}
+
+function RoutingSummaryFooter({
+  t,
+  accountRoundRobin,
+  comboRoundRobin,
+  accountStickyDisplay,
+  comboStickyDisplay,
+}: {
+  t: Translate;
+  accountRoundRobin: boolean;
+  comboRoundRobin: boolean;
+  accountStickyDisplay: number;
+  comboStickyDisplay: number;
+}) {
+  return (
+    <p className="text-xs text-text-muted italic pt-2 border-t border-border/50">
+      {accountRoundRobin
+        ? t("routingStrategyAccountSummary", { limit: accountStickyDisplay })
+        : t("routingStrategyFillFirstSummary")}
+      {comboRoundRobin
+        ? t("routingStrategyComboSummary", { limit: comboStickyDisplay })
+        : t("routingStrategyComboFallbackSummary")}
+    </p>
+  );
+}
+
+/**
+ * 9router-style Routing Strategy card (Profile → Routing Strategy parity).
+ * Settings → Routing, first card on the page.
+ */
+export default function RoutingStrategyCard() {
+  const t = useTranslations("settings");
+  const tc = useTranslations("common");
+  const { settings, setSettings, loading, busy, run } = useRoutingStrategySettings();
+
+  const accountRoundRobin = settings.fallbackStrategy === "round-robin";
+  const comboRoundRobin = settings.comboStrategy === "round-robin";
+  const accountStickyDisplay = numericLimit(settings.stickyRoundRobinLimit, 3);
+  const comboStickyDisplay = numericLimit(settings.comboStickyRoundRobinLimit, 1);
+
+  return (
+    <Card>
+      <div className="flex items-center gap-3 mb-4">
+        <div className="p-2 rounded-lg bg-blue-500/10 text-blue-500 shrink-0">
+          <span className="material-symbols-outlined text-[20px]" aria-hidden="true">
+            route
+          </span>
+        </div>
+        <div>
+          <h3 className="text-base sm:text-lg font-semibold">{t("routingStrategyTitle")}</h3>
+          <p className="text-xs text-text-muted">{t("routingStrategySubtitle")}</p>
+        </div>
+      </div>
+
+      {loading ? (
+        <p className="text-sm text-text-muted">{tc("loading")}</p>
+      ) : (
+        <div className="flex flex-col gap-4">
+          <AccountRoundRobinSection t={t} busy={busy} settings={settings} setSettings={setSettings} run={run} />
+          <ComboRoundRobinSection t={t} busy={busy} settings={settings} setSettings={setSettings} run={run} />
+          <RoutingSummaryFooter
+            t={t}
+            accountRoundRobin={accountRoundRobin}
+            comboRoundRobin={comboRoundRobin}
+            accountStickyDisplay={accountStickyDisplay}
+            comboStickyDisplay={comboStickyDisplay}
+          />
+        </div>
+      )}
+    </Card>
+  );
+}
diff --git a/src/app/(dashboard)/dashboard/settings/components/parseBulkProxyImport.ts b/src/app/(dashboard)/dashboard/settings/components/parseBulkProxyImport.ts
index 753d87d7f4..cbd70440a3 100644
--- a/src/app/(dashboard)/dashboard/settings/components/parseBulkProxyImport.ts
+++ b/src/app/(dashboard)/dashboard/settings/components/parseBulkProxyImport.ts
@@ -3,7 +3,19 @@
  *
  * Supported line formats (one proxy per line):
  *   1. Pipe-delimited:  NAME|HOST|PORT[|USERNAME|PASSWORD|TYPE|REGION|STATUS|NOTES]
- *   2. Auth-less short: HOST:PORT  → name is auto-generated as "Imported HOST:PORT"
+ *   2. Shorthand formats (no pipe character):
+ *        a. ip:port
+ *        b. ip:port:user:pass
+ *        c. user:pass@ip:port
+ *        d. user:pass:ip:port
+ *        e. protocol://ip:port
+ *        f. protocol://user:pass@ip:port
+ *
+ * Protocol header mode:
+ *   If a line contains only a bare protocol name (http, https, socks5),
+ *   it sets the default type for all subsequent shorthand lines that
+ *   don't include an explicit protocol:// prefix. The per-line prefix
+ *   always takes precedence over the header default.
  *
  * Lines starting with # and blank lines are skipped.
  */
@@ -25,8 +37,154 @@ export type ParseError = {
   reason: string;
 };
 
-export const VALID_PROXY_TYPES = new Set(["http", "https", "socks5"]);
-export const VALID_PROXY_STATUSES = new Set(["active", "inactive"]);
+export const VALID_PROXY_TYPES: Record<string, true> = { http: true, https: true, socks5: true };
+export const VALID_PROXY_STATUSES: Record<string, true> = { active: true, inactive: true };
+
+/**
+ * True if a string looks like an IPv4 address or a DNS hostname.
+ */
+function looksLikeHost(s: string): boolean {
+  if (!s) return false;
+  // IPv4: four dot-separated octets, each 0–255
+  const ipParts = s.split(".");
+  if (ipParts.length === 4 && ipParts.every((o) => /^\d+$/.test(o) && Number(o) >= 0 && Number(o) <= 255)) {
+    return true;
+  }
+  // Hostname: alphanumeric + dots/hyphens, at least one char
+  return /^[a-zA-Z0-9]([a-zA-Z0-9.-]*[a-zA-Z0-9])?$/.test(s);
+}
+
+/**
+ * Validate and push an entry from parsed shorthand components.
+ * Returns true if an entry was pushed, false if an error was pushed.
+ */
+function pushShorthandEntry(
+  entries: ParsedProxyEntry[],
+  errors: ParseError[],
+  lineNum: number,
+  host: string,
+  portStr: string,
+  username: string,
+  password: string,
+  type: string,
+): boolean {
+  if (!host) {
+    errors.push({ line: lineNum, reason: "bulkImportErrorMissingHost" });
+    return false;
+  }
+  const port = Number(portStr);
+  if (!portStr || isNaN(port) || port < 1 || port > 65535) {
+    errors.push({ line: lineNum, reason: "bulkImportErrorInvalidPort" });
+    return false;
+  }
+  const normalizedType = type.toLowerCase();
+  if (!VALID_PROXY_TYPES[normalizedType]) {
+    errors.push({ line: lineNum, reason: "bulkImportErrorInvalidType" });
+    return false;
+  }
+  entries.push({
+    name: `Imported ${host}:${portStr}`,
+    host,
+    port,
+    username,
+    password,
+    type: normalizedType,
+    region: "",
+    status: "active",
+    notes: "",
+  });
+  return true;
+}
+
+/**
+ * Parse a shorthand (non-pipe) proxy line.
+ *
+ * Recognized formats:
+ *   protocol://user:pass@host:port
+ *   protocol://host:port
+ *   user:pass@host:port
+ *   host:port:user:pass
+ *   user:pass:host:port
+ *   host:port
+ */
+function parseShorthandLine(
+  raw: string,
+  lineNum: number,
+  defaultType: string,
+  entries: ParsedProxyEntry[],
+  errors: ParseError[],
+): boolean {
+  let type = defaultType;
+  let working = raw;
+
+  // Check for protocol:// prefix
+  const protocolMatch = working.match(/^(https?|socks5):\/\/(.+)$/i);
+  if (protocolMatch) {
+    type = protocolMatch[1].toLowerCase();
+    working = protocolMatch[2];
+  }
+
+  // Check for user:pass@host:port format (after protocol stripped)
+  const atIdx = working.indexOf("@");
+  if (atIdx > 0) {
+    const authPart = working.slice(0, atIdx);
+    const hostPart = working.slice(atIdx + 1);
+    const credColon = authPart.indexOf(":");
+    let username = "";
+    let password = "";
+    if (credColon > 0) {
+      username = authPart.slice(0, credColon).trim();
+      password = authPart.slice(credColon + 1).trim();
+    } else {
+      username = authPart.trim();
+    }
+    // hostPart is now host:port
+    const colonIdx = hostPart.lastIndexOf(":");
+    if (colonIdx > 0) {
+      const host = hostPart.slice(0, colonIdx).trim();
+      const portStr = hostPart.slice(colonIdx + 1).trim();
+      return pushShorthandEntry(entries, errors, lineNum, host, portStr, username, password, type);
+    }
+    errors.push({ line: lineNum, reason: "bulkImportErrorInvalidPort" });
+    return false;
+  }
+
+  // No @ — split by colon to determine which colon-delimited format
+  const colonParts = working.split(":").map((p) => p.trim());
+
+  if (colonParts.length === 2) {
+    // host:port
+    const [host, portStr] = colonParts;
+    return pushShorthandEntry(entries, errors, lineNum, host, portStr, "", "", type);
+  }
+
+  if (colonParts.length === 4) {
+    // Two possibilities: ip:port:user:pass OR user:pass:ip:port
+    // Require the "host" slot to look like an IP/hostname AND the "port" slot to be a valid port.
+    const isPort1 = /^\d+$/.test(colonParts[1]) && Number(colonParts[1]) >= 1 && Number(colonParts[1]) <= 65535;
+    const isPort3 = /^\d+$/.test(colonParts[3]) && Number(colonParts[3]) >= 1 && Number(colonParts[3]) <= 65535;
+    const hostLooksLikePart0 = looksLikeHost(colonParts[0]);
+    const hostLooksLikePart2 = looksLikeHost(colonParts[2]);
+
+    if (hostLooksLikePart0 && isPort1) {
+      // ip:port:user:pass
+      const [host, portStr, username, password] = colonParts;
+      return pushShorthandEntry(entries, errors, lineNum, host, portStr, username, password, type);
+    }
+    if (hostLooksLikePart2 && isPort3) {
+      // user:pass:ip:port
+      const [username, password, host, portStr] = colonParts;
+      return pushShorthandEntry(entries, errors, lineNum, host, portStr, username, password, type);
+    }
+    // Can't determine format
+    errors.push({ line: lineNum, reason: "bulkImportErrorInvalidPort" });
+    return false;
+  }
+
+  // Unknown colon format
+  errors.push({ line: lineNum, reason: "bulkImportErrorMissingHost" });
+  return false;
+}
 
 export function parseBulkImportText(text: string): {
   entries: ParsedProxyEntry[];
@@ -37,6 +195,7 @@ export function parseBulkImportText(text: string): {
   const entries: ParsedProxyEntry[] = [];
   const errors: ParseError[] = [];
   let skipped = 0;
+  let defaultType = "socks5";
 
   for (let i = 0; i < lines.length; i++) {
     const raw = lines[i].trim();
@@ -47,77 +206,58 @@ export function parseBulkImportText(text: string): {
 
     const lineNum = i + 1;
 
-    // Auth-less shorthand: HOST:PORT (no pipe characters, exactly one colon)
-    if (!raw.includes("|")) {
-      const colonIdx = raw.lastIndexOf(":");
-      if (colonIdx > 0) {
-        const host = raw.slice(0, colonIdx).trim();
-        const portStr = raw.slice(colonIdx + 1).trim();
-        const port = Number(portStr);
-        if (!host) {
-          errors.push({ line: lineNum, reason: "bulkImportErrorMissingHost" });
-          continue;
-        }
-        if (!portStr || isNaN(port) || port < 1 || port > 65535) {
-          errors.push({ line: lineNum, reason: "bulkImportErrorInvalidPort" });
-          continue;
-        }
-        entries.push({
-          name: `Imported ${host}:${portStr}`,
-          host,
-          port,
-          username: "",
-          password: "",
-          type: "http",
-          region: "",
-          status: "active",
-          notes: "",
-        });
+    // Protocol header: a bare protocol name sets the default for subsequent shorthand lines
+    const lower = raw.toLowerCase();
+    if (VALID_PROXY_TYPES[lower]) {
+      defaultType = lower;
+      continue;
+    }
+
+    // Pipe-delimited format: NAME|HOST|PORT[|USERNAME|PASSWORD|TYPE|REGION|STATUS|NOTES]
+    if (raw.includes("|")) {
+      const parts = raw.split("|").map((p) => p.trim());
+      const [name, host, portStr, username, password, type, region, status, notes] = parts;
+
+      if (!name) {
+        errors.push({ line: lineNum, reason: "bulkImportErrorMissingName" });
         continue;
       }
-      errors.push({ line: lineNum, reason: "bulkImportErrorMissingHost" });
+      if (!host) {
+        errors.push({ line: lineNum, reason: "bulkImportErrorMissingHost" });
+        continue;
+      }
+      const port = Number(portStr);
+      if (!portStr || isNaN(port) || port < 1 || port > 65535) {
+        errors.push({ line: lineNum, reason: "bulkImportErrorInvalidPort" });
+        continue;
+      }
+      const normalizedType = (type || "socks5").toLowerCase();
+      if (!VALID_PROXY_TYPES[normalizedType]) {
+        errors.push({ line: lineNum, reason: "bulkImportErrorInvalidType" });
+        continue;
+      }
+      const normalizedStatus = (status || "active").toLowerCase();
+      if (!VALID_PROXY_STATUSES[normalizedStatus]) {
+        errors.push({ line: lineNum, reason: "bulkImportErrorInvalidStatus" });
+        continue;
+      }
+
+      entries.push({
+        name,
+        host,
+        port,
+        username: username || "",
+        password: password || "",
+        type: normalizedType,
+        region: region || "",
+        status: normalizedStatus,
+        notes: notes || "",
+      });
       continue;
     }
 
-    // Full pipe-delimited format: NAME|HOST|PORT[|USERNAME|PASSWORD|TYPE|REGION|STATUS|NOTES]
-    const parts = raw.split("|").map((p) => p.trim());
-    const [name, host, portStr, username, password, type, region, status, notes] = parts;
-
-    if (!name) {
-      errors.push({ line: lineNum, reason: "bulkImportErrorMissingName" });
-      continue;
-    }
-    if (!host) {
-      errors.push({ line: lineNum, reason: "bulkImportErrorMissingHost" });
-      continue;
-    }
-    const port = Number(portStr);
-    if (!portStr || isNaN(port) || port < 1 || port > 65535) {
-      errors.push({ line: lineNum, reason: "bulkImportErrorInvalidPort" });
-      continue;
-    }
-    const normalizedType = (type || "socks5").toLowerCase();
-    if (!VALID_PROXY_TYPES.has(normalizedType)) {
-      errors.push({ line: lineNum, reason: "bulkImportErrorInvalidType" });
-      continue;
-    }
-    const normalizedStatus = (status || "active").toLowerCase();
-    if (!VALID_PROXY_STATUSES.has(normalizedStatus)) {
-      errors.push({ line: lineNum, reason: "bulkImportErrorInvalidStatus" });
-      continue;
-    }
-
-    entries.push({
-      name,
-      host,
-      port,
-      username: username || "",
-      password: password || "",
-      type: normalizedType,
-      region: region || "",
-      status: normalizedStatus,
-      notes: notes || "",
-    });
+    // Shorthand formats (no pipe character)
+    parseShorthandLine(raw, lineNum, defaultType, entries, errors);
   }
 
   return { entries, errors, skipped };
diff --git a/src/app/(dashboard)/dashboard/settings/components/proxy/FreePoolTab.tsx b/src/app/(dashboard)/dashboard/settings/components/proxy/FreePoolTab.tsx
index de797c884c..daca24c8d6 100644
--- a/src/app/(dashboard)/dashboard/settings/components/proxy/FreePoolTab.tsx
+++ b/src/app/(dashboard)/dashboard/settings/components/proxy/FreePoolTab.tsx
@@ -17,14 +17,17 @@ type FreePoolStats = {
   lastSyncAt: string | null;
 };
 
+const PER_PAGE = 50;
+const MAX_VISIBLE_PAGES = 7;
+
 export default function FreePoolTab() {
   const t = useTranslations("settings");
   const [proxies, setProxies] = useState<FreeProxyRowData[]>([]);
   const [stats, setStats] = useState<FreePoolStats | null>(null);
   const [disabledSources, setDisabledSources] = useState<Set<SourceId>>(new Set());
-  const [filterProtocol, setFilterProtocol] = useState("");
-  const [filterCountry, setFilterCountry] = useState("");
-  const [minQuality, setMinQuality] = useState("");
+  const [filterProtocol, setFilterProtocolRaw] = useState("");
+  const [filterCountry, setFilterCountryRaw] = useState("");
+  const [minQuality, setMinQualityRaw] = useState("");
   const [loading, setLoading] = useState(true);
   const [syncing, setSyncing] = useState(false);
   const [selected, setSelected] = useState<Set<string>>(new Set());
@@ -32,22 +35,29 @@ export default function FreePoolTab() {
   const [bulkProgress, setBulkProgress] = useState<string | null>(null);
   // #5595: per-source sync errors so a "Total: 0" result is never silent.
   const [syncErrors, setSyncErrors] = useState<Record<string, string[]> | null>(null);
+  // Pagination state
+  const [page, setPage] = useState(1);
+  const [total, setTotal] = useState(0);
 
   // Load persisted disabled-sources from localStorage on mount
   useEffect(() => {
+    const saved = loadDisabledSources();
     // eslint-disable-next-line react-hooks/set-state-in-effect -- localStorage hydration, runs once
-    setDisabledSources(loadDisabledSources());
-  }, []);
-
-  const handleToggleSource = useCallback((source: SourceId) => {
-    setDisabledSources((prev) => {
-      const next = new Set(prev);
-      if (next.has(source)) next.delete(source);
-      else next.add(source);
-      saveDisabledSources(next);
-      return next;
-    });
+    if (saved) setDisabledSources(saved);
   }, []);
+  // Wrapper setters that also reset page to 1
+  const setFilterProtocol = (v: string) => {
+    setFilterProtocolRaw(v);
+    setPage(1);
+  };
+  const setFilterCountry = (v: string) => {
+    setFilterCountryRaw(v);
+    setPage(1);
+  };
+  const setMinQuality = (v: string) => {
+    setMinQualityRaw(v);
+    setPage(1);
+  };
 
   const loadData = useCallback(async () => {
     setLoading(true);
@@ -60,7 +70,8 @@ export default function FreePoolTab() {
       if (filterProtocol) params.set("protocol", filterProtocol);
       if (filterCountry) params.set("country", filterCountry);
       if (minQuality) params.set("minQuality", minQuality);
-      params.set("limit", "200");
+      params.set("limit", String(PER_PAGE));
+      params.set("offset", String((page - 1) * PER_PAGE));
 
       const [proxiesRes, statsRes] = await Promise.all([
         fetch(`/api/settings/free-proxies?${params.toString()}`),
@@ -69,6 +80,7 @@ export default function FreePoolTab() {
       if (proxiesRes.ok) {
         const data = await proxiesRes.json();
         setProxies(data.items || []);
+        setTotal(data.total ?? 0);
       }
       if (statsRes.ok) {
         const data = await statsRes.json();
@@ -76,7 +88,7 @@ export default function FreePoolTab() {
       }
     } catch {}
     setLoading(false);
-  }, [disabledSources, filterProtocol, filterCountry, minQuality]);
+  }, [disabledSources, filterProtocol, filterCountry, minQuality, page]);
 
   useEffect(() => {
     // eslint-disable-next-line react-hooks/set-state-in-effect -- async data fetch on filter change
@@ -94,17 +106,9 @@ export default function FreePoolTab() {
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify(body),
       });
-      // #5595: surface per-source errors the route already returns so a
-      // partial/empty sync explains itself instead of silently showing "Total: 0".
-      const data = await res.json().catch(() => null);
-      if (data?.results) {
-        const errs: Record<string, string[]> = {};
-        for (const [src, r] of Object.entries(
-          data.results as Record<string, { errors?: string[] }>
-        )) {
-          if (Array.isArray(r?.errors) && r.errors.length > 0) errs[src] = r.errors;
-        }
-        if (Object.keys(errs).length > 0) setSyncErrors(errs);
+      const data = await res.json();
+      if (!res.ok) {
+        setSyncErrors(data.errors ?? null);
       }
       await loadData();
     } catch {}
@@ -112,17 +116,20 @@ export default function FreePoolTab() {
   };
 
   const handleAddToPool = async (id: string) => {
-    setAddingIds((prev) => new Set(prev).add(id));
+    setAddingIds((prev) => {
+      const next = new Set(prev);
+      next.add(id);
+      return next;
+    });
     try {
       const res = await fetch(`/api/settings/free-proxies/${id}/add-to-pool`, {
         method: "POST",
       });
-      // #4878: gate on the parsed body, not just res.ok. The route used to return
-      // a default 200 with { success:false } on a failed connectivity probe, which
-      // flipped the row to "In Pool" optimistically even though nothing was added.
-      const data = await res.json().catch(() => null);
-      if (res.ok && data?.success) {
-        setProxies((prev) => prev.map((p) => (p.id === id ? { ...p, inPool: true } : p)));
+      if (res.ok) {
+        const body = await res.json();
+        if (body.ok !== true) return;
+        // Optimistic: remove from local list since it's now in pool
+        setProxies((prev) => prev.filter((p) => p.id !== id));
       }
     } catch {}
     setAddingIds((prev) => {
@@ -159,6 +166,42 @@ export default function FreePoolTab() {
   };
 
   const notInPoolProxies = proxies.filter((p) => !p.inPool);
+  const totalPages = Math.max(1, Math.ceil(total / PER_PAGE));
+
+  // Build visible page range around current page
+  const buildPageRange = (): (number | "ellipsis")[] => {
+    if (totalPages <= MAX_VISIBLE_PAGES) {
+      return Array.from({ length: totalPages }, (_, i) => i + 1);
+    }
+    const pages: (number | "ellipsis")[] = [];
+    const half = Math.floor(MAX_VISIBLE_PAGES / 2);
+    let start = Math.max(1, page - half);
+    let end = Math.min(totalPages, page + half);
+
+    // Adjust if near start/end
+    if (page - half < 1) {
+      end = Math.min(totalPages, MAX_VISIBLE_PAGES);
+    }
+    if (page + half > totalPages) {
+      start = Math.max(1, totalPages - MAX_VISIBLE_PAGES + 1);
+    }
+
+    if (start > 1) {
+      pages.push(1);
+      if (start > 2) pages.push("ellipsis");
+    }
+    for (let i = start; i <= end; i++) pages.push(i);
+    if (end < totalPages) {
+      if (end < totalPages - 1) pages.push("ellipsis");
+      pages.push(totalPages);
+    }
+    return pages;
+  };
+
+  const handlePageChange = (newPage: number) => {
+    if (newPage < 1 || newPage > totalPages) return;
+    setPage(newPage);
+  };
 
   return (
     <div className="space-y-4">
@@ -313,6 +356,55 @@ export default function FreePoolTab() {
           </tbody>
         </table>
       </div>
+
+      {/* Page-number pagination */}
+      {totalPages > 1 && (
+        <div className="flex items-center justify-center gap-1 pt-2">
+          <button
+            type="button"
+            onClick={() => handlePageChange(page - 1)}
+            disabled={page <= 1}
+            aria-label="Previous page"
+          >
+            &laquo;
+          </button>
+          {buildPageRange().map((p, i) =>
+            p === "ellipsis" ? (
+              <span key={`ellipsis-${i}`} className="px-1 text-text-muted text-xs">
+                ...
+              </span>
+            ) : (
+              <button
+                key={p}
+                type="button"
+                onClick={() => handlePageChange(p)}
+                className={`px-2.5 py-1 text-xs rounded ${
+                  p === page
+                    ? "bg-primary text-white font-medium"
+                    : "hover:bg-black/5 dark:hover:bg-white/5"
+                }`}
+              >
+                {p}
+              </button>
+            )
+          )}
+          <button
+            type="button"
+            onClick={() => handlePageChange(page + 1)}
+            disabled={page >= totalPages}
+            aria-label="Next page"
+          >
+            &raquo;
+          </button>
+        </div>
+      )}
+
+      {/* Per-page summary */}
+      <div className="text-center text-xs text-text-muted">
+        {total > 0
+          ? `Page ${page} of ${totalPages} (${total} total proxies)`
+          : `${total} total proxies`}
+      </div>
     </div>
   );
 }
diff --git a/src/app/(dashboard)/dashboard/settings/components/proxy/ProxyPoolTab.tsx b/src/app/(dashboard)/dashboard/settings/components/proxy/ProxyPoolTab.tsx
index e31b8b1dd3..52406cfd22 100644
--- a/src/app/(dashboard)/dashboard/settings/components/proxy/ProxyPoolTab.tsx
+++ b/src/app/(dashboard)/dashboard/settings/components/proxy/ProxyPoolTab.tsx
@@ -6,6 +6,7 @@ import ProxyRegistryManager from "../ProxyRegistryManager";
 import VercelRelayModal from "./VercelRelayModal";
 import DenoRelayModal from "./DenoRelayModal";
 import CloudflareRelayModal from "./CloudflareRelayModal";
+import type { ProxyItem } from "../proxyRegistryTypes";
 
 export default function ProxyPoolTab() {
   const t = useTranslations("settings");
@@ -41,6 +42,11 @@ export default function ProxyPoolTab() {
   const handleCloudflareDeployed = (_poolProxyId: string, relayUrl: string) => {
     alert(`${t("cloudflareRelaySuccess")}: ${relayUrl}`);
   };
+  const handleRedeployRelay = (proxy: ProxyItem) => {
+    if (proxy.type === "vercel") setVercelModalOpen(true);
+    else if (proxy.type === "deno") setDenoModalOpen(true);
+    else if (proxy.type === "cloudflare") setCloudflareModalOpen(true);
+  };
 
   return (
     <div className="space-y-4">
@@ -116,7 +122,7 @@ export default function ProxyPoolTab() {
           </div>
         </div>
       )}
-      <ProxyRegistryManager />
+      <ProxyRegistryManager onRedeployRelay={handleRedeployRelay} />
       <VercelRelayModal
         isOpen={vercelModalOpen}
         onClose={() => setVercelModalOpen(false)}
diff --git a/src/app/(dashboard)/dashboard/settings/components/proxyRegistryTypes.ts b/src/app/(dashboard)/dashboard/settings/components/proxyRegistryTypes.ts
new file mode 100644
index 0000000000..787c1b5240
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/settings/components/proxyRegistryTypes.ts
@@ -0,0 +1,29 @@
+// Client-safe types for the proxy registry UI. This module MUST NOT import
+// server-only code (e.g. `lib/db/proxies/mappers`, which pulls in node `crypto`
+// via the encryption helper) — it is imported by "use client" components.
+//
+// `RelayRepairMode` mirrors the server-side union returned by
+// `relayRepairMode()` in lib/db/proxies/mappers.ts. Keep the two in sync.
+
+export type RelayRepairMode = "noop" | "recovered" | "redeploy" | null;
+
+export interface RelayInfo {
+  isRelay: boolean;
+  authMissing: boolean;
+  repairMode: RelayRepairMode;
+}
+
+export interface ProxyItem {
+  id: string;
+  name: string;
+  type: string;
+  host: string;
+  port: number;
+  username?: string | null;
+  password?: string | null;
+  region?: string | null;
+  notes?: string | null;
+  status?: string;
+  family?: string;
+  relayInfo?: RelayInfo;
+}
diff --git a/src/app/(dashboard)/dashboard/settings/components/proxyStrategyOptions.ts b/src/app/(dashboard)/dashboard/settings/components/proxyStrategyOptions.ts
new file mode 100644
index 0000000000..3f7a74e576
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/settings/components/proxyStrategyOptions.ts
@@ -0,0 +1,17 @@
+// Pool rotation strategy options shared by ProxyRegistryManager's pool strategy
+// selector. Extracted so the union type has a single source of truth and the
+// <option> list can be rendered from data instead of literal JSX (#6798).
+export type PoolStrategy = "round-robin" | "random" | "sticky" | "latency";
+
+export const POOL_STRATEGY_VALUES: PoolStrategy[] = ["round-robin", "random", "sticky", "latency"];
+
+export const POOL_STRATEGY_OPTIONS: Array<{ value: PoolStrategy; labelKey: string }> = [
+  { value: "round-robin", labelKey: "strategyRoundRobin" },
+  { value: "random", labelKey: "strategyRandom" },
+  { value: "sticky", labelKey: "strategySticky" },
+  { value: "latency", labelKey: "strategyLatency" },
+];
+
+export function isPoolStrategy(value: unknown): value is PoolStrategy {
+  return POOL_STRATEGY_VALUES.includes(value as PoolStrategy);
+}
diff --git a/src/app/(dashboard)/dashboard/settings/components/useProxyBulkImport.ts b/src/app/(dashboard)/dashboard/settings/components/useProxyBulkImport.ts
new file mode 100644
index 0000000000..a152b8d7dc
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/settings/components/useProxyBulkImport.ts
@@ -0,0 +1,176 @@
+"use client";
+
+import { useState, useCallback } from "react";
+import { useTranslations } from "next-intl";
+
+type ParsedProxyEntry = {
+  name: string;
+  host: string;
+  port: number;
+  username: string;
+  password: string;
+  type: string;
+  region: string;
+  status: string;
+  notes: string;
+};
+
+type ParseError = {
+  line: number;
+  reason: string;
+};
+
+type BulkImportResult = {
+  created: number;
+  updated: number;
+  failed: number;
+};
+
+const BULK_IMPORT_TEMPLATE = `# Proxy Bulk Import
+# Format: NAME|HOST|PORT|USERNAME|PASSWORD|TYPE|REGION|STATUS|NOTES
+# Required: NAME, HOST, PORT
+# Optional: USERNAME, PASSWORD, TYPE (http|https|socks5, default: socks5), REGION, STATUS (active|inactive, default: active), NOTES
+# Lines starting with # are ignored. Existing proxies (same host+port) will be updated.
+#
+# SOCKS5 examples:
+# proxy-us|138.99.147.218|50101|myuser|mypass|socks5|US-East|active|US production proxy
+# proxy-eu|200.234.177.62|50101|myuser|mypass|socks5|EU-West
+#
+# HTTP/HTTPS examples:
+# http-proxy|10.0.0.50|8080|||http||active|Internal HTTP proxy
+# https-proxy|proxy.example.com|443|admin|secret123|https|US|active
+`;
+
+const VALID_TYPES = new Set(["http", "https", "socks5"]);
+const VALID_STATUSES = new Set(["active", "inactive"]);
+
+export function parseBulkImportText(text: string): {
+  entries: ParsedProxyEntry[];
+  errors: ParseError[];
+  skipped: number;
+} {
+  const lines = text.split("\n");
+  const entries: ParsedProxyEntry[] = [];
+  const errors: ParseError[] = [];
+  let skipped = 0;
+
+  for (let i = 0; i < lines.length; i++) {
+    const raw = lines[i].trim();
+    if (!raw || raw.startsWith("#")) {
+      skipped++;
+      continue;
+    }
+
+    const parts = raw.split("|").map((p) => p.trim());
+    const [name, host, portStr, username, password, type, region, status, notes] = parts;
+    const lineNum = i + 1;
+
+    if (!name) {
+      errors.push({ line: lineNum, reason: "bulkImportErrorMissingName" });
+      continue;
+    }
+    if (!host) {
+      errors.push({ line: lineNum, reason: "bulkImportErrorMissingHost" });
+      continue;
+    }
+    const port = Number(portStr);
+    if (!portStr || isNaN(port) || port < 1 || port > 65535) {
+      errors.push({ line: lineNum, reason: "bulkImportErrorInvalidPort" });
+      continue;
+    }
+    const normalizedType = (type || "socks5").toLowerCase();
+    if (!VALID_TYPES.has(normalizedType)) {
+      errors.push({ line: lineNum, reason: "bulkImportErrorInvalidType" });
+      continue;
+    }
+    const normalizedStatus = (status || "active").toLowerCase();
+    if (!VALID_STATUSES.has(normalizedStatus)) {
+      errors.push({ line: lineNum, reason: "bulkImportErrorInvalidStatus" });
+      continue;
+    }
+
+    entries.push({
+      name,
+      host,
+      port,
+      username: username || "",
+      password: password || "",
+      type: normalizedType,
+      region: region || "",
+      status: normalizedStatus,
+      notes: notes || "",
+    });
+  }
+
+  return { entries, errors, skipped };
+}
+
+interface UseProxyBulkImportOptions {
+  onImport: (entries: ParsedProxyEntry[]) => Promise<BulkImportResult>;
+}
+
+export function useProxyBulkImport({ onImport }: UseProxyBulkImportOptions) {
+  const t = useTranslations("proxyRegistry");
+  const [open, setOpen] = useState(false);
+  const [text, setText] = useState(BULK_IMPORT_TEMPLATE);
+  const [parsed, setParsed] = useState<ParsedProxyEntry[]>([]);
+  const [errors, setErrors] = useState<ParseError[]>([]);
+  const [skipped, setSkipped] = useState(0);
+  const [parsedOnce, setParsedOnce] = useState(false);
+  const [importing, setImporting] = useState(false);
+  const [result, setResult] = useState<BulkImportResult | null>(null);
+
+  const handleParse = useCallback(() => {
+    const { entries, errors: parseErrors, skipped: skippedLines } = parseBulkImportText(text);
+    setParsed(entries);
+    setErrors(parseErrors);
+    setSkipped(skippedLines);
+    setParsedOnce(true);
+    setResult(null);
+  }, [text]);
+
+  const handleImport = useCallback(async () => {
+    if (parsed.length === 0) return;
+    setImporting(true);
+    try {
+      const res = await onImport(parsed);
+      setResult(res);
+      if (res.failed === 0) {
+        setText(BULK_IMPORT_TEMPLATE);
+        setParsed([]);
+        setErrors([]);
+        setSkipped(0);
+        setParsedOnce(false);
+      }
+    } finally {
+      setImporting(false);
+    }
+  }, [parsed, onImport]);
+
+  const handleClose = useCallback(() => {
+    setOpen(false);
+    setText(BULK_IMPORT_TEMPLATE);
+    setParsed([]);
+    setErrors([]);
+    setSkipped(0);
+    setParsedOnce(false);
+    setResult(null);
+  }, []);
+
+  return {
+    open,
+    setOpen,
+    text,
+    setText,
+    parsed,
+    errors,
+    skipped,
+    parsedOnce,
+    importing,
+    result,
+    t,
+    handleParse,
+    handleImport,
+    handleClose,
+  };
+}
diff --git a/src/app/(dashboard)/dashboard/settings/components/useProxyPoolModal.ts b/src/app/(dashboard)/dashboard/settings/components/useProxyPoolModal.ts
new file mode 100644
index 0000000000..b23e48d6cb
--- /dev/null
+++ b/src/app/(dashboard)/dashboard/settings/components/useProxyPoolModal.ts
@@ -0,0 +1,96 @@
+"use client";
+
+import { useState, useCallback } from "react";
+import { useTranslations } from "next-intl";
+
+interface UseProxyPoolModalOptions {
+  items: { id: string; name: string }[];
+  onSave: (
+    scope: string,
+    scopeIds: string,
+    proxyId: string,
+    strategy: "round-robin" | "random" | "sticky"
+  ) => Promise<void>;
+  onLoad: (
+    scope: string,
+    scopeIds: string,
+    proxyId: string
+  ) => Promise<{ members: string[]; strategy: string } | null>;
+}
+
+export function useProxyPoolModal({ items, onSave, onLoad }: UseProxyPoolModalOptions) {
+  const t = useTranslations("proxyRegistry");
+  const [open, setOpen] = useState(false);
+  const [scope, setScope] = useState<"global" | "provider">("provider");
+  const [scopeIds, setScopeIds] = useState("");
+  const [proxyId, setProxyId] = useState("");
+  const [strategy, setStrategy] = useState<"round-robin" | "random" | "sticky">("round-robin");
+  const [members, setMembers] = useState<string[]>([]);
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [loaded, setLoaded] = useState(false);
+
+  const handleLoad = useCallback(async () => {
+    if (!proxyId) return;
+    setLoading(true);
+    setError(null);
+    try {
+      const data = await onLoad(scope, scopeIds, proxyId);
+      if (data) {
+        setMembers(data.members);
+        setStrategy(data.strategy as "round-robin" | "random" | "sticky");
+        setLoaded(true);
+      }
+    } catch (e: any) {
+      setError(e?.message || t("poolLoadFailed"));
+    } finally {
+      setLoading(false);
+    }
+  }, [scope, scopeIds, proxyId, onLoad, t]);
+
+  const handleSave = useCallback(async () => {
+    if (!proxyId) return;
+    setLoading(true);
+    setError(null);
+    try {
+      await onSave(scope, scopeIds, proxyId, strategy);
+      setOpen(false);
+    } catch (e: any) {
+      setError(e?.message || t("poolSaveFailed"));
+    } finally {
+      setLoading(false);
+    }
+  }, [scope, scopeIds, proxyId, strategy, onSave, t]);
+
+  const handleClose = useCallback(() => {
+    setOpen(false);
+    setScope("provider");
+    setScopeIds("");
+    setProxyId("");
+    setStrategy("round-robin");
+    setMembers([]);
+    setLoaded(false);
+    setError(null);
+  }, []);
+
+  return {
+    open,
+    setOpen,
+    scope,
+    setScope,
+    scopeIds,
+    setScopeIds,
+    proxyId,
+    setProxyId,
+    strategy,
+    setStrategy,
+    members,
+    loading,
+    error,
+    loaded,
+    handleLoad,
+    handleSave,
+    handleClose,
+    t,
+  };
+}
diff --git a/src/app/(dashboard)/dashboard/settings/routing/page.tsx b/src/app/(dashboard)/dashboard/settings/routing/page.tsx
index dfc098029a..ef7dd734f6 100644
--- a/src/app/(dashboard)/dashboard/settings/routing/page.tsx
+++ b/src/app/(dashboard)/dashboard/settings/routing/page.tsx
@@ -1,6 +1,7 @@
 "use client";
 
 import { useTranslations } from "next-intl";
+import RoutingStrategyCard from "../components/RoutingStrategyCard";
 import RoutingTab from "../components/RoutingTab";
 import ModelRoutingSection from "@/shared/components/ModelRoutingSection";
 import ComboDefaultsTab from "../components/ComboDefaultsTab";
@@ -13,6 +14,7 @@ export default function SettingsRoutingPage() {
   return (
     <div className="space-y-6">
       <p className="text-sm text-text-muted">{t("routingSettingsIntro")}</p>
+      <RoutingStrategyCard />
       <ComboDefaultsTab />
       <ModelAliasesUnified />
       <FallbackChainsEditor />
diff --git a/src/app/(dashboard)/dashboard/translator/components/advanced/CompressionPreviewAccordion.tsx b/src/app/(dashboard)/dashboard/translator/components/advanced/CompressionPreviewAccordion.tsx
index 1208a182fc..ee13753420 100644
--- a/src/app/(dashboard)/dashboard/translator/components/advanced/CompressionPreviewAccordion.tsx
+++ b/src/app/(dashboard)/dashboard/translator/components/advanced/CompressionPreviewAccordion.tsx
@@ -176,7 +176,7 @@ function CompressionPreviewContent({ inputContent = "" }: { inputContent?: strin
 
           {compressionResult.techniquesUsed.length > 0 && (
             <div className="text-xs text-text-muted">
-              <span className="font-semibold">{t("techniques") || "Técnicas:"}</span>{" "}
+              <span className="font-semibold">{t("techniques") || "Techniques:"}</span>{" "}
               {compressionResult.techniquesUsed.join(", ")}
             </div>
           )}
diff --git a/src/app/(dashboard)/dashboard/translator/hooks/useAvailableModels.tsx b/src/app/(dashboard)/dashboard/translator/hooks/useAvailableModels.tsx
index 339c716466..0a74df0386 100644
--- a/src/app/(dashboard)/dashboard/translator/hooks/useAvailableModels.tsx
+++ b/src/app/(dashboard)/dashboard/translator/hooks/useAvailableModels.tsx
@@ -2,7 +2,7 @@
 
 import { useState, useEffect, useCallback, useMemo } from "react";
 import { compareTr } from "@/shared/utils/turkishText";
-import type { ModelReasoningCapabilities } from "@/app/(dashboard)/dashboard/playground/components/reasoningControls";
+import type { ModelReasoningCapabilities } from "@/app/(dashboard)/dashboard/playground/components/reasoningControlUtils";
 
 /**
  * Prefix-based format→model matching, used to pick a smart default
diff --git a/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/QuotaCard.tsx b/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/QuotaCard.tsx
index 96a88afd05..7c7833b7f9 100644
--- a/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/QuotaCard.tsx
+++ b/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/QuotaCard.tsx
@@ -110,6 +110,7 @@ export default function QuotaCard({
       />
       <QuotaCardExpanded
         quotas={quotas}
+        providerId={connection.provider}
         loading={loading}
         error={error}
         message={quota?.message ?? null}
diff --git a/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/QuotaCardGrid.tsx b/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/QuotaCardGrid.tsx
index b8cc040af9..dbf1c253fd 100644
--- a/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/QuotaCardGrid.tsx
+++ b/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/QuotaCardGrid.tsx
@@ -47,16 +47,16 @@ export default function QuotaCardGrid({
   }
 
   return (
-    <div className="flex flex-col gap-6">
+    <div className="columns-1 2xl:columns-2 gap-6 [column-fill:_balance]">
       {[...groups.entries()].map(([provider, conns]) => (
-        <div key={provider} className="flex flex-col gap-3">
+        <div key={provider} className="flex flex-col gap-3 break-inside-avoid mb-6">
           <h3 className="text-sm font-semibold text-text-main flex items-center gap-2">
             {providerLabels[provider] || provider}
             <span className="text-xs font-normal text-text-muted">
               ({conns.length} account{conns.length !== 1 ? "s" : ""})
             </span>
           </h3>
-          <div className="grid grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4 gap-3">
+          <div className="grid grid-cols-2 md:grid-cols-3 xl:grid-cols-4 gap-3">
             {conns.map((conn) => (
               <QuotaCard
                 key={conn.id}
diff --git a/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/parts/QuotaCardExpanded.tsx b/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/parts/QuotaCardExpanded.tsx
index 3fccc765be..a672cd978d 100644
--- a/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/parts/QuotaCardExpanded.tsx
+++ b/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/parts/QuotaCardExpanded.tsx
@@ -11,6 +11,7 @@ import {
 } from "../utils";
 import QuotaMiniBar from "../QuotaMiniBar";
 import { translateUsageOrFallback, type UsageTranslationValues } from "../i18nFallback";
+import { hasFixedQuotaOrder } from "../quotaParsing";
 
 const CURRENCY_SYMBOLS: Record<string, string> = {
   USD: "$",
@@ -31,6 +32,18 @@ export function sortQuotasByRemaining(quotas: any[]): any[] {
   );
 }
 
+/**
+ * Pure helper — resolves the display order for a provider's quotas.
+ * Providers with a deterministic fixed-window order (codex, glm family — see
+ * quotaParsing.ts's sortCodexOrder()/sortGlmOrder()) keep the order
+ * parseQuotaData() already established. Every other provider still gets the
+ * remaining-percentage sort. Fixes #6687 (bars re-sorted by % undid the fixed
+ * session/weekly order).
+ */
+export function resolveQuotaDisplayOrder(providerId: string | undefined, quotas: any[]): any[] {
+  return hasFixedQuotaOrder(providerId) ? [...quotas] : sortQuotasByRemaining(quotas);
+}
+
 /** Pure helper — slices the sorted quotas down to the visible window. */
 export function getVisibleQuotas(sortedQuotas: any[], expanded: boolean): any[] {
   return expanded ? sortedQuotas : sortedQuotas.slice(0, DEFAULT_VISIBLE_ROWS);
@@ -38,6 +51,7 @@ export function getVisibleQuotas(sortedQuotas: any[], expanded: boolean): any[]
 
 interface Props {
   quotas: any[];
+  providerId?: string;
   loading: boolean;
   error: string | null;
   message?: string | null;
@@ -155,6 +169,7 @@ function QuotaDetailRow({ q }: { q: any }) {
 
 export default function QuotaCardExpanded({
   quotas,
+  providerId,
   loading,
   error,
   message,
@@ -174,7 +189,10 @@ export default function QuotaCardExpanded({
     translateUsageOrFallback(t, key, fallback, values);
 
   const [expanded, setExpanded] = useState(false);
-  const sortedQuotas = useMemo(() => sortQuotasByRemaining(quotas), [quotas]);
+  const sortedQuotas = useMemo(
+    () => resolveQuotaDisplayOrder(providerId, quotas),
+    [quotas, providerId]
+  );
   const visibleQuotas = useMemo(
     () => getVisibleQuotas(sortedQuotas, expanded),
     [sortedQuotas, expanded]
diff --git a/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/quotaParsing.ts b/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/quotaParsing.ts
index aa210469a1..0530404c05 100644
--- a/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/quotaParsing.ts
+++ b/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/quotaParsing.ts
@@ -9,6 +9,17 @@ const CODEX_QUOTA_ORDER: Record<string, number> = {
   gpt_5_3_codex_spark_weekly: 3,
   banked_reset_credits: 4,
 };
+const GLM_FAMILY_PROVIDERS = ["glm", "glm-cn", "glmt", "opencode-go"];
+
+/**
+ * Providers whose quotas already get a deterministic fixed-window order from
+ * sortGlmOrder()/sortCodexOrder() below. Display layers (e.g. QuotaCardExpanded)
+ * must not re-sort these by remaining percentage, or they undo this order (#6687).
+ */
+export function hasFixedQuotaOrder(providerId: string | undefined): boolean {
+  const id = String(providerId || "").toLowerCase();
+  return id === "codex" || GLM_FAMILY_PROVIDERS.includes(id);
+}
 
 function quotaEntries(data: any): Array<[string, any]> {
   return data?.quotas && typeof data.quotas === "object" ? Object.entries(data.quotas) : [];
@@ -147,12 +158,39 @@ function parseCodex(data: any) {
   return quotas;
 }
 
+function buildClaudeExtraUsageQuota(extraUsage: any) {
+  const monthlyLimit = Number(extraUsage?.monthly_limit ?? 0);
+  const usedCredits = Number(extraUsage?.used_credits ?? 0);
+  const utilization = Number(extraUsage?.utilization ?? 0);
+  const remainingPercentage = Number.isFinite(utilization)
+    ? Math.max(0, 100 - utilization)
+    : undefined;
+  const remaining = Number.isFinite(monthlyLimit) ? Math.max(0, monthlyLimit - usedCredits) : 0;
+
+  return buildCreditsQuota("extra_usage", remaining, remainingPercentage ?? 100, {
+    used: Number.isFinite(usedCredits) ? usedCredits : 0,
+    total: Number.isFinite(monthlyLimit) ? monthlyLimit : 0,
+    currency: extraUsage?.currency,
+  });
+}
+
+// #6806: some Claude plans (e.g. "default_raven_enterprise") return no
+// five_hour/seven_day utilization windows at all — only a credit-billing
+// extraUsage block — so quotas can be {} while extraUsage still holds real,
+// actionable usage data. Fold it in instead of falling back to "No quota data".
 function parseClaude(data: any) {
   if (data?.message)
     return [{ name: "error", used: 0, total: 0, resetAt: null, message: data.message }];
-  return quotaEntries(data).map(([name, quota]) =>
+
+  const quotas = quotaEntries(data).map(([name, quota]) =>
     normalizeQuotaEntry(name, quota, { isPercentageOnly: true })
   );
+
+  if (data?.extraUsage?.is_enabled) {
+    quotas.push(buildClaudeExtraUsageQuota(data.extraUsage));
+  }
+
+  return quotas;
 }
 
 function parseDeepseekQuota(quotaKey: string, quota: any) {
@@ -190,7 +228,7 @@ function sortProviderModelOrder(provider: string, quotas: any[]) {
 }
 
 function sortGlmOrder(providerId: string, quotas: any[]) {
-  if (!["glm", "glm-cn", "glmt", "opencode-go"].includes(providerId)) return;
+  if (!GLM_FAMILY_PROVIDERS.includes(providerId)) return;
   quotas.sort((a, b) => (GLM_QUOTA_ORDER[a.name] ?? 99) - (GLM_QUOTA_ORDER[b.name] ?? 99));
 }
 
diff --git a/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/utils.tsx b/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/utils.tsx
index 7526b87ead..77058cdc82 100644
--- a/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/utils.tsx
+++ b/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/utils.tsx
@@ -34,6 +34,8 @@ const QUOTA_LABEL_MAP: Record<string, string> = {
   tokens: "Tokens",
   time_limit: "Time Limit",
   banked_reset_credits: "Banked Reset Credits",
+  gemini_weekly: "Gemini Weekly",
+  claude_gpt_weekly: "Claude & GPT Weekly",
 };
 
 function toRecord(value: unknown): Record<string, unknown> {
diff --git a/src/app/api/assess/route.ts b/src/app/api/assess/route.ts
index 993d21a77c..a8c83bedd4 100644
--- a/src/app/api/assess/route.ts
+++ b/src/app/api/assess/route.ts
@@ -9,6 +9,7 @@ import {
   type ModelCategory,
 } from "@/domain/assessment/types";
 import { validateBody } from "@/shared/validation/helpers";
+import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
 
 const assessor = new Assessor(
   process.env.OMNIROUTe_API_KEY ?? process.env.API_KEY ?? "",
@@ -96,7 +97,7 @@ export async function POST(request: NextRequest) {
     });
   } catch (error) {
     return NextResponse.json(
-      { error: error instanceof Error ? error.message : "Unknown error" },
+      { error: sanitizeErrorMessage(error instanceof Error ? error.message : "Unknown error") },
       { status: 500 }
     );
   }
diff --git a/src/app/api/cache/entries/route.ts b/src/app/api/cache/entries/route.ts
index 48fc5e88fe..d2a7ab4bc7 100644
--- a/src/app/api/cache/entries/route.ts
+++ b/src/app/api/cache/entries/route.ts
@@ -5,6 +5,7 @@ import {
   deleteSemanticCacheBySignature,
   deleteSemanticCacheByModel,
 } from "@/lib/db/semanticCache";
+import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
 
 export async function GET(req: NextRequest) {
   if (!(await isAuthenticated(req))) {
@@ -32,7 +33,7 @@ export async function GET(req: NextRequest) {
       },
     });
   } catch (error) {
-    return NextResponse.json({ error: String(error) }, { status: 500 });
+    return NextResponse.json({ error: sanitizeErrorMessage(error) }, { status: 500 });
   }
 }
 
@@ -58,6 +59,6 @@ export async function DELETE(req: NextRequest) {
 
     return NextResponse.json({ error: "Provide signature or model parameter" }, { status: 400 });
   } catch (error) {
-    return NextResponse.json({ error: String(error) }, { status: 500 });
+    return NextResponse.json({ error: sanitizeErrorMessage(error) }, { status: 500 });
   }
 }
diff --git a/src/app/api/chaos/config/route.ts b/src/app/api/chaos/config/route.ts
new file mode 100644
index 0000000000..c68b3b7b3e
--- /dev/null
+++ b/src/app/api/chaos/config/route.ts
@@ -0,0 +1,84 @@
+/**
+ * GET /api/chaos/config — Get chaos mode configuration
+ * PUT /api/chaos/config — Update chaos mode configuration
+ * DELETE /api/chaos/config — Reset to defaults
+ *
+ * Chaos Mode global settings: which providers/models participate,
+ * default mode (parallel/collaborative), system prompt, timeout.
+ */
+
+import { NextResponse } from "next/server";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { buildErrorBody, sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
+import {
+  getChaosConfig,
+  setChaosConfig,
+  resetChaosConfig,
+  chaosConfigSchema,
+} from "@/lib/chaos/chaosConfig";
+import { validateBody, isValidationFailure } from "@/shared/validation/helpers";
+import * as log from "@/sse/utils/logger";
+
+export const dynamic = "force-dynamic";
+
+/**
+ * GET /api/chaos/config
+ * Returns the current chaos mode configuration.
+ */
+export async function GET(request: Request) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  try {
+    const config = await getChaosConfig();
+    return NextResponse.json({ config });
+  } catch (err) {
+    const msg = sanitizeErrorMessage(err);
+    log.error("chaos", "Error fetching chaos config", err);
+    return NextResponse.json(buildErrorBody(500, msg), { status: 500 });
+  }
+}
+
+/**
+ * PUT /api/chaos/config
+ * Update chaos mode configuration.
+ */
+export async function PUT(request: Request) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  try {
+    const rawBody = await request.json();
+    const validation = validateBody(chaosConfigSchema, rawBody);
+    if (isValidationFailure(validation)) {
+      return NextResponse.json(buildErrorBody(400, validation.error.message), {
+        status: 400,
+      });
+    }
+
+    const config = await setChaosConfig(validation.data);
+    return NextResponse.json({ config, message: "Chaos config updated" });
+  } catch (err) {
+    const msg = sanitizeErrorMessage(err);
+    log.error("chaos", "Error updating chaos config", err);
+    return NextResponse.json(buildErrorBody(500, msg), { status: 500 });
+  }
+}
+
+/**
+ * DELETE /api/chaos/config
+ * Reset chaos config to defaults.
+ */
+export async function DELETE(request: Request) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  try {
+    const config = await resetChaosConfig();
+    return NextResponse.json({ config, message: "Chaos config reset to defaults" });
+  } catch (err) {
+    const msg = sanitizeErrorMessage(err);
+    log.error("chaos", "Error resetting chaos config", err);
+    return NextResponse.json(buildErrorBody(500, msg), { status: 500 });
+  }
+}
diff --git a/src/app/api/chaos/run/route.ts b/src/app/api/chaos/run/route.ts
new file mode 100644
index 0000000000..b6c784cc5c
--- /dev/null
+++ b/src/app/api/chaos/run/route.ts
@@ -0,0 +1,73 @@
+/**
+ * POST /api/chaos/run — Unified Chaos Mode execution endpoint.
+ *
+ * Dashboard-friendly: uses the current management session (cookie) for auth.
+ * Delegates all execution logic to the shared chaosExecutor library.
+ *
+ * Body (JSON):
+ *   task: string          // REQUIRED — the task/goal
+ *   providers?: string[]  // Optional — filter specific providers
+ *   mode?: "parallel" | "collaborative"  // Optional — override global default
+ *   systemPrompt?: string // Optional — override global system prompt
+ *   maxTokens?: number    // Optional — override max_tokens per model call
+ *
+ * Returns the same shape as POST /api/skills/collect/chaos.
+ */
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { validateBody, isValidationFailure } from "@/shared/validation/helpers";
+import { buildErrorBody, sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
+import { getChaosConfig } from "@/lib/chaos/chaosConfig";
+import { executeChaosRun, type ChaosRunResult } from "@/lib/chaos/chaosExecutor";
+import * as log from "@/sse/utils/logger";
+
+export const dynamic = "force-dynamic";
+
+const runSchema = z.object({
+  task: z.string().min(1, "Task is required").max(100_000, "task too long"),
+  providers: z.array(z.string().min(1)).max(50).optional(),
+  mode: z.enum(["parallel", "collaborative"]).optional(),
+  systemPrompt: z.string().max(10_000).optional(),
+  maxTokens: z.number().int().min(256).max(128_000).optional(),
+});
+
+export async function POST(request: Request) {
+  // Require dashboard management auth (cookie-based)
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  try {
+    // Load global chaos config
+    const globalConfig = await getChaosConfig();
+    if (!globalConfig.enabled) {
+      return NextResponse.json(
+        buildErrorBody(400, "Chaos Mode is not enabled. Enable it in Dashboard → Chaos Mode."),
+        { status: 400 }
+      );
+    }
+
+    const rawBody = await request.json();
+    const validation = validateBody(runSchema, rawBody);
+    if (isValidationFailure(validation)) {
+      return NextResponse.json(buildErrorBody(400, validation.error.message), { status: 400 });
+    }
+
+    const { task, providers, mode, systemPrompt, maxTokens } = validation.data;
+
+    const result: ChaosRunResult = await executeChaosRun({
+      task,
+      providers,
+      mode,
+      systemPrompt,
+      timeoutMs: globalConfig.timeoutMs,
+      maxTokens: maxTokens || globalConfig.maxTokens,
+    });
+
+    return NextResponse.json(result);
+  } catch (err) {
+    const msg = sanitizeErrorMessage(err);
+    log.error("chaos", "Chaos run error", err);
+    return NextResponse.json(buildErrorBody(500, msg), { status: 500 });
+  }
+}
diff --git a/src/app/api/cli-tools/codex-settings/route.ts b/src/app/api/cli-tools/codex-settings/route.ts
index 7e890fd8ed..2f382a62bc 100644
--- a/src/app/api/cli-tools/codex-settings/route.ts
+++ b/src/app/api/cli-tools/codex-settings/route.ts
@@ -260,7 +260,7 @@ export async function POST(request: Request) {
     parsed._root.model = model;
 
     if (reasoningEffort && reasoningEffort !== "none") {
-      // Optional: low, medium, high
+      // Optional Codex reasoning effort.
       parsed._root.model_reasoning_effort = reasoningEffort;
     } else {
       delete parsed._root.model_reasoning_effort;
diff --git a/src/app/api/cli-tools/letta-settings/route.ts b/src/app/api/cli-tools/letta-settings/route.ts
new file mode 100644
index 0000000000..f10f1a42a7
--- /dev/null
+++ b/src/app/api/cli-tools/letta-settings/route.ts
@@ -0,0 +1,329 @@
+export const dynamic = "force-dynamic";
+
+import { NextResponse } from "next/server";
+import fs from "fs/promises";
+import path from "path";
+import os from "os";
+import { exec } from "child_process";
+import { promisify } from "util";
+import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
+import { cliAuthOnlyConfigSchema } from "@/shared/validation/schemas/cli";
+import { requireCliToolsAuth } from "@/lib/api/requireCliToolsAuth";
+import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
+
+const execAsync = promisify(exec);
+
+// ── Paths ──────────────────────────────────────────────────────────────
+const getLettaDir = () => path.join(os.homedir(), ".letta");
+const getSettingsPath = () => path.join(getLettaDir(), "settings.json");
+const getLocalBackendDir = () => path.join(getLettaDir(), "lc-local-backend");
+const getProviderAuthPath = () => path.join(getLocalBackendDir(), "providers", "auth.json");
+const getBackupPath = () =>
+  path.join(getLocalBackendDir(), "providers", "auth.json.omniroute-backup");
+
+// ── Provider name in auth.json ─────────────────────────────────────────
+// "lmstudio" provider type has localModelDiscovery: "openai-compatible"
+// which auto-discovers models from /v1/models and shows them in /model picker
+// Models appear as "lmstudio/<model-id>" in the CLI
+const PROVIDER_NAME = "lmstudio";
+const PROVIDER_TYPE = "lmstudio_openai";
+
+// ── Check if Letta CLI is installed ────────────────────────────────────
+const checkLettaInstalled = async () => {
+  try {
+    const isWindows = os.platform() === "win32";
+    const command = isWindows ? "where letta" : "which letta";
+    const env = isWindows
+      ? { ...process.env, PATH: `${process.env.APPDATA}\\npm;${process.env.PATH}` }
+      : process.env;
+    await execAsync(command, { windowsHide: true, env });
+    return true;
+  } catch {
+    // Also check if config directory exists (CLI may be installed but not on PATH)
+    try {
+      await fs.access(getLettaDir());
+      return true;
+    } catch {
+      return false;
+    }
+  }
+};
+
+// ── Read settings.json ─────────────────────────────────────────────────
+const readSettings = async () => {
+  try {
+    const content = await fs.readFile(getSettingsPath(), "utf-8");
+    return JSON.parse(content);
+  } catch (error) {
+    if (error.code === "ENOENT") return {};
+    throw error;
+  }
+};
+
+// ── Read auth.json ──────────────────────────────────────────────────────
+const readAuthFile = async () => {
+  try {
+    const content = await fs.readFile(getProviderAuthPath(), "utf-8");
+    return JSON.parse(content);
+  } catch (error) {
+    if (error.code === "ENOENT") return { version: 1, providers: {} };
+    throw error;
+  }
+};
+
+// ── Check if a base_url points to OmniRoute ──────────────────────────────
+const isOmniRouteUrl = (baseUrl) => {
+  if (!baseUrl) return false;
+  return baseUrl.includes(":20128") || baseUrl.includes(":3000") || baseUrl.includes("omniroute");
+};
+
+// ── Check if OmniRoute is configured ─────────────────────────────────────
+const hasOmniRouteConfig = (authFile) => {
+  if (!authFile?.providers) return false;
+  const provider = authFile.providers[PROVIDER_NAME];
+  if (!provider) return false;
+  return isOmniRouteUrl(provider.base_url);
+};
+
+// ── GET - Check Letta CLI and read current settings ────────────────────
+export async function GET(request: Request) {
+  const authError = await requireCliToolsAuth(request);
+  if (authError) return authError;
+  try {
+    const isInstalled = await checkLettaInstalled();
+
+    if (!isInstalled) {
+      return NextResponse.json({
+        installed: false,
+        config: null,
+        message: "Letta CLI is not installed",
+      });
+    }
+
+    const settings = await readSettings();
+    const authFile = await readAuthFile();
+    const provider = authFile?.providers?.[PROVIDER_NAME];
+
+    // Detect if lmstudio is already configured for a non-OmniRoute endpoint
+    let lmstudioConflict = false;
+    if (provider && !isOmniRouteUrl(provider.base_url)) {
+      lmstudioConflict = true;
+    }
+
+    return NextResponse.json({
+      installed: true,
+      config: authFile,
+      hasOmniRoute: hasOmniRouteConfig(authFile),
+      lmstudioConflict,
+      configPath: getProviderAuthPath(),
+      letta: {
+        baseURL: provider?.base_url || null,
+      },
+      backendMode: settings.preferredBackendMode || "api",
+    });
+  } catch (error) {
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(error) } },
+      { status: 500 }
+    );
+  }
+}
+
+// ── POST - Apply OmniRoute as LM Studio provider + switch to local mode ──
+/**
+ * Steps 1-2 of POST: read the existing Letta auth.json, refuse to clobber a real
+ * LM Studio configuration unless `overwrite` is set (409 with conflict info), and back
+ * up a non-OmniRoute provider before it is overwritten. Extracted to keep POST under
+ * the complexity gate.
+ */
+async function prepareLettaAuthFile(
+  overwrite: boolean | undefined
+): Promise<
+  | { conflictResponse: NextResponse }
+  | { authFile: { version: number; providers: Record<string, any> }; authPath: string }
+> {
+  const localBackendDir = getLocalBackendDir();
+  const authPath = getProviderAuthPath();
+  await fs.mkdir(path.join(localBackendDir, "providers"), { recursive: true });
+
+  let authFile = { version: 1, providers: {} as Record<string, any> };
+  try {
+    const existing = await fs.readFile(authPath, "utf-8");
+    authFile = JSON.parse(existing);
+  } catch {
+    /* No existing file */
+  }
+
+  const existingProvider = authFile.providers?.[PROVIDER_NAME];
+  if (existingProvider && !isOmniRouteUrl(existingProvider.base_url) && !overwrite) {
+    // User has lmstudio configured for actual LM Studio — refuse to overwrite
+    return {
+      conflictResponse: NextResponse.json(
+        {
+          error: `lmstudio provider is already configured for ${existingProvider.base_url}. Overwriting will break your existing LM Studio connection. Apply again to overwrite.`,
+          conflict: true,
+          existingBaseUrl: existingProvider.base_url,
+        },
+        { status: 409 }
+      ),
+    };
+  }
+
+  // Back up existing lmstudio provider before overwriting
+  if (existingProvider && !isOmniRouteUrl(existingProvider.base_url)) {
+    const backupPath = getBackupPath();
+    await fs.writeFile(backupPath, JSON.stringify(existingProvider, null, 2));
+  }
+
+  return { authFile, authPath };
+}
+
+export async function POST(request: Request) {
+  const authError = await requireCliToolsAuth(request);
+  if (authError) return authError;
+  let rawBody;
+  try {
+    rawBody = await request.json();
+  } catch {
+    return NextResponse.json({ error: { message: "Invalid JSON body" } }, { status: 400 });
+  }
+
+  try {
+    const validation = validateBody(cliAuthOnlyConfigSchema, rawBody);
+    if (isValidationFailure(validation)) {
+      return NextResponse.json({ error: validation.error }, { status: 400 });
+    }
+    const { baseUrl, apiKey, overwrite } = validation.data;
+
+    const normalizedBaseUrl = baseUrl.endsWith("/v1") ? baseUrl : `${baseUrl}/v1`;
+
+    // ── 1-2. Read auth.json, guard non-OmniRoute conflicts, back up before overwrite ──
+    const prepared = await prepareLettaAuthFile(overwrite);
+    if ("conflictResponse" in prepared) {
+      return prepared.conflictResponse;
+    }
+    const { authFile, authPath } = prepared;
+
+    // ── 3. Switch to local mode in settings.json ──
+    const settingsPath = getSettingsPath();
+    const lettaDir = getLettaDir();
+    await fs.mkdir(lettaDir, { recursive: true });
+
+    let settings = {};
+    try {
+      const existing = await fs.readFile(settingsPath, "utf-8");
+      settings = JSON.parse(existing);
+    } catch {
+      /* No existing settings */
+    }
+
+    settings.preferredBackendMode = "local";
+    await fs.writeFile(settingsPath, JSON.stringify(settings, null, 2));
+
+    // ── 4. Write lmstudio provider to auth.json ──
+    // Clean up legacy lc-omniroute provider if present
+    if (authFile.providers?.["lc-omniroute"]) {
+      delete authFile.providers["lc-omniroute"];
+    }
+
+    // Create or update lmstudio provider
+    authFile.providers[PROVIDER_NAME] = {
+      id: `local-provider-${PROVIDER_NAME}`,
+      name: PROVIDER_NAME,
+      provider_type: PROVIDER_TYPE,
+      provider_category: "byok",
+      auth: { type: "api", key: apiKey },
+      base_url: normalizedBaseUrl,
+      created_at: authFile.providers[PROVIDER_NAME]?.created_at || new Date().toISOString(),
+      updated_at: new Date().toISOString(),
+    };
+
+    await fs.writeFile(authPath, JSON.stringify(authFile, null, 2));
+
+    return NextResponse.json({
+      success: true,
+      message: "Settings applied. Restart Letta CLI, then use /model to select a OmniRoute model.",
+      needsRestart: true,
+    });
+  } catch (error) {
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(error) } },
+      { status: 500 }
+    );
+  }
+}
+
+// ── DELETE - Remove OmniRoute configuration ──────────────────────────────
+export async function DELETE(request: Request) {
+  const authError = await requireCliToolsAuth(request);
+  if (authError) return authError;
+  try {
+    // ── 1. Remove lmstudio provider from auth.json, restore backup if exists ──
+    const authPath = getProviderAuthPath();
+    const backupPath = getBackupPath();
+    let authFile = { version: 1, providers: {} };
+    try {
+      const existing = await fs.readFile(authPath, "utf-8");
+      authFile = JSON.parse(existing);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+
+    let changed = false;
+    let restored = false;
+
+    if (authFile.providers?.[PROVIDER_NAME]) {
+      // Check if there's a backup of a pre-existing lmstudio config
+      try {
+        const backupContent = await fs.readFile(backupPath, "utf-8");
+        const backupProvider = JSON.parse(backupContent);
+        // Restore the original lmstudio config
+        authFile.providers[PROVIDER_NAME] = backupProvider;
+        restored = true;
+        await fs.unlink(backupPath);
+      } catch {
+        // No backup — just remove the provider
+        delete authFile.providers[PROVIDER_NAME];
+      }
+      changed = true;
+    }
+
+    // Clean up legacy lc-omniroute provider if present
+    if (authFile.providers?.["lc-omniroute"]) {
+      delete authFile.providers["lc-omniroute"];
+      changed = true;
+    }
+
+    if (changed) {
+      await fs.writeFile(authPath, JSON.stringify(authFile, null, 2));
+    }
+
+    // ── 2. Reset backend mode to api in settings.json ──
+    const settingsPath = getSettingsPath();
+    try {
+      const existing = await fs.readFile(settingsPath, "utf-8");
+      const settings = JSON.parse(existing);
+      if (settings.preferredBackendMode === "local") {
+        settings.preferredBackendMode = "api";
+        await fs.writeFile(settingsPath, JSON.stringify(settings, null, 2));
+      }
+    } catch {
+      /* No settings file */
+    }
+
+    const message = restored
+      ? "OmniRoute config removed. Your original LM Studio provider has been restored. Restart Letta CLI to take effect."
+      : "OmniRoute config removed. Restart Letta CLI to take effect.";
+
+    return NextResponse.json({
+      success: true,
+      message,
+      needsRestart: true,
+    });
+  } catch (error) {
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(error) } },
+      { status: 500 }
+    );
+  }
+}
diff --git a/src/app/api/cli-tools/omp-settings/route.ts b/src/app/api/cli-tools/omp-settings/route.ts
new file mode 100644
index 0000000000..dc1e840c6c
--- /dev/null
+++ b/src/app/api/cli-tools/omp-settings/route.ts
@@ -0,0 +1,180 @@
+export const dynamic = "force-dynamic";
+
+import { NextResponse } from "next/server";
+import { exec } from "child_process";
+import { promisify } from "util";
+import path from "path";
+import os from "os";
+import fs from "fs/promises";
+import { load as yamlLoad, dump as yamlDump } from "js-yaml";
+import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
+import { cliAuthOnlyConfigSchema } from "@/shared/validation/schemas/cli";
+import { getOmpCredentials, saveOmpCredentials, deleteOmpCredentials } from "@/lib/db/omp";
+import { requireCliToolsAuth } from "@/lib/api/requireCliToolsAuth";
+import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
+
+const execAsync = promisify(exec);
+
+const PROVIDER_ID = "omniroute";
+
+const getOmpDir = () => path.join(os.homedir(), ".omp", "agent");
+const getOmpDbPath = () => path.join(getOmpDir(), "agent.db");
+const getOmpModelsYmlPath = () => path.join(getOmpDir(), "models.yml");
+
+const checkOmpInstalled = async () => {
+  const isWindows = os.platform() === "win32";
+  try {
+    const command = isWindows ? "where omp" : "which omp";
+    await execAsync(command, { windowsHide: true });
+    return true;
+  } catch {
+    try {
+      await fs.access(getOmpDbPath());
+      return true;
+    } catch {
+      if (isWindows) {
+        try {
+          const appDataPath = path.join(process.env.LOCALAPPDATA || "", "omp", "omp.exe");
+          await fs.access(appDataPath);
+          return true;
+        } catch {}
+      }
+      return false;
+    }
+  }
+};
+
+const readModelsYml = async () => {
+  try {
+    const content = await fs.readFile(getOmpModelsYmlPath(), "utf-8");
+    return yamlLoad(content) || {};
+  } catch {
+    return {};
+  }
+};
+
+export async function GET(request: Request) {
+  const authError = await requireCliToolsAuth(request);
+  if (authError) return authError;
+  try {
+    const installed = await checkOmpInstalled();
+
+    if (!installed) {
+      return NextResponse.json({
+        installed: false,
+        config: null,
+        message: "Oh My Pi is not installed",
+      });
+    }
+
+    const creds = getOmpCredentials(PROVIDER_ID);
+    const modelsYml = await readModelsYml();
+    const ymlProvider = modelsYml?.providers?.[PROVIDER_ID];
+
+    return NextResponse.json({
+      installed: true,
+      config: {
+        providers: {
+          [PROVIDER_ID]: {
+            baseUrl: ymlProvider?.baseUrl || creds.baseUrl,
+            apiKey: ymlProvider?.apiKey || creds.apiKey,
+            discovery: ymlProvider?.discovery?.type || null,
+          },
+        },
+      },
+      hasOmniRoute: !!(ymlProvider || creds.hasOmniRoute),
+      configPath: getOmpModelsYmlPath(),
+    });
+  } catch (error) {
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(error) } },
+      { status: 500 }
+    );
+  }
+}
+
+export async function POST(request: Request) {
+  const authError = await requireCliToolsAuth(request);
+  if (authError) return authError;
+  let rawBody;
+  try {
+    rawBody = await request.json();
+  } catch {
+    return NextResponse.json({ error: { message: "Invalid JSON body" } }, { status: 400 });
+  }
+
+  try {
+    const validation = validateBody(cliAuthOnlyConfigSchema, rawBody);
+    if (isValidationFailure(validation)) {
+      return NextResponse.json({ error: validation.error }, { status: 400 });
+    }
+    const { baseUrl, apiKey } = validation.data;
+
+    const normalizedBaseUrl = baseUrl.endsWith("/v1") ? baseUrl : `${baseUrl}/v1`;
+    const keyRef = apiKey || "sk_omniroute";
+
+    await fs.mkdir(getOmpDir(), { recursive: true });
+
+    // 1. Write models.yml — provider config + auto-discovery
+    const modelsYml = await readModelsYml();
+    if (!modelsYml.providers) modelsYml.providers = {};
+
+    modelsYml.providers[PROVIDER_ID] = {
+      baseUrl: normalizedBaseUrl,
+      apiKey: keyRef,
+      api: "openai-completions",
+      authHeader: true,
+      disableStrictTools: true,
+      discovery: { type: "proxy" },
+    };
+
+    await fs.writeFile(getOmpModelsYmlPath(), yamlDump(modelsYml, { lineWidth: -1 }), "utf-8");
+
+    // 2. Write auth_credentials — so omp sees omniroute as "logged in"
+    saveOmpCredentials(PROVIDER_ID, keyRef, normalizedBaseUrl);
+
+    return NextResponse.json({
+      success: true,
+      message:
+        "Oh My Pi settings applied! Run omp and all OmniRoute models appear under omniroute in /model.",
+      configPath: getOmpModelsYmlPath(),
+    });
+  } catch (error) {
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(error) } },
+      { status: 500 }
+    );
+  }
+}
+
+export async function DELETE(request: Request) {
+  const authError = await requireCliToolsAuth(request);
+  if (authError) return authError;
+  try {
+    // 1. Remove from models.yml
+    const modelsYml = await readModelsYml();
+    if (modelsYml?.providers?.[PROVIDER_ID]) {
+      delete modelsYml.providers[PROVIDER_ID];
+      if (Object.keys(modelsYml.providers).length === 0) delete modelsYml.providers;
+      await fs.mkdir(getOmpDir(), { recursive: true });
+      if (Object.keys(modelsYml).length === 0) {
+        await fs.unlink(getOmpModelsYmlPath()).catch(() => {});
+      } else {
+        await fs.writeFile(getOmpModelsYmlPath(), yamlDump(modelsYml, { lineWidth: -1 }), "utf-8");
+      }
+    }
+
+    // 2. Remove from auth_credentials
+    deleteOmpCredentials(PROVIDER_ID);
+
+    return NextResponse.json({
+      success: true,
+      message: "OmniRoute removed from Oh My Pi",
+    });
+  } catch (error) {
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(error) } },
+      { status: 500 }
+    );
+  }
+}
diff --git a/src/app/api/combos/test/route.ts b/src/app/api/combos/test/route.ts
index db8723477d..bd73410d77 100644
--- a/src/app/api/combos/test/route.ts
+++ b/src/app/api/combos/test/route.ts
@@ -7,6 +7,7 @@ import { resolveNestedComboTargets } from "@omniroute/open-sse/services/combo.ts
 import { testComboSchema } from "@/shared/validation/schemas";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
 
 async function getInternalApiKey(): Promise<string | null> {
   // Combo health-check probes hit /v1/chat/completions, which enforces
@@ -115,7 +116,7 @@ async function testComboTarget(target, baseInternalUrl, internalApiKey: string |
     const latencyMs = Date.now() - startTime;
     return buildComboTestResult(target, {
       status: "error",
-      error: error.name === "AbortError" ? "Timeout (20s)" : error.message,
+      error: error.name === "AbortError" ? "Timeout (20s)" : sanitizeErrorMessage(error.message),
       latencyMs,
     });
   }
diff --git a/src/app/api/compression/preview/route.ts b/src/app/api/compression/preview/route.ts
index 3153298ffa..c656f0ced3 100644
--- a/src/app/api/compression/preview/route.ts
+++ b/src/app/api/compression/preview/route.ts
@@ -16,7 +16,10 @@ import {
 } from "@omniroute/open-sse/services/compression/diffHelper";
 import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
 import { countTextTokens } from "@/shared/utils/tiktokenCounter";
-import { ensureEngineBreakdown } from "@omniroute/open-sse/services/compression/engineBreakdown";
+import {
+  ensureEngineBreakdown,
+  reconcileSingleEngineTokens,
+} from "@omniroute/open-sse/services/compression/engineBreakdown";
 import { summarizeEncoderCandidates } from "@omniroute/open-sse/services/compression/engines/headroom/encoderComparison";
 import { DEFAULT_MIN_ROWS } from "@omniroute/open-sse/services/compression/engines/headroom/smartcrusher";
 
@@ -217,7 +220,14 @@ export async function POST(req: Request) {
     const tokensSaved = Math.max(0, originalTokens - compressedTokens);
     const savingsPct = originalTokens > 0 ? Math.round((tokensSaved / originalTokens) * 100) : 0;
     const techniquesUsed: string[] = result.stats?.techniquesUsed ?? [];
-    const engineBreakdown = result.stats ? ensureEngineBreakdown(result.stats) : [];
+    const engineBreakdown = result.stats
+      ? reconcileSingleEngineTokens(
+          ensureEngineBreakdown(result.stats),
+          originalTokens,
+          compressedTokens,
+          savingsPct
+        )
+      : [];
     const diff = buildCompressionPreviewDiff(
       originalText,
       compressedText,
@@ -230,6 +240,31 @@ export async function POST(req: Request) {
       ? summarizeEncoderCandidates(messages, DEFAULT_MIN_ROWS, countTextTokens)
       : null;
 
+    // #6461: when fallbackApplied=true, synthesize a deduped reason list from data the
+    // pipeline already produces on result.stats (engineBreakdown[].rejectReason,
+    // validationErrors, and inflation-guard entries in validationWarnings). Non-fallback
+    // runs return []/null — zero change on the happy path.
+    const fallbackReasons: string[] = [];
+    if (diff.fallbackApplied) {
+      const seen = new Set<string>();
+      const push = (s: unknown) => {
+        if (typeof s === "string" && s.length > 0 && !seen.has(s)) {
+          seen.add(s);
+          fallbackReasons.push(s);
+        }
+      };
+      for (const step of engineBreakdown) {
+        if ((step as { rejected?: boolean }).rejected === true) {
+          push((step as { rejectReason?: string }).rejectReason);
+        }
+      }
+      for (const err of diff.validationErrors ?? []) push(err);
+      for (const warn of diff.validationWarnings ?? []) {
+        if (typeof warn === "string" && warn.startsWith("pipeline-inflation-guard:")) push(warn);
+      }
+    }
+    const fallbackReason = fallbackReasons[0] ?? null;
+
     return NextResponse.json({
       encoderComparison,
       original: originalText,
@@ -246,7 +281,7 @@ export async function POST(req: Request) {
       mode: effectiveMode,
       intensity: null,
       outputMode: null,
-      skippedReasons: [],
+      skippedReasons: fallbackReasons,
       diff: diff.segments,
       preservedBlocks: diff.preservedBlocks,
       ruleRemovals: diff.ruleRemovals,
@@ -261,7 +296,10 @@ export async function POST(req: Request) {
       validationWarnings: diff.validationWarnings,
       validationErrors: diff.validationErrors,
       fallbackApplied: diff.fallbackApplied,
-      ...(diff.fallbackReason && { fallbackReason: diff.fallbackReason }),
+      // Prefer the pipeline's canonical `diff.fallbackReason`; fall back to the
+      // first synthesized reason (#6461) when the pipeline did not set one.
+      fallbackReason: diff.fallbackReason ?? fallbackReason,
+      fallbackReasons,
       ...(diff.heatmap ? { heatmap: diff.heatmap } : {}),
     });
   } catch (err: unknown) {
diff --git a/src/app/api/db-backups/exportAll/route.ts b/src/app/api/db-backups/exportAll/route.ts
index 35dba50bd4..6e89631df7 100644
--- a/src/app/api/db-backups/exportAll/route.ts
+++ b/src/app/api/db-backups/exportAll/route.ts
@@ -7,6 +7,7 @@ import path from "path";
 import os from "os";
 import { execFileSync } from "node:child_process";
 import { isAuthenticated } from "@/shared/utils/apiAuth";
+import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
 
 /**
  * GET /api/db-backups/exportAll
@@ -104,7 +105,7 @@ export async function GET(request: NextRequest) {
     return NextResponse.json(
       {
         error: "Failed to create full export",
-        details: error instanceof Error ? error.message : String(error),
+        details: sanitizeErrorMessage(error instanceof Error ? error.message : String(error)),
       },
       { status: 500 }
     );
diff --git a/src/app/api/db/health/route.ts b/src/app/api/db/health/route.ts
index dfe84dda6c..6e0b47f0b3 100644
--- a/src/app/api/db/health/route.ts
+++ b/src/app/api/db/health/route.ts
@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { runManagedDbHealthCheck } from "@/lib/db/core";
 import { isAuthenticated } from "@/shared/utils/apiAuth";
+import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
 
 export async function GET(request: Request) {
   if (!(await isAuthenticated(request))) {
@@ -12,7 +13,10 @@ export async function GET(request: Request) {
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     console.error("[API] DB health diagnosis failed:", message);
-    return NextResponse.json({ error: { message } }, { status: 500 });
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(message) } },
+      { status: 500 }
+    );
   }
 }
 
@@ -26,6 +30,9 @@ export async function POST(request: Request) {
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     console.error("[API] DB health repair failed:", message);
-    return NextResponse.json({ error: { message } }, { status: 500 });
+    return NextResponse.json(
+      { error: { message: sanitizeErrorMessage(message) } },
+      { status: 500 }
+    );
   }
 }
diff --git a/src/app/api/github-skills/route.ts b/src/app/api/github-skills/route.ts
index f4687a3847..a8d69a8384 100644
--- a/src/app/api/github-skills/route.ts
+++ b/src/app/api/github-skills/route.ts
@@ -15,6 +15,7 @@ import { searchGitHubSkills } from "@/lib/skills/githubCollector";
 import { matchesSearch } from "@/shared/utils/turkishText";
 import { validateBody } from "@/shared/validation/helpers";
 import { buildErrorBody, sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 
 const installSkillSchema = z.object({
   repoName: z.string().min(1),
@@ -25,6 +26,9 @@ const installSkillSchema = z.object({
 export const dynamic = "force-dynamic";
 
 export async function GET(request: NextRequest) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
   try {
     const { searchParams } = new URL(request.url);
     const minStars = parseInt(searchParams.get("minStars") ?? "1", 10);
@@ -64,6 +68,9 @@ export async function GET(request: NextRequest) {
 }
 
 export async function POST(request: NextRequest) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
   try {
     const parsed = validateBody(installSkillSchema, await request.json());
     if (!parsed.success) {
diff --git a/src/app/api/internal/codex-responses-ws/route.ts b/src/app/api/internal/codex-responses-ws/route.ts
index ec1d710981..3036a40761 100644
--- a/src/app/api/internal/codex-responses-ws/route.ts
+++ b/src/app/api/internal/codex-responses-ws/route.ts
@@ -6,6 +6,7 @@ import { getApiKeyMetadata } from "@/lib/db/apiKeys";
 import { authorizeWebSocketHandshake, extractWsTokenFromRequest } from "@/lib/ws/handshake";
 import { getModelInfo } from "@/sse/services/model";
 import { getProviderCredentialsWithQuotaPreflight } from "@/sse/services/auth";
+import { enforceApiKeyPolicy } from "@/shared/utils/apiKeyPolicy";
 import { checkAndRefreshToken } from "@/sse/services/tokenRefresh";
 import { resolveCodexWsModelInfo } from "./modelResolution";
 import { isFeatureFlagEnabled } from "@/shared/utils/featureFlags";
@@ -340,6 +341,28 @@ async function authenticate(body: JsonRecord) {
   });
 }
 
+/**
+ * #6564: the WS bridge authenticates the API key (see `authenticate()`) but
+ * historically never enforced the API-key model/combo policy the HTTP
+ * `/v1/responses` path enforces via `enforceApiKeyPolicy()` — a key
+ * restricted to `allowedModels`/`allowedCombos` could still reach a direct
+ * Codex model through this transport. The bridge's token arrives via query
+ * params, not a normal Authorization header, so this builds an equivalent
+ * Request carrying the extracted bearer token and evaluates policy against
+ * the CLIENT-requested model, before any Codex-specific remapping.
+ */
+async function enforceCodexWsApiKeyPolicy(
+  authRequest: Request,
+  apiKey: string | null,
+  requestedModel: string
+): Promise<{ rejection: Response | null; apiKeyInfo: ApiKeyMetadata | null }> {
+  const policyHeaders = new Headers(authRequest.headers);
+  if (apiKey) policyHeaders.set("Authorization", `Bearer ${apiKey}`);
+  const policyRequest = new Request(authRequest.url, { headers: policyHeaders });
+  const policy = await enforceApiKeyPolicy(policyRequest, requestedModel);
+  return { rejection: policy.rejection, apiKeyInfo: policy.apiKeyInfo };
+}
+
 async function prepare(body: JsonRecord) {
   // Global kill-switch (feature flag OMNIROUTE_CODEX_WS_ENABLED, default ON).
   // When disabled, the public Responses-over-WebSocket endpoint is unavailable.
@@ -352,17 +375,23 @@ async function prepare(body: JsonRecord) {
 
   const authRequest = getAuthRequest(body);
   const apiKey = extractWsTokenFromRequest(authRequest);
-  const metadata = apiKey ? await getApiKeyMetadata(apiKey).catch(() => null) : null;
-  const allowedConnections =
-    metadata && Array.isArray(metadata.allowedConnections) && metadata.allowedConnections.length > 0
-      ? metadata.allowedConnections
-      : null;
 
   const responseBody = isRecord(body.response) ? body.response : {};
   const requestedModel =
     typeof responseBody.model === "string" && responseBody.model.trim()
       ? responseBody.model.trim()
       : "gpt-5.5";
+
+  const policyResult = await enforceCodexWsApiKeyPolicy(authRequest, apiKey, requestedModel);
+  if (policyResult.rejection) return policyResult.rejection;
+
+  const metadata =
+    policyResult.apiKeyInfo ?? (apiKey ? await getApiKeyMetadata(apiKey).catch(() => null) : null);
+  const allowedConnections =
+    metadata && Array.isArray(metadata.allowedConnections) && metadata.allowedConnections.length > 0
+      ? metadata.allowedConnections
+      : null;
+
   // codex-only bridge: re-resolve bare ChatGPT model ids (the Codex CLI rejects
   // provider-prefixed ids client-side over WebSocket) as codex models.
   const modelInfo = await resolveCodexWsModelInfo(requestedModel, getModelInfo);
diff --git a/src/app/api/keys/[id]/route.ts b/src/app/api/keys/[id]/route.ts
index 8fd10cc338..da22e8451e 100644
--- a/src/app/api/keys/[id]/route.ts
+++ b/src/app/api/keys/[id]/route.ts
@@ -86,6 +86,7 @@ export async function PATCH(request, { params }) {
       usageLimitEnabled,
       dailyUsageLimitUsd,
       weeklyUsageLimitUsd,
+      chaosModeEnabled,
     } = validation.data;
 
     const payload: Parameters<typeof updateApiKeyPermissions>[1] = {};
@@ -112,6 +113,7 @@ export async function PATCH(request, { params }) {
     if (usageLimitEnabled !== undefined) payload.usageLimitEnabled = usageLimitEnabled;
     if (dailyUsageLimitUsd !== undefined) payload.dailyUsageLimitUsd = dailyUsageLimitUsd;
     if (weeklyUsageLimitUsd !== undefined) payload.weeklyUsageLimitUsd = weeklyUsageLimitUsd;
+    if (chaosModeEnabled !== undefined) payload.chaosModeEnabled = chaosModeEnabled;
 
     const updated = await updateApiKeyPermissions(id, payload);
     if (!updated) {
@@ -145,6 +147,7 @@ export async function PATCH(request, { params }) {
       ...(usageLimitEnabled !== undefined && { usageLimitEnabled }),
       ...(dailyUsageLimitUsd !== undefined && { dailyUsageLimitUsd }),
       ...(weeklyUsageLimitUsd !== undefined && { weeklyUsageLimitUsd }),
+      ...(chaosModeEnabled !== undefined && { chaosModeEnabled }),
     });
   } catch (error) {
     log.error("keys", "Error updating key permissions", error);
diff --git a/src/app/api/keys/route.ts b/src/app/api/keys/route.ts
index b4611943f6..631b35c024 100644
--- a/src/app/api/keys/route.ts
+++ b/src/app/api/keys/route.ts
@@ -71,6 +71,7 @@ export async function POST(request) {
       usageLimitEnabled,
       dailyUsageLimitUsd,
       weeklyUsageLimitUsd,
+      chaosModeEnabled,
     } = validation.data;
 
     // Always get machineId from server
@@ -82,7 +83,8 @@ export async function POST(request) {
       allowUsageCommand === true ||
       usageLimitEnabled === true ||
       dailyUsageLimitUsd !== undefined ||
-      weeklyUsageLimitUsd !== undefined
+      weeklyUsageLimitUsd !== undefined ||
+      chaosModeEnabled === true
     ) {
       await updateApiKeyPermissions(apiKey.id, {
         ...(noLog === true && { noLog: true }),
@@ -90,11 +92,19 @@ export async function POST(request) {
         ...(usageLimitEnabled === true && { usageLimitEnabled: true }),
         ...(dailyUsageLimitUsd !== undefined && { dailyUsageLimitUsd }),
         ...(weeklyUsageLimitUsd !== undefined && { weeklyUsageLimitUsd }),
+        ...(chaosModeEnabled === true && { chaosModeEnabled: true }),
       });
     }
 
-    // Auto sync to Cloud if enabled
-    await syncKeysToCloudIfEnabled();
+    // Auto sync to Cloud if enabled — fire-and-forget. Cloud sync is a
+    // background side-effect, not part of the key-creation contract, and it
+    // performs an outbound network call. Awaiting it here blocked the HTTP
+    // response on a slow/unreachable Cloud endpoint (e.g. a fresh/offline
+    // install with a misconfigured or unreachable CLOUD_URL): the request
+    // would hang until the fetch settled or timed out (#6570). Errors inside
+    // syncKeysToCloudIfEnabled() are already caught and logged internally, so
+    // this is safe to leave unawaited.
+    void syncKeysToCloudIfEnabled();
 
     return NextResponse.json(
       {
@@ -107,6 +117,7 @@ export async function POST(request) {
         usageLimitEnabled: usageLimitEnabled === true,
         dailyUsageLimitUsd: dailyUsageLimitUsd ?? null,
         weeklyUsageLimitUsd: weeklyUsageLimitUsd ?? null,
+        chaosModeEnabled: chaosModeEnabled === true,
         streamDefaultMode: "legacy",
       },
       { status: 201 }
diff --git a/src/app/api/middleware/hooks/[name]/route.ts b/src/app/api/middleware/hooks/[name]/route.ts
index 087730d960..647cb523cc 100644
--- a/src/app/api/middleware/hooks/[name]/route.ts
+++ b/src/app/api/middleware/hooks/[name]/route.ts
@@ -10,6 +10,7 @@ import { registerHook, unregisterHook, updateHook } from "@/lib/middleware/regis
 import type { HookConfig } from "@/lib/middleware/types";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
 
 type RouteParams = { params: Promise<{ name: string }> };
 
@@ -105,7 +106,7 @@ export async function PUT(request: Request, { params }: RouteParams) {
     return NextResponse.json({ hook: saved });
   } catch (error: any) {
     console.error("[API] PUT /api/middleware/hooks/[name] error:", error);
-    return NextResponse.json({ error: error?.message || "Failed to update hook" }, { status: 500 });
+    return NextResponse.json({ error: sanitizeErrorMessage(error) || "Failed to update hook" }, { status: 500 });
   }
 }
 
diff --git a/src/app/api/middleware/hooks/route.ts b/src/app/api/middleware/hooks/route.ts
index 1350777912..ea8b40ef69 100644
--- a/src/app/api/middleware/hooks/route.ts
+++ b/src/app/api/middleware/hooks/route.ts
@@ -10,6 +10,7 @@ import { registerHook, getAllHooks } from "@/lib/middleware/registry";
 import type { HookConfig, CreateHookRequest } from "@/lib/middleware/types";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
 
 const hookScopeSchema = z.union([
   z.object({ type: z.literal("global") }),
@@ -114,6 +115,6 @@ export async function POST(request: Request) {
     return NextResponse.json({ hook: saved }, { status: 201 });
   } catch (error: any) {
     console.error("[API] POST /api/middleware/hooks error:", error);
-    return NextResponse.json({ error: error?.message || "Failed to create hook" }, { status: 500 });
+    return NextResponse.json({ error: sanitizeErrorMessage(error) || "Failed to create hook" }, { status: 500 });
   }
 }
diff --git a/src/app/api/model-capability-overrides/route.ts b/src/app/api/model-capability-overrides/route.ts
new file mode 100644
index 0000000000..8b7b456579
--- /dev/null
+++ b/src/app/api/model-capability-overrides/route.ts
@@ -0,0 +1,83 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { resolveProviderAlias } from "@omniroute/open-sse/services/model.ts";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import {
+  listModelCapabilityOverrides,
+  removeModelCapabilityOverride,
+  setModelCapabilityOverride,
+  type ModelCapabilityOverrideKey,
+} from "@/lib/db/modelCapabilityOverrides";
+
+const overrideKeySchema = z.enum(["max_token"]);
+
+const upsertOverrideSchema = z.object({
+  target: z.string().min(3),
+  key: overrideKeySchema,
+  value: z.coerce.number().int().positive(),
+});
+
+function canonicalizeTarget(target: string): string | null {
+  const raw = target.trim();
+  const slashIndex = raw.indexOf("/");
+  if (slashIndex <= 0 || slashIndex === raw.length - 1) return null;
+
+  const provider = raw.slice(0, slashIndex).trim();
+  const modelId = raw.slice(slashIndex + 1).trim();
+  if (!provider || !modelId) return null;
+
+  return `${resolveProviderAlias(provider) || provider}/${modelId}`;
+}
+
+export async function GET(request: Request) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  return NextResponse.json({ overrides: listModelCapabilityOverrides() });
+}
+
+export async function PATCH(request: Request) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  let rawBody: unknown;
+  try {
+    rawBody = await request.json();
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
+  }
+
+  const parsed = upsertOverrideSchema.safeParse(rawBody);
+  if (!parsed.success) {
+    return NextResponse.json({ error: parsed.error.issues }, { status: 400 });
+  }
+
+  const target = canonicalizeTarget(parsed.data.target);
+  if (!target) {
+    return NextResponse.json({ error: "Invalid model capability override" }, { status: 400 });
+  }
+
+  const written = setModelCapabilityOverride(target, parsed.data.key, parsed.data.value);
+  if (!written) {
+    return NextResponse.json({ error: "Invalid model capability override" }, { status: 400 });
+  }
+
+  return NextResponse.json({ overrides: listModelCapabilityOverrides() });
+}
+
+export async function DELETE(request: Request) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  const { searchParams } = new URL(request.url);
+  const target = canonicalizeTarget(searchParams.get("target") || "");
+  const key = searchParams.get("key") || "";
+  const parsedKey = overrideKeySchema.safeParse(key);
+
+  if (!target || !parsedKey.success) {
+    return NextResponse.json({ error: "target and key are required" }, { status: 400 });
+  }
+
+  removeModelCapabilityOverride(target, parsedKey.data as ModelCapabilityOverrideKey);
+  return NextResponse.json({ overrides: listModelCapabilityOverrides() });
+}
diff --git a/src/app/api/model-combo-mappings/route.ts b/src/app/api/model-combo-mappings/route.ts
index eb8b7d23f4..955530e4f5 100644
--- a/src/app/api/model-combo-mappings/route.ts
+++ b/src/app/api/model-combo-mappings/route.ts
@@ -4,11 +4,11 @@
  * POST — Create a new mapping
  */
 
-import { z } from "zod";
 import { NextResponse } from "next/server";
+import { z } from "zod";
 import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
-import { getModelComboMappings, createModelComboMapping } from "@/lib/localDb";
-import { validateBody, isValidationFailure } from "@/shared/validation/helpers";
+import { createModelComboMapping, getModelComboMappings } from "@/lib/localDb";
+import { validatedJsonBody } from "@/shared/validation/helpers";
 
 const createMappingSchema = z.object({
   pattern: z.string().min(1, "Pattern is required").max(500),
@@ -36,13 +36,12 @@ export async function POST(request: Request) {
   if (authError) return authError;
 
   try {
-    const rawBody = await request.json();
-    const validation = validateBody(createMappingSchema, rawBody);
-    if (isValidationFailure(validation)) {
-      return NextResponse.json({ error: validation.error }, { status: 400 });
+    const parsed = await validatedJsonBody(request, createMappingSchema);
+    if (!parsed.success) {
+      return parsed.response;
     }
 
-    const { data } = validation;
+    const { data } = parsed;
     const mapping = await createModelComboMapping({
       pattern: data.pattern.trim(),
       comboId: data.comboId,
diff --git a/src/app/api/models/openrouter-catalog/route.ts b/src/app/api/models/openrouter-catalog/route.ts
index dee7e8f13e..dcb8656cd1 100644
--- a/src/app/api/models/openrouter-catalog/route.ts
+++ b/src/app/api/models/openrouter-catalog/route.ts
@@ -9,6 +9,8 @@
 import { NextRequest, NextResponse } from "next/server";
 import { isAuthenticated } from "@/shared/utils/apiAuth";
 import { getOpenRouterCatalog, refreshOpenRouterCatalog } from "@/lib/catalog/openrouterCatalog";
+import { getSettings } from "@/lib/db/settings";
+import { isFreeModel } from "@/shared/utils/freeModels";
 
 export async function GET(req: NextRequest) {
   // Require authentication (dashboard/API key)
@@ -19,30 +21,42 @@ export async function GET(req: NextRequest) {
     );
   }
 
+  // #6328 (follow-up to #6495): REMOVE — not just hide — paid models from the
+  // OpenRouter catalog echo when hidePaidModels is on. Fail open on settings read.
+  let hidePaid = false;
+  try {
+    const settings = await getSettings();
+    hidePaid = settings?.hidePaidModels === true;
+  } catch {}
+  const applyFilter = <T extends { id?: string }>(data: T[]): T[] =>
+    hidePaid ? data.filter((m) => isFreeModel("or", m as { id: string; pricing?: unknown })) : data;
+
   const forceRefresh = req.nextUrl.searchParams.get("refresh") === "true";
 
   if (forceRefresh) {
     const result = await refreshOpenRouterCatalog();
+    const data = applyFilter(result.data);
     return NextResponse.json({
       object: "list",
-      data: result.data,
+      data,
       meta: {
         source: result.ok ? "fresh" : "error",
-        count: result.data.length,
+        count: data.length,
         error: result.error ?? undefined,
       },
     });
   }
 
   const result = await getOpenRouterCatalog();
+  const data = applyFilter(result.data);
   return NextResponse.json({
     object: "list",
-    data: result.data,
+    data,
     meta: {
       source: result.fromCache ? (result.stale ? "stale-cache" : "cache") : "fresh",
       cachedAt: result.cachedAt ?? undefined,
       stale: result.stale,
-      count: result.data.length,
+      count: data.length,
     },
   });
 }
diff --git a/src/app/api/models/route.ts b/src/app/api/models/route.ts
index 92cf976126..9c3d078229 100644
--- a/src/app/api/models/route.ts
+++ b/src/app/api/models/route.ts
@@ -4,6 +4,8 @@ import { AI_MODELS, PROVIDER_ID_TO_ALIAS } from "@/shared/constants/models";
 import { updateModelAliasSchema } from "@/shared/validation/schemas";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { hasEligibleConnectionForModel } from "@/domain/connectionModelRules";
+import { getSettings } from "@/lib/db/settings";
+import { isFreeModel, providerHasFreeModels } from "@/shared/utils/freeModels";
 
 // GET /api/models - Get models with aliases (only from active providers by default)
 export async function GET(request: Request) {
@@ -85,7 +87,22 @@ export async function GET(request: Request) {
       };
     }).filter((m: any) => showAll || m.available);
 
-    return NextResponse.json({ models });
+    // #6328 (follow-up to #6495): REMOVE — not just hide — paid models from the
+    // dashboard model picker when the operator opts into hidePaidModels. Mirrors
+    // the `shouldHidePaid` guard in `src/app/api/v1/models/catalog.ts` (public
+    // catalog). Settings read fails open: on error we preserve pre-patch behavior.
+    let hidePaid = false;
+    try {
+      const settings = await getSettings();
+      hidePaid = settings?.hidePaidModels === true;
+    } catch {}
+    const filtered = hidePaid
+      ? models.filter(
+          (m: { provider: string; model: string }) => providerHasFreeModels(m.provider) && isFreeModel(m.provider, { id: m.model })
+        )
+      : models;
+
+    return NextResponse.json({ models: filtered });
   } catch (error) {
     console.log("Error fetching models:", error);
     return NextResponse.json({ error: "Failed to fetch models" }, { status: 500 });
diff --git a/src/app/api/models/test-all/route.ts b/src/app/api/models/test-all/route.ts
index bd0913df41..28a418dd48 100644
--- a/src/app/api/models/test-all/route.ts
+++ b/src/app/api/models/test-all/route.ts
@@ -16,10 +16,21 @@ import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 import { runSingleModelTest } from "@/lib/api/modelTestRunner";
 import { setModelIsHidden } from "@/lib/localDb";
 import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
+import { getSettings } from "@/lib/db/settings";
+import { isFreeModel, providerHasFreeModels } from "@/shared/utils/freeModels";
 import * as log from "@/sse/utils/logger";
 
 const PER_MODEL_TIMEOUT_MS = 20_000;
 const CONSECUTIVE_RATE_LIMIT_STOP_THRESHOLD = 3;
+/** Web-session providers (esp. Arena/CF) ban burst probes — pause between models. */
+const SLOW_PROBE_PROVIDERS = new Set(["lmarena", "lma"]);
+/** Fixed inter-model delay for SLOW_PROBE_PROVIDERS (no env — avoids doc-sync drift). */
+const SLOW_PROBE_DELAY_MS = 3500;
+const CONSECUTIVE_BOT_STOP_THRESHOLD = 2;
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
 
 const testAllSchema = z.object({
   providerId: z.string().min(1),
@@ -80,6 +91,16 @@ export async function POST(request: Request) {
   }
   const { providerId, modelIds, connectionId, respectRateLimit, autoHideFailed } = validation.data;
 
+  // #6328 (follow-up to #6495): REMOVE — not just hide — paid Test-all dispatches
+  // when hidePaidModels is on. Paid ids are skipped inside the loop with a
+  // "Skipped" entry; the skip does NOT touch the consecutive-rate-limit halt
+  // counter (skips are not upstream failures). Fail open on settings read.
+  let hidePaid = false;
+  try {
+    const settings = await getSettings();
+    hidePaid = settings?.hidePaidModels === true;
+  } catch {}
+
   log.info(
     "MODEL_TEST_ALL",
     `Starting batch test for ${modelIds.length} model(s) on provider ${providerId}`,
@@ -94,12 +115,33 @@ export async function POST(request: Request) {
 
   const results: Record<string, BatchTestResultEntry> = {};
   let consecutiveRateLimits = 0;
+  let consecutiveBotBlocks = 0;
   let stoppedEarly = false;
-  let stopReason: "consecutive_rate_limits" | undefined;
+  let stopReason: "consecutive_rate_limits" | "consecutive_bot_blocks" | undefined;
+  const slowProbe = SLOW_PROBE_PROVIDERS.has(providerId);
+  let testedUpstream = 0;
 
   for (const modelId of modelIds) {
+    // #6328: skip paid ids without dispatching; do not increment
+    // consecutiveRateLimits — skip is not a rate-limited failure.
+    if (
+      hidePaid &&
+      !(providerHasFreeModels(providerId) && isFreeModel(providerId, { id: modelId }))
+    ) {
+      results[modelId] = {
+        status: "error",
+        latencyMs: 0,
+        error: "Skipped: paid model with hidePaidModels enabled",
+      };
+      continue;
+    }
+
     let entry: BatchTestResultEntry;
     try {
+      // Space out Arena/CF probes — sequential alone still looks like a burst.
+      if (slowProbe && testedUpstream > 0 && SLOW_PROBE_DELAY_MS > 0) {
+        await sleep(SLOW_PROBE_DELAY_MS);
+      }
       // `runSingleModelTest` only engages the Bottleneck rate limiter when
       // `connectionId` is provided. To honor `respectRateLimit=false`, we
       // omit the connectionId so the runner bypasses `withRateLimit`.
@@ -112,6 +154,7 @@ export async function POST(request: Request) {
         timeoutMs: PER_MODEL_TIMEOUT_MS,
       });
       entry = toBatchEntry(result);
+      testedUpstream += 1;
     } catch (error: unknown) {
       log.error("MODEL_TEST_ALL", `Unexpected error testing model ${modelId}`, {
         providerId,
@@ -131,6 +174,16 @@ export async function POST(request: Request) {
       consecutiveRateLimits = 0;
     }
 
+    const botBlocked =
+      entry.statusCode === 403 ||
+      (typeof entry.error === "string" &&
+        /cloudflare|bot management|recaptcha|cf-chl|just a moment/i.test(entry.error));
+    if (botBlocked) {
+      consecutiveBotBlocks += 1;
+    } else if (entry.status === "ok") {
+      consecutiveBotBlocks = 0;
+    }
+
     if (autoHideFailed && entry.status === "error" && !entry.rateLimited && !entry.isTimeout) {
       try {
         await setModelIsHidden(providerId, modelId, true);
@@ -176,6 +229,21 @@ export async function POST(request: Request) {
       );
       break;
     }
+
+    if (slowProbe && consecutiveBotBlocks >= CONSECUTIVE_BOT_STOP_THRESHOLD) {
+      stoppedEarly = true;
+      stopReason = "consecutive_bot_blocks";
+      log.warn(
+        "MODEL_TEST_ALL",
+        `Stopping batch early after ${consecutiveBotBlocks} consecutive bot/Cloudflare blocks (avoid session ban)`,
+        {
+          providerId,
+          testedCount: Object.keys(results).length,
+          totalCount: modelIds.length,
+        }
+      );
+      break;
+    }
   }
 
   log.info(
diff --git a/src/app/api/models/test/route.ts b/src/app/api/models/test/route.ts
index 8044d51d20..c8974707a1 100644
--- a/src/app/api/models/test/route.ts
+++ b/src/app/api/models/test/route.ts
@@ -3,6 +3,8 @@ import { z } from "zod";
 import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 import { runSingleModelTest } from "@/lib/api/modelTestRunner";
 import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error.ts";
+import { getSettings } from "@/lib/db/settings";
+import { isFreeModel, providerHasFreeModels } from "@/shared/utils/freeModels";
 
 const testModelSchema = z.object({
   providerId: z.string().min(1),
@@ -40,6 +42,27 @@ export async function POST(request: Request) {
     }
     const { providerId, modelId, connectionId } = validation.data;
 
+    // #6328 (follow-up to #6495): REMOVE — not just hide — paid Test dispatches
+    // when hidePaidModels is on. 403 (distinct from validation-400) so callers
+    // can tell policy-blocked apart from bad-request. Fail open on settings read.
+    let hidePaid = false;
+    try {
+      const settings = await getSettings();
+      hidePaid = settings?.hidePaidModels === true;
+    } catch {}
+    if (
+      hidePaid &&
+      !(providerHasFreeModels(providerId) && isFreeModel(providerId, { id: modelId }))
+    ) {
+      return NextResponse.json(
+        {
+          status: "error",
+          error: "Paid model blocked while hidePaidModels is enabled",
+        },
+        { status: 403 }
+      );
+    }
+
     const result = await runSingleModelTest({
       providerId,
       modelId,
diff --git a/src/app/api/monitoring/health/route.ts b/src/app/api/monitoring/health/route.ts
index 4b991b612c..aa396447dd 100644
--- a/src/app/api/monitoring/health/route.ts
+++ b/src/app/api/monitoring/health/route.ts
@@ -11,7 +11,20 @@ import { isAuthenticated } from "@/shared/utils/apiAuth";
  * Returns system info, provider health (circuit breakers),
  * rate limit status, and database stats.
  */
+// §8.2 optimization: short-TTL cache for the health payload. Health is a
+// frequently-polled endpoint and rebuilding it every request (DB reads +
+// status aggregation across 8 subsystems) is wasteful under rapid polling. 1s
+// stays near-real-time for monitoring; the cache is invalidated on DELETE
+// (circuit-breaker reset) so a manual reset is reflected immediately.
+let healthPayloadCache: { payload: unknown; expiresAt: number } | null = null;
+const HEALTH_PAYLOAD_TTL_MS = 1000;
+
 export async function GET() {
+  const cachedNow = Date.now();
+  if (healthPayloadCache && cachedNow <= healthPayloadCache.expiresAt) {
+    return NextResponse.json(healthPayloadCache.payload);
+  }
+
   const readHealthValue = <T>(label: string, reader: () => T, fallback: T): T => {
     try {
       return reader();
@@ -158,6 +171,7 @@ export async function GET() {
       credentialHealth,
     });
 
+    healthPayloadCache = { payload, expiresAt: Date.now() + HEALTH_PAYLOAD_TTL_MS };
     return NextResponse.json(payload);
   } catch (error) {
     console.error("[API] GET /api/monitoring/health error:", error);
@@ -196,6 +210,7 @@ export async function DELETE(request: Request) {
     const resetCount = before.length;
 
     resetAllCircuitBreakers();
+    healthPayloadCache = null; // a reset just happened — don't serve a stale GET snapshot
 
     console.log(`[API] DELETE /api/monitoring/health — Reset ${resetCount} circuit breakers`);
 
diff --git a/src/app/api/oauth/kiro/api-key/helpers.ts b/src/app/api/oauth/kiro/api-key/helpers.ts
new file mode 100644
index 0000000000..8a0da5b89c
--- /dev/null
+++ b/src/app/api/oauth/kiro/api-key/helpers.ts
@@ -0,0 +1,24 @@
+import { createHash } from "node:crypto";
+
+export function buildKiroApiKeyConnectionName(
+  targetProvider: string,
+  region: string,
+  apiKey: string
+): string {
+  const label = targetProvider === "amazon-q" ? "Amazon Q" : "Kiro";
+  const safeRegion = region || "us-east-1";
+  const fingerprint = createHash("sha256").update(apiKey.trim()).digest("hex").slice(0, 8);
+  return `${label} API Key (${safeRegion}, ${fingerprint})`;
+}
+
+export function isKiroApiKeyImportClientError(error: unknown): boolean {
+  const message = (error instanceof Error ? error.message : String(error || "")).toLowerCase();
+  return (
+    message.includes("api key is required") ||
+    message.includes("invalid region") ||
+    message.includes("invalid kiro api key") ||
+    message.includes("invalid api key") ||
+    message.includes("no kiro profile available") ||
+    message.includes("failed to list profiles")
+  );
+}
diff --git a/src/app/api/oauth/kiro/api-key/route.ts b/src/app/api/oauth/kiro/api-key/route.ts
new file mode 100644
index 0000000000..0564d0937f
--- /dev/null
+++ b/src/app/api/oauth/kiro/api-key/route.ts
@@ -0,0 +1,106 @@
+import { NextResponse } from "next/server";
+import { KiroService } from "@/lib/oauth/services/kiro";
+import { createProviderConnection, isCloudEnabled } from "@/models";
+import { syncToCloud } from "@/lib/cloudSync";
+import { getConsistentMachineId } from "@/shared/utils/machineId";
+import { kiroApiKeyImportSchema } from "@/shared/validation/schemas";
+import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
+import { isAuthRequired, isAuthenticated } from "@/shared/utils/apiAuth";
+import { buildKiroImportError } from "../import/route";
+import { buildKiroApiKeyConnectionName, isKiroApiKeyImportClientError } from "./helpers";
+
+async function requireKiroApiKeyImportAuth(request: Request) {
+  if (!(await isAuthRequired(request))) return null;
+  if (await isAuthenticated(request)) return null;
+  return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+}
+
+/**
+ * POST /api/oauth/kiro/api-key
+ *
+ * Imports a long-lived Kiro / AWS CodeWhisperer API key. API-key auth has no
+ * refresh token; profile discovery is best-effort because AWS rejects
+ * ListAvailableProfiles for some API keys while still accepting generation calls.
+ */
+export async function POST(request: Request) {
+  const authResponse = await requireKiroApiKeyImportAuth(request);
+  if (authResponse) return authResponse;
+
+  let rawBody;
+  try {
+    rawBody = await request.json();
+  } catch {
+    return NextResponse.json(
+      {
+        error: {
+          message: "Invalid request",
+          details: [{ field: "body", message: "Invalid JSON body" }],
+        },
+      },
+      { status: 400 }
+    );
+  }
+
+  try {
+    const { searchParams } = new URL(request.url);
+    const targetProvider = searchParams.get("targetProvider") === "amazon-q" ? "amazon-q" : "kiro";
+    const validation = validateBody(kiroApiKeyImportSchema, rawBody);
+    if (isValidationFailure(validation)) {
+      return NextResponse.json({ error: validation.error }, { status: 400 });
+    }
+
+    const { apiKey, region } = validation.data;
+    const kiroService = new KiroService();
+    const credential = await kiroService.validateApiKey(apiKey, region || "us-east-1");
+    const email = kiroService.extractEmailFromJWT(credential.accessToken);
+
+    const connection: any = await createProviderConnection({
+      provider: targetProvider,
+      authType: "apikey",
+      name: buildKiroApiKeyConnectionName(targetProvider, credential.region, apiKey),
+      apiKey: credential.accessToken,
+      accessToken: credential.accessToken,
+      refreshToken: null,
+      // Long-lived key with no scheduled refresh. Keep a future timestamp so
+      // health/token paths do not treat the connection as immediately expired.
+      expiresAt: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000).toISOString(),
+      email: email || null,
+      providerSpecificData: {
+        profileArn: credential.profileArn,
+        region: credential.region,
+        authMethod: "api_key",
+        provider: "API Key",
+      },
+      testStatus: "active",
+    });
+
+    await syncToCloudIfEnabled();
+
+    return NextResponse.json({
+      success: true,
+      connection: {
+        id: connection.id,
+        provider: connection.provider,
+        email: connection.email,
+      },
+    });
+  } catch (error) {
+    console.error("Kiro API key import error:", error);
+    return NextResponse.json(
+      { error: buildKiroImportError(error) },
+      { status: isKiroApiKeyImportClientError(error) ? 400 : 500 }
+    );
+  }
+}
+
+async function syncToCloudIfEnabled() {
+  try {
+    const cloudEnabled = await isCloudEnabled();
+    if (!cloudEnabled) return;
+
+    const machineId = await getConsistentMachineId();
+    await syncToCloud(machineId);
+  } catch (error) {
+    console.log("Error syncing to cloud after Kiro API key import:", error);
+  }
+}
diff --git a/src/app/api/oauth/kiro/auto-import/route.ts b/src/app/api/oauth/kiro/auto-import/route.ts
index 1387f06302..3c3937cc59 100755
--- a/src/app/api/oauth/kiro/auto-import/route.ts
+++ b/src/app/api/oauth/kiro/auto-import/route.ts
@@ -13,6 +13,11 @@ import { syncToCloud } from "@/lib/cloudSync";
 import { getConsistentMachineId } from "@/shared/utils/machineId";
 import { KiroService } from "@/lib/oauth/services/kiro";
 import { runWithProxyContext } from "@omniroute/open-sse/utils/proxyFetch.ts";
+import {
+  emailFromExternalIdpToken,
+  isExternalIdpAuthMethod,
+  normalizeScope,
+} from "@omniroute/open-sse/services/kiroExternalIdp.ts";
 
 /**
  * GET /api/oauth/kiro/auto-import
@@ -202,16 +207,69 @@ async function tryKiroCliSqlite(): Promise<{
 
 // ── ~/.aws/sso/cache fallback ─────────────────────────────────────────────────
 
+/**
+ * Read the Amazon Q Developer profileArn the Kiro IDE persists in its
+ * `profile.json`. This is the authoritative source for the profileArn of AWS
+ * IAM Identity Center AND External IdP (organization) logins, since neither can
+ * enumerate it via ListAvailableProfiles (org tokens get an empty list).
+ *
+ * The ARN's region segment is preserved verbatim (#2314). #2059 originally
+ * forced every ARN's region to us-east-1, which 403s the runtime gateway for
+ * IDC accounts that live in a non-us-east-1 region. The OAuth device-code
+ * path (src/lib/oauth/providers/kiro.ts) already discovers the correct
+ * region-matched ARN, so this fallback now mirrors that behavior instead of
+ * rewriting it.
+ */
+async function readKiroIdeProfileArn(): Promise<string | null> {
+  const { readFile } = await import("fs/promises");
+  const kiroProfilePaths = [
+    join(
+      process.env.APPDATA || join(homedir(), "AppData", "Roaming"),
+      "Kiro",
+      "User",
+      "globalStorage",
+      "kiro.kiroagent",
+      "profile.json"
+    ),
+    join(homedir(), ".config", "Kiro", "User", "globalStorage", "kiro.kiroagent", "profile.json"),
+    join(
+      homedir(),
+      "Library",
+      "Application Support",
+      "Kiro",
+      "User",
+      "globalStorage",
+      "kiro.kiroagent",
+      "profile.json"
+    ),
+  ];
+  for (const profilePath of kiroProfilePaths) {
+    try {
+      const profileContent = await readFile(profilePath, "utf-8");
+      const profileData = JSON.parse(profileContent);
+      if (profileData.arn) {
+        return profileData.arn;
+      }
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+
 async function tryAwsSsoCache(targetProvider: string): Promise<{
   found: boolean;
   triedPath?: string;
   refreshToken?: string;
+  accessToken?: string | null;
   source?: string;
   clientId?: string | null;
   clientSecret?: string | null;
   region?: string | null;
   authMethod?: string | null;
   profileArn?: string | null;
+  tokenEndpoint?: string | null;
+  scopes?: string | string[] | null;
 }> {
   const { readFile, readdir } = await import("fs/promises");
   const cachePath = join(homedir(), ".aws/sso/cache");
@@ -235,6 +293,34 @@ async function tryAwsSsoCache(targetProvider: string): Promise<{
     try {
       const content = await readFile(join(cachePath, file), "utf-8");
       const data = JSON.parse(content);
+
+      // Enterprise / Microsoft Entra "Your organization" (external_idp) tokens are NOT AWS SSO
+      // tokens — their refresh token does not start with `aorAAAAAG`. Detect them by authMethod/
+      // provider and take the dedicated external_idp branch (org IdP tokenEndpoint refresh +
+      // profileArn read from the Kiro IDE profile.json).
+      const isExternalIdp =
+        !!data.refreshToken &&
+        (isExternalIdpAuthMethod(data.authMethod) ||
+          String(data.provider || "").toLowerCase() === "externalidp");
+
+      if (isExternalIdp) {
+        const region: string | null = data.region || null;
+        const profileArn = await readKiroIdeProfileArn();
+        return {
+          found: true,
+          source: file,
+          refreshToken: data.refreshToken,
+          accessToken: data.accessToken || null,
+          clientId: data.clientId || null,
+          clientSecret: null,
+          region,
+          authMethod: "external_idp",
+          profileArn,
+          tokenEndpoint: data.tokenEndpoint || null,
+          scopes: data.scopes || null,
+        };
+      }
+
       if (data.refreshToken?.startsWith("aorAAAAAG")) {
         const region: string | null = data.region || null;
         const authMethod: string | null = data.authMethod || null;
@@ -257,46 +343,9 @@ async function tryAwsSsoCache(targetProvider: string): Promise<{
           }
         }
 
-        // Read profileArn from Kiro IDE's profile.json.
-        // Kiro IDC (Identity Center) accounts can live in regions other than
-        // us-east-1. #2059 forced every ARN's region segment to us-east-1,
-        // which 403s the runtime gateway for non-us-east-1 IDC accounts. The
-        // OAuth device-code path (src/lib/oauth/providers/kiro.ts) already
-        // discovers the correct region-matched ARN; mirror that here by
-        // preserving the profile's ARN region verbatim instead of rewriting
-        // it.
-        let profileArn: string | null = null;
-        const kiroProfilePaths = [
-          join(
-            process.env.APPDATA || join(homedir(), "AppData", "Roaming"),
-            "Kiro",
-            "User",
-            "globalStorage",
-            "kiro.kiroagent",
-            "profile.json"
-          ),
-          join(
-            homedir(),
-            ".config",
-            "Kiro",
-            "User",
-            "globalStorage",
-            "kiro.kiroagent",
-            "profile.json"
-          ),
-        ];
-        for (const profilePath of kiroProfilePaths) {
-          try {
-            const profileContent = await readFile(profilePath, "utf-8");
-            const profileData = JSON.parse(profileContent);
-            if (profileData.arn) {
-              profileArn = profileData.arn;
-              break;
-            }
-          } catch {
-            continue;
-          }
-        }
+        // Read profileArn from Kiro IDE's profile.json. The region is preserved
+        // verbatim by readKiroIdeProfileArn() (#2314) — see its docstring for why.
+        const profileArn: string | null = await readKiroIdeProfileArn();
 
         return {
           found: true,
@@ -375,6 +424,9 @@ export function findKiroConnectionByProfileArn(
 type SaveAndRespondResult = Awaited<ReturnType<typeof tryKiroCliSqlite>> & {
   // Fields added by tryAwsSsoCache for IDC tokens (#2059)
   authMethod?: string | null;
+  // Fields added by tryAwsSsoCache for External IdP (organization) tokens
+  tokenEndpoint?: string | null;
+  scopes?: string | string[] | null;
 };
 
 async function saveAndRespond(
@@ -386,6 +438,81 @@ async function saveAndRespond(
     const kiroService = new KiroService();
     const proxy = await resolveProxyForProvider(targetProvider);
 
+    // Enterprise / Microsoft Entra "Your organization" (external_idp) tokens: refresh via the
+    // org IdP tokenEndpoint (public-client OAuth2), persist the Kiro IDE profileArn, and mark
+    // the connection so the runtime executor sends `TokenType: EXTERNAL_IDP` and the quota
+    // fetch works. These tokens can't refresh via AWS OIDC / Kiro social and have no client
+    // secret, so they get their own path.
+    if (isExternalIdpAuthMethod(result.authMethod)) {
+      const region = result.region || "us-east-1";
+      const scope = normalizeScope(result.scopes);
+      const externalIdpPsd = {
+        authMethod: "external_idp",
+        clientId: result.clientId || undefined,
+        tokenEndpoint: result.tokenEndpoint || undefined,
+        scope,
+        region,
+      };
+      const refreshed = await runWithProxyContext(proxy, () =>
+        kiroService.refreshToken(result.refreshToken!, externalIdpPsd)
+      );
+      const email =
+        emailFromExternalIdpToken(refreshed.accessToken) ||
+        kiroService.extractEmailFromJWT(refreshed.accessToken);
+      const profileArn = result.profileArn || null;
+      const connectionName = deriveKiroConnectionName({
+        email,
+        profileArn: profileArn || undefined,
+        region,
+        targetProvider,
+      });
+      const providerSpecificData: Record<string, any> = {
+        authMethod: "external_idp",
+        provider: "ExternalIdp",
+        clientId: result.clientId || null,
+        tokenEndpoint: result.tokenEndpoint || null,
+        scope,
+        region,
+      };
+      if (profileArn) providerSpecificData.profileArn = profileArn;
+
+      const existingConnections = await getProviderConnections({ provider: targetProvider });
+      const existingByArn = findKiroConnectionByProfileArn(
+        existingConnections,
+        profileArn || undefined
+      );
+      const record = {
+        accessToken: refreshed.accessToken,
+        refreshToken: refreshed.refreshToken || result.refreshToken!,
+        expiresAt: new Date(Date.now() + (refreshed.expiresIn || 3600) * 1000).toISOString(),
+        email: email || null,
+        name: connectionName,
+        providerSpecificData,
+        testStatus: "active",
+      };
+      if (existingByArn && typeof existingByArn.id === "string") {
+        await updateProviderConnection(existingByArn.id, record);
+      } else {
+        await createProviderConnection({
+          provider: targetProvider,
+          authType: "oauth",
+          ...record,
+        } as any);
+      }
+      if (isCloudEnabled()) {
+        const machineId = await getConsistentMachineId();
+        await syncToCloud(machineId).catch(() => {});
+      }
+      return NextResponse.json({
+        found: true,
+        source: result.source,
+        email: email || null,
+        profileArn: profileArn || null,
+        region,
+        message: "Kiro credentials imported successfully.",
+      });
+    }
+
     // If we have a refresh token but no valid access token, refresh now
     let accessToken = result.accessToken;
     let refreshToken = result.refreshToken!;
diff --git a/src/app/api/oauth/kiro/import/route.ts b/src/app/api/oauth/kiro/import/route.ts
index 7774908866..4e58bfcbd3 100755
--- a/src/app/api/oauth/kiro/import/route.ts
+++ b/src/app/api/oauth/kiro/import/route.ts
@@ -8,6 +8,11 @@ import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { isAuthRequired, isAuthenticated } from "@/shared/utils/apiAuth";
 import { runWithProxyContext } from "@omniroute/open-sse/utils/proxyFetch.ts";
 import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
+import {
+  emailFromExternalIdpToken,
+  isExternalIdpAuthMethod,
+  normalizeScope,
+} from "@omniroute/open-sse/services/kiroExternalIdp.ts";
 
 /**
  * Build the user-facing error message for a failed Kiro/Amazon-Q token import.
@@ -63,12 +68,58 @@ export async function POST(request: Request) {
     }
     const { refreshToken, region, clientId, clientSecret, authMethod, profileArn } =
       validation.data;
+    const { tokenEndpoint, scopes } = validation.data;
 
     const kiroService = new KiroService();
 
     // Resolve proxy for this provider (provider-level → global → direct)
     const proxy = await resolveProxyForProvider(targetProvider);
 
+    // Enterprise / Microsoft Entra "Your organization" (external_idp) import. These tokens are
+    // NOT AWS SSO tokens (their refresh token does not start with `aorAAAAAG`), so the Builder
+    // ID / IDC path (validateImportToken) rejects them. Refresh via the org IdP's tokenEndpoint,
+    // persist the org profileArn (read from the Kiro IDE profile.json by the caller), and mark
+    // the connection so the runtime executor sends `TokenType: EXTERNAL_IDP`.
+    if (isExternalIdpAuthMethod(authMethod)) {
+      const scope = normalizeScope(scopes);
+      const externalIdpPsd = {
+        authMethod: "external_idp",
+        clientId,
+        tokenEndpoint,
+        scope,
+        region: region || "us-east-1",
+      };
+      const refreshed = await runWithProxyContext(proxy, () =>
+        kiroService.refreshToken(refreshToken.trim(), externalIdpPsd)
+      );
+      const email =
+        emailFromExternalIdpToken(refreshed.accessToken) ||
+        kiroService.extractEmailFromJWT(refreshed.accessToken);
+      const connection: any = await createProviderConnection({
+        provider: targetProvider,
+        authType: "oauth",
+        accessToken: refreshed.accessToken,
+        refreshToken: refreshed.refreshToken || refreshToken.trim(),
+        expiresAt: new Date(Date.now() + (refreshed.expiresIn || 3600) * 1000).toISOString(),
+        email: email || null,
+        providerSpecificData: {
+          profileArn: profileArn || null,
+          authMethod: "external_idp",
+          provider: "ExternalIdp",
+          clientId,
+          tokenEndpoint,
+          scope,
+          region: region || "us-east-1",
+        },
+        testStatus: "active",
+      } as any);
+      await syncToCloudIfEnabled();
+      return NextResponse.json({
+        success: true,
+        connection: { id: connection.id, provider: connection.provider, email: connection.email },
+      });
+    }
+
     // For IDC tokens the client already has OIDC client credentials extracted from the
     // SSO cache registration file by auto-import (#2059). Refresh directly via the
     // regional OIDC endpoint without calling registerClient() again. For social /
diff --git a/src/app/api/playground/presets/route.ts b/src/app/api/playground/presets/route.ts
index d290524cc2..468154b040 100644
--- a/src/app/api/playground/presets/route.ts
+++ b/src/app/api/playground/presets/route.ts
@@ -10,6 +10,7 @@
 import { buildErrorBody, sanitizeErrorMessage } from "@omniroute/open-sse/utils/error.ts";
 import { HTTP_STATUS } from "@omniroute/open-sse/config/constants.ts";
 import { extractApiKey, isValidApiKey } from "@/sse/services/auth";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 import { listPlaygroundPresets, createPlaygroundPreset } from "@/lib/db/playgroundPresets";
 import { PlaygroundPresetCreateSchema } from "@/shared/schemas/playground";
 import { isRequireApiKeyEnabled } from "@/shared/utils/featureFlags";
@@ -28,11 +29,23 @@ function errorResp(status: number, message: string): Response {
 
 async function checkAuth(request: Request): Promise<Response | null> {
   const apiKeyRaw = extractApiKey(request);
-  if (isRequireApiKeyEnabled() && !apiKeyRaw) {
-    return errorResp(HTTP_STATUS.UNAUTHORIZED, "Authentication required");
+  // External-client path: if an API key is presented it MUST be valid.
+  if (apiKeyRaw) {
+    if (!(await isValidApiKey(apiKeyRaw))) {
+      return errorResp(HTTP_STATUS.UNAUTHORIZED, "Invalid API key");
+    }
+    return null;
   }
-  if (apiKeyRaw && !(await isValidApiKey(apiKeyRaw))) {
-    return errorResp(HTTP_STATUS.UNAUTHORIZED, "Invalid API key");
+  // Dashboard path: the Playground page itself calls this route with a
+  // cookie/session (no API key). Under REQUIRE_API_KEY=true that previously
+  // 401'd the authenticated dashboard (QA P1: preset auth mismatch). Accept a
+  // valid management/dashboard session as an alternative to an API key.
+  const managementError = await requireManagementAuth(request);
+  if (!managementError) return null;
+  // Neither an API key nor a valid dashboard session: enforce only when
+  // API-key enforcement is on (preserves the legacy anonymous-allowed default).
+  if (isRequireApiKeyEnabled()) {
+    return errorResp(HTTP_STATUS.UNAUTHORIZED, "Authentication required");
   }
   return null;
 }
diff --git a/src/app/api/plugins/[name]/config/route.ts b/src/app/api/plugins/[name]/config/route.ts
index dbbae2ae32..e6b94375b8 100644
--- a/src/app/api/plugins/[name]/config/route.ts
+++ b/src/app/api/plugins/[name]/config/route.ts
@@ -1,9 +1,9 @@
-import { NextRequest, NextResponse } from "next/server";
-import { CORS_HEADERS, handleCorsOptions } from "@/shared/utils/cors";
 import { buildErrorBody } from "@omniroute/open-sse/utils/error";
-import { getPluginByName, updatePluginConfig } from "@/lib/db/plugins";
-import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { type NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { getPluginByName, updatePluginConfig } from "@/lib/db/plugins";
+import { CORS_HEADERS, handleCorsOptions } from "@/shared/utils/cors";
 
 export async function OPTIONS() {
   return handleCorsOptions();
@@ -41,7 +41,16 @@ export async function PUT(request: NextRequest, { params }: { params: Promise<{
   const authError = await requireManagementAuth(request);
   if (authError) return authError;
   const { name } = await params;
-  const body = await request.json();
+
+  let body: unknown;
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json(buildErrorBody(400, "Invalid JSON body"), {
+      status: 400,
+      headers: CORS_HEADERS,
+    });
+  }
 
   const schema = z.object({
     config: z.record(z.string(), z.unknown()),
diff --git a/src/app/api/provider-models/route.ts b/src/app/api/provider-models/route.ts
index 4f982d5912..e606a124d0 100644
--- a/src/app/api/provider-models/route.ts
+++ b/src/app/api/provider-models/route.ts
@@ -11,6 +11,11 @@ import {
   mergeModelCompatOverride,
   type ModelCompatPatch,
 } from "@/lib/localDb";
+import {
+  getModelContextOverrideRecord,
+  setModelContextOverride,
+  removeModelContextOverride,
+} from "@/lib/db/modelContextOverrides";
 import {
   deleteManagedAvailableModelAliases,
   deleteManagedAvailableModelAliasesForProvider,
@@ -59,8 +64,24 @@ export async function GET(request) {
 
     const models = provider ? await getCustomModels(provider) : await getAllCustomModels();
     const modelCompatOverrides = provider ? getModelCompatOverrides(provider) : [];
+    // #4125: surface the manual/auto context-window override (Feature 5004 table) on
+    // each custom-model row so the UI can show/edit it without a second round trip.
+    const modelsWithContextOverride =
+      provider && Array.isArray(models)
+        ? models.map((model: Record<string, unknown>) => {
+            const modelId = typeof model?.id === "string" ? model.id : null;
+            const record = modelId ? getModelContextOverrideRecord(provider, modelId) : null;
+            return record
+              ? {
+                  ...model,
+                  contextWindowOverride: record.realContext,
+                  contextWindowOverrideSource: record.source,
+                }
+              : model;
+          })
+        : models;
 
-    return Response.json({ models, modelCompatOverrides });
+    return Response.json({ models: modelsWithContextOverride, modelCompatOverrides });
   } catch {
     return Response.json(
       { error: { message: "Failed to fetch provider models", type: "server_error" } },
@@ -172,6 +193,7 @@ export async function PUT(request) {
       preserveOpenAIDeveloperRole,
       upstreamHeaders,
       compatByProtocol,
+      contextWindowOverride,
     } = validation.data;
 
     const raw = rawBody as Record<string, unknown>;
@@ -188,6 +210,20 @@ export async function PUT(request) {
       updates.compatByProtocol = compatByProtocol;
     }
 
+    // #4125: manual context-window override — persisted in the Feature-5004
+    // `model_context_overrides` table (source="manual"), independent of the
+    // customModels JSON row, so it applies whether or not other fields changed.
+    let contextWindowOverrideResult: number | null | undefined;
+    if ("contextWindowOverride" in raw) {
+      if (contextWindowOverride == null) {
+        removeModelContextOverride(provider, modelId);
+        contextWindowOverrideResult = null;
+      } else {
+        setModelContextOverride(provider, modelId, contextWindowOverride, "manual");
+        contextWindowOverrideResult = contextWindowOverride;
+      }
+    }
+
     const model = await updateCustomModel(provider, modelId, updates);
 
     if (!model) {
@@ -202,12 +238,14 @@ export async function PUT(request) {
             "preserveOpenAIDeveloperRole",
             "upstreamHeaders",
             "compatByProtocol",
+            "contextWindowOverride",
           ].includes(k)
         ) &&
         ("normalizeToolCallId" in raw ||
           "preserveOpenAIDeveloperRole" in raw ||
           "upstreamHeaders" in raw ||
-          "compatByProtocol" in raw);
+          "compatByProtocol" in raw ||
+          "contextWindowOverride" in raw);
       if (compatOnly) {
         const knownProvider =
           !!provider &&
@@ -248,6 +286,9 @@ export async function PUT(request) {
         return Response.json({
           ok: true,
           modelCompatOverrides: getModelCompatOverrides(provider),
+          ...(contextWindowOverrideResult !== undefined
+            ? { contextWindowOverride: contextWindowOverrideResult }
+            : {}),
         });
       }
       return Response.json(
@@ -256,7 +297,12 @@ export async function PUT(request) {
       );
     }
 
-    return Response.json({ model });
+    return Response.json({
+      model,
+      ...(contextWindowOverrideResult !== undefined
+        ? { contextWindowOverride: contextWindowOverrideResult }
+        : {}),
+    });
   } catch (error) {
     console.error("Error updating provider model:", error);
     return Response.json(
diff --git a/src/app/api/providers/[id]/models/discovery/codex.ts b/src/app/api/providers/[id]/models/discovery/codex.ts
new file mode 100644
index 0000000000..7992d36b67
--- /dev/null
+++ b/src/app/api/providers/[id]/models/discovery/codex.ts
@@ -0,0 +1,460 @@
+import {
+  getCodexClientVersion,
+  getCodexDefaultHeaders,
+} from "@omniroute/open-sse/config/codexClient.ts";
+import { isCodexDiscoveryModelExcluded } from "@/shared/services/codexDiscoveryPolicy";
+
+export {
+  CODEX_DISCOVERY_EXCLUDED_IDS,
+  CODEX_DISCOVERY_EXCLUDED_ID_PREFIXES,
+  isCodexDiscoveryModelExcluded,
+} from "@/shared/services/codexDiscoveryPolicy";
+
+export const CODEX_MODELS_URL = "https://chatgpt.com/backend-api/codex/models";
+export const CODEX_GITHUB_MODELS_URL =
+  "https://raw.githubusercontent.com/openai/codex/refs/heads/main/codex-rs/models-manager/models.json";
+export const CODEX_GITHUB_CATALOG_CACHE_TTL_MS = 5 * 60 * 1000;
+
+type JsonRecord = Record<string, unknown>;
+
+export type CodexDiscoveryModel = {
+  id: string;
+  name: string;
+  owned_by: "codex";
+  apiFormat: "responses";
+  supportedEndpoints: ["responses"];
+  inputTokenLimit?: number;
+  outputTokenLimit?: number;
+  description?: string;
+  supportsThinking?: boolean;
+  supportsVision?: boolean;
+};
+
+export type CodexModelsFetch = (
+  input: string,
+  init: {
+    method: "GET";
+    headers: Record<string, string>;
+  }
+) => Promise<Response>;
+
+type CodexGithubCatalogCache = {
+  models: CodexDiscoveryModel[];
+  etag?: string;
+  expiresAt: number;
+};
+
+let codexGithubCatalogCache: CodexGithubCatalogCache | null = null;
+
+function asRecord(value: unknown): JsonRecord {
+  return value && typeof value === "object" && !Array.isArray(value) ? (value as JsonRecord) : {};
+}
+
+function toNonEmptyString(value: unknown): string | null {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+
+function firstPositiveNumber(...candidates: unknown[]): number | undefined {
+  for (const candidate of candidates) {
+    if (typeof candidate === "number" && Number.isFinite(candidate) && candidate > 0) {
+      return candidate;
+    }
+  }
+  return undefined;
+}
+
+function parseVersionParts(version: string): number[] | null {
+  const parts = version
+    .trim()
+    .split(".")
+    .map((part) => Number(part));
+  return parts.length > 0 && parts.every((part) => Number.isInteger(part) && part >= 0)
+    ? parts
+    : null;
+}
+
+function compareVersions(left: string, right: string): number {
+  const leftParts = parseVersionParts(left);
+  const rightParts = parseVersionParts(right);
+  if (!leftParts || !rightParts) return 0;
+
+  const length = Math.max(leftParts.length, rightParts.length);
+  for (let index = 0; index < length; index += 1) {
+    const a = leftParts[index] || 0;
+    const b = rightParts[index] || 0;
+    if (a !== b) return a - b;
+  }
+  return 0;
+}
+
+export function buildCodexModelsUrl(clientVersion = getCodexClientVersion()): string {
+  const url = new URL(CODEX_MODELS_URL);
+  url.searchParams.set("client_version", clientVersion);
+  return url.toString();
+}
+
+function getCodexModelItems(payload: unknown): unknown[] {
+  const record = asRecord(payload);
+  if (Array.isArray(record.models)) return record.models;
+  if (Array.isArray(record.data)) return record.data;
+  if (Array.isArray(payload)) return payload;
+
+  const objectItems = Object.entries(record)
+    .filter(([, value]) => value && typeof value === "object" && !Array.isArray(value))
+    .map(([key, value]) => ({ id: key, ...asRecord(value) }));
+  return objectItems.length > 0 ? objectItems : [];
+}
+
+function shouldImportCodexModel(record: JsonRecord): boolean {
+  if (toNonEmptyString(record.visibility)?.toLowerCase() === "hide") return false;
+  if (record.supported_in_api === false || record.supportedInApi === false) return false;
+
+  const minimalClientVersion =
+    toNonEmptyString(record.minimal_client_version) ||
+    toNonEmptyString(record.minimalClientVersion);
+  if (minimalClientVersion && compareVersions(minimalClientVersion, getCodexClientVersion()) > 0) {
+    return false;
+  }
+
+  return true;
+}
+
+function getCodexModelId(record: JsonRecord): string | null {
+  return (
+    toNonEmptyString(record.slug) || toNonEmptyString(record.id) || toNonEmptyString(record.model)
+  );
+}
+
+function getCodexModelName(record: JsonRecord, id: string): string {
+  return (
+    toNonEmptyString(record.display_name) ||
+    toNonEmptyString(record.displayName) ||
+    toNonEmptyString(record.name) ||
+    toNonEmptyString(record.title) ||
+    id
+  );
+}
+
+function recordSupportsThinking(record: JsonRecord): boolean {
+  return (
+    Array.isArray(record.supported_reasoning_levels) && record.supported_reasoning_levels.length > 0
+  );
+}
+
+function isImageModality(modality: unknown): boolean {
+  return toNonEmptyString(modality)?.toLowerCase() === "image";
+}
+
+function recordSupportsVision(record: JsonRecord): boolean {
+  return Array.isArray(record.input_modalities) && record.input_modalities.some(isImageModality);
+}
+
+function buildCodexDiscoveryModel(record: JsonRecord): CodexDiscoveryModel | null {
+  if (!shouldImportCodexModel(record)) return null;
+
+  const id = getCodexModelId(record);
+  if (!id) return null;
+
+  const topProvider = asRecord(record.top_provider);
+  const limits = asRecord(record.limits);
+  const model: CodexDiscoveryModel = {
+    id,
+    name: getCodexModelName(record, id),
+    owned_by: "codex",
+    apiFormat: "responses",
+    supportedEndpoints: ["responses"],
+  };
+  const inputTokenLimit = firstPositiveNumber(
+    record.inputTokenLimit,
+    record.maxInputTokens,
+    record.max_input_tokens,
+    record.contextLength,
+    record.context_length,
+    record.context_window,
+    record.max_context_window,
+    topProvider.context_length,
+    limits.input_tokens,
+    limits.inputTokenLimit,
+    limits.max_input_tokens
+  );
+  const outputTokenLimit = firstPositiveNumber(
+    record.outputTokenLimit,
+    record.maxOutputTokens,
+    record.max_output_tokens,
+    topProvider.max_completion_tokens,
+    limits.output_tokens,
+    limits.outputTokenLimit,
+    limits.max_output_tokens
+  );
+  const description = toNonEmptyString(record.description);
+
+  if (typeof inputTokenLimit === "number") model.inputTokenLimit = inputTokenLimit;
+  if (typeof outputTokenLimit === "number") model.outputTokenLimit = outputTokenLimit;
+  if (description) model.description = description;
+  if (recordSupportsThinking(record)) model.supportsThinking = true;
+  if (recordSupportsVision(record)) model.supportsVision = true;
+
+  return model;
+}
+
+export function normalizeCodexModelsResponse(payload: unknown): CodexDiscoveryModel[] {
+  const deduped = new Map<string, CodexDiscoveryModel>();
+
+  for (const item of getCodexModelItems(payload)) {
+    const model = buildCodexDiscoveryModel(asRecord(item));
+    if (model) deduped.set(model.id, model);
+  }
+
+  return Array.from(deduped.values());
+}
+
+export function normalizeCodexGithubCatalogResponse(payload: unknown): CodexDiscoveryModel[] {
+  return normalizeCodexModelsResponse(payload);
+}
+
+export function clearCodexGithubCatalogCacheForTests(): void {
+  codexGithubCatalogCache = null;
+}
+
+function getFreshCodexGithubCatalogCache(
+  now: number,
+  cacheTtlMs: number
+): CodexDiscoveryModel[] | null {
+  const cache = codexGithubCatalogCache;
+  if (cacheTtlMs > 0 && cache && cache.expiresAt > now) {
+    return cache.models;
+  }
+  return null;
+}
+
+function buildCodexGithubCatalogHeaders(): Record<string, string> {
+  const headers: Record<string, string> = {
+    Accept: "application/json",
+    "Content-Type": "application/json",
+  };
+  if (codexGithubCatalogCache?.etag) {
+    headers["If-None-Match"] = codexGithubCatalogCache.etag;
+  }
+  return headers;
+}
+
+function getNotModifiedCodexGithubCatalog(
+  response: Response,
+  now: number,
+  cacheTtlMs: number
+): CodexDiscoveryModel[] | null {
+  if (response.status !== 304 || !codexGithubCatalogCache) return null;
+
+  codexGithubCatalogCache = {
+    ...codexGithubCatalogCache,
+    expiresAt: now + cacheTtlMs,
+  };
+  return codexGithubCatalogCache.models;
+}
+
+function storeCodexGithubCatalogCache(
+  models: CodexDiscoveryModel[],
+  response: Response,
+  now: number,
+  cacheTtlMs: number
+): void {
+  const etag = toNonEmptyString(response.headers.get("etag"));
+  codexGithubCatalogCache = {
+    models,
+    ...(etag ? { etag } : {}),
+    expiresAt: now + cacheTtlMs,
+  };
+}
+
+type CodexLocalCatalogModel = {
+  id: string;
+  name?: string;
+  apiFormat?: string;
+  supportedEndpoints?: string[];
+  contextLength?: number;
+  maxInputTokens?: number;
+  maxOutputTokens?: number;
+};
+
+function localCatalogModelToCodexDiscoveryModel(
+  model: CodexLocalCatalogModel
+): CodexDiscoveryModel {
+  const inputTokenLimit = firstPositiveNumber(model.maxInputTokens, model.contextLength);
+  const outputTokenLimit = firstPositiveNumber(model.maxOutputTokens);
+  return {
+    id: model.id,
+    name: model.name || model.id,
+    owned_by: "codex",
+    apiFormat: "responses",
+    supportedEndpoints: ["responses"],
+    ...(typeof inputTokenLimit === "number" ? { inputTokenLimit } : {}),
+    ...(typeof outputTokenLimit === "number" ? { outputTokenLimit } : {}),
+  };
+}
+
+/**
+ * Live/GitHub discovery is the source of truth for "what exists".
+ * Explicit filters (denylist / predicates) are the policy layer for "what we show".
+ * Do NOT reintroduce curated-only allowlisting as the default path (#6862 / #6859).
+ */
+export function mergeCodexLiveModelsWithLocalCatalog(
+  liveModels: CodexDiscoveryModel[],
+  localCatalogModels: CodexLocalCatalogModel[]
+): CodexDiscoveryModel[] {
+  const merged = new Map<string, CodexDiscoveryModel>();
+
+  for (const liveModel of liveModels) {
+    if (!liveModel?.id) continue;
+    merged.set(liveModel.id, liveModel);
+  }
+
+  for (const localModel of localCatalogModels) {
+    if (!localModel.id) continue;
+    const normalizedLocal = localCatalogModelToCodexDiscoveryModel(localModel);
+    const existing = merged.get(localModel.id);
+    merged.set(localModel.id, existing ? { ...normalizedLocal, ...existing } : normalizedLocal);
+  }
+
+  return Array.from(merged.values());
+}
+
+/** Return true to KEEP the model. */
+export type CodexDiscoveryModelFilter = (model: CodexDiscoveryModel) => boolean;
+
+/**
+ * Apply policy filters after discovery merge. Default denylist runs first;
+ * extraFilters are additional keep-predicates (all must pass).
+ */
+export function applyCodexDiscoveryFilters(
+  models: CodexDiscoveryModel[],
+  extraFilters: readonly CodexDiscoveryModelFilter[] = []
+): CodexDiscoveryModel[] {
+  return models.filter((model) => {
+    if (isCodexDiscoveryModelExcluded(model)) return false;
+    return extraFilters.every((keep) => keep(model));
+  });
+}
+
+/** Convenience: merge live/local then apply default (+ optional) filters. */
+export function buildCodexDiscoveryCatalog(
+  remoteModels: CodexDiscoveryModel[],
+  localCatalogModels: CodexLocalCatalogModel[],
+  extraFilters: readonly CodexDiscoveryModelFilter[] = []
+): CodexDiscoveryModel[] {
+  return applyCodexDiscoveryFilters(
+    mergeCodexLiveModelsWithLocalCatalog(remoteModels, localCatalogModels),
+    extraFilters
+  );
+}
+
+export type CuratedCodexCatalogResult = {
+  models: CodexDiscoveryModel[];
+  candidateModels: CodexDiscoveryModel[];
+};
+
+/**
+ * Optional curated-only view (allowlist). NOT used by the default Codex
+ * discovery route — kept for diagnostics / explicit call sites only.
+ */
+export function reconcileCuratedCodexCatalog(
+  remoteModels: CodexDiscoveryModel[],
+  curatedModels: CodexLocalCatalogModel[]
+): CuratedCodexCatalogResult {
+  const remoteById = new Map(remoteModels.map((model) => [model.id, model]));
+  const curatedIds = new Set<string>();
+  const models: CodexDiscoveryModel[] = [];
+
+  for (const localModel of curatedModels) {
+    if (!localModel.id) continue;
+    curatedIds.add(localModel.id);
+    const normalizedLocal = localCatalogModelToCodexDiscoveryModel(localModel);
+    const remoteModel = remoteById.get(localModel.id);
+    models.push(remoteModel ? { ...remoteModel, ...normalizedLocal } : normalizedLocal);
+  }
+
+  const candidateModels = remoteModels.filter((model) => !curatedIds.has(model.id));
+  return { models, candidateModels };
+}
+
+export function enrichCodexModelsFromGithubCatalog(
+  models: CodexDiscoveryModel[],
+  githubCatalogModels: CodexDiscoveryModel[]
+): CodexDiscoveryModel[] {
+  const byId = new Map(githubCatalogModels.map((model) => [model.id, model]));
+  return models.map((model) => {
+    const githubModel = byId.get(model.id);
+    return githubModel ? { ...githubModel, ...model } : model;
+  });
+}
+
+export async function fetchCodexDiscoveryModels({
+  accessToken,
+  providerSpecificData,
+  fetchImpl,
+}: {
+  accessToken: string | null;
+  providerSpecificData?: Record<string, unknown> | null;
+  fetchImpl: CodexModelsFetch;
+}): Promise<CodexDiscoveryModel[] | null> {
+  if (!accessToken) return null;
+
+  try {
+    const workspaceId =
+      toNonEmptyString(providerSpecificData?.workspaceId) ||
+      toNonEmptyString(providerSpecificData?.chatgptAccountId) ||
+      toNonEmptyString(providerSpecificData?.accountId);
+    const headers: Record<string, string> = {
+      ...getCodexDefaultHeaders(),
+      Accept: "application/json",
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${accessToken}`,
+      originator: "codex_cli_rs",
+    };
+    if (workspaceId) headers["chatgpt-account-id"] = workspaceId;
+
+    const response = await fetchImpl(buildCodexModelsUrl(), {
+      method: "GET",
+      headers,
+    });
+
+    if (!response.ok) return null;
+
+    const models = normalizeCodexModelsResponse(await response.json());
+    return models.length > 0 ? models : null;
+  } catch {
+    return null;
+  }
+}
+
+export async function fetchCodexGithubCatalogModels({
+  fetchImpl,
+  now = Date.now(),
+  cacheTtlMs = CODEX_GITHUB_CATALOG_CACHE_TTL_MS,
+}: {
+  fetchImpl: CodexModelsFetch;
+  now?: number;
+  cacheTtlMs?: number;
+}): Promise<CodexDiscoveryModel[] | null> {
+  const cachedModels = getFreshCodexGithubCatalogCache(now, cacheTtlMs);
+  if (cachedModels) return cachedModels;
+
+  try {
+    const response = await fetchImpl(CODEX_GITHUB_MODELS_URL, {
+      method: "GET",
+      headers: buildCodexGithubCatalogHeaders(),
+    });
+
+    const notModifiedModels = getNotModifiedCodexGithubCatalog(response, now, cacheTtlMs);
+    if (notModifiedModels) return notModifiedModels;
+
+    if (!response.ok) return null;
+
+    const models = normalizeCodexGithubCatalogResponse(await response.json());
+    if (models.length === 0) return null;
+
+    storeCodexGithubCatalogCache(models, response, now, cacheTtlMs);
+    return models;
+  } catch {
+    return codexGithubCatalogCache?.models || null;
+  }
+}
diff --git a/src/app/api/providers/[id]/models/discovery/providerModelsConfig.ts b/src/app/api/providers/[id]/models/discovery/providerModelsConfig.ts
index b7bb1940a8..ab0b1de1cb 100644
--- a/src/app/api/providers/[id]/models/discovery/providerModelsConfig.ts
+++ b/src/app/api/providers/[id]/models/discovery/providerModelsConfig.ts
@@ -3,6 +3,7 @@ import { getAntigravityHeaders } from "@omniroute/open-sse/services/antigravityH
 import { parseGeminiModelsList } from "@/lib/providerModels/geminiModelsParser";
 import { filterClinepassModels } from "@omniroute/open-sse/services/clinepassModels.ts";
 import { normalizeOpenAiLikeModelsResponse } from "./normalizers";
+import { extractKimiJwt } from "@/lib/providers/webCookieAuth";
 
 export type ProviderModelsConfigEntry = {
   url: string;
@@ -12,6 +13,7 @@ export type ProviderModelsConfigEntry = {
   authPrefix?: string;
   authQuery?: string;
   body?: unknown;
+  buildHeaders?: (token: string) => Record<string, string>;
   parseResponse: (data: any) => any;
 };
 
@@ -60,10 +62,10 @@ export const PROVIDER_MODELS_CONFIG: Record<string, ProviderModelsConfigEntry> =
   },
   // #3931: qwen-web (cookie provider) was missing here, so its discovery page
   // showed nothing (the OAuth fallback above only fires for provider==="qwen").
-  // `chat.qwen.ai/api/v2/models` is public (no auth header configured/sent);
+  // `chat.qwen.ai/api/v2/models/` is public (no auth header configured/sent);
   // shape `{ data: { data: [{ id, name, owned_by }] } }`, flatter `{ data: [] }` fallback.
   "qwen-web": {
-    url: "https://chat.qwen.ai/api/v2/models",
+    url: "https://chat.qwen.ai/api/v2/models/",
     method: "GET",
     headers: { "Content-Type": "application/json" },
     parseResponse: (data) => {
@@ -78,18 +80,34 @@ export const PROVIDER_MODELS_CONFIG: Record<string, ProviderModelsConfigEntry> =
     },
   },
   // #5858 follow-up: kimi-web (cookie provider) on the international domain.
-  // `GetAvailableModels` returns the model list as a plain JSON envelope
-  // (no Connect framing on either request or response — only the chat
-  // completion endpoint uses the 5-byte envelope). Auth: Bearer JWT extracted
-  // from the `kimi-auth` cookie the user pasted. Agent variants
+  // `GetAvailableModels` returns the model list as a plain JSON envelope.
+  // Auth mirrors the web app: Bearer JWT plus `Cookie: kimi-auth=<JWT>`.
+  // Agent variants
   // (`k2d6-agent*`) need a different scenario + agent fields this executor
   // doesn't shape, so they're filtered out.
   "kimi-web": {
     url: "https://www.kimi.com/apiv2/kimi.gateway.config.v1.ConfigService/GetAvailableModels",
-    method: "GET",
-    headers: { accept: "application/json, text/plain, */*", "Content-Type": "application/json" },
-    authHeader: "Authorization",
-    authPrefix: "Bearer ",
+    method: "POST",
+    headers: { accept: "*/*", "Content-Type": "application/json" },
+    body: {},
+    buildHeaders: (token) => {
+      const jwt = extractKimiJwt(token);
+      return {
+        accept: "*/*",
+        "Content-Type": "application/json",
+        "connect-protocol-version": "1",
+        Origin: "https://www.kimi.com",
+        Referer: "https://www.kimi.com/",
+        "User-Agent":
+          "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36",
+        ...(jwt
+          ? {
+              Authorization: `Bearer ${jwt}`,
+              Cookie: `kimi-auth=${jwt}`,
+            }
+          : {}),
+      };
+    },
     parseResponse: (data) => {
       const list = (data?.availableModels || []) as Array<{
         key?: string;
@@ -131,14 +149,6 @@ export const PROVIDER_MODELS_CONFIG: Record<string, ProviderModelsConfigEntry> =
     authPrefix: "Bearer ",
     parseResponse: (data) => data.data || [],
   },
-  glhf: {
-    url: "https://glhf.chat/api/openai/v1/models",
-    method: "GET",
-    headers: { "Content-Type": "application/json" },
-    authHeader: "Authorization",
-    authPrefix: "Bearer ",
-    parseResponse: (data) => data.data || data.models || [],
-  },
   aimlapi: {
     // #5570: AI/ML API's live catalog (400+ models) lives at the public,
     // auth-free /models database endpoint (NOT /v1/models). The registry has no
@@ -260,6 +270,18 @@ export const PROVIDER_MODELS_CONFIG: Record<string, ProviderModelsConfigEntry> =
     authPrefix: "Bearer ",
     parseResponse: (data) => data.data || data.models || [],
   },
+  // OpenVecta (https://openvecta.com/) — OpenAI-compatible `/v1/models` returning
+  // { object: "list", data: [{ id, context_length, owned_by, … }, …] }. Bearer
+  // token with the `ov_sk_…` prefix. Same discovery shape as Together AI /
+  // Cerebras / NVIDIA NIM (live-fetch path; registry seed is the offline fallback).
+  openvecta: {
+    url: "https://api.openvecta.com/v1/models",
+    method: "GET",
+    headers: { "Content-Type": "application/json" },
+    authHeader: "Authorization",
+    authPrefix: "Bearer ",
+    parseResponse: (data) => data.data || data.models || [],
+  },
   fireworks: {
     url: "https://api.fireworks.ai/inference/v1/models",
     method: "GET",
diff --git a/src/app/api/providers/[id]/models/discovery/providerSets.ts b/src/app/api/providers/[id]/models/discovery/providerSets.ts
index 4bf76ecb19..1cc2049a22 100644
--- a/src/app/api/providers/[id]/models/discovery/providerSets.ts
+++ b/src/app/api/providers/[id]/models/discovery/providerSets.ts
@@ -64,6 +64,12 @@ export const NAMED_OPENAI_STYLE_PROVIDERS = new Set([
   // it proxies many upstream models (DeepSeek, Claude, Kimi...) behind one key, so the
   // full catalog is discovered live from https://api.qnaigc.com/v1/models.
   "qiniu",
+  // OpenVecta (https://openvecta.com/) is an OpenAI-compatible AI inference gateway
+  // hosting LLMs (GLM, Claude, DeepSeek, GPT OSS, Llama, Kimi, Nemotron…) plus
+  // text-embedding-* models behind a single Bearer key. The full catalog is
+  // discovered live from https://api.openvecta.com/v1/models; the registry seed
+  // (registry/openvecta) covers the most-used LLMs as the offline fallback.
+  "openvecta",
 ]);
 
 export function isNamedOpenAIStyleProvider(provider: string): boolean {
diff --git a/src/app/api/providers/[id]/models/discoveryConfig.ts b/src/app/api/providers/[id]/models/discoveryConfig.ts
index 5432cc8c32..ef6b6c4681 100644
--- a/src/app/api/providers/[id]/models/discoveryConfig.ts
+++ b/src/app/api/providers/[id]/models/discoveryConfig.ts
@@ -1,4 +1,5 @@
 import { getRegistryEntry } from "@omniroute/open-sse/config/providerRegistry.ts";
+import type { ProviderModelsConfigEntry } from "./discovery/providerModelsConfig";
 
 /**
  * Derive a models-discovery config from the provider's registry `modelsUrl`
@@ -8,18 +9,9 @@ import { getRegistryEntry } from "@omniroute/open-sse/config/providerRegistry.ts
  * OpenAI-compatible `/v1/models` endpoint, or `undefined` when the
  * registry entry has no `modelsUrl`.
  */
-export function deriveConfigFromRegistryModelsUrl(provider: string):
-  | {
-      url: string;
-      method: "GET";
-      headers: Record<string, string>;
-      authHeader?: string;
-      authPrefix?: string;
-      authQuery?: string;
-      body?: unknown;
-      parseResponse: (data: any) => any;
-    }
-  | undefined {
+export function deriveConfigFromRegistryModelsUrl(
+  provider: string
+): ProviderModelsConfigEntry | undefined {
   const entry = getRegistryEntry(provider);
   if (typeof entry?.modelsUrl === "string" && entry.modelsUrl.length > 0) {
     return {
diff --git a/src/app/api/providers/[id]/models/route.ts b/src/app/api/providers/[id]/models/route.ts
index c862d4e508..ebca992a15 100755
--- a/src/app/api/providers/[id]/models/route.ts
+++ b/src/app/api/providers/[id]/models/route.ts
@@ -21,7 +21,10 @@ import {
   getSafeOutboundFetchErrorStatus,
   safeOutboundFetch,
 } from "@/shared/network/safeOutboundFetch";
-import { getProviderOutboundGuard } from "@/shared/network/outboundUrlGuard";
+import {
+  getProviderOutboundGuard,
+  getProviderValidationGuard,
+} from "@/shared/network/outboundUrlGuard";
 import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
 import { getStaticQoderModels } from "@omniroute/open-sse/services/qoderCli.ts";
 import { deriveConfigFromRegistryModelsUrl } from "./discoveryConfig";
@@ -97,6 +100,12 @@ import {
   type ProviderModelsConfigEntry,
   PROVIDER_MODELS_CONFIG,
 } from "./discovery/providerModelsConfig";
+import {
+  buildCodexDiscoveryCatalog,
+  enrichCodexModelsFromGithubCatalog,
+  fetchCodexDiscoveryModels,
+  fetchCodexGithubCatalogModels,
+} from "./discovery/codex";
 
 /**
  * GET /api/providers/[id]/models - Get models list from provider
@@ -112,6 +121,7 @@ export async function GET(
     // Check if we should exclude hidden models (used by MCP tools to prevent hidden model leaks)
     const { searchParams } = new URL(request.url);
     const excludeHidden = searchParams.get("excludeHidden") === "true";
+    const excludeCustom = searchParams.get("excludeCustom") === "true";
     const refresh = searchParams.get("refresh") === "true";
 
     const connection = await getProviderConnectionById(id);
@@ -217,15 +227,19 @@ export async function GET(
     // per-connection route (used by MCP list_models_catalog + the dashboard
     // import view) never did, so custom models were dropped on both the
     // discovery-success and local_catalog paths. Read them once here and fold
-    // them into every models response via buildResponse below (dedup by id).
+    // them into every user-facing models response via buildResponse below
+    // (dedup by id). Internal model-sync discovery opts out because these rows
+    // are a response projection, not provider-discovered models.
     let customModelsForProvider: Array<{ id: string; name?: string }> = [];
-    try {
-      const custom = await getCustomModels(provider);
-      if (Array.isArray(custom)) {
-        customModelsForProvider = custom as Array<{ id: string; name?: string }>;
+    if (!excludeCustom) {
+      try {
+        const custom = await getCustomModels(provider);
+        if (Array.isArray(custom)) {
+          customModelsForProvider = custom as Array<{ id: string; name?: string }>;
+        }
+      } catch {
+        // DB unavailable — proceed without custom models.
       }
-    } catch {
-      // DB unavailable — proceed without custom models.
     }
 
     const mergeCustomModels = (models: any[]) => {
@@ -330,14 +344,16 @@ export async function GET(
     const buildDiscoveryFallbackResponse = ({
       cacheWarning = "API unavailable — using cached catalog",
       localWarning = "API unavailable — using local catalog",
+      localIntentional = false,
     }: {
       cacheWarning?: string;
       localWarning?: string;
+      localIntentional?: boolean;
     } = {}) => {
       if (cachedDiscoveryModels.length > 0) {
         return buildCachedDiscoveryResponse(cacheWarning);
       }
-      return buildLocalCatalogResponse(localWarning);
+      return buildLocalCatalogResponse(localWarning, localIntentional);
     };
 
     const buildDiscoveryErrorFallbackResponse = (
@@ -385,7 +401,11 @@ export async function GET(
       });
     };
 
-    const buildApiDiscoveryResponse = async (models: any[], warning?: string) => {
+    const buildApiDiscoveryResponse = async (
+      models: any[],
+      warning?: string,
+      extraPayload: Record<string, unknown> = {}
+    ) => {
       const discoveredModels = await persistDiscoveredModels(provider, connectionId, models);
       if (discoveredModels.length > 0) {
         return buildResponse({
@@ -394,6 +414,7 @@ export async function GET(
           models,
           source: "api",
           ...(warning ? { warning } : {}),
+          ...extraPayload,
         });
       }
 
@@ -458,6 +479,13 @@ export async function GET(
       if (localCatalog) return localCatalog;
     }
 
+    if (provider === "lmarena") {
+      // Direct-chat allowlist is the intended source — no arena.ai HTML scrape
+      // (avoids CF bot burn and thrashy initialModels rows).
+      const localCatalog = buildLocalCatalogResponse(undefined, true);
+      if (localCatalog) return localCatalog;
+    }
+
     if (provider === "bedrock") {
       const cachedResponse = maybeReturnCachedDiscovery();
       if (cachedResponse) return cachedResponse;
@@ -610,7 +638,11 @@ export async function GET(
         try {
           const response = await safeOutboundFetch(modelsUrl, {
             ...SAFE_OUTBOUND_FETCH_PRESETS.modelsProbe,
-            guard: getProviderOutboundGuard(),
+            // #6939: model-list discovery for local/OpenAI-compatible providers (e.g. LM
+            // Studio on a LAN host) must use the same guard tier as the test-connection path
+            // (getProviderValidationGuard — respects the local-first default) rather than the
+            // stricter outbound guard, which never allows LAN hosts by default.
+            guard: getProviderValidationGuard(),
             proxyConfig: proxy,
             method: "GET",
             headers: isNamedOpenAIStyleProvider(provider)
@@ -1705,6 +1737,99 @@ export async function GET(
       });
     }
 
+    if (provider === "codex") {
+      // Auto-merge live/GitHub/local (future-proof discovery), then apply explicit
+      // denylist filters (e.g. drop GPT-5.4 family). Do not gate remote-only IDs.
+      const staticCodexCatalog = mergeLocalCatalogModels(
+        getModelsByProviderId("codex") || [],
+        getStaticModelsForProvider("codex") || []
+      );
+      const finalizeCodexCatalog = (remoteModels: typeof cachedDiscoveryModels) =>
+        buildCodexDiscoveryCatalog(remoteModels, staticCodexCatalog);
+      const cachedCatalogModels = finalizeCodexCatalog(cachedDiscoveryModels);
+      const cachedIdsMatchFinalCatalog =
+        cachedDiscoveryModels.length === cachedCatalogModels.length &&
+        cachedDiscoveryModels.every((model, index) => model.id === cachedCatalogModels[index]?.id);
+      const persistFilteredCacheIfNeeded = async () => {
+        if (cachedIdsMatchFinalCatalog) return;
+        await persistDiscoveredModels(provider, connectionId, cachedCatalogModels);
+      };
+
+      if (!refresh && cachedDiscoveryModels.length > 0) {
+        await persistFilteredCacheIfNeeded();
+        return buildResponse({
+          provider,
+          connectionId,
+          models: cachedCatalogModels,
+          source: "cache",
+        });
+      }
+
+      if (!refresh && !autoFetchModels) {
+        return buildResponse({
+          provider,
+          connectionId,
+          models: finalizeCodexCatalog([]),
+          source: "local_catalog",
+          warning: "Auto-fetch disabled — using local catalog",
+        });
+      }
+
+      const liveModels = await fetchCodexDiscoveryModels({
+        accessToken: accessToken || null,
+        providerSpecificData: connection.providerSpecificData,
+        fetchImpl: (url, init) =>
+          safeOutboundFetch(url, {
+            ...SAFE_OUTBOUND_FETCH_PRESETS.modelsDiscovery,
+            guard: getProviderOutboundGuard(),
+            proxyConfig: proxy,
+            ...init,
+          }),
+      });
+      const githubCatalogModels = await fetchCodexGithubCatalogModels({
+        fetchImpl: (url, init) =>
+          safeOutboundFetch(url, {
+            ...SAFE_OUTBOUND_FETCH_PRESETS.modelsDiscovery,
+            guard: "public-only",
+            proxyConfig: proxy,
+            ...init,
+          }),
+      });
+      if (liveModels && liveModels.length > 0) {
+        const enrichedLiveModels =
+          githubCatalogModels && githubCatalogModels.length > 0
+            ? enrichCodexModelsFromGithubCatalog(liveModels, githubCatalogModels)
+            : liveModels;
+        return buildApiDiscoveryResponse(finalizeCodexCatalog(enrichedLiveModels));
+      }
+
+      if (githubCatalogModels && githubCatalogModels.length > 0) {
+        return buildApiDiscoveryResponse(
+          finalizeCodexCatalog(githubCatalogModels),
+          "Codex live catalog unavailable — using GitHub model catalog"
+        );
+      }
+
+      if (cachedDiscoveryModels.length > 0) {
+        await persistFilteredCacheIfNeeded();
+        return buildResponse({
+          provider,
+          connectionId,
+          models: cachedCatalogModels,
+          source: "cache",
+          warning: "Codex live catalog unavailable — using cached catalog",
+        });
+      }
+      return buildResponse({
+        provider,
+        connectionId,
+        models: finalizeCodexCatalog([]),
+        source: "local_catalog",
+        intentional: true,
+        warning: "Codex live and GitHub catalogs unavailable — using local catalog",
+      });
+    }
+
     const localCatalog = mergeLocalCatalogModels(registryCatalogModels, specialtyCatalogModels);
     if (!config && localCatalog.length > 0) {
       return buildResponse({
@@ -1806,8 +1931,8 @@ export async function GET(
     }
 
     // Build headers
-    const headers = { ...config.headers };
-    if (config.authHeader && !config.authQuery) {
+    const headers = config.buildHeaders ? config.buildHeaders(token) : { ...config.headers };
+    if (!config.buildHeaders && config.authHeader && !config.authQuery) {
       headers[config.authHeader] = (config.authPrefix || "") + token;
     }
 
diff --git a/src/app/api/providers/[id]/param-filters/route.ts b/src/app/api/providers/[id]/param-filters/route.ts
new file mode 100644
index 0000000000..35ae1ed69d
--- /dev/null
+++ b/src/app/api/providers/[id]/param-filters/route.ts
@@ -0,0 +1,80 @@
+import { NextResponse } from "next/server";
+import {
+  getParamFilterConfig,
+  setParamFilterConfig,
+  deleteParamFilterConfig,
+} from "@/lib/db/paramFilters";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { updateParamFilterConfigSchema } from "@/shared/validation/schemas";
+import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
+import { buildErrorBody, sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
+
+/**
+ * GET /api/providers/[id]/param-filters
+ * Returns the param filter config for a provider, or null if not configured.
+ */
+export async function GET(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  try {
+    const { id } = await params;
+    const config = getParamFilterConfig(id);
+    return NextResponse.json(config ?? { block: [], allow: [], autoLearn: false });
+  } catch (error) {
+    return NextResponse.json(buildErrorBody(500, sanitizeErrorMessage(error)), { status: 500 });
+  }
+}
+
+/**
+ * PUT /api/providers/[id]/param-filters
+ * Upsert the param filter config for a provider.
+ * Body: { block?: string[], allow?: string[], models?: Record<string, { block?: string[], allow?: string[] }>, autoLearn?: boolean }
+ */
+export async function PUT(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  let rawBody: unknown;
+  try {
+    rawBody = await request.json();
+  } catch {
+    return NextResponse.json(buildErrorBody(400, "Invalid JSON body"), { status: 400 });
+  }
+
+  try {
+    const { id } = await params;
+    const validation = validateBody(updateParamFilterConfigSchema, rawBody);
+    if (isValidationFailure(validation)) {
+      return NextResponse.json({ error: validation.error }, { status: 400 });
+    }
+    const { block, allow, models, autoLearn } = validation.data;
+
+    setParamFilterConfig(id, {
+      block: block ?? [],
+      allow: allow ?? [],
+      models,
+      autoLearn: autoLearn ?? false,
+    });
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    return NextResponse.json(buildErrorBody(500, sanitizeErrorMessage(error)), { status: 500 });
+  }
+}
+
+/**
+ * DELETE /api/providers/[id]/param-filters
+ * Remove the param filter config for a provider (reset to no filtering).
+ */
+export async function DELETE(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  try {
+    const { id } = await params;
+    deleteParamFilterConfig(id);
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    return NextResponse.json(buildErrorBody(500, sanitizeErrorMessage(error)), { status: 500 });
+  }
+}
diff --git a/src/app/api/providers/[id]/sync-models/route.ts b/src/app/api/providers/[id]/sync-models/route.ts
index b4c5646cd3..94578e4c4c 100644
--- a/src/app/api/providers/[id]/sync-models/route.ts
+++ b/src/app/api/providers/[id]/sync-models/route.ts
@@ -10,6 +10,8 @@ import { saveCallLog } from "@/lib/usage/callLogs";
 import { isAuthenticated } from "@/shared/utils/apiAuth";
 import {
   buildModelSyncInternalHeaders,
+  fetchModelSyncInternal,
+  getModelSyncInternalBaseUrl,
   isModelSyncInternalRequest,
 } from "@/shared/services/modelSyncScheduler";
 import { autoSyncCodexProfilesFromLiveCatalog } from "@/lib/cli-helper/codexProfileAutoSync";
@@ -180,7 +182,7 @@ export type EnsureReadyOptions = {
 export async function ensureLoopbackServerReady(opts: EnsureReadyOptions = {}): Promise<void> {
   if (__loopbackReadyPromise != null) return __loopbackReadyPromise;
   __loopbackReadyPromise = (async () => {
-    const f = opts.fetch ?? fetch;
+    const f = opts.fetch ?? fetchModelSyncInternal;
     const maxWaitMs = opts.maxWaitMs ?? 30_000;
     const pollMs = opts.pollMs ?? 250;
     const deadline = Date.now() + maxWaitMs;
@@ -191,10 +193,10 @@ export async function ensureLoopbackServerReady(opts: EnsureReadyOptions = {}):
         // readiness — we only care that the dispatcher succeeds (no
         // ECONNREFUSED). Using a synthetic connection id so no real DB lookup
         // is needed; the 404 is sufficient proof the server is dispatching.
-        const probePort = process.env.OMNIROUTE_PORT || process.env.PORT || "20128";
         const res = await f(
-          `http://127.0.0.1:${probePort}/api/providers/__readiness_probe__/models`,
+          `${getModelSyncInternalBaseUrl()}/api/providers/__readiness_probe__/models`,
           {
+            redirect: "error",
             signal: AbortSignal.timeout(2_000),
           }
         );
@@ -264,7 +266,7 @@ export async function selfFetchWithRetry(
   url: string,
   opts: SelfFetchWithRetryOptions = {}
 ): Promise<Response> {
-  const f = opts.fetch ?? fetch;
+  const f = opts.fetch ?? fetchModelSyncInternal;
   // Reduced from 5 to 3: the readiness gate now handles the boot race.
   // Retries here are only for transient failures after server is confirmed up.
   const maxRetries = opts.maxRetries ?? 3;
@@ -321,30 +323,20 @@ export async function selfFetchWithRetry(
 // ---------------------------------------------------------------------------
 
 async function fetchProviderModelsForSync(request: Request, connectionId: string) {
-  // Construct a safe localhost URL from the incoming request's origin.
-  // The route only accepts authenticated or internal-scheduler requests,
-  // and the path is hardcoded — no user-controlled URL components reach fetch.
-  // Always use 127.0.0.1 (IPv4) — never "localhost" which may resolve to ::1
-  // (IPv6) in containers, causing TypeError: fetch failed even when the HTTP
-  // server is bound only to 0.0.0.0 (IPv4 only).
-  const SAFE_HOSTS = new Set(["localhost", "127.0.0.1", "0.0.0.0", "::1"]);
-  const incomingUrl = new URL(request.url);
-  const loopbackPort =
-    SAFE_HOSTS.has(incomingUrl.hostname) && incomingUrl.port
-      ? incomingUrl.port
-      : process.env.PORT || "20128";
-  const safeOrigin = `http://127.0.0.1:${loopbackPort}`;
-  const modelsPath = `/api/providers/${encodeURIComponent(connectionId)}/models?refresh=true`;
+  const safeOrigin = getModelSyncInternalBaseUrl();
+  const modelsPath =
+    `/api/providers/${encodeURIComponent(connectionId)}/models` +
+    "?refresh=true&excludeCustom=true";
   const headers = {
     cookie: request.headers.get("cookie") || "",
     ...buildModelSyncInternalHeaders(),
   };
 
-  const targetUrl = new URL(modelsPath, safeOrigin).href;
+  const targetUrl = `${safeOrigin}${modelsPath}`;
 
   // Wrap fetch so it forwards the required headers on every retry attempt.
   const fetchWithHeaders: typeof fetch = (input, init) =>
-    fetch(input as string, { ...init, headers });
+    fetchModelSyncInternal(input, { ...init, headers, redirect: "error" });
 
   return selfFetchWithRetry(targetUrl, {
     fetch: fetchWithHeaders,
@@ -376,9 +368,12 @@ async function fetchProviderModelsForSync(request: Request, connectionId: string
 export async function POST(request: Request, { params }: { params: Promise<{ id: string }> }) {
   const start = Date.now();
   const { id } = await params;
+  const requestUrl = new URL(request.url);
   const mode = (
-    new URL(request.url).searchParams.get("mode") === "import" ? "merge" : "sync"
+    requestUrl.searchParams.get("mode") === "import" ? "merge" : "sync"
   ) as ManagedModelImportMode;
+  // quiet=1: boot revalidation path — skip chatty ModelSync console lines
+  const quiet = requestUrl.searchParams.get("quiet") === "1";
   let logProvider = "unknown";
   let channelLabel: string | null = null;
 
@@ -523,7 +518,7 @@ export async function POST(request: Request, { params }: { params: Promise<{ id:
     const updatedCount = importedChanges.updated;
     const shouldLog = modelChanges.total > 0 || customModelChanges.total > 0;
 
-    if (shouldLog) {
+    if (shouldLog && !quiet) {
       void autoSyncCodexProfilesFromLiveCatalog(request, `model-sync:${logProvider}`)
         .then((syncResult) => {
           if (syncResult.ok) {
@@ -561,6 +556,14 @@ export async function POST(request: Request, { params }: { params: Promise<{ id:
             err?.message || err
           );
         });
+    } else if (shouldLog && quiet) {
+      // Still update profiles; suppress console noise from boot revalidation.
+      void autoSyncCodexProfilesFromLiveCatalog(request, `model-sync:${logProvider}`).catch(
+        () => undefined
+      );
+      void autoSyncClaudeProfilesFromLiveCatalog(request, `model-sync:${logProvider}`).catch(
+        () => undefined
+      );
     }
 
     if (shouldLog) {
diff --git a/src/app/api/providers/health-autopilot/actions/route.ts b/src/app/api/providers/health-autopilot/actions/route.ts
index 1cc58e5bae..ecd14550c9 100644
--- a/src/app/api/providers/health-autopilot/actions/route.ts
+++ b/src/app/api/providers/health-autopilot/actions/route.ts
@@ -3,7 +3,6 @@ import { z } from "zod";
 
 import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 import { executeProviderHealthAutopilotAction } from "@/lib/monitoring/providerHealthAutopilot";
-import { validateBrowserMutationOrigin } from "@/server/origin/publicOrigin";
 import { validateBody } from "@/shared/validation/helpers";
 
 const actionSchema = z.object({
@@ -29,11 +28,11 @@ export async function POST(request: Request) {
   const authError = await requireManagementAuth(request);
   if (authError) return authError;
 
-  const originVerdict = validateBrowserMutationOrigin(request);
-  if (!originVerdict.ok) {
-    return NextResponse.json({ error: { message: "Invalid request origin" } }, { status: 403 });
-  }
-
+  // Origin validation for browser mutations is centralized in the authz pipeline
+  // (src/server/authz/pipeline.ts) for MANAGEMENT routes — see PR #5278. Do NOT
+  // re-check origin here: the pipeline strips PEER_IP_HEADER before forwarding,
+  // so a duplicate per-route check cannot resolve the LAN "direct-local-host"
+  // candidate and spuriously rejects same-origin LAN/Docker requests (#6277).
   try {
     let rawBody: unknown;
     try {
diff --git a/src/app/api/providers/route.ts b/src/app/api/providers/route.ts
index 7d0aad17db..bf63734ffd 100644
--- a/src/app/api/providers/route.ts
+++ b/src/app/api/providers/route.ts
@@ -34,6 +34,7 @@ import { isManagedProviderConnectionId } from "@/lib/providers/catalog";
 import { isApiKeyRevealEnabled, maskStoredApiKey } from "@/lib/apiKeyExposure";
 import {
   buildModelSyncInternalHeaders,
+  fetchModelSyncInternal,
   getModelSyncInternalBaseUrl,
 } from "@/shared/services/modelSyncScheduler";
 
@@ -194,7 +195,11 @@ export async function POST(request: Request) {
       };
       const syncUrl = `${internalOrigin}/api/providers/${encodeURIComponent(newConnection.id)}/sync-models?mode=import`;
       // Intentionally not awaited: this is async/non-blocking work.
-      void fetch(syncUrl, { method: "POST", headers: syncHeaders })
+      void fetchModelSyncInternal(syncUrl, {
+        method: "POST",
+        headers: syncHeaders,
+        redirect: "error",
+      })
         .then((syncRes) => {
           if (!syncRes.ok) {
             console.log(`[providers] Auto-sync failed for ${newConnection.id}: ${syncRes.status}`);
diff --git a/src/app/api/settings/compression/mcp-accessibility/route.ts b/src/app/api/settings/compression/mcp-accessibility/route.ts
index f2ee4803db..23f1731aa7 100644
--- a/src/app/api/settings/compression/mcp-accessibility/route.ts
+++ b/src/app/api/settings/compression/mcp-accessibility/route.ts
@@ -3,6 +3,7 @@ import { getMcpAccessibilityConfig, setMcpAccessibilityConfig } from "@/lib/db/c
 import { isAuthenticated } from "@/shared/utils/apiAuth";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { mcpAccessibilityConfigSchema } from "@/shared/validation/compressionConfigSchemas";
+import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
 
 // Read/update the mcpAccessibility engine config (compression/mcpAccessibility DB key) that the
 // MCP server consumes on every tool call to trim oversized tool outputs. Kept as a dedicated
@@ -18,7 +19,7 @@ export async function GET(request: NextRequest) {
     const config = await getMcpAccessibilityConfig();
     return NextResponse.json(config);
   } catch (error) {
-    return NextResponse.json({ error: String(error) }, { status: 500 });
+    return NextResponse.json({ error: sanitizeErrorMessage(error) }, { status: 500 });
   }
 }
 
@@ -47,6 +48,6 @@ export async function PUT(request: NextRequest) {
     const config = await getMcpAccessibilityConfig();
     return NextResponse.json(config);
   } catch (error) {
-    return NextResponse.json({ error: String(error) }, { status: 500 });
+    return NextResponse.json({ error: sanitizeErrorMessage(error) }, { status: 500 });
   }
 }
diff --git a/src/app/api/settings/compression/route.ts b/src/app/api/settings/compression/route.ts
index 97f1e3aeef..a19ab6bfd0 100644
--- a/src/app/api/settings/compression/route.ts
+++ b/src/app/api/settings/compression/route.ts
@@ -3,6 +3,7 @@ import { getCompressionSettings, updateCompressionSettings } from "@/lib/db/comp
 import { isAuthenticated } from "@/shared/utils/apiAuth";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { compressionSettingsUpdateSchema } from "@/shared/validation/compressionConfigSchemas";
+import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
 
 export async function GET(request: NextRequest) {
   if (!(await isAuthenticated(request))) {
@@ -13,7 +14,7 @@ export async function GET(request: NextRequest) {
     const settings = await getCompressionSettings();
     return NextResponse.json(settings);
   } catch (error) {
-    return NextResponse.json({ error: String(error) }, { status: 500 });
+    return NextResponse.json({ error: sanitizeErrorMessage(error) }, { status: 500 });
   }
 }
 
@@ -40,6 +41,6 @@ export async function PUT(request: NextRequest) {
     );
     return NextResponse.json(settings);
   } catch (error) {
-    return NextResponse.json({ error: String(error) }, { status: 500 });
+    return NextResponse.json({ error: sanitizeErrorMessage(error) }, { status: 500 });
   }
 }
diff --git a/src/app/api/settings/export-json/route.ts b/src/app/api/settings/export-json/route.ts
index 51dc429414..942a18caaf 100644
--- a/src/app/api/settings/export-json/route.ts
+++ b/src/app/api/settings/export-json/route.ts
@@ -12,6 +12,37 @@ import {
   getAllDomainCostHistory,
   getAllDomainBudgets,
 } from "@/lib/db/usageAnalytics";
+import { isFreeModel, providerHasFreeModels } from "@/shared/utils/freeModels";
+
+/**
+ * When `settings.hidePaidModels === true`, exports must not leak paid model ids
+ * via combos — otherwise a round-trip (export → share/store → import) silently
+ * re-materialises the paid targets the operator asked to REMOVE (#6328).
+ * Filter combo model steps in place; keep combo-ref steps untouched.
+ */
+export function filterPaidComboSteps<T extends { models?: unknown }>(combos: T[]): T[] {
+  return combos.map((combo) => {
+    if (!Array.isArray(combo.models)) return combo;
+    const filtered = combo.models.filter((step) => {
+      if (!step || typeof step !== "object") return true;
+      const s = step as Record<string, unknown>;
+      if (s.kind === "combo-ref") return true;
+      const rawModel = typeof s.model === "string" ? s.model.trim() : "";
+      if (!rawModel) return true;
+      const provider =
+        (typeof s.providerId === "string" && s.providerId.trim()) ||
+        (typeof s.provider === "string" && s.provider.trim()) ||
+        (rawModel.includes("/") ? rawModel.split("/")[0] : "");
+      if (!provider) return true;
+      if (!providerHasFreeModels(provider)) return false;
+      const modelId = rawModel.startsWith(`${provider}/`)
+        ? rawModel.slice(provider.length + 1)
+        : rawModel;
+      return isFreeModel(provider, { id: modelId });
+    });
+    return { ...combo, models: filtered };
+  });
+}
 
 /**
  * GET /api/settings/export-json
@@ -39,9 +70,15 @@ export async function GET(request: Request) {
 
     const providerConnections = await getProviderConnections();
     const providerNodes = await getProviderNodes();
-    const combos = await getCombos();
+    const combosRaw = await getCombos();
     const apiKeys = await getApiKeys();
 
+    // #6328: honor hidePaidModels at the export boundary so backup files
+    // cannot silently smuggle paid model ids back in on import.
+    const combos = rawSettings.hidePaidModels === true
+      ? filterPaidComboSteps(combosRaw as Array<{ models?: unknown }>)
+      : combosRaw;
+
     const exportData: Record<string, unknown> = {
       settings: safeSettings,
       providerConnections,
diff --git a/src/app/api/settings/free-proxies/[id]/add-to-pool/route.ts b/src/app/api/settings/free-proxies/[id]/add-to-pool/route.ts
index f1590b1da6..2cfb6ddefa 100644
--- a/src/app/api/settings/free-proxies/[id]/add-to-pool/route.ts
+++ b/src/app/api/settings/free-proxies/[id]/add-to-pool/route.ts
@@ -104,7 +104,7 @@ export async function POST(request: Request, { params }: { params: Promise<{ id:
       return createErrorResponse({
         status: 500,
         message: "Failed to create proxy in registry",
-        type: "internal_error",
+        type: "server_error",
       });
     }
 
diff --git a/src/app/api/settings/free-proxies/route.ts b/src/app/api/settings/free-proxies/route.ts
index efa58a5051..a36132535f 100644
--- a/src/app/api/settings/free-proxies/route.ts
+++ b/src/app/api/settings/free-proxies/route.ts
@@ -2,7 +2,14 @@ import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 import { createErrorResponse, createErrorResponseFromUnknown } from "@/lib/api/errorResponse";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { freeProxyListSchema, freeProxySourceSchema } from "@/shared/validation/freeProxySchemas";
-import { listFreeProxies, deleteFreeProxy, clearFreeProxiesBySource } from "@/lib/localDb";
+import {
+  listFreeProxies,
+  countFreeProxies,
+  deleteFreeProxy,
+  clearFreeProxiesBySource,
+  getFreeProxyStats,
+  getFreeProxySyncErrors,
+} from "@/lib/localDb";
 import type { FreeProxySourceId } from "@/lib/freeProxyProviders/types";
 
 export async function GET(request: Request) {
@@ -16,6 +23,8 @@ export async function GET(request: Request) {
       protocol: searchParams.get("protocol") || undefined,
       country: searchParams.get("country") || undefined,
       minQuality: searchParams.get("minQuality") || undefined,
+      search: searchParams.get("search") || undefined,
+      sortBy: searchParams.get("sortBy") || undefined,
       limit: searchParams.get("limit") || undefined,
       offset: searchParams.get("offset") || undefined,
       onlyNotInPool: searchParams.get("onlyNotInPool") || undefined,
@@ -35,12 +44,36 @@ export async function GET(request: Request) {
       protocol: validation.data.protocol,
       country: validation.data.country,
       minQuality: validation.data.minQuality,
+      search: validation.data.search,
+      sortBy: validation.data.sortBy,
       limit: validation.data.limit,
       offset: validation.data.offset,
       onlyNotInPool: validation.data.onlyNotInPool || undefined,
     });
 
-    return Response.json({ items, total: items.length });
+    const total = await countFreeProxies({
+      sources: validation.data.sources as FreeProxySourceId[] | undefined,
+      protocol: validation.data.protocol,
+      country: validation.data.country,
+      minQuality: validation.data.minQuality,
+      search: validation.data.search,
+      onlyNotInPool: validation.data.onlyNotInPool || undefined,
+    });
+
+    const limit = validation.data.limit ?? 50;
+    const stats = await getFreeProxyStats();
+    const syncErrors = await getFreeProxySyncErrors();
+
+    return Response.json({
+      success: true,
+      data: {
+        proxies: items,
+        total,
+        hasMore: items.length >= limit && total > items.length + (validation.data.offset ?? 0),
+        stats,
+        syncErrors,
+      },
+    });
   } catch (error) {
     return createErrorResponseFromUnknown(error, "Failed to list free proxies");
   }
diff --git a/src/app/api/settings/free-proxies/sync/route.ts b/src/app/api/settings/free-proxies/sync/route.ts
index df5bf78e49..94dbaf7698 100644
--- a/src/app/api/settings/free-proxies/sync/route.ts
+++ b/src/app/api/settings/free-proxies/sync/route.ts
@@ -3,7 +3,11 @@ import { createErrorResponse, createErrorResponseFromUnknown } from "@/lib/api/e
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { freeProxySyncSchema } from "@/shared/validation/freeProxySchemas";
 import { getEnabledProviders, getProvider } from "@/lib/freeProxyProviders";
-import { recordFreeProxySync } from "@/lib/localDb";
+import {
+  recordFreeProxySync,
+  clearFreeProxySyncErrors,
+  recordFreeProxySyncErrors,
+} from "@/lib/localDb";
 import type { FreeProxyProvider, FreeProxySourceId } from "@/lib/freeProxyProviders/types";
 
 let _providersOverrideForTests: FreeProxyProvider[] | null = null;
@@ -51,16 +55,19 @@ export async function POST(request: Request) {
     for (const provider of providers) {
       try {
         results[provider.id] = await provider.sync();
+        await clearFreeProxySyncErrors(provider.id);
       } catch (error) {
         // #5595: isolate per-source failures so one provider throwing doesn't
         // abort the whole sync — the other sources still populate the pool and
         // the failure is surfaced in `results` instead of a blanket 500.
+        const errorMessage = error instanceof Error ? error.message : String(error);
         results[provider.id] = {
           fetched: 0,
           added: 0,
           updated: 0,
-          errors: [error instanceof Error ? error.message : String(error)],
+          errors: [errorMessage],
         };
+        await recordFreeProxySyncErrors(provider.id, [errorMessage]);
       }
     }
 
diff --git a/src/app/api/settings/notion/route.ts b/src/app/api/settings/notion/route.ts
index dc92e14189..4b41e77d6e 100644
--- a/src/app/api/settings/notion/route.ts
+++ b/src/app/api/settings/notion/route.ts
@@ -7,6 +7,7 @@ import {
   clearNotionToken,
 } from "@/lib/db/notion";
 import { createNotionClient } from "@/lib/notion/api";
+import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
 
 const setTokenSchema = z.object({
   token: z.string().min(1).max(500),
@@ -24,7 +25,7 @@ export async function GET(request: NextRequest) {
       hasToken: config.token !== null,
     });
   } catch (error) {
-    return NextResponse.json({ error: String(error) }, { status: 500 });
+    return NextResponse.json({ error: sanitizeErrorMessage(error) }, { status: 500 });
   }
 }
 
@@ -68,7 +69,7 @@ export async function POST(request: NextRequest) {
   } catch (error) {
     clearNotionToken();
     const msg = error instanceof Error ? error.message : String(error);
-    return NextResponse.json({ error: msg, connected: false }, { status: 400 });
+    return NextResponse.json({ error: sanitizeErrorMessage(msg), connected: false }, { status: 400 });
   }
 }
 
@@ -84,6 +85,6 @@ export async function DELETE(request: NextRequest) {
       message: "Notion integration disconnected",
     });
   } catch (error) {
-    return NextResponse.json({ error: String(error) }, { status: 500 });
+    return NextResponse.json({ error: sanitizeErrorMessage(error) }, { status: 500 });
   }
 }
diff --git a/src/app/api/settings/obsidian/route.ts b/src/app/api/settings/obsidian/route.ts
index 6ca88e9cf2..3d3086dd75 100644
--- a/src/app/api/settings/obsidian/route.ts
+++ b/src/app/api/settings/obsidian/route.ts
@@ -11,6 +11,7 @@ import {
   setObsidianVaultPath,
 } from "@/lib/db/obsidian";
 import { createObsidianClient } from "@/lib/obsidian/api";
+import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
 
 const setTokenSchema = z.object({
   token: z.string().min(1).max(5000),
@@ -31,7 +32,7 @@ export async function GET(request: NextRequest) {
       vaultPath: config.vaultPath,
     });
   } catch (error) {
-    return NextResponse.json({ error: String(error) }, { status: 500 });
+    return NextResponse.json({ error: sanitizeErrorMessage(error) }, { status: 500 });
   }
 }
 
@@ -96,7 +97,7 @@ export async function POST(request: NextRequest) {
     });
   } catch (error) {
     const msg = error instanceof Error ? error.message : String(error);
-    return NextResponse.json({ error: msg, connected: false }, { status: 400 });
+    return NextResponse.json({ error: sanitizeErrorMessage(msg), connected: false }, { status: 400 });
   }
 }
 
@@ -112,6 +113,6 @@ export async function DELETE(request: NextRequest) {
       message: "Obsidian integration disconnected",
     });
   } catch (error) {
-    return NextResponse.json({ error: String(error) }, { status: 500 });
+    return NextResponse.json({ error: sanitizeErrorMessage(error) }, { status: 500 });
   }
 }
diff --git a/src/app/api/settings/proxies/[id]/repair-relay/route.ts b/src/app/api/settings/proxies/[id]/repair-relay/route.ts
new file mode 100644
index 0000000000..3c2b075866
--- /dev/null
+++ b/src/app/api/settings/proxies/[id]/repair-relay/route.ts
@@ -0,0 +1,102 @@
+import { z } from "zod";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { createErrorResponse, createErrorResponseFromUnknown } from "@/lib/api/errorResponse";
+import { getProxyById, updateProxy } from "@/lib/localDb";
+import { decrypt } from "@/lib/db/encryption";
+import { isRelayProxyType, relayRepairMode } from "@/lib/db/proxies/mappers";
+import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
+
+const idParamSchema = z.object({ id: z.string().min(1) });
+
+/**
+ * POST /api/settings/proxies/[id]/repair-relay
+ *
+ * Recovers a relay's auth IN PLACE without a full redeploy. The deploy token is
+ * never persisted, but when STORAGE_ENCRYPTION_KEY is set the deploy routes
+ * wrote an encrypted `relayAuthEnc` blob into proxy `notes`. That blob is the
+ * recoverable secret — we decrypt it and write the plaintext `relayAuth` back,
+ * so the relay works again without re-entering any deploy credentials.
+ *
+ * Returns:
+ *   200 { repaired: false, mode: "noop" }      — plaintext already present
+ *   200 { repaired: true,  mode: "recovered" }  — re-derived from relayAuthEnc
+ *   409 { repaired: false, mode: "redeploy" }  — token unrecoverable, redeploy
+ *   400                                      — not a relay-type proxy
+ *   404                                      — proxy not found
+ */
+export async function POST(
+  request: Request,
+  context: { params: Promise<{ id: string }> | { id: string } }
+) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  const params = await context.params;
+  const idValidation = validateBody(idParamSchema, params);
+  if (isValidationFailure(idValidation)) {
+    return createErrorResponse({
+      status: 400,
+      message: idValidation.error.message,
+      type: "invalid_request",
+    });
+  }
+  const { id } = idValidation.data;
+
+  try {
+    const proxy = await getProxyById(id, { includeSecrets: true });
+    if (!proxy) {
+      return createErrorResponse({ status: 404, message: "Proxy not found", type: "not_found" });
+    }
+
+    if (!isRelayProxyType(proxy.type)) {
+      return createErrorResponse({
+        status: 400,
+        message: "Repair is only available for relay proxies (vercel/deno/cloudflare)",
+        type: "invalid_request",
+      });
+    }
+
+    const mode = relayRepairMode(proxy.notes, proxy.type);
+    if (mode === "noop") {
+      return Response.json({ repaired: false, mode });
+    }
+
+    if (mode === "redeploy") {
+      return createErrorResponse({
+        status: 409,
+        message:
+          "Relay auth is unrecoverable (no stored token, encrypted blob absent or undecryptable — " +
+          "likely a STORAGE_ENCRYPTION_KEY rotation). Redeploy the relay to write a fresh relayAuth.",
+        type: "conflict",
+      });
+    }
+
+    // mode === "recovered": read the still-encrypted blob, decrypt, write plaintext.
+    let enc: string | undefined;
+    let existingNotes: Record<string, unknown> = {};
+    try {
+      const parsed = JSON.parse(proxy.notes ?? "{}") as Record<string, unknown>;
+      existingNotes = parsed;
+      if (typeof parsed.relayAuthEnc === "string") enc = parsed.relayAuthEnc;
+    } catch {
+      enc = undefined;
+    }
+    const decrypted = typeof enc === "string" ? decrypt(enc) : undefined;
+    if (!decrypted) {
+      return createErrorResponse({
+        status: 409,
+        message:
+          "Relay auth is unrecoverable (encrypted blob could not be decrypted — likely a " +
+          "STORAGE_ENCRYPTION_KEY rotation). Redeploy the relay to write a fresh relayAuth.",
+        type: "conflict",
+      });
+    }
+
+    // Merge relayAuth into existing notes; drop relayAuthEnc since plaintext is now present.
+    const { relayAuthEnc: _dropped, ...rest } = existingNotes as { relayAuthEnc?: unknown };
+    await updateProxy(id, { notes: JSON.stringify({ ...rest, relayAuth: decrypted }) });
+    return Response.json({ repaired: true, mode: "recovered" });
+  } catch (error) {
+    return createErrorResponseFromUnknown(error, "Failed to repair relay");
+  }
+}
diff --git a/src/app/api/settings/proxies/route.ts b/src/app/api/settings/proxies/route.ts
index 62abcaf344..6c201674bf 100644
--- a/src/app/api/settings/proxies/route.ts
+++ b/src/app/api/settings/proxies/route.ts
@@ -7,6 +7,13 @@ import {
 } from "@/lib/api/proxyRegistryRouteHandlers";
 import { createErrorResponseFromUnknown } from "@/lib/api/errorResponse";
 import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import {
+  isRelayAuthMissing,
+  isRelayProxyType,
+  redactProxySecrets,
+  relayRepairMode,
+} from "@/lib/db/proxies/mappers";
+import { getRelayProbeStats } from "@/lib/db/relayProbeStats";
 
 export async function GET(request: Request) {
   const authError = await requireManagementAuth(request);
@@ -16,13 +23,25 @@ export async function GET(request: Request) {
     const lookupResponse = await resolveProxyLookupResponse(searchParams, "whereUsed");
     if (lookupResponse) return lookupResponse;
 
-    const proxies = await listProxies({ includeSecrets: false });
-    // #3508: expose the SOCKS5 feature flag at runtime so the dashboard reflects the live
-    // ENABLE_SOCKS5_PROXY env (the UI previously gated on NEXT_PUBLIC_*, which is baked at
-    // build time and ignored a runtime Docker env).
+    // Load with secrets so we can derive relay repair state (whether a relay's
+    // auth is missing and whether it can be recovered in place vs needs a
+    // redeploy). The secrets themselves never leave the server — we redact each
+    // row before responding and only surface the derived relayInfo booleans.
+    const rawProxies = await listProxies({ includeSecrets: true });
+    const items = rawProxies.map((p) => ({
+      ...redactProxySecrets(p),
+      relayInfo: {
+        isRelay: isRelayProxyType(p.type),
+        authMissing: isRelayAuthMissing(p.notes, p.type),
+        repairMode: relayRepairMode(p.notes, p.type),
+      },
+    }));
     return Response.json({
-      items: proxies,
-      total: proxies.length,
+      items,
+      total: items.length,
+      // #5890: coarse relay health pulse for the dashboard — how many relay
+      // probes have run, and how many came back alive.
+      relayProbeStats: getRelayProbeStats(),
       // Default ON (opt-out): only an explicit falsey value disables SOCKS5.
       socks5Enabled: !["false", "0", "no", "off"].includes(
         (process.env.ENABLE_SOCKS5_PROXY ?? "").trim().toLowerCase()
diff --git a/src/app/api/settings/proxy/cloudflare-deploy/route.ts b/src/app/api/settings/proxy/cloudflare-deploy/route.ts
index 55aac1d561..7f8f7a1ef6 100644
--- a/src/app/api/settings/proxy/cloudflare-deploy/route.ts
+++ b/src/app/api/settings/proxy/cloudflare-deploy/route.ts
@@ -5,7 +5,10 @@ import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { cloudflareDeploySchema } from "@/shared/validation/freeProxySchemas";
 import { createProxy } from "@/lib/localDb";
 import { encrypt } from "@/lib/db/encryption";
-import { buildCloudflareWorkerScript } from "@/lib/proxyRelay/cloudflareWorkerScript";
+import {
+  buildCloudflareWorkerScript,
+  buildCloudflareWorkerUploadRequest,
+} from "@/lib/proxyRelay/cloudflareWorkerScript";
 
 // Port of upstream decolua/9router PR #1360 — Cloudflare Workers proxy relay.
 // Architecture mirrors src/app/api/settings/proxy/vercel-deploy/route.ts so the
@@ -13,7 +16,8 @@ import { buildCloudflareWorkerScript } from "@/lib/proxyRelay/cloudflareWorkerSc
 // guard work unchanged. Only the deployment surface differs (Cloudflare Workers
 // API instead of Vercel /v13/deployments).
 
-const CLOUDFLARE_API_BASE = process.env.CLOUDFLARE_API_BASE || "https://api.cloudflare.com/client/v4";
+const CLOUDFLARE_API_BASE =
+  process.env.CLOUDFLARE_API_BASE || "https://api.cloudflare.com/client/v4";
 
 export async function POST(request: Request) {
   const authError = await requireManagementAuth(request);
@@ -49,37 +53,39 @@ export async function POST(request: Request) {
 
   try {
     // 1. PUT the Worker script — Cloudflare requires multipart/form-data with
-    //    main_module + a metadata blob describing the upload.
+    //    body_part + a metadata blob describing the upload.
+    //
+    //    Built as a raw Buffer with an explicit boundary rather than a native
+    //    `FormData` (#6416): in production `globalThis.fetch` is patched with
+    //    `node_modules/undici`'s own fetch (see `open-sse/utils/proxyFetch.ts`),
+    //    whose `FormData` class differs from the runtime's global `FormData`.
+    //    Passing a native `FormData` instance through that patched fetch makes
+    //    undici serialize the body as the literal string `"[object FormData]"`
+    //    with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare
+    //    rejects with "Content-Type must be one of: application/javascript,
+    //    text/javascript, multipart/form-data" — the same class of bug fixed
+    //    for image edits in #3273.
+    //
+    //    The script part itself must stay `application/javascript` (Cloudflare
+    //    rejects `application/javascript+module`, #5128), but with that MIME the
+    //    uploaded body is parsed as a Service Worker, not an ES module. So the
+    //    metadata must point at the script via `body_part`, not `main_module` —
+    //    otherwise Cloudflare rejects the body with `Unexpected token 'export'`
+    //    when it sees module syntax in a non-module upload (#6496 / #6416).
     const workerScriptUrl = `${CLOUDFLARE_API_BASE}/accounts/${accountId}/workers/scripts/${projectName}`;
-    const formData = new FormData();
-    formData.append(
-      "index.js",
-      // Cloudflare's script-upload API only accepts application/javascript,
-      // text/javascript, or multipart/form-data for the script part and rejects
-      // "application/javascript+module" outright (#5128). ES-module semantics
-      // come from `main_module` in the metadata blob below, not this MIME type.
-      new Blob([workerScript], { type: "application/javascript" }),
-      "index.js"
-    );
-    formData.append(
-      "metadata",
-      new Blob(
-        [
-          JSON.stringify({
-            main_module: "index.js",
-            compatibility_date: "2026-03-20",
-            observability: { enabled: true },
-          }),
-        ],
-        { type: "application/json" }
-      ),
-      "metadata.json"
+    const { headers: uploadHeaders, body: uploadBody } = buildCloudflareWorkerUploadRequest(
+      workerScript,
+      {
+        body_part: "index.js",
+        compatibility_date: "2026-03-20",
+        observability: { enabled: true },
+      }
     );
 
     const uploadRes = await fetch(workerScriptUrl, {
       method: "PUT",
-      headers: { Authorization: `Bearer ${apiToken}` },
-      body: formData,
+      headers: { Authorization: `Bearer ${apiToken}`, ...uploadHeaders },
+      body: uploadBody,
     });
 
     if (!uploadRes.ok) {
diff --git a/src/app/api/settings/proxy/test/relayTestResult.ts b/src/app/api/settings/proxy/test/relayTestResult.ts
index a6e2d4afee..09f5e93e9c 100644
--- a/src/app/api/settings/proxy/test/relayTestResult.ts
+++ b/src/app/api/settings/proxy/test/relayTestResult.ts
@@ -10,14 +10,29 @@ export interface RelayTestResult {
   latencyMs: number;
   proxyUrl: string;
   error?: string;
+  relay?: RelayAwareness;
 }
 
+// Echoed from the relay response headers so the dashboard can show which
+// backend actually answered, how many hops it tried, and whether it fell back.
+export interface RelayAwareness {
+  url: string | null;
+  mode: string | null;
+  attempts: number | null;
+  fallback: boolean | null;
+}
+
+// Minimal header accessor so both the DOM `Headers` type and undici's
+// `IncomingHttpHeaders` (which only exposes `.get(name)`) can be passed in.
+type HeaderAccessor = { get(name: string): string | null };
+
 export function buildRelayTestResult(input: {
   statusCode: number;
   publicIp: string | null;
   latencyMs: number;
   relayUrl: string;
   relayAuthPresent: boolean;
+  relayResponseHeaders?: HeaderAccessor;
 }): RelayTestResult {
   const { statusCode, publicIp, latencyMs, relayUrl, relayAuthPresent } = input;
   const success = statusCode === 200;
@@ -30,6 +45,23 @@ export function buildRelayTestResult(input: {
         : " — no relay auth token was found; redeploy the relay, or check for a STORAGE_ENCRYPTION_KEY rotation";
     }
     result.error = error;
+  } else if (input.relayResponseHeaders) {
+    result.relay = parseRelayAwareness(input.relayResponseHeaders);
   }
   return result;
 }
+
+function parseRelayAwareness(headers: HeaderAccessor): RelayAwareness {
+  const read = (name: string): string | null => {
+    const value = headers.get(name);
+    return value === null ? null : value;
+  };
+  const attemptsRaw = read("x-relay-attempts");
+  const fallbackRaw = read("x-relay-fallback");
+  return {
+    url: read("x-relay-url"),
+    mode: read("x-relay-mode"),
+    attempts: attemptsRaw === null ? null : Number(attemptsRaw) || null,
+    fallback: fallbackRaw === null ? null : fallbackRaw === "true",
+  };
+}
diff --git a/src/app/api/settings/proxy/test/route.ts b/src/app/api/settings/proxy/test/route.ts
index dbe44967b4..c1eaf085b9 100644
--- a/src/app/api/settings/proxy/test/route.ts
+++ b/src/app/api/settings/proxy/test/route.ts
@@ -14,6 +14,7 @@ import { extractRelayAuth } from "@/lib/db/proxies";
 import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
 import { buildRelayTestResult } from "./relayTestResult";
+import { recordRelayProbe } from "@/lib/db/relayProbeStats";
 
 const BASE_SUPPORTED_PROXY_TYPES = new Set(["http", "https"]);
 
@@ -128,7 +129,16 @@ export async function POST(request: Request) {
           latencyMs: Date.now() - start,
           relayUrl,
           relayAuthPresent: relayAuth.length > 0,
+          relayResponseHeaders: {
+            get: (name: string) => {
+              const value = res.headers[name.toLowerCase()];
+              return value === undefined ? null : String(value);
+            },
+          },
         });
+        // #5890: track relay probe outcomes so the dashboard can surface a
+        // relayTested / relayAlive pulse and flag an unhealthy sidecar backend.
+        recordRelayProbe(relayResult.success);
         // #5716: a relay that *responds* non-200 (e.g. 401 auth mismatch) used to
         // return `success:false` with no reason and no log — a silent failure.
         if (!relayResult.success) {
diff --git a/src/app/api/skills/collect/chaos/route.ts b/src/app/api/skills/collect/chaos/route.ts
new file mode 100644
index 0000000000..04268993ec
--- /dev/null
+++ b/src/app/api/skills/collect/chaos/route.ts
@@ -0,0 +1,147 @@
+/**
+ * POST /api/skills/collect/chaos
+ *
+ * Chaos Mode — spawn multiple models across providers for parallel or collaborative
+ * task execution. Each active provider contributes one model instance; all models
+ * work on the same task simultaneously (parallel) or in a chain where each sees
+ * the previous model's output (collaborative).
+ *
+ * External API: uses Bearer token auth (API key with chaos_mode_enabled).
+ *
+ * Body (JSON):
+ *   task: string                   // REQUIRED — the task/goal for all models
+ *   providers?: string[]           // Optional filter — only these provider IDs
+ *   mode?: "parallel" | "collaborative"  // Default: from global config
+ *   systemPrompt?: string          // Optional custom system prompt override
+ *   maxTokens?: number             // Optional — max_tokens per model call
+ *
+ * Returns:
+ *   {
+ *     task, mode, startedAt,
+ *     totalProviders, totalResults,
+ *     models: [{ providerId, providerName, modelId, status, content, error?, durationMs }],
+ *     summary?: string
+ *   }
+ */
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { validateBody, isValidationFailure } from "@/shared/validation/helpers";
+import { buildErrorBody, sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
+import { validateApiKey, getApiKeyMetadata } from "@/lib/localDb";
+import { getChaosConfig } from "@/lib/chaos/chaosConfig";
+import { executeChaosRun, type ChaosRunResult } from "@/lib/chaos/chaosExecutor";
+import * as log from "@/sse/utils/logger";
+
+export const dynamic = "force-dynamic";
+
+// ── Schema ───────────────────────────────────────────────────────────────────
+
+const chaosSchema = z.object({
+  task: z.string().min(1, "task is required").max(100_000, "task too long"),
+  providers: z.array(z.string().min(1)).max(50).optional(),
+  mode: z.enum(["parallel", "collaborative"]).optional(),
+  systemPrompt: z.string().max(10_000).optional(),
+  maxTokens: z.number().int().min(256).max(128_000).optional(),
+});
+
+// ── Auth helpers ─────────────────────────────────────────────────────────────
+
+/**
+ * Extract Bearer token from Authorization header.
+ */
+function extractBearerToken(request: Request): string | null {
+  const auth = request.headers.get("Authorization");
+  if (!auth || !auth.startsWith("Bearer ")) return null;
+  return auth.slice(7).trim();
+}
+
+/**
+ * Verify API key has chaos mode enabled.
+ * validateApiKey returns a plain boolean for BOTH the deployment-time env key and a
+ * DB-backed key (see src/lib/db/apiKeys.ts::validateApiKey) — it never returns the
+ * key record, so the env-key/DB-key distinction has to be made via getApiKeyMetadata,
+ * whose synthesized env-key record is tagged `id: "env-key"` (src/lib/db/apiKeys.ts::
+ * getApiKeyMetadata) and always carries "manage" scope.
+ */
+async function verifyChaosKey(bearerToken: string): Promise<{ ok: boolean; error?: string }> {
+  const isValid = await validateApiKey(bearerToken);
+  if (!isValid) {
+    return { ok: false, error: "Invalid API key" };
+  }
+
+  const metadata = await getApiKeyMetadata(bearerToken);
+  if (!metadata) {
+    return { ok: false, error: "Invalid API key" };
+  }
+
+  // Env key has full access (see getApiKeyMetadata's synthesized "env-key" record).
+  if (metadata.id === "env-key") {
+    return { ok: true };
+  }
+
+  if (!metadata.chaosModeEnabled) {
+    return {
+      ok: false,
+      error: "Chaos Mode is not enabled for this API key. Enable it in API Key settings.",
+    };
+  }
+
+  return { ok: true };
+}
+
+// ── Main handler ─────────────────────────────────────────────────────────────
+
+export async function POST(request: Request) {
+  try {
+    // ── API Key auth check ─────────────────────────────────────────────
+    const bearerToken = extractBearerToken(request);
+    if (!bearerToken) {
+      return NextResponse.json(
+        buildErrorBody(401, "Missing or invalid Authorization header — Bearer token required"),
+        { status: 401 }
+      );
+    }
+
+    const auth = await verifyChaosKey(bearerToken);
+    if (!auth.ok) {
+      return NextResponse.json(buildErrorBody(403, auth.error!), { status: 403 });
+    }
+
+    // ── Parse request body ─────────────────────────────────────────────
+    const rawBody = await request.json();
+    const validation = validateBody(chaosSchema, rawBody);
+    if (isValidationFailure(validation)) {
+      return NextResponse.json(buildErrorBody(400, validation.error.message), {
+        status: 400,
+      });
+    }
+
+    const { task, providers, mode, systemPrompt, maxTokens } = validation.data;
+
+    // ── Load global chaos config ───────────────────────────────────────
+    const globalConfig = await getChaosConfig();
+    if (!globalConfig.enabled) {
+      return NextResponse.json(
+        buildErrorBody(400, "Chaos Mode is not enabled globally. Enable it in Dashboard → Chaos Mode."),
+        { status: 400 }
+      );
+    }
+
+    // ── Execute via the shared executor ────────────────────────────────
+    const result: ChaosRunResult = await executeChaosRun({
+      task,
+      providers,
+      mode,
+      systemPrompt,
+      timeoutMs: globalConfig.timeoutMs,
+      maxTokens: maxTokens || globalConfig.maxTokens,
+      apiKey: bearerToken,
+    });
+
+    return NextResponse.json(result);
+  } catch (err) {
+    const msg = sanitizeErrorMessage(err);
+    log.error("chaos", "Chaos external API error", err);
+    return NextResponse.json(buildErrorBody(500, msg), { status: 500 });
+  }
+}
diff --git a/src/app/api/skills/collect/detect/route.ts b/src/app/api/skills/collect/detect/route.ts
new file mode 100644
index 0000000000..5f755c6ec7
--- /dev/null
+++ b/src/app/api/skills/collect/detect/route.ts
@@ -0,0 +1,164 @@
+/**
+ * GET /api/skills/collect/detect
+ *
+ * Detect installed CLI coding tools + search GitHub for matching agent skills.
+ * Uses OmniRoute's built-in CLI_TOOL_IDS detection (no Skill Collector bridge needed).
+ *
+ * Returns: {
+ *   tools: { toolId, installed, runnable, command, reason }[],
+ *   matchedSkills: { toolId, skillName, repo, score, stars }[],
+ *   totalSkills: number
+ * }
+ */
+import { NextRequest, NextResponse } from "next/server";
+import { getCliRuntimeStatus, CLI_TOOL_IDS } from "@/shared/services/cliRuntime";
+import { searchGitHubSkills, type GitHubSkillRepo } from "@/lib/skills/githubCollector";
+import { buildErrorBody } from "@omniroute/open-sse/utils/error";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+
+export const dynamic = "force-dynamic";
+
+const CODING_TOOL_KEYWORDS: Record<string, string[]> = {
+  claude: ["claude", "anthropic", "claude-code"],
+  codex: ["codex", "openai", "gpt"],
+  cursor: ["cursor", "cursor-ai"],
+  copilot: ["copilot", "github-copilot"],
+  opencode: ["opencode"],
+  cline: ["cline"],
+  kilocode: ["kilo", "kilocode"],
+  hermes: ["hermes", "nous-research"],
+  "hermes-agent": ["hermes", "hermes-agent"],
+  openclaw: ["openclaw"],
+  droid: ["droid", "factory-ai"],
+  continue: ["continue"],
+  antigravity: ["antigravity"],
+  qwen: ["qwen", "alibaba"],
+  windsurf: ["windsurf"],
+  devin: ["devin", "cognition"],
+};
+
+interface DetectedTool {
+  installed: boolean;
+  runnable: boolean;
+  command: string | null;
+  reason: string | null;
+}
+
+interface MatchedSkill {
+  toolId: string;
+  toolName: string;
+  skillName: string;
+  repo: string;
+  htmlUrl: string;
+  score: number;
+  stars: number;
+  description: string;
+}
+
+/** Probes every catalog CLI tool in parallel via getCliRuntimeStatus(). */
+async function detectInstalledTools(): Promise<Record<string, DetectedTool>> {
+  const toolIds = CLI_TOOL_IDS as readonly string[];
+  const detectedTools: Record<string, DetectedTool> = {};
+
+  await Promise.allSettled(
+    toolIds.map(async (toolId) => {
+      try {
+        const result = await getCliRuntimeStatus(toolId);
+        detectedTools[toolId] = {
+          installed: result.installed,
+          runnable: result.runnable,
+          command: result.command ?? null,
+          reason: result.reason ?? null,
+        };
+      } catch {
+        detectedTools[toolId] = {
+          installed: false,
+          runnable: false,
+          command: null,
+          reason: "check_failed",
+        };
+      }
+    })
+  );
+
+  return detectedTools;
+}
+
+function toMatchedSkill(toolId: string, repo: GitHubSkillRepo): MatchedSkill {
+  return {
+    toolId,
+    toolName: toolId,
+    skillName: repo.fullName?.split("/").pop() ?? "unknown",
+    repo: repo.fullName ?? "",
+    htmlUrl: repo.htmlUrl ?? "",
+    score: repo.score ?? 0,
+    stars: repo.stars ?? 0,
+    description: (repo.description ?? "").slice(0, 200),
+  };
+}
+
+/** For each repo, matches it to the first installed tool whose keywords hit. */
+function matchSkillsToTools(repos: GitHubSkillRepo[], installedTools: string[]): MatchedSkill[] {
+  const matchedSkills: MatchedSkill[] = [];
+
+  for (const repo of repos) {
+    const name = (repo.fullName ?? "").toLowerCase();
+    const desc = (repo.description ?? "").toLowerCase();
+
+    const matchedTool = installedTools.find((toolId) => {
+      const keywords = CODING_TOOL_KEYWORDS[toolId] ?? [toolId];
+      return keywords.some((kw) => name.includes(kw) || desc.includes(kw));
+    });
+    if (matchedTool) matchedSkills.push(toMatchedSkill(matchedTool, repo));
+  }
+
+  return matchedSkills;
+}
+
+/** Fills in tools with zero keyword matches by distributing top-scored skills evenly. */
+function distributeUnmatchedSkills(
+  repos: GitHubSkillRepo[],
+  matchedSkills: MatchedSkill[],
+  installedTools: string[]
+): MatchedSkill[] {
+  const toolsWithoutMatches = installedTools.filter(
+    (id) => !matchedSkills.some((m) => m.toolId === id)
+  );
+  if (toolsWithoutMatches.length === 0 || repos.length === 0) return matchedSkills;
+
+  const topSkills = repos.filter((r) => (r.score ?? 0) >= 0.4).slice(0, Math.min(10, repos.length));
+  const distributed = topSkills.map((r, i) =>
+    toMatchedSkill(toolsWithoutMatches[i % toolsWithoutMatches.length], r)
+  );
+
+  return [...matchedSkills, ...distributed];
+}
+
+export async function GET(request: NextRequest) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  try {
+    const detectedTools = await detectInstalledTools();
+    const installedTools = Object.entries(detectedTools)
+      .filter(([, v]) => v.installed)
+      .map(([id]) => id);
+
+    const { repos, errors } = await searchGitHubSkills({ minStars: 1, maxResults: 100 });
+
+    const directMatches = matchSkillsToTools(repos, installedTools);
+    const matchedSkills = distributeUnmatchedSkills(repos, directMatches, installedTools);
+
+    return NextResponse.json({
+      tools: detectedTools,
+      installedToolIds: installedTools,
+      matchedSkills: matchedSkills.slice(0, 50),
+      totalSkills: repos.length,
+      totalMatched: matchedSkills.length,
+      searchErrors: (errors?.length ?? 0) > 0 ? errors : undefined,
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return NextResponse.json(buildErrorBody(500, msg), { status: 500 });
+  }
+}
diff --git a/src/app/api/skills/collect/install/route.ts b/src/app/api/skills/collect/install/route.ts
new file mode 100644
index 0000000000..cecca07196
--- /dev/null
+++ b/src/app/api/skills/collect/install/route.ts
@@ -0,0 +1,130 @@
+/**
+ * POST /api/skills/collect/install
+ *
+ * Install a discovered GitHub skill to detected CLI tools.
+ * Uses OmniRoute's skill registry + CLI tool paths (no Skill Collector bridge).
+ *
+ * Body: {
+ *   repoName: string,       // GitHub full name (e.g. "user/repo")
+ *   targets: string[],      // Tool IDs to install to (e.g. ["codex", "claude"])
+ *   description?: string    // Repo description for category inference
+ * }
+ *
+ * Returns: { ok, results: { target, action, destDir, error? }[] }
+ */
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { validateBody, isValidationFailure } from "@/shared/validation/helpers";
+import { sanitizeErrorMessage, buildErrorBody } from "@omniroute/open-sse/utils/error";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+
+const installSchema = z.object({
+  repoName: z.string().min(1, "repoName is required"),
+  targets: z
+    .array(z.string().min(1, "target toolId must be non-empty"))
+    .min(1, "at least one target required")
+    .max(10, "max 10 targets"),
+  description: z.string().default(""),
+});
+
+const CODING_TOOL_PATHS: Record<string, string> = {
+  claude: "~/.claude/skills/{category}",
+  codex: "~/.codex/skills/{category}",
+  hermes: "~/AppData/Local/hermes/skills/{category}",
+  opencode: "~/.opencode/skills/{category}",
+  gemini: "~/.gemini/skills/{category}",
+  cursor: "~/.cursor/skills/{category}",
+  copilot: "~/.copilot/skills/{category}",
+  cline: "~/.cline/skills/{category}",
+  windsurf: "~/.windsurf/skills/{category}",
+  devin: "~/.devin/skills/{category}",
+  antigravity: "~/.antigravity/skills/{category}",
+  qwen: "~/.qwen/skills/{category}",
+  kilocode: "~/.kilocode/skills/{category}",
+  openclaw: "~/.openclaw/skills/{category}",
+  droid: "~/.droid/skills/{category}",
+  continue: "~/.continue/skills/{category}",
+};
+
+function inferCategory(skillName: string, description: string): string {
+  const text = `${skillName} ${description}`.toLowerCase();
+  const mapping: Record<string, string[]> = {
+    security: ["security", "pentest", "exploit", "malware", "forensics", "vulnerability"],
+    "data-science": ["data", "analytics", "pandas", "ml", "model", "train"],
+    devops: ["deploy", "docker", "k8s", "terraform", "ci/cd", "pipeline"],
+    creative: ["design", "image", "video", "art", "music"],
+    productivity: ["email", "doc", "slide", "report", "calendar"],
+    research: ["paper", "arxiv", "academic", "literature"],
+    "software-development": ["code", "refactor", "test", "lint", "review", "debug"],
+    media: ["youtube", "transcript", "gif", "video", "audio"],
+  };
+  for (const [cat, keywords] of Object.entries(mapping)) {
+    if (keywords.some((k) => text.includes(k))) return cat;
+  }
+  return "imported-github";
+}
+
+function expandHome(dir: string): string {
+  // Home dir resolution: Windows (USERPROFILE) → Unix fallback (HOME)
+  const home =
+    typeof process !== "undefined" ? process.env.USERPROFILE || process.env.HOME || "" : "";
+  return dir.replace(/^~/, home);
+}
+
+function resolveDestDir(target: string, skillName: string, description: string): string {
+  const template = CODING_TOOL_PATHS[target];
+  if (!template) {
+    throw new Error(
+      `Unknown target tool: "${target}". Supported: ${Object.keys(CODING_TOOL_PATHS).join(", ")}`
+    );
+  }
+  const category = inferCategory(skillName, description);
+  const resolved = template.replace("{category}", category).replace("{name}", skillName);
+  return expandHome(`${resolved}/${skillName}`);
+}
+
+export async function POST(request: Request) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  try {
+    const rawBody = await request.json();
+    const validation = validateBody(installSchema, rawBody);
+    if (isValidationFailure(validation)) {
+      return NextResponse.json(buildErrorBody(400, validation.error.message), { status: 400 });
+    }
+
+    const { repoName, targets, description } = validation.data;
+    const skillName = repoName.split("/").pop() || repoName;
+
+    const results = targets.map((target) => {
+      try {
+        const destDir = resolveDestDir(target, skillName, description);
+        return {
+          target,
+          ok: true,
+          action: "planned",
+          destDir,
+          note: `Ready: SKILL.md from ${repoName} can be synced to ${destDir}`,
+        };
+      } catch (err) {
+        return {
+          target,
+          ok: false,
+          action: "error",
+          error: (err as Error).message,
+        };
+      }
+    });
+
+    return NextResponse.json({
+      ok: results.every((r) => r.ok),
+      repoName,
+      skillName,
+      results,
+    });
+  } catch (err) {
+    const msg = sanitizeErrorMessage(err);
+    return NextResponse.json(buildErrorBody(500, msg), { status: 500 });
+  }
+}
diff --git a/src/app/api/sync/initialize/route.ts b/src/app/api/sync/initialize/route.ts
index 46f5a83b90..353db3f82f 100644
--- a/src/app/api/sync/initialize/route.ts
+++ b/src/app/api/sync/initialize/route.ts
@@ -1,7 +1,6 @@
 import { NextResponse } from "next/server";
 import initializeCloudSync from "@/shared/services/initializeCloudSync";
 import { startModelSyncScheduler } from "@/shared/services/modelSyncScheduler";
-import { resolveOmniRouteBaseUrl } from "@/shared/utils/resolveOmniRouteBaseUrl";
 
 let syncInitialized = false;
 let modelSyncInitialized = false;
@@ -20,8 +19,7 @@ export async function POST(request) {
 
     // (#488) Start model auto-sync scheduler (24h, configurable via MODEL_SYNC_INTERVAL_HOURS)
     if (!modelSyncInitialized) {
-      const origin = request.headers.get("origin") || resolveOmniRouteBaseUrl();
-      startModelSyncScheduler(origin);
+      startModelSyncScheduler();
       modelSyncInitialized = true;
     }
 
diff --git a/src/app/api/tools/agent-bridge/agents/[id]/dns/route.ts b/src/app/api/tools/agent-bridge/agents/[id]/dns/route.ts
index 2aec5c7712..368f8bcded 100644
--- a/src/app/api/tools/agent-bridge/agents/[id]/dns/route.ts
+++ b/src/app/api/tools/agent-bridge/agents/[id]/dns/route.ts
@@ -11,6 +11,7 @@ import { upsertAgentBridgeState } from "@/lib/db/agentBridgeState";
 import { getCachedPassword } from "@/mitm/manager";
 import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
 import { createErrorResponse } from "@/lib/api/errorResponse";
+import { ALL_TARGETS } from "@/mitm/targets/index";
 
 type Params = { params: { id: string } };
 
@@ -33,6 +34,12 @@ export async function POST(request: Request, { params }: Params): Promise<Respon
     });
   }
 
+  // Validate the agent ID maps to a known target.
+  const target = ALL_TARGETS.find((t) => t.id === id);
+  if (!target) {
+    return createErrorResponse({ status: 404, message: `Unknown agent: ${id}` });
+  }
+
   const { enabled } = parsed.data;
   const raw = body as Record<string, unknown>;
   const sudoPassword =
@@ -40,9 +47,9 @@ export async function POST(request: Request, { params }: Params): Promise<Respon
 
   try {
     if (enabled) {
-      await addDNSEntry(sudoPassword);
+      await addDNSEntry(sudoPassword, id);
     } else {
-      await removeDNSEntry(sudoPassword);
+      await removeDNSEntry(sudoPassword, id);
     }
 
     upsertAgentBridgeState({ agent_id: id, dns_enabled: enabled });
diff --git a/src/app/api/tools/agent-bridge/server/route.ts b/src/app/api/tools/agent-bridge/server/route.ts
index 55dc76b8cc..84f4397cd3 100644
--- a/src/app/api/tools/agent-bridge/server/route.ts
+++ b/src/app/api/tools/agent-bridge/server/route.ts
@@ -13,6 +13,28 @@ import { resolveMitmDataDir } from "@/mitm/dataDir";
 import path from "path";
 import { sanitizeErrorMessage } from "@omniroute/open-sse/utils/error";
 import { createErrorResponse } from "@/lib/api/errorResponse";
+import { pickApiKeyForInternalUse } from "@/lib/localDb";
+
+/**
+ * Resolve the OmniRoute API key the spawned MITM child (`server.cjs`) uses to
+ * authenticate its own outbound calls back to `/v1/chat/completions`
+ * (`ROUTER_API_KEY` env — see `src/mitm/manager.ts::startMitmInternal`).
+ *
+ * Historically this only checked an explicit `apiKey` request field (never
+ * sent by the AgentBridge UI — `AgentBridgeServerActionSchema` has no
+ * `apiKey` field) and the `ROUTER_API_KEY` process env var (unset unless an
+ * operator manually exports it). On a normal install neither is ever set, so
+ * `startMitm()` always received `""` and the MITM child exited with
+ * "ROUTER_API_KEY required" even though OmniRoute already had a usable key in
+ * its own DB (#6403). Falls back to the same DB-backed selector used by the
+ * combo-health-check / cloud-sync-verify internal probes.
+ */
+export async function resolveRouterApiKey(rawApiKey: string): Promise<string> {
+  if (rawApiKey) return rawApiKey;
+  if (process.env.ROUTER_API_KEY) return process.env.ROUTER_API_KEY;
+  const picked = await pickApiKeyForInternalUse("internal-probe");
+  return picked ?? "";
+}
 
 export async function POST(request: Request): Promise<Response> {
   let body: unknown;
@@ -35,11 +57,12 @@ export async function POST(request: Request): Promise<Response> {
   const raw = body as Record<string, unknown>;
   const sudoPassword =
     typeof raw.sudoPassword === "string" ? raw.sudoPassword : (getCachedPassword() ?? "");
-  const apiKey = typeof raw.apiKey === "string" ? raw.apiKey : (process.env.ROUTER_API_KEY ?? "");
+  const rawApiKey = typeof raw.apiKey === "string" ? raw.apiKey : "";
 
   try {
     if (action === "start") {
       if (sudoPassword) setCachedPassword(sudoPassword);
+      const apiKey = await resolveRouterApiKey(rawApiKey);
       const { startMitm } = await import("@/mitm/manager.runtime");
       const result = await startMitm(apiKey, sudoPassword);
       return Response.json({ ok: true, ...result });
@@ -61,6 +84,7 @@ export async function POST(request: Request): Promise<Response> {
       }
       // stopMitm calls clearCachedPassword() internally, so re-cache after stop
       if (sudoPassword || pwd) setCachedPassword(sudoPassword || pwd);
+      const apiKey = await resolveRouterApiKey(rawApiKey);
       const result = await startMitm(apiKey, sudoPassword || pwd);
       return Response.json({ ok: true, ...result });
     }
diff --git a/src/app/api/usage/requests-by-provider-date/route.ts b/src/app/api/usage/requests-by-provider-date/route.ts
new file mode 100644
index 0000000000..0f1527b1d1
--- /dev/null
+++ b/src/app/api/usage/requests-by-provider-date/route.ts
@@ -0,0 +1,115 @@
+import { NextResponse } from "next/server";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { buildUnifiedSource, getProviderDailyUsageRows } from "@/lib/db/usageAnalytics";
+
+/**
+ * GET /api/usage/requests-by-provider-date — #4009
+ *
+ * Per-day, per-provider request counts (some providers bill by request, not
+ * token, so operators need a plain count broken down by date). Sliced into
+ * its own route (rather than folding into /api/usage/analytics) because that
+ * route's file size is frozen at the quality-gate baseline.
+ *
+ * Query params (all optional, mirror /api/usage/analytics):
+ *  - range: "1d" | "7d" | "30d" | "90d" | "ytd" | "all" (default "30d")
+ *  - startDate / endDate: ISO-8601, overrides `range` when both are set
+ *  - date: YYYY-MM-DD, narrows the result to a single calendar date
+ */
+
+function getRangeStartIso(range: string): string | null {
+  const end = new Date();
+  const start = new Date(end);
+
+  switch (range) {
+    case "1d":
+      start.setDate(start.getDate() - 1);
+      break;
+    case "7d":
+      start.setDate(start.getDate() - 7);
+      break;
+    case "30d":
+      start.setDate(start.getDate() - 30);
+      break;
+    case "90d":
+      start.setDate(start.getDate() - 90);
+      break;
+    case "ytd":
+      start.setMonth(0, 1);
+      start.setHours(0, 0, 0, 0);
+      break;
+    case "all":
+    default:
+      return null;
+  }
+
+  return start.toISOString();
+}
+
+interface DateWindow {
+  sinceIso: string | null;
+  untilIso: string | null;
+}
+
+/**
+ * Resolves the query window from the request's params: an explicit single
+ * `date` wins, then an explicit `startDate`/`endDate` pair, then falls back
+ * to the named `range` preset.
+ */
+function resolveDateWindow(searchParams: URLSearchParams, range: string): DateWindow {
+  const singleDate = searchParams.get("date") || undefined;
+  if (singleDate) {
+    return { sinceIso: `${singleDate}T00:00:00.000Z`, untilIso: `${singleDate}T23:59:59.999Z` };
+  }
+  const startDate = searchParams.get("startDate") || undefined;
+  const endDate = searchParams.get("endDate") || undefined;
+  return {
+    sinceIso: startDate || getRangeStartIso(range),
+    untilIso: endDate || null,
+  };
+}
+
+async function resolveRawCutoffDate(): Promise<string> {
+  const { getUserDatabaseSettings } = await import("@/lib/db/databaseSettings");
+  const dbSettings = getUserDatabaseSettings();
+  const rawRetentionDays = dbSettings.aggregation?.rawDataRetentionDays ?? 30;
+  const rawCutoff = new Date();
+  rawCutoff.setDate(rawCutoff.getDate() - rawRetentionDays);
+  return rawCutoff.toISOString().split("T")[0];
+}
+
+function errorResponse(error: unknown): Promise<Response> {
+  console.error("Error computing requests-by-provider-date:", error);
+  const message = error instanceof Error ? error.message : String(error);
+  return import("@omniroute/open-sse/utils/error").then(({ buildErrorBody }) =>
+    NextResponse.json(buildErrorBody(500, message || "Failed to compute requests-by-provider-date"), {
+      status: 500,
+    })
+  );
+}
+
+export async function GET(request: Request) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  try {
+    const { searchParams } = new URL(request.url);
+    const range = searchParams.get("range") || "30d";
+    const singleDate = searchParams.get("date") || undefined;
+    const { sinceIso, untilIso } = resolveDateWindow(searchParams, range);
+    const rawCutoffDate = await resolveRawCutoffDate();
+
+    const { unifiedSource, unifiedParams } = buildUnifiedSource({
+      sinceIso,
+      untilIso,
+      rawCutoffDate,
+      apiKeyWhere: "",
+      apiKeyParams: {},
+    });
+
+    const rows = getProviderDailyUsageRows(unifiedSource, unifiedParams);
+
+    return NextResponse.json({ rows, range, date: singleDate ?? null });
+  } catch (error) {
+    return errorResponse(error);
+  }
+}
diff --git a/src/app/api/v1/audio/speech/route.ts b/src/app/api/v1/audio/speech/route.ts
index 2b3ed2173c..576721f522 100644
--- a/src/app/api/v1/audio/speech/route.ts
+++ b/src/app/api/v1/audio/speech/route.ts
@@ -1,6 +1,9 @@
 import { handleAudioSpeech } from "@omniroute/open-sse/handlers/audioSpeech.ts";
 import { withInjectionGuard } from "@/middleware/promptInjectionGuard";
-import { getProviderCredentials, clearRecoveredProviderState } from "@/sse/services/auth";
+import {
+  getProviderCredentialsWithQuotaPreflight,
+  clearRecoveredProviderState,
+} from "@/sse/services/auth";
 import {
   parseSpeechModel,
   getSpeechProvider,
@@ -95,7 +98,7 @@ async function postHandler(request, context) {
   // Get credentials — skip for local providers (authType: "none")
   let credentials = null;
   if (providerConfig && providerConfig.authType !== "none") {
-    credentials = await getProviderCredentials(provider);
+    credentials = await getProviderCredentialsWithQuotaPreflight(provider);
     if (!credentials) {
       return errorResponse(HTTP_STATUS.BAD_REQUEST, `No credentials for provider: ${provider}`);
     }
diff --git a/src/app/api/v1/audio/transcriptions/route.ts b/src/app/api/v1/audio/transcriptions/route.ts
index 7f55b374a7..3087d260d5 100644
--- a/src/app/api/v1/audio/transcriptions/route.ts
+++ b/src/app/api/v1/audio/transcriptions/route.ts
@@ -1,7 +1,10 @@
 // Allow large audio/video file uploads — 5min for processing large files (up to 2GB)
 export const maxDuration = 300;
 import { handleAudioTranscription } from "@omniroute/open-sse/handlers/audioTranscription.ts";
-import { getProviderCredentials, clearRecoveredProviderState } from "@/sse/services/auth";
+import {
+  getProviderCredentialsWithQuotaPreflight,
+  clearRecoveredProviderState,
+} from "@/sse/services/auth";
 import {
   parseTranscriptionModel,
   getTranscriptionProvider,
@@ -96,7 +99,7 @@ export async function POST(request) {
   // Get credentials — skip for local providers (authType: "none")
   let credentials = null;
   if (providerConfig && providerConfig.authType !== "none") {
-    credentials = await getProviderCredentials(provider);
+    credentials = await getProviderCredentialsWithQuotaPreflight(provider);
     if (!credentials) {
       return errorResponse(HTTP_STATUS.BAD_REQUEST, `No credentials for provider: ${provider}`);
     }
diff --git a/src/app/api/v1/audio/translations/route.ts b/src/app/api/v1/audio/translations/route.ts
index 11dca26ca4..622afcfe29 100644
--- a/src/app/api/v1/audio/translations/route.ts
+++ b/src/app/api/v1/audio/translations/route.ts
@@ -1,7 +1,10 @@
 // Allow large audio/video file uploads — 5min for processing large files (up to 2GB)
 export const maxDuration = 300;
 import { handleAudioTranslation } from "@omniroute/open-sse/handlers/audioTranslation.ts";
-import { getProviderCredentials, clearRecoveredProviderState } from "@/sse/services/auth";
+import {
+  getProviderCredentialsWithQuotaPreflight,
+  clearRecoveredProviderState,
+} from "@/sse/services/auth";
 import {
   parseTranslationModel,
   getTranslationProvider,
@@ -98,7 +101,7 @@ export async function POST(request) {
   // Get credentials — skip for local providers (authType: "none")
   let credentials = null;
   if (providerConfig && providerConfig.authType !== "none") {
-    credentials = await getProviderCredentials(provider);
+    credentials = await getProviderCredentialsWithQuotaPreflight(provider);
     if (!credentials) {
       return errorResponse(HTTP_STATUS.BAD_REQUEST, `No credentials for provider: ${provider}`);
     }
diff --git a/src/app/api/v1/embeddings/route.ts b/src/app/api/v1/embeddings/route.ts
index 2b84d12b2b..385958636b 100644
--- a/src/app/api/v1/embeddings/route.ts
+++ b/src/app/api/v1/embeddings/route.ts
@@ -6,7 +6,6 @@ import { isRequireApiKeyEnabled } from "@/shared/utils/featureFlags";
 import { v1EmbeddingsSchema } from "@/shared/validation/schemas";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 
-import { getApiKeyMetadata } from "@/lib/localDb";
 import { createEmbeddingResponse, type EmbeddingHandlerOptions } from "@/lib/embeddings/service";
 import { extractApiKey, isValidApiKey } from "@/sse/services/auth";
 import { withInjectionGuard } from "@/middleware/promptInjectionGuard";
@@ -69,7 +68,7 @@ async function postHandler(request, context) {
   if (policy.rejection) return policy.rejection;
 
   // Extract API key info for logging
-  const apiKeyMeta = apiKeyRaw ? await getApiKeyMetadata(apiKeyRaw) : null;
+  const apiKeyMeta = policy.apiKeyInfo;
 
   // Build client raw request for logging
   const clientRawRequest = {
diff --git a/src/app/api/v1/images/edits/route.ts b/src/app/api/v1/images/edits/route.ts
index 089282f8f7..21e525d6df 100644
--- a/src/app/api/v1/images/edits/route.ts
+++ b/src/app/api/v1/images/edits/route.ts
@@ -3,7 +3,10 @@ import {
   handleOpenAIImageEdit,
 } from "@omniroute/open-sse/handlers/imageGeneration.ts";
 import { withInjectionGuard } from "@/middleware/promptInjectionGuard";
-import { getProviderCredentials, clearRecoveredProviderState } from "@/sse/services/auth";
+import {
+  getProviderCredentialsWithQuotaPreflight,
+  clearRecoveredProviderState,
+} from "@/sse/services/auth";
 import { parseImageModel, getImageProvider } from "@omniroute/open-sse/config/imageRegistry.ts";
 import { errorResponse, unavailableResponse } from "@omniroute/open-sse/utils/error.ts";
 import { HTTP_STATUS } from "@omniroute/open-sse/config/constants.ts";
@@ -154,7 +157,7 @@ async function postHandler(request: Request, context) {
     return errorResponse(HTTP_STATUS.BAD_REQUEST, "Missing required field: image");
   }
 
-  const fullModel = model || "cgpt-web/gpt-5.3-instant";
+  const fullModel = model || "cgpt-web/gpt-5.5";
 
   const policy = await enforceApiKeyPolicy(request, fullModel);
   if (policy.rejection) return policy.rejection;
@@ -172,7 +175,7 @@ async function postHandler(request: Request, context) {
 
   // chatgpt-web keeps its conversation-continuation edit flow unchanged.
   if (providerConfig?.format === "chatgpt-web") {
-    const credentials = await getProviderCredentials(
+    const credentials = await getProviderCredentialsWithQuotaPreflight(
       parsed.provider,
       null,
       allowedConnections,
@@ -241,7 +244,7 @@ async function postHandler(request: Request, context) {
     );
   }
 
-  const credentials = await getProviderCredentials(
+  const credentials = await getProviderCredentialsWithQuotaPreflight(
     customProviderId,
     null,
     allowedConnections,
diff --git a/src/app/api/v1/images/generations/route.ts b/src/app/api/v1/images/generations/route.ts
index f1b517f4c9..8c5d090349 100644
--- a/src/app/api/v1/images/generations/route.ts
+++ b/src/app/api/v1/images/generations/route.ts
@@ -1,7 +1,7 @@
 import { handleImageGeneration } from "@omniroute/open-sse/handlers/imageGeneration.ts";
 import { withInjectionGuard } from "@/middleware/promptInjectionGuard";
 import {
-  getProviderCredentials,
+  getProviderCredentialsWithQuotaPreflight,
   clearRecoveredProviderState,
   extractApiKey,
   isValidApiKey,
@@ -171,7 +171,7 @@ async function postHandler(request, context) {
   // Get credentials — skip for local providers (authType: "none")
   let credentials = null;
   if (providerConfig && providerConfig.authType !== "none") {
-    credentials = await getProviderCredentials(provider);
+    credentials = await getProviderCredentialsWithQuotaPreflight(provider);
     if (!credentials) {
       return errorResponse(
         HTTP_STATUS.BAD_REQUEST,
@@ -187,7 +187,7 @@ async function postHandler(request, context) {
       );
     }
   } else if (isCustomModel) {
-    credentials = await getProviderCredentials(provider);
+    credentials = await getProviderCredentialsWithQuotaPreflight(provider);
     if (!credentials) {
       return errorResponse(
         HTTP_STATUS.BAD_REQUEST,
diff --git a/src/app/api/v1/messages/route.ts b/src/app/api/v1/messages/route.ts
index 9a67080aa8..3e2172b1eb 100644
--- a/src/app/api/v1/messages/route.ts
+++ b/src/app/api/v1/messages/route.ts
@@ -1,6 +1,7 @@
 import { handleChat } from "@/sse/handlers/chat";
 import { initTranslators } from "@omniroute/open-sse/translator/index.ts";
 import { withInjectionGuard } from "@/middleware/promptInjectionGuard";
+import { requireJsonContentType } from "@/shared/middleware/requireJsonContentType";
 import {
   withEarlyStreamKeepalive,
   ANTHROPIC_PING_FRAME,
@@ -39,6 +40,11 @@ export async function OPTIONS() {
  * parsed at most once per request.
  */
 async function postHandler(request: any, context: any, preParsedBody: any = null) {
+  // Reject non-JSON Content-Type with 415 before touching the body — mirrors OpenAI's
+  // reference API and matches /v1/chat/completions (#6414).
+  const ctRejection = requireJsonContentType(request);
+  if (ctRejection) return ctRejection;
+
   await ensureInitialized();
   // Streaming Anthropic clients (Claude Code, the Anthropic SDK) drop the connection
   // when no bytes arrive while a large prompt is processed before the first token — a
diff --git a/src/app/api/v1/models/[...model]/route.ts b/src/app/api/v1/models/[...model]/route.ts
index cb3d22e8b0..43da6fd487 100644
--- a/src/app/api/v1/models/[...model]/route.ts
+++ b/src/app/api/v1/models/[...model]/route.ts
@@ -9,6 +9,18 @@ export async function OPTIONS() {
   return handleCorsOptions();
 }
 
+/**
+ * HEAD /v1/models/{model} — availability probe (RFC 9110 §9.3.2).
+ * Prevents Next.js auto-derived HEAD from streaming the full GET body,
+ * which caused ~6s hangs for SDK/gateway health probes (#6400).
+ */
+export async function HEAD() {
+  return new Response(null, {
+    status: 200,
+    headers: { "content-type": "application/json" },
+  });
+}
+
 /**
  * GET /v1/models/{model} — OpenAI-compatible single-model retrieval (#4674).
  *
diff --git a/src/app/api/v1/models/catalog.ts b/src/app/api/v1/models/catalog.ts
index ab6fe78b79..380827f11a 100644
--- a/src/app/api/v1/models/catalog.ts
+++ b/src/app/api/v1/models/catalog.ts
@@ -12,7 +12,10 @@ import {
 import { extractAliasBackedModels } from "./aliasBackedModels";
 import { appendNoThinkingVariants } from "@omniroute/open-sse/utils/noThinkingAlias";
 import { getAllEmbeddingModels } from "@omniroute/open-sse/config/embeddingRegistry";
-import { getAllImageModels } from "@omniroute/open-sse/config/imageRegistry";
+import {
+  getAllImageModels,
+  isRegisteredImageModel,
+} from "@omniroute/open-sse/config/imageRegistry";
 import { getAllRerankModels } from "@omniroute/open-sse/config/rerankRegistry";
 import { getAllAudioModels } from "@omniroute/open-sse/config/audioRegistry";
 import { getAllModerationModels } from "@omniroute/open-sse/config/moderationRegistry";
@@ -26,6 +29,7 @@ import {
   AUTO_SUFFIX_VARIANTS,
   AUTO_FAMILY_IDS,
   createBuiltinAutoCombo,
+  isPaidTierAutoId,
 } from "@omniroute/open-sse/services/autoCombo/builtinCatalog";
 import { getAllSyncedAvailableModels, type SyncedAvailableModel } from "@/lib/db/models";
 import { getModelCatalogCacheVersion } from "@/lib/db/readCache";
@@ -77,6 +81,7 @@ import { getVisionCapabilityFields, getCustomVisionCapabilityFields } from "./ca
 import { FALLBACK_ALIAS_TO_PROVIDER, buildAliasMaps } from "./catalogProviderMaps";
 import { getModelCatalogAuthRejection, isCodexModelCatalogClient } from "./catalogRequest";
 import { isFreeModel, providerHasFreeModels } from "@/shared/utils/freeModels";
+import { isCodexDiscoveryModelExcluded } from "@/shared/services/codexDiscoveryPolicy";
 
 // Public API of this module is preserved after the catalog helper extraction:
 // `isVisionModelId` (vision-detection-consistency.test.ts) and
@@ -649,6 +654,11 @@ async function buildUnifiedModelsResponseCore(
       ...AUTO_FAMILY_IDS,
     ]) {
       if (blockedProviders.has("auto") || listedIds.has(autoId)) continue; // #5192
+      // #6328 (follow-up to #6495 / #6512): REMOVE — not just hide — paid-tier
+      // auto/* ids (auto/pro-* + auto/*:pro) from the advertised catalog when the
+      // operator opts into hidePaidModels. The candidate-pool filter in
+      // virtualFactory (#6512) still gates request-time routing for the rest.
+      if (hidePaid && isPaidTierAutoId(autoId)) continue;
       listedIds.add(autoId);
       const baseAutoEntry = {
         id: autoId,
@@ -754,7 +764,8 @@ async function buildUnifiedModelsResponseCore(
         if (!providerSupportsModel(canonicalProviderId, model.id)) continue;
         const aliasId = `${alias}/${model.id}`;
         if (getModelIsHidden(canonicalProviderId, model.id)) continue;
-        if (shouldHidePaid(canonicalProviderId, model.id, (model as any).pricing)) continue;
+        if (shouldHidePaid(canonicalProviderId, model.id, (model as { pricing?: unknown }).pricing))
+          continue;
 
         const visionFields =
           getVisionCapabilityFields(aliasId) || getVisionCapabilityFields(model.id);
@@ -842,7 +853,29 @@ async function buildUnifiedModelsResponseCore(
 
         for (const sm of syncedModels) {
           if (!providerSupportsModel(canonicalProviderId, sm.id)) continue;
+          if (canonicalProviderId === "codex" && isCodexDiscoveryModelExcluded(sm)) {
+            continue;
+          }
           if (getModelIsHidden(providerId, sm.id)) continue;
+          // #6457: some upstream discovery catalogs (e.g. HuggingFace's live
+          // `/v1/models`) return image/diffusion models with no modality info,
+          // so `endpoints` below would default to ["chat"] and misrepresent
+          // them as chat-capable. Skip any synced model that is already a
+          // registered image model for this provider — getAllImageModels()
+          // below adds the correctly-typed `type: "image"` entry instead.
+          if (
+            isRegisteredImageModel(canonicalProviderId, sm.id) ||
+            isRegisteredImageModel(providerId, sm.id)
+          ) {
+            continue;
+          }
+          // #6328: apply hidePaidModels to synced provider rows too. Synced rows
+          // rarely carry pricing metadata, so shouldHidePaid() falls through to
+          // the FREE_MODEL_IDS_BY_PROVIDER catalog — providers with a curated
+          // free roster show only those; providers with none fall through to
+          // hide-all via providerHasFreeModels() === false.
+          if (shouldHidePaid(canonicalProviderId, sm.id, (sm as { pricing?: unknown }).pricing))
+            continue;
 
           const registryEntry = REGISTRY[providerId];
           const displayModelId =
@@ -1200,6 +1233,13 @@ async function buildUnifiedModelsResponseCore(
           if (!modelId) continue;
           if (model.isHidden === true) continue;
           if (getModelIsHidden(canonicalProviderId, modelId)) continue;
+          // #6328: apply hidePaidModels to user-defined custom rows too.
+          // Custom entries do not carry pricing, so shouldHidePaid() decides
+          // via FREE_MODEL_IDS_BY_PROVIDER — matches synced/PROVIDER_MODELS.
+          if (
+            shouldHidePaid(canonicalProviderId, modelId, (model as { pricing?: unknown }).pricing)
+          )
+            continue;
           // noAuth providers have no connection rows; keep auth providers gated. (#2798/#3200)
           const isNoAuthProvider = isNoAuthProviderKey(canonicalProviderId, providerId, alias);
           if (
@@ -1325,6 +1365,10 @@ async function buildUnifiedModelsResponseCore(
         }
 
         if (getModelIsHidden(canonicalProviderId, modelId)) continue;
+        // #6328: apply hidePaidModels to alias-backed rows too. Alias mappings
+        // point at providerKey/modelId with no pricing, so shouldHidePaid()
+        // decides via the FREE_MODEL_IDS_BY_PROVIDER catalog tier.
+        if (shouldHidePaid(canonicalProviderId, modelId)) continue;
 
         const aliasId = `${alias}/${modelId}`;
         const rawPrefixedId = `${providerKey}/${modelId}`;
@@ -1393,6 +1437,11 @@ async function buildUnifiedModelsResponseCore(
         const modelId = typeof model.id === "string" ? model.id : null;
         if (!modelId) continue;
         if (getModelIsHidden(canonicalProviderId, modelId)) continue;
+        // #6328: apply hidePaidModels to managed-fallback rows too. Compatible
+        // provider fallbacks lack pricing; shouldHidePaid() decides via the
+        // FREE_MODEL_IDS_BY_PROVIDER catalog tier.
+        if (shouldHidePaid(canonicalProviderId, modelId, (model as { pricing?: unknown }).pricing))
+          continue;
         if (!hasEligibleConnectionForModel([conn], modelId)) continue;
 
         const aliasId = `${alias}/${modelId}`;
diff --git a/src/app/api/v1/models/route.ts b/src/app/api/v1/models/route.ts
index eb30a4daf7..f884388ae8 100644
--- a/src/app/api/v1/models/route.ts
+++ b/src/app/api/v1/models/route.ts
@@ -6,12 +6,27 @@ import { getUnifiedModelsResponse } from "./catalog";
 export async function OPTIONS() {
   return new Response(null, {
     headers: {
-      "Access-Control-Allow-Methods": "GET, OPTIONS",
+      "Access-Control-Allow-Methods": "GET, HEAD, OPTIONS",
       "Access-Control-Allow-Headers": "*",
     },
   });
 }
 
+/**
+ * HEAD /v1/models - availability probe (RFC 9110 §9.3.2: HEAD returns headers only)
+ *
+ * Explicit handler prevents Next.js auto-derived HEAD from streaming the full
+ * GET body (200+ providers enumerated on-demand), which caused ~6s hang for
+ * clients like the OpenAI SDK that use HEAD as a health/preflight probe.
+ * See: https://github.com/diegosouzapw/OmniRoute/issues/6400
+ */
+export async function HEAD() {
+  return new Response(null, {
+    status: 200,
+    headers: { "content-type": "application/json" },
+  });
+}
+
 /**
  * GET /v1/models - OpenAI compatible models list
  */
diff --git a/src/app/api/v1/moderations/route.ts b/src/app/api/v1/moderations/route.ts
index 359e8f76f8..36fb4aa75a 100644
--- a/src/app/api/v1/moderations/route.ts
+++ b/src/app/api/v1/moderations/route.ts
@@ -1,5 +1,8 @@
 import { handleModeration } from "@omniroute/open-sse/handlers/moderations.ts";
-import { getProviderCredentials, clearRecoveredProviderState } from "@/sse/services/auth";
+import {
+  getProviderCredentialsWithQuotaPreflight,
+  clearRecoveredProviderState,
+} from "@/sse/services/auth";
 import { withInjectionGuard } from "@/middleware/promptInjectionGuard";
 import { parseModerationModel } from "@omniroute/open-sse/config/moderationRegistry.ts";
 import { errorResponse } from "@omniroute/open-sse/utils/error.ts";
@@ -52,7 +55,7 @@ async function postHandler(request, context) {
 
   // Default to openai if no provider prefix
   const resolvedProvider = provider || "openai";
-  const credentials = await getProviderCredentials(resolvedProvider);
+  const credentials = await getProviderCredentialsWithQuotaPreflight(resolvedProvider);
   if (!credentials) {
     return errorResponse(
       HTTP_STATUS.BAD_REQUEST,
diff --git a/src/app/api/v1/music/generations/route.ts b/src/app/api/v1/music/generations/route.ts
index 2d4b278c93..c4ce53077d 100644
--- a/src/app/api/v1/music/generations/route.ts
+++ b/src/app/api/v1/music/generations/route.ts
@@ -1,6 +1,9 @@
 import { handleMusicGeneration } from "@omniroute/open-sse/handlers/musicGeneration.ts";
 import { withInjectionGuard } from "@/middleware/promptInjectionGuard";
-import { getProviderCredentials, clearRecoveredProviderState } from "@/sse/services/auth";
+import {
+  getProviderCredentialsWithQuotaPreflight,
+  clearRecoveredProviderState,
+} from "@/sse/services/auth";
 import { parseMusicModel, getMusicProvider } from "@omniroute/open-sse/config/musicRegistry.ts";
 import { errorResponse } from "@omniroute/open-sse/utils/error.ts";
 import { HTTP_STATUS } from "@omniroute/open-sse/config/constants.ts";
@@ -72,7 +75,7 @@ async function postHandler(request, context) {
   // Get credentials — skip for local providers (authType: "none")
   let credentials = null;
   if (providerConfig && providerConfig.authType !== "none") {
-    credentials = await getProviderCredentials(provider);
+    credentials = await getProviderCredentialsWithQuotaPreflight(provider);
     if (!credentials) {
       return errorResponse(
         HTTP_STATUS.BAD_REQUEST,
diff --git a/src/app/api/v1/ocr/route.ts b/src/app/api/v1/ocr/route.ts
index 8b717c7a58..1304792722 100644
--- a/src/app/api/v1/ocr/route.ts
+++ b/src/app/api/v1/ocr/route.ts
@@ -1,5 +1,8 @@
 import { handleOcr } from "@omniroute/open-sse/handlers/ocr.ts";
-import { getProviderCredentials, clearRecoveredProviderState } from "@/sse/services/auth";
+import {
+  getProviderCredentialsWithQuotaPreflight,
+  clearRecoveredProviderState,
+} from "@/sse/services/auth";
 import { withInjectionGuard } from "@/middleware/promptInjectionGuard";
 import { parseOcrModel } from "@omniroute/open-sse/config/ocrRegistry.ts";
 import { errorResponse } from "@omniroute/open-sse/utils/error.ts";
@@ -52,7 +55,7 @@ async function postHandler(request, context) {
 
   // Default to mistral if no provider prefix
   const resolvedProvider = provider || "mistral";
-  const credentials = await getProviderCredentials(resolvedProvider);
+  const credentials = await getProviderCredentialsWithQuotaPreflight(resolvedProvider);
   if (!credentials) {
     return errorResponse(
       HTTP_STATUS.BAD_REQUEST,
diff --git a/src/app/api/v1/providers/[provider]/embeddings/route.ts b/src/app/api/v1/providers/[provider]/embeddings/route.ts
index f5329addb6..01dbe5bc84 100644
--- a/src/app/api/v1/providers/[provider]/embeddings/route.ts
+++ b/src/app/api/v1/providers/[provider]/embeddings/route.ts
@@ -2,7 +2,7 @@ import { errorResponse, unavailableResponse } from "@omniroute/open-sse/utils/er
 import { HTTP_STATUS } from "@omniroute/open-sse/config/constants.ts";
 import { getRegistryEntry } from "@omniroute/open-sse/config/providerRegistry.ts";
 import {
-  getProviderCredentials,
+  getProviderCredentialsWithQuotaPreflight,
   clearRecoveredProviderState,
   extractApiKey,
   isValidApiKey,
@@ -71,7 +71,7 @@ export async function POST(request, { params }) {
     }
   }
 
-  const credentials = await getProviderCredentials(providerEntry.id);
+  const credentials = await getProviderCredentialsWithQuotaPreflight(providerEntry.id);
   if (!credentials) {
     return errorResponse(HTTP_STATUS.BAD_REQUEST, `No credentials for provider: ${rawProvider}`);
   }
diff --git a/src/app/api/v1/providers/[provider]/images/generations/route.ts b/src/app/api/v1/providers/[provider]/images/generations/route.ts
index 66555796e0..f80f580b78 100644
--- a/src/app/api/v1/providers/[provider]/images/generations/route.ts
+++ b/src/app/api/v1/providers/[provider]/images/generations/route.ts
@@ -2,7 +2,7 @@ import { handleImageGeneration } from "@omniroute/open-sse/handlers/imageGenerat
 import { errorResponse, unavailableResponse } from "@omniroute/open-sse/utils/error.ts";
 import { HTTP_STATUS } from "@omniroute/open-sse/config/constants.ts";
 import {
-  getProviderCredentials,
+  getProviderCredentialsWithQuotaPreflight,
   clearRecoveredProviderState,
   extractApiKey,
   isValidApiKey,
@@ -68,7 +68,7 @@ export async function POST(request, { params }) {
     );
   }
 
-  const credentials = await getProviderCredentials(rawProvider);
+  const credentials = await getProviderCredentialsWithQuotaPreflight(rawProvider);
   if (!credentials) {
     return errorResponse(
       HTTP_STATUS.BAD_REQUEST,
diff --git a/src/app/api/v1/relay/chat/completions/bifrost/route.ts b/src/app/api/v1/relay/chat/completions/bifrost/route.ts
index da8722d11c..b0df931b0e 100644
--- a/src/app/api/v1/relay/chat/completions/bifrost/route.ts
+++ b/src/app/api/v1/relay/chat/completions/bifrost/route.ts
@@ -176,7 +176,7 @@ export async function POST(request: Request) {
       });
     }
 
-    const rateCheck = checkRateLimit(token.id);
+    const rateCheck = checkRateLimit(token.id, token);
     if (!rateCheck.allowed) {
       recordRelayUsage(token.id, {
         requestId: request.headers.get("x-request-id") || undefined,
diff --git a/src/app/api/v1/relay/chat/completions/route.ts b/src/app/api/v1/relay/chat/completions/route.ts
index f674327f62..8ee4a25a2d 100644
--- a/src/app/api/v1/relay/chat/completions/route.ts
+++ b/src/app/api/v1/relay/chat/completions/route.ts
@@ -215,7 +215,7 @@ export async function POST(request: Request) {
     }
 
     // 2b. Per-token rate limit check
-    const rateCheck = checkRateLimit(token.id);
+    const rateCheck = checkRateLimit(token.id, token);
     if (!rateCheck.allowed) {
       recordRelayUsage(token.id, {
         requestId: request.headers.get("x-request-id") || undefined,
@@ -303,8 +303,7 @@ export async function POST(request: Request) {
       bifrostFallbackReason = bifrostDecision.fallbackReason;
     }
     if (bifrostDecision.tryBifrost) {
-      const cooldown =
-        backend === "auto" ? getActiveBifrostCooldown(bifrostConfig.baseUrl) : null;
+      const cooldown = backend === "auto" ? getActiveBifrostCooldown(bifrostConfig.baseUrl) : null;
       if (cooldown) {
         bifrostFallbackReason = `bifrost-cooldown; remaining=${cooldown.remainingMs}`;
       } else {
diff --git a/src/app/api/v1/rerank/route.ts b/src/app/api/v1/rerank/route.ts
index 13283a5ca1..a2f60bb623 100644
--- a/src/app/api/v1/rerank/route.ts
+++ b/src/app/api/v1/rerank/route.ts
@@ -1,5 +1,8 @@
 import { handleRerank } from "@omniroute/open-sse/handlers/rerank.ts";
-import { getProviderCredentials, clearRecoveredProviderState } from "@/sse/services/auth";
+import {
+  getProviderCredentialsWithQuotaPreflight,
+  clearRecoveredProviderState,
+} from "@/sse/services/auth";
 import { withInjectionGuard } from "@/middleware/promptInjectionGuard";
 import { parseRerankModel, getRerankProvider } from "@omniroute/open-sse/config/rerankRegistry.ts";
 import { errorResponse } from "@omniroute/open-sse/utils/error.ts";
@@ -102,7 +105,7 @@ async function postHandler(request, context) {
 
   if (provider) {
     // Cloud provider matched
-    const credentials = await getProviderCredentials(provider);
+    const credentials = await getProviderCredentialsWithQuotaPreflight(provider);
     if (!credentials) {
       return errorResponse(HTTP_STATUS.BAD_REQUEST, `No credentials for provider: ${provider}`);
     }
@@ -132,7 +135,7 @@ async function postHandler(request, context) {
     const localProvider = localProviders.find((p) => p.id === prefix);
 
     if (localProvider) {
-      const credentials = await getProviderCredentials(localProvider.providerId);
+      const credentials = await getProviderCredentialsWithQuotaPreflight(localProvider.providerId);
       if (!credentials) {
         return errorResponse(
           HTTP_STATUS.BAD_REQUEST,
diff --git a/src/app/api/v1/search/route.ts b/src/app/api/v1/search/route.ts
index 40f5fa5694..3290f26d29 100644
--- a/src/app/api/v1/search/route.ts
+++ b/src/app/api/v1/search/route.ts
@@ -1,5 +1,9 @@
 import { handleSearch } from "@omniroute/open-sse/handlers/search.ts";
-import { getProviderCredentials, extractApiKey, isValidApiKey } from "@/sse/services/auth";
+import {
+  getProviderCredentialsWithQuotaPreflight,
+  extractApiKey,
+  isValidApiKey,
+} from "@/sse/services/auth";
 import {
   getAllSearchProviders,
   getSearchProvider,
@@ -64,13 +68,15 @@ type SearchCredentials = Record<string, any>;
 type SearchCredentialLookup = SearchCredentials | RateLimitedCredentials | null;
 
 async function resolveSearchCredentials(providerId: string): Promise<SearchCredentialLookup> {
-  const credentials = await getProviderCredentials(providerId).catch(() => null);
+  const credentials = await getProviderCredentialsWithQuotaPreflight(providerId).catch(() => null);
   if (credentials && !isAllRateLimitedCredentials(credentials)) return credentials;
 
   const fallbackId = SEARCH_CREDENTIAL_FALLBACKS[providerId];
   if (!fallbackId) return credentials;
 
-  const fallbackCredentials = await getProviderCredentials(fallbackId).catch(() => null);
+  const fallbackCredentials = await getProviderCredentialsWithQuotaPreflight(fallbackId).catch(
+    () => null
+  );
   if (fallbackCredentials && !isAllRateLimitedCredentials(fallbackCredentials)) {
     return fallbackCredentials;
   }
@@ -180,7 +186,9 @@ async function postHandler(request: Request, context: unknown) {
       // Sort by cost to find cheapest with credentials (fallback-only providers
       // are reached via the last-resort step below, never the primary pick).
       const sortedIds = Object.values(SEARCH_PROVIDERS)
-        .filter((provider) => !provider.fallbackOnly && supportsSearchType(provider, body.search_type))
+        .filter(
+          (provider) => !provider.fallbackOnly && supportsSearchType(provider, body.search_type)
+        )
         .sort((a, b) => a.costPerQuery - b.costPerQuery)
         .map((p) => p.id);
 
@@ -216,7 +224,9 @@ async function postHandler(request: Request, context: unknown) {
     // Find alternate for failover — must bind credentials to the matched provider.
     // Exclude fallback-only providers; they are only used by the last-resort step.
     const otherIds = Object.values(SEARCH_PROVIDERS)
-      .filter((provider) => !provider.fallbackOnly && supportsSearchType(provider, body.search_type))
+      .filter(
+        (provider) => !provider.fallbackOnly && supportsSearchType(provider, body.search_type)
+      )
       .sort((a, b) => a.costPerQuery - b.costPerQuery)
       .map((p) => p.id)
       .filter((id) => id !== providerConfig.id);
diff --git a/src/app/api/v1/videos/generations/route.ts b/src/app/api/v1/videos/generations/route.ts
index cf482df797..f1c3693d56 100644
--- a/src/app/api/v1/videos/generations/route.ts
+++ b/src/app/api/v1/videos/generations/route.ts
@@ -1,7 +1,10 @@
 import { handleVideoGeneration } from "@omniroute/open-sse/handlers/videoGeneration.ts";
 import { resolveVideoCredentialProvider } from "@omniroute/open-sse/handlers/videoGeneration/googleFlow.ts";
 import { withInjectionGuard } from "@/middleware/promptInjectionGuard";
-import { getProviderCredentials, clearRecoveredProviderState } from "@/sse/services/auth";
+import {
+  getProviderCredentialsWithQuotaPreflight,
+  clearRecoveredProviderState,
+} from "@/sse/services/auth";
 import { parseVideoModel, getVideoProvider } from "@omniroute/open-sse/config/videoRegistry.ts";
 import { errorResponse } from "@omniroute/open-sse/utils/error.ts";
 import { HTTP_STATUS } from "@omniroute/open-sse/config/constants.ts";
@@ -75,7 +78,9 @@ async function postHandler(request, context) {
   // OAuth credential (resolveVideoCredentialProvider maps googleflow → antigravity).
   let credentials = null;
   if (providerConfig && providerConfig.authType !== "none") {
-    credentials = await getProviderCredentials(resolveVideoCredentialProvider(provider));
+    credentials = await getProviderCredentialsWithQuotaPreflight(
+      resolveVideoCredentialProvider(provider)
+    );
     if (!credentials) {
       return errorResponse(
         HTTP_STATUS.BAD_REQUEST,
diff --git a/src/app/api/v1/web/fetch/route.ts b/src/app/api/v1/web/fetch/route.ts
index 77ffabe2a9..c32466ab9b 100644
--- a/src/app/api/v1/web/fetch/route.ts
+++ b/src/app/api/v1/web/fetch/route.ts
@@ -12,7 +12,11 @@ import { errorResponse } from "@omniroute/open-sse/utils/error.ts";
 import { HTTP_STATUS } from "@omniroute/open-sse/config/constants.ts";
 import { handleWebFetch } from "@omniroute/open-sse/handlers/webFetch.ts";
 import * as log from "@/sse/utils/logger";
-import { extractApiKey, isValidApiKey, getProviderCredentials } from "@/sse/services/auth";
+import {
+  extractApiKey,
+  isValidApiKey,
+  getProviderCredentialsWithQuotaPreflight,
+} from "@/sse/services/auth";
 import { enforceApiKeyPolicy } from "@/shared/utils/apiKeyPolicy";
 import { isRequireApiKeyEnabled } from "@/shared/utils/featureFlags";
 import { v1WebFetchSchema } from "@/shared/validation/schemas";
@@ -38,7 +42,7 @@ async function resolveCredentials(
   providerId: WebFetchProviderId
 ): Promise<{ apiKey?: string } | null> {
   try {
-    const creds = await getProviderCredentials(providerId);
+    const creds = await getProviderCredentialsWithQuotaPreflight(providerId);
     return creds ?? null;
   } catch {
     return null;
diff --git a/src/app/api/v1/ws/route.ts b/src/app/api/v1/ws/route.ts
index bdd629578d..fb85cc50fc 100644
--- a/src/app/api/v1/ws/route.ts
+++ b/src/app/api/v1/ws/route.ts
@@ -1,4 +1,5 @@
 import { CORS_HEADERS } from "@/shared/utils/cors";
+import { getLiveWsPath } from "@/shared/utils/wsPath";
 import { authorizeWebSocketHandshake } from "@/lib/ws/handshake";
 
 const WS_HANDSHAKE_HEADERS = {
@@ -26,9 +27,9 @@ function getWsProtocol() {
     },
     cancel: { type: "cancel", id: "req-1" },
     live: {
-      port: parseInt(process.env.LIVE_WS_PORT || "20129", 10),
+      port: parseInt(process.env.LIVE_WS_PORT || "20132", 10),
       publicUrl: getLivePublicUrl(),
-      path: "/live",
+      path: getLiveWsPath(),
       protocol: "json",
       channels: ["requests", "combo", "credentials"],
       auth: "api-key",
@@ -82,9 +83,9 @@ export async function GET(request: Request) {
         authType: auth.authType,
         protocol: getWsProtocol(),
         live: {
-          port: parseInt(process.env.LIVE_WS_PORT || "20129", 10),
+          port: parseInt(process.env.LIVE_WS_PORT || "20132", 10),
           publicUrl: getLivePublicUrl(),
-          path: "/live",
+          path: getLiveWsPath(),
           protocol: "json",
           channels: ["requests", "combo", "credentials"],
           auth: "api-key",
diff --git a/src/app/docs/lib/openapi.generated.ts b/src/app/docs/lib/openapi.generated.ts
index 7f0053095e..53876ec347 100644
--- a/src/app/docs/lib/openapi.generated.ts
+++ b/src/app/docs/lib/openapi.generated.ts
@@ -173,7 +173,8 @@ export const OPENAPI_ENDPOINTS: OpenApiEndpoint[] = [
     path: "/api/v1/providers/{provider}/models",
     method: "GET",
     summary: "List models for a specific provider",
-    description: "Returns only models for the selected provider with provider prefix removed from each model id.",
+    description:
+      "Returns only models for the selected provider with provider prefix removed from each model id.",
     tag: "Models",
     tags: ["Models"],
     requiresAuth: true,
@@ -203,7 +204,8 @@ export const OPENAPI_ENDPOINTS: OpenApiEndpoint[] = [
     path: "/api/v1/ws",
     method: "GET",
     summary: "Chat completion over WebSocket (handshake + upgrade)",
-    description: "OpenAI-compatible chat over a WebSocket connection. `GET` with `?handshake=1` returns the connection descriptor (auth path, message protocol and live-event channels) as JSON; a plain `GET` without an Upgrade returns `426 Upgrade Required`. After upgrading, the client exchanges JSON frames — `{type:\"request\", id, payload:{model, messages}}` to start a completion and `{type:\"cancel\", id}` to abort it. A separate live channel (default port `LIVE_WS_PORT=20129`, path `/live`) streams dashboard events on the `requests`, `combo` and `credentials` topics with a 15s heartbeat. Requires an API key.",
+    description:
+      'OpenAI-compatible chat over a WebSocket connection. `GET` with `?handshake=1` returns the connection descriptor (auth path, message protocol and live-event channels) as JSON; a plain `GET` without an Upgrade returns `426 Upgrade Required`. After upgrading, the client exchanges JSON frames — `{type:"request", id, payload:{model, messages}}` to start a completion and `{type:"cancel", id}` to abort it. A separate live channel (default port `LIVE_WS_PORT=20132`, path `/live`) streams dashboard events on the `requests`, `combo` and `credentials` topics with a 15s heartbeat. Requires an API key.',
     tag: "Chat",
     tags: ["Chat"],
     requiresAuth: true,
diff --git a/src/hooks/useLiveDashboard.ts b/src/hooks/useLiveDashboard.ts
index b31c4be047..05c991a31f 100644
--- a/src/hooks/useLiveDashboard.ts
+++ b/src/hooks/useLiveDashboard.ts
@@ -13,6 +13,7 @@
 
 import { useEffect, useRef, useState, useCallback } from "react";
 import type { DashboardChannel, DashboardEventName } from "@/lib/events/types";
+import { deriveLiveWsPath } from "@/shared/utils/wsPath";
 
 // ── Config ────────────────────────────────────────────────────────────────
 
@@ -27,21 +28,22 @@ function sanitizeWsPublicUrl(url: unknown): string | null {
 // Build-time inlined value (Docker/npm prebuilt images won't have this — the
 // runtime value is discovered via the /api/v1/ws?handshake=1 handshake below).
 const BUILD_TIME_PUBLIC_WS_URL = sanitizeWsPublicUrl(process.env.NEXT_PUBLIC_LIVE_WS_PUBLIC_URL);
+const BUILD_TIME_WS_PATH = deriveLiveWsPath(process.env.NEXT_PUBLIC_LIVE_WS_PUBLIC_URL);
 
 function getDefaultWsUrl(): string {
   if (BUILD_TIME_PUBLIC_WS_URL) return BUILD_TIME_PUBLIC_WS_URL;
-  if (typeof window === "undefined") return "ws://localhost:20129";
+  if (typeof window === "undefined") return `ws://localhost:20132${BUILD_TIME_WS_PATH}`;
   const protocol = window.location.protocol === "https:" ? "wss:" : "ws:";
   const { hostname } = window.location;
-  // Bug #1 fix: Use the WS server's actual port (20129) for both loopback
+  // Bug #1 fix: Use the WS server's actual port (20132) for both loopback
   // and non-loopback clients. Previously the non-loopback branch tried to
   // upgrade the HTTP port (window.location.host) which has no upgrade
   // handler in src/proxy.ts. If the user wants the upgrade to go through
   // Next.js (same-origin), they should explicitly pass `wsUrl`.
   if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1") {
-    return `${protocol}//${hostname}:20129`;
+    return `${protocol}//${hostname}:20132${BUILD_TIME_WS_PATH}`;
   }
-  return `${protocol}//${hostname}:20129`;
+  return `${protocol}//${hostname}:20132${BUILD_TIME_WS_PATH}`;
 }
 
 const DEFAULT_WS_URL = getDefaultWsUrl();
@@ -65,7 +67,7 @@ export interface DashboardConnectionState {
 // ── Core Hook ─────────────────────────────────────────────────────────────
 
 export interface UseLiveDashboardOptions {
-  /** WebSocket URL (default: ws://hostname:20129) */
+  /** WebSocket URL (default: ws://hostname:20132) */
   wsUrl?: string;
   /** Whether the WebSocket connection should be active (default: true) */
   enabled?: boolean;
@@ -105,6 +107,7 @@ export function useLiveDashboard({
   // Skipped when the caller passes an explicit wsUrl or the env was inlined.
   const needsHandshake = !wsUrl && !BUILD_TIME_PUBLIC_WS_URL && typeof window !== "undefined";
   const [handshakeUrl, setHandshakeUrl] = useState<string | null>(null);
+  const [handshakePath, setHandshakePath] = useState<string | null>(null);
   const [wsUrlResolved, setWsUrlResolved] = useState(!needsHandshake);
 
   useEffect(() => {
@@ -116,6 +119,9 @@ export function useLiveDashboard({
         if (cancelled) return;
         const publicUrl = sanitizeWsPublicUrl(body?.live?.publicUrl);
         if (publicUrl) setHandshakeUrl(publicUrl);
+        if (typeof body?.live?.path === "string" && body.live.path.startsWith("/")) {
+          setHandshakePath(body.live.path);
+        }
       })
       .catch(() => {
         // Handshake unavailable — fall back to the default URL.
@@ -128,7 +134,20 @@ export function useLiveDashboard({
     };
   }, [needsHandshake, wsUrlResolved]);
 
-  const effectiveWsUrl = wsUrl ?? handshakeUrl ?? DEFAULT_WS_URL;
+  const effectiveWsUrl = (() => {
+    if (wsUrl) return wsUrl;
+    if (handshakeUrl) return handshakeUrl;
+    if (handshakePath && handshakePath !== BUILD_TIME_WS_PATH) {
+      try {
+        const url = new URL(DEFAULT_WS_URL);
+        url.pathname = handshakePath;
+        return url.toString();
+      } catch {
+        return DEFAULT_WS_URL;
+      }
+    }
+    return DEFAULT_WS_URL;
+  })();
 
   const [events, setEvents] = useState<WsEventPayload[]>([]);
   const wsRef = useRef<WebSocket | null>(null);
diff --git a/src/i18n/messages/ar.json b/src/i18n/messages/ar.json
index a01346415e..de049135af 100644
--- a/src/i18n/messages/ar.json
+++ b/src/i18n/messages/ar.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "نشط",
     "filterError": "خطأ",
     "filterBanned": "محظور",
-    "filterCreditsExhausted": "نفدت الأرصدة"
+    "filterCreditsExhausted": "نفدت الأرصدة",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "الإعدادات",
diff --git a/src/i18n/messages/az.json b/src/i18n/messages/az.json
index 9f997a6882..e0694b225d 100644
--- a/src/i18n/messages/az.json
+++ b/src/i18n/messages/az.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "Aktiv",
     "filterError": "Xəta",
     "filterBanned": "Qadağan edilib",
-    "filterCreditsExhausted": "Kreditlər bitib"
+    "filterCreditsExhausted": "Kreditlər bitib",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "Settings",
diff --git a/src/i18n/messages/bg.json b/src/i18n/messages/bg.json
index 562ea344a1..b6e9952e85 100644
--- a/src/i18n/messages/bg.json
+++ b/src/i18n/messages/bg.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "Активни",
     "filterError": "Грешка",
     "filterBanned": "Блокиран",
-    "filterCreditsExhausted": "Изчерпани кредити"
+    "filterCreditsExhausted": "Изчерпани кредити",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "Настройки",
diff --git a/src/i18n/messages/bn.json b/src/i18n/messages/bn.json
index 9409247b32..27a35531b4 100644
--- a/src/i18n/messages/bn.json
+++ b/src/i18n/messages/bn.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "সক্রিয়",
     "filterError": "ত্রুটি",
     "filterBanned": "নিষিদ্ধ",
-    "filterCreditsExhausted": "ক্রেডিট শেষ"
+    "filterCreditsExhausted": "ক্রেডিট শেষ",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "Settings",
diff --git a/src/i18n/messages/cs.json b/src/i18n/messages/cs.json
index 846c49326c..0f2db58994 100644
--- a/src/i18n/messages/cs.json
+++ b/src/i18n/messages/cs.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "Aktivní",
     "filterError": "Chyba",
     "filterBanned": "Zablokováno",
-    "filterCreditsExhausted": "Vyčerpané kredity"
+    "filterCreditsExhausted": "Vyčerpané kredity",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "Nastavení",
diff --git a/src/i18n/messages/da.json b/src/i18n/messages/da.json
index b58cc1eeac..3db278c319 100644
--- a/src/i18n/messages/da.json
+++ b/src/i18n/messages/da.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "Aktiv",
     "filterError": "Fejl",
     "filterBanned": "Blokeret",
-    "filterCreditsExhausted": "Kreditter opbrugt"
+    "filterCreditsExhausted": "Kreditter opbrugt",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "Indstillinger",
diff --git a/src/i18n/messages/de.json b/src/i18n/messages/de.json
index 419b883f87..f9b37487c5 100644
--- a/src/i18n/messages/de.json
+++ b/src/i18n/messages/de.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4425,7 +4428,11 @@
     "filterActive": "Aktiv",
     "filterError": "Fehler",
     "filterBanned": "Gesperrt",
-    "filterCreditsExhausted": "Guthaben aufgebraucht"
+    "filterCreditsExhausted": "Guthaben aufgebraucht",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "Einstellungen",
diff --git a/src/i18n/messages/en.json b/src/i18n/messages/en.json
index 456b7d17e5..1e172158a6 100644
--- a/src/i18n/messages/en.json
+++ b/src/i18n/messages/en.json
@@ -871,6 +871,7 @@
     "skills": "Skills",
     "omniSkills": "OmniSkills",
     "agentSkills": "AgentSkills",
+    "chaosConfig": "Chaos Mode",
     "docs": "Docs",
     "issues": "Issues",
     "endpoints": "Endpoints",
@@ -955,6 +956,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1546,6 +1548,8 @@
     "chartModel": "Model",
     "chartProvider": "Provider",
     "chartProviderBreakdown": "Provider Breakdown",
+    "chartDate": "Date",
+    "chartRequestsByProviderDate": "Requests by Provider & Date",
     "filterAllKeys": "All Keys",
     "filterSearchKeys": "Search keys…",
     "filterNoKeysMatch": "No keys match",
@@ -4318,6 +4322,29 @@
     "targetFormatAuto": "Default (auto)",
     "targetFormatGemini": "Gemini",
     "targetFormatAntigravity": "Antigravity",
+    "contextWindowOverrideLabel": "Context Window Override",
+    "contextWindowOverridePlaceholder": "e.g. 131072",
+    "contextWindowOverrideHint": "Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "Context window override must be a positive whole number of tokens",
+    "compatParamFiltersLabel": "Param Filters",
+    "compatBlockedParamsHint": "Blocked params (stripped from requests)",
+    "compatAllowedParamsHint": "Allowed params (re-added after deny)",
+    "paramFiltersSectionTitle": "Param Filters",
+    "paramFiltersSectionHint": "Strip or re-add request parameters before sending to this provider. Used to avoid 400 errors from providers that reject certain params (e.g. NVIDIA NIM rejects <code>thinking</code>).",
+    "paramFiltersBlockedLabel": "Blocked parameters",
+    "paramFiltersBlockedHint": "These params are stripped from outgoing requests (denylist).",
+    "paramFiltersAllowedLabel": "Allowed parameters",
+    "paramFiltersAllowedHint": "These params are re-added after denylist stripping (only if the client sent them).",
+    "paramFiltersAutoLearnLabel": "Auto-learn from 400 errors",
+    "paramFiltersAutoLearnHint": "When enabled, if the upstream returns a 400 with \"Unsupported parameter: X\", the param is automatically added to the block list and the request retried.",
+    "paramFiltersSaving": "Saving…",
+    "paramFiltersSaveChanges": "Save Changes",
+    "paramFiltersResetToDefault": "Reset to Default",
+    "paramFiltersLoadError": "Failed to load param filter config: {error}",
+    "paramFiltersSaveSuccess": "Param filter config saved",
+    "paramFiltersSaveError": "Failed to save param filter config: {error}",
+    "paramFiltersResetSuccess": "Param filter config reset to defaults",
+    "paramFiltersResetError": "Failed to reset param filter config: {error}",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
@@ -4863,7 +4890,8 @@
     "doubaoWebDesc": "ByteDance AI chat via dola.com",
     "overrideBaseUrlAdvanced": "Advanced: override base URL",
     "overrideBaseUrlHint": "Advanced: point this built-in provider at a custom endpoint. Leave blank to use the default.",
-    "bulkAddFormatHintCloudflare": "One key per line. Format: name|accountId|apiKey (Cloudflare account ID + API token)."
+    "bulkAddFormatHintCloudflare": "One key per line. Format: name|accountId|apiKey (Cloudflare account ID + API token).",
+    "lmarenaWebCookieHint": "Open arena.ai, sign in, then copy the full Cookie header from a Network request. Include arena-auth-prod-v1.0 and arena-auth-prod-v1.1 (and further chunks if present), preferably with cf_clearance. Do not paste only the empty arena-auth-prod-v1 cookie. Optional: providerSpecificData.recaptchaV3Token if create-evaluation still returns 403."
   },
   "settings": {
     "title": "Settings",
@@ -5042,7 +5070,7 @@
     "strategy": "Strategy",
     "preserveClientCache": "Preserve Client Cache",
     "enabled": "Enabled",
-    "loading": "Loading...",
+    "loading": "Loading…",
     "saving": "Saving...",
     "save": "Save",
     "circuitBreaker": "Circuit Breaker",
@@ -5208,6 +5236,14 @@
     "proxyFreePoolQuality": "Quality",
     "proxyFreePoolLatency": "Latency",
     "proxyFreePoolEmpty": "No proxies found. Click Sync All to fetch from sources.",
+    "proxyFreePoolSearchPlaceholder": "Search host…",
+    "proxyFreePoolSearchLabel": "Search proxies by host",
+    "proxyFreePoolSortLabel": "Sort proxies",
+    "proxyFreePoolSortQuality": "Quality",
+    "proxyFreePoolSortLatency": "Latency",
+    "proxyFreePoolSortRecent": "Recently validated",
+    "proxyFreePoolListTotal": "Listed",
+    "proxyFreePoolLoadMore": "Load more",
     "close": "Close",
     "cancel": "Cancel",
     "globalLabel": "Global",
@@ -5306,6 +5342,22 @@
     "strictRandomDesc": "Shuffle deck — uses each account once before reshuffling",
     "stickyLimit": "Sticky Limit",
     "stickyLimitDesc": "Calls per account before switching when global account fallback uses Round Robin",
+    "routingStrategyTitle": "Routing Strategy",
+    "routingStrategySubtitle": "Match 9router: account round-robin, sticky limits, and combo rotation",
+    "accountRoundRobin": "Round Robin",
+    "accountRoundRobinDesc": "Cycle through accounts to distribute load",
+    "comboRoundRobin": "Combo Round Robin",
+    "comboRoundRobinDesc": "Cycle through combo targets instead of always starting with the first",
+    "comboStickyLimit": "Combo Sticky Limit",
+    "comboStickyLimitDesc": "Calls per combo target before switching",
+    "routingStrategyAccountSummary": "Distributing requests across accounts with {limit} calls per account.",
+    "routingStrategyFillFirstSummary": "Using accounts in priority order (Fill First).",
+    "routingStrategyComboSummary": " Combos rotate after {limit} call(s) per target.",
+    "routingStrategyComboFallbackSummary": " Combos use each combo's configured strategy (default priority/fallback).",
+    "providerAccountRoutingTitle": "Multi-account routing",
+    "providerAccountRoutingDesc": "Override global account strategy for this provider (9router parity).",
+    "providerRoutingStrategy": "Account strategy",
+    "providerRoutingInheritGlobal": "Inherit global default",
     "modelAliases": "Model Aliases",
     "modelAliasesTitle": "Model Aliases",
     "modelAliasesDesc": "Remap model names using exact matches or wildcard patterns.",
@@ -5513,6 +5565,20 @@
     "errorDuringImport": "An error occurred during import",
     "modelPricing": "Model Pricing",
     "modelPricingDesc": "Configure cost rates per model • All rates in $/1M tokens",
+    "modelOverridesTitle": "Model Overrides",
+    "modelOverridesDesc": "Override provider/model capabilities used by routing and request shaping. Targets use the same provider/model form as combos.",
+    "searchModelOverrideTargets": "Search provider/model...",
+    "selectedModel": "Selected model",
+    "configured": "configured",
+    "none": "None",
+    "modelOverrideValuePlaceholder": "Numeric value",
+    "addKeyValue": "Add key value",
+    "noModelOverrides": "No overrides configured for this model.",
+    "modelOverrideLoadFailed": "Failed to load model overrides",
+    "modelOverrideSaved": "Model override saved",
+    "modelOverrideRemoved": "Model override removed",
+    "modelOverrideSaveFailed": "Failed to save model override",
+    "modelOverrideRemoveFailed": "Failed to remove model override",
     "registry": "Registry",
     "priced": "Priced",
     "searchProvidersModels": "Search providers or models...",
@@ -7933,9 +7999,16 @@
     "testSuccess": "✓ {ip}",
     "testLatency": "{latency}ms",
     "testFailure": "✗ {error}",
+    "repair": "Repair",
+    "relayAuthMissing": "auth missing",
+    "relayRepairTooltip": "Recover relay auth in place. If the token is unrecoverable (e.g. after a STORAGE_ENCRYPTION_KEY rotation), redeploy the relay instead.",
+    "relayRepairRedeployRequired": "Relay auth is unrecoverable — redeploy the relay to write a fresh token.",
+    "relayRepairFailed": "Relay repair failed",
+    "relayRepairError": "repair failed",
+    "relayProbeSummary": "Relay probes: {alive}/{tested} alive",
     "bulkImport": "Bulk Import",
     "bulkImportTitle": "Bulk Import Proxies",
-    "bulkImportDescription": "Paste proxy profiles one per line. Supported formats: pipe-delimited (NAME|HOST|PORT|…) or auth-less shorthand (HOST:PORT). Existing proxies (same host + port) will be updated.",
+    "bulkImportDescription": "Paste proxy profiles one per line. Supported formats: pipe-delimited (NAME|HOST|PORT|…), shorthand (ip:port, ip:port:user:pass, user:pass@ip:port, user:pass:ip:port, protocol://ip:port, protocol://user:pass@ip:port), or protocol header mode (bare protocol on first line applies to subsequent shorthand lines). Existing proxies (same host + port) will be updated.",
     "bulkImportParse": "Parse",
     "bulkImportImport": "Import {count} Proxies",
     "bulkImportImporting": "Importing...",
@@ -7965,11 +8038,12 @@
     "poolLoad": "Load Pool",
     "poolLoadFailed": "Failed to load the proxy pool",
     "poolStrategyLabel": "Rotation strategy",
-    "poolStrategyHint": "round-robin cycles members in order; random picks uniformly; sticky holds one member for a window before advancing.",
+    "poolStrategyHint": "round-robin cycles members in order; random picks uniformly; sticky holds one member for a window; latency-optimized picks the fastest based on logs.",
     "poolStrategyFailed": "Failed to update the rotation strategy",
     "strategyRoundRobin": "Round-robin",
     "strategyRandom": "Random",
     "strategySticky": "Sticky",
+    "strategyLatency": "Latency-optimized",
     "poolMembersLabel": "Pool members ({count})",
     "poolNoMembers": "No proxies in this pool yet.",
     "poolRemove": "Remove",
@@ -7977,7 +8051,8 @@
     "poolAddLabel": "Add a proxy",
     "poolAddMember": "Add",
     "poolAddFailed": "Failed to add the proxy to the pool",
-    "poolSelectProxy": "Select a proxy…"
+    "poolSelectProxy": "Select a proxy…",
+    "poolSaveFailed": "Failed to save pool assignment"
   },
   "playground": {
     "title": "Model Playground",
@@ -9113,5 +9188,35 @@
     "auth": "Auth",
     "feasibility": "Feasibility",
     "models": "Models"
+  },
+  "chaosConfig": {
+    "pageTitle": "Chaos Mode",
+    "pageSubtitle": "Run multiple AI models in parallel or collaboratively on the same task",
+    "enableChaos": "Enable Chaos Mode",
+    "enableChaosDesc": "Allow API keys with chaos mode enabled to use this feature",
+    "mode": "Default Mode",
+    "modeParallel": "Parallel",
+    "modeCollaborative": "Collaborative",
+    "modeParallelDesc": "All models run simultaneously — fastest results",
+    "modeCollaborativeDesc": "Models chain outputs — each sees the previous result",
+    "timeout": "Timeout (ms)",
+    "timeoutDesc": "Max time per model call (5000-600000ms)",
+    "systemPrompt": "System Prompt (optional)",
+    "systemPromptDesc": "Custom instructions for all chaos mode model instances",
+    "providerOverrides": "Provider Overrides",
+    "providerOverridesDesc": "Select specific models per provider for chaos mode",
+    "providerId": "Provider",
+    "modelId": "Model",
+    "addProvider": "Add Provider",
+    "removeProvider": "Remove",
+    "saveConfig": "Save Configuration",
+    "configSaved": "Chaos configuration saved successfully",
+    "configError": "Failed to save chaos configuration",
+    "configReset": "Reset to Defaults",
+    "keyPermission": "Chaos Mode Access",
+    "keyPermissionDesc": "Allow this API key to use Chaos Mode (multi-model parallel execution)",
+    "testButton": "Test Chaos Mode",
+    "testTask": "Write a short poem about artificial intelligence",
+    "loadingProviderModels": "Loading providers..."
   }
 }
diff --git a/src/i18n/messages/es.json b/src/i18n/messages/es.json
index dde3a4f1b3..84c20d31b9 100644
--- a/src/i18n/messages/es.json
+++ b/src/i18n/messages/es.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "Activo",
     "filterError": "Error",
     "filterBanned": "Bloqueado",
-    "filterCreditsExhausted": "Créditos agotados"
+    "filterCreditsExhausted": "Créditos agotados",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "Configuración",
diff --git a/src/i18n/messages/fa.json b/src/i18n/messages/fa.json
index 191582311f..2e85c028be 100644
--- a/src/i18n/messages/fa.json
+++ b/src/i18n/messages/fa.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "فعال",
     "filterError": "خطا",
     "filterBanned": "مسدود",
-    "filterCreditsExhausted": "اعتبار تمام‌شده"
+    "filterCreditsExhausted": "اعتبار تمام‌شده",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "Settings",
diff --git a/src/i18n/messages/fi.json b/src/i18n/messages/fi.json
index c28ce1b4ce..dff90e6c94 100644
--- a/src/i18n/messages/fi.json
+++ b/src/i18n/messages/fi.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "Aktiivinen",
     "filterError": "Virhe",
     "filterBanned": "Estetty",
-    "filterCreditsExhausted": "Krediitit lopussa"
+    "filterCreditsExhausted": "Krediitit lopussa",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "Asetukset",
diff --git a/src/i18n/messages/fr.json b/src/i18n/messages/fr.json
index 1a1cd5cb1e..39188d982a 100644
--- a/src/i18n/messages/fr.json
+++ b/src/i18n/messages/fr.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "Actif",
     "filterError": "Erreur",
     "filterBanned": "Banni",
-    "filterCreditsExhausted": "Crédits épuisés"
+    "filterCreditsExhausted": "Crédits épuisés",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "Paramètres",
diff --git a/src/i18n/messages/gu.json b/src/i18n/messages/gu.json
index 5d9c379080..4b79943447 100644
--- a/src/i18n/messages/gu.json
+++ b/src/i18n/messages/gu.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "સક્રિય",
     "filterError": "ભૂલ",
     "filterBanned": "પ્રતિબંધિત",
-    "filterCreditsExhausted": "ક્રેડિટ સમાપ્ત"
+    "filterCreditsExhausted": "ક્રેડિટ સમાપ્ત",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "Settings",
diff --git a/src/i18n/messages/he.json b/src/i18n/messages/he.json
index c0a2929d39..5740d5cd97 100644
--- a/src/i18n/messages/he.json
+++ b/src/i18n/messages/he.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "פעיל",
     "filterError": "שגיאה",
     "filterBanned": "חסום",
-    "filterCreditsExhausted": "קרדיטים אזלו"
+    "filterCreditsExhausted": "קרדיטים אזלו",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "הגדרות",
diff --git a/src/i18n/messages/hi.json b/src/i18n/messages/hi.json
index 7971f97a35..11bee167d9 100644
--- a/src/i18n/messages/hi.json
+++ b/src/i18n/messages/hi.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "सक्रिय",
     "filterError": "त्रुटि",
     "filterBanned": "प्रतिबंधित",
-    "filterCreditsExhausted": "क्रेडिट समाप्त"
+    "filterCreditsExhausted": "क्रेडिट समाप्त",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "सेटिंग्स",
diff --git a/src/i18n/messages/hu.json b/src/i18n/messages/hu.json
index 26d467aab4..1dd27e618e 100644
--- a/src/i18n/messages/hu.json
+++ b/src/i18n/messages/hu.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "Aktív",
     "filterError": "Hiba",
     "filterBanned": "Letiltva",
-    "filterCreditsExhausted": "Elfogyott kreditek"
+    "filterCreditsExhausted": "Elfogyott kreditek",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "Beállítások elemre",
diff --git a/src/i18n/messages/id.json b/src/i18n/messages/id.json
index a32279e29e..4f2c76c499 100644
--- a/src/i18n/messages/id.json
+++ b/src/i18n/messages/id.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "Aktif",
     "filterError": "Kesalahan",
     "filterBanned": "Diblokir",
-    "filterCreditsExhausted": "Kredit habis"
+    "filterCreditsExhausted": "Kredit habis",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "Pengaturan",
diff --git a/src/i18n/messages/in.json b/src/i18n/messages/in.json
index bcbc55f846..ace72ac9ca 100644
--- a/src/i18n/messages/in.json
+++ b/src/i18n/messages/in.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "Aktif",
     "filterError": "Kesalahan",
     "filterBanned": "Diblokir",
-    "filterCreditsExhausted": "Kredit habis"
+    "filterCreditsExhausted": "Kredit habis",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "Settings",
diff --git a/src/i18n/messages/it.json b/src/i18n/messages/it.json
index 5a8af9cc4e..1e1f70cf43 100644
--- a/src/i18n/messages/it.json
+++ b/src/i18n/messages/it.json
@@ -954,6 +954,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1545,6 +1546,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -3987,13 +3990,13 @@
     "testAllResults": "__MISSING__:{ok} of {total} models working",
     "noModelsToTest": "__MISSING__:No models match the current filter",
     "showAllModels": "__MISSING__:All",
-    "showVisibleOnly": "__MISSING__:Visible only",
-    "freeFilterAll": "__MISSING__:All",
-    "freeFilterFreeOnly": "__MISSING__:Free only",
-    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "showVisibleOnly": "Solo visibili",
+    "freeFilterAll": "Tutti",
+    "freeFilterFreeOnly": "Solo gratuiti",
+    "freeFilterPaidOnly": "Solo a pagamento",
     "sortFreeFirst": "__MISSING__:Free first",
-    "showHiddenOnly": "__MISSING__:Hidden only",
-    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "showHiddenOnly": "Solo nascosti",
+    "filterByVisibility": "Filtra per visibilità",
     "autoHideFailed": "__MISSING__:Auto-hide failed models",
     "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Connesso",
@@ -4002,8 +4005,8 @@
     "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
     "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
     "filterAll": "Tutti",
-    "filterVisible": "__MISSING__:Visible only",
-    "filterHidden": "__MISSING__:Hidden only",
+    "filterVisible": "Solo visibili",
+    "filterHidden": "Solo nascosti",
     "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Attenzione",
     "noConnections": "Nessuna connessione",
@@ -4171,7 +4174,7 @@
     "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
     "hideFailedAuto": "__MISSING__:Auto-hide failed models",
     "selectAllModels": "Select all",
-    "hideAllModels": "__MISSING__:Hide all",
+    "hideAllModels": "Nascondi tutti",
     "modelsActive": "attivi",
     "showModel": "Mostra modello",
     "hideModel": "Nascondi modello",
@@ -4307,6 +4310,10 @@
     "targetFormatAuto": "__MISSING__:Default (auto)",
     "targetFormatGemini": "__MISSING__:Gemini",
     "targetFormatAntigravity": "__MISSING__:Antigravity",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
diff --git a/src/i18n/messages/ja.json b/src/i18n/messages/ja.json
index aee765e207..c052fed1d7 100644
--- a/src/i18n/messages/ja.json
+++ b/src/i18n/messages/ja.json
@@ -952,6 +952,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1541,6 +1542,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -3959,13 +3962,13 @@
     "testAllResults": "__MISSING__:{ok} of {total} models working",
     "noModelsToTest": "__MISSING__:No models match the current filter",
     "showAllModels": "__MISSING__:All",
-    "showVisibleOnly": "__MISSING__:Visible only",
-    "freeFilterAll": "__MISSING__:All",
-    "freeFilterFreeOnly": "__MISSING__:Free only",
-    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "showVisibleOnly": "表示のみ",
+    "freeFilterAll": "すべて",
+    "freeFilterFreeOnly": "無料のみ",
+    "freeFilterPaidOnly": "有料のみ",
     "sortFreeFirst": "__MISSING__:Free first",
-    "showHiddenOnly": "__MISSING__:Hidden only",
-    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "showHiddenOnly": "非表示のみ",
+    "filterByVisibility": "表示状態で絞り込み",
     "autoHideFailed": "__MISSING__:Auto-hide failed models",
     "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} 接続されました",
@@ -3974,8 +3977,8 @@
     "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
     "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
     "filterAll": "すべて",
-    "filterVisible": "__MISSING__:Visible only",
-    "filterHidden": "__MISSING__:Hidden only",
+    "filterVisible": "表示のみ",
+    "filterHidden": "非表示のみ",
     "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} 警告",
     "noConnections": "接続がありません",
@@ -4143,7 +4146,7 @@
     "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
     "hideFailedAuto": "__MISSING__:Auto-hide failed models",
     "selectAllModels": "Select all",
-    "hideAllModels": "__MISSING__:Hide all",
+    "hideAllModels": "すべて非表示",
     "modelsActive": "有効",
     "showModel": "モデルを表示",
     "hideModel": "モデルを非表示",
@@ -4279,6 +4282,10 @@
     "targetFormatAuto": "__MISSING__:Default (auto)",
     "targetFormatGemini": "__MISSING__:Gemini",
     "targetFormatAntigravity": "__MISSING__:Antigravity",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
diff --git a/src/i18n/messages/ko.json b/src/i18n/messages/ko.json
index 8a87d25c7a..e300c36890 100644
--- a/src/i18n/messages/ko.json
+++ b/src/i18n/messages/ko.json
@@ -952,6 +952,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1541,6 +1542,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -3959,13 +3962,13 @@
     "testAllResults": "__MISSING__:{ok} of {total} models working",
     "noModelsToTest": "__MISSING__:No models match the current filter",
     "showAllModels": "__MISSING__:All",
-    "showVisibleOnly": "__MISSING__:Visible only",
-    "freeFilterAll": "__MISSING__:All",
-    "freeFilterFreeOnly": "__MISSING__:Free only",
-    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "showVisibleOnly": "표시된 항목만",
+    "freeFilterAll": "전체",
+    "freeFilterFreeOnly": "무료만",
+    "freeFilterPaidOnly": "유료만",
     "sortFreeFirst": "__MISSING__:Free first",
-    "showHiddenOnly": "__MISSING__:Hidden only",
-    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "showHiddenOnly": "숨겨진 항목만",
+    "filterByVisibility": "표시 여부로 필터링",
     "autoHideFailed": "__MISSING__:Auto-hide failed models",
     "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} 연결됨",
@@ -3974,8 +3977,8 @@
     "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
     "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
     "filterAll": "전체",
-    "filterVisible": "__MISSING__:Visible only",
-    "filterHidden": "__MISSING__:Hidden only",
+    "filterVisible": "표시된 항목만",
+    "filterHidden": "숨겨진 항목만",
     "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} 경고",
     "noConnections": "연결 없음",
@@ -4143,7 +4146,7 @@
     "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
     "hideFailedAuto": "__MISSING__:Auto-hide failed models",
     "selectAllModels": "Select all",
-    "hideAllModels": "__MISSING__:Hide all",
+    "hideAllModels": "모두 숨기기",
     "modelsActive": "활성",
     "showModel": "모델 표시",
     "hideModel": "모델 숨기기",
@@ -4279,6 +4282,10 @@
     "targetFormatAuto": "__MISSING__:Default (auto)",
     "targetFormatGemini": "__MISSING__:Gemini",
     "targetFormatAntigravity": "__MISSING__:Antigravity",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
diff --git a/src/i18n/messages/mr.json b/src/i18n/messages/mr.json
index 4509b851f4..1ad40bb3ea 100644
--- a/src/i18n/messages/mr.json
+++ b/src/i18n/messages/mr.json
@@ -952,6 +952,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1541,6 +1542,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -3959,13 +3962,13 @@
     "testAllResults": "__MISSING__:{ok} of {total} models working",
     "noModelsToTest": "__MISSING__:No models match the current filter",
     "showAllModels": "__MISSING__:All",
-    "showVisibleOnly": "__MISSING__:Visible only",
-    "freeFilterAll": "__MISSING__:All",
-    "freeFilterFreeOnly": "__MISSING__:Free only",
-    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "showVisibleOnly": "फक्त दृश्यमान",
+    "freeFilterAll": "सर्व",
+    "freeFilterFreeOnly": "फक्त मोफत",
+    "freeFilterPaidOnly": "फक्त सशुल्क",
     "sortFreeFirst": "__MISSING__:Free first",
-    "showHiddenOnly": "__MISSING__:Hidden only",
-    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "showHiddenOnly": "फक्त लपवलेले",
+    "filterByVisibility": "दृश्यमानतेनुसार फिल्टर करा",
     "autoHideFailed": "__MISSING__:Auto-hide failed models",
     "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Connected",
@@ -3974,8 +3977,8 @@
     "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
     "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
     "filterAll": "सर्व",
-    "filterVisible": "__MISSING__:Visible only",
-    "filterHidden": "__MISSING__:Hidden only",
+    "filterVisible": "फक्त दृश्यमान",
+    "filterHidden": "फक्त लपवलेले",
     "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} चेतावणी",
     "noConnections": "No connections",
@@ -4143,7 +4146,7 @@
     "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
     "hideFailedAuto": "__MISSING__:Auto-hide failed models",
     "selectAllModels": "Select all",
-    "hideAllModels": "__MISSING__:Hide all",
+    "hideAllModels": "सर्व लपवा",
     "modelsActive": "Active",
     "showModel": "Show model",
     "hideModel": "Hide model",
@@ -4279,6 +4282,10 @@
     "targetFormatAuto": "__MISSING__:Default (auto)",
     "targetFormatGemini": "__MISSING__:Gemini",
     "targetFormatAntigravity": "__MISSING__:Antigravity",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
diff --git a/src/i18n/messages/ms.json b/src/i18n/messages/ms.json
index 2abb9a24b0..f01ceac27e 100644
--- a/src/i18n/messages/ms.json
+++ b/src/i18n/messages/ms.json
@@ -952,6 +952,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1541,6 +1542,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -3959,13 +3962,13 @@
     "testAllResults": "__MISSING__:{ok} of {total} models working",
     "noModelsToTest": "__MISSING__:No models match the current filter",
     "showAllModels": "__MISSING__:All",
-    "showVisibleOnly": "__MISSING__:Visible only",
-    "freeFilterAll": "__MISSING__:All",
-    "freeFilterFreeOnly": "__MISSING__:Free only",
-    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "showVisibleOnly": "Kelihatan sahaja",
+    "freeFilterAll": "Semua",
+    "freeFilterFreeOnly": "Percuma sahaja",
+    "freeFilterPaidOnly": "Berbayar sahaja",
     "sortFreeFirst": "__MISSING__:Free first",
-    "showHiddenOnly": "__MISSING__:Hidden only",
-    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "showHiddenOnly": "Tersembunyi sahaja",
+    "filterByVisibility": "Tapis mengikut keterlihatan",
     "autoHideFailed": "__MISSING__:Auto-hide failed models",
     "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Disambungkan",
@@ -3974,8 +3977,8 @@
     "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
     "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
     "filterAll": "Semua",
-    "filterVisible": "__MISSING__:Visible only",
-    "filterHidden": "__MISSING__:Hidden only",
+    "filterVisible": "Kelihatan sahaja",
+    "filterHidden": "Tersembunyi sahaja",
     "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Amaran",
     "noConnections": "Tiada sambungan",
@@ -4143,7 +4146,7 @@
     "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
     "hideFailedAuto": "__MISSING__:Auto-hide failed models",
     "selectAllModels": "Select all",
-    "hideAllModels": "__MISSING__:Hide all",
+    "hideAllModels": "Sembunyikan semua",
     "modelsActive": "aktif",
     "showModel": "Tunjukkan model",
     "hideModel": "Sembunyikan model",
@@ -4279,6 +4282,10 @@
     "targetFormatAuto": "__MISSING__:Default (auto)",
     "targetFormatGemini": "__MISSING__:Gemini",
     "targetFormatAntigravity": "__MISSING__:Antigravity",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
diff --git a/src/i18n/messages/nl.json b/src/i18n/messages/nl.json
index 1206611ab1..560df3cb73 100644
--- a/src/i18n/messages/nl.json
+++ b/src/i18n/messages/nl.json
@@ -952,6 +952,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1541,6 +1542,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -3959,13 +3962,13 @@
     "testAllResults": "__MISSING__:{ok} of {total} models working",
     "noModelsToTest": "__MISSING__:No models match the current filter",
     "showAllModels": "__MISSING__:All",
-    "showVisibleOnly": "__MISSING__:Visible only",
-    "freeFilterAll": "__MISSING__:All",
-    "freeFilterFreeOnly": "__MISSING__:Free only",
-    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "showVisibleOnly": "Alleen zichtbaar",
+    "freeFilterAll": "Alle",
+    "freeFilterFreeOnly": "Alleen gratis",
+    "freeFilterPaidOnly": "Alleen betaald",
     "sortFreeFirst": "__MISSING__:Free first",
-    "showHiddenOnly": "__MISSING__:Hidden only",
-    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "showHiddenOnly": "Alleen verborgen",
+    "filterByVisibility": "Filteren op zichtbaarheid",
     "autoHideFailed": "__MISSING__:Auto-hide failed models",
     "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Verbonden",
@@ -3974,8 +3977,8 @@
     "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
     "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
     "filterAll": "Alle",
-    "filterVisible": "__MISSING__:Visible only",
-    "filterHidden": "__MISSING__:Hidden only",
+    "filterVisible": "Alleen zichtbaar",
+    "filterHidden": "Alleen verborgen",
     "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Waarschuwing",
     "noConnections": "Geen verbindingen",
@@ -4143,7 +4146,7 @@
     "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
     "hideFailedAuto": "__MISSING__:Auto-hide failed models",
     "selectAllModels": "Select all",
-    "hideAllModels": "__MISSING__:Hide all",
+    "hideAllModels": "Alles verbergen",
     "modelsActive": "actief",
     "showModel": "Model tonen",
     "hideModel": "Model verbergen",
@@ -4279,6 +4282,10 @@
     "targetFormatAuto": "__MISSING__:Default (auto)",
     "targetFormatGemini": "__MISSING__:Gemini",
     "targetFormatAntigravity": "__MISSING__:Antigravity",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
diff --git a/src/i18n/messages/no.json b/src/i18n/messages/no.json
index bd68fb48c9..47b6584623 100644
--- a/src/i18n/messages/no.json
+++ b/src/i18n/messages/no.json
@@ -952,6 +952,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1541,6 +1542,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -3959,13 +3962,13 @@
     "testAllResults": "__MISSING__:{ok} of {total} models working",
     "noModelsToTest": "__MISSING__:No models match the current filter",
     "showAllModels": "__MISSING__:All",
-    "showVisibleOnly": "__MISSING__:Visible only",
-    "freeFilterAll": "__MISSING__:All",
-    "freeFilterFreeOnly": "__MISSING__:Free only",
-    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "showVisibleOnly": "Kun synlige",
+    "freeFilterAll": "Alle",
+    "freeFilterFreeOnly": "Kun gratis",
+    "freeFilterPaidOnly": "Kun betalte",
     "sortFreeFirst": "__MISSING__:Free first",
-    "showHiddenOnly": "__MISSING__:Hidden only",
-    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "showHiddenOnly": "Kun skjulte",
+    "filterByVisibility": "Filtrer etter synlighet",
     "autoHideFailed": "__MISSING__:Auto-hide failed models",
     "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Tilkoblet",
@@ -3974,8 +3977,8 @@
     "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
     "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
     "filterAll": "Alle",
-    "filterVisible": "__MISSING__:Visible only",
-    "filterHidden": "__MISSING__:Hidden only",
+    "filterVisible": "Kun synlige",
+    "filterHidden": "Kun skjulte",
     "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Advarsel",
     "noConnections": "Ingen tilkoblinger",
@@ -4143,7 +4146,7 @@
     "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
     "hideFailedAuto": "__MISSING__:Auto-hide failed models",
     "selectAllModels": "Select all",
-    "hideAllModels": "__MISSING__:Hide all",
+    "hideAllModels": "Skjul alle",
     "modelsActive": "aktive",
     "showModel": "Vis modell",
     "hideModel": "Skjul modell",
@@ -4279,6 +4282,10 @@
     "targetFormatAuto": "__MISSING__:Default (auto)",
     "targetFormatGemini": "__MISSING__:Gemini",
     "targetFormatAntigravity": "__MISSING__:Antigravity",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
diff --git a/src/i18n/messages/phi.json b/src/i18n/messages/phi.json
index d7b9e0ec27..7e6afb8e3d 100644
--- a/src/i18n/messages/phi.json
+++ b/src/i18n/messages/phi.json
@@ -952,6 +952,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1541,6 +1542,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -3959,13 +3962,13 @@
     "testAllResults": "__MISSING__:{ok} of {total} models working",
     "noModelsToTest": "__MISSING__:No models match the current filter",
     "showAllModels": "__MISSING__:All",
-    "showVisibleOnly": "__MISSING__:Visible only",
-    "freeFilterAll": "__MISSING__:All",
-    "freeFilterFreeOnly": "__MISSING__:Free only",
-    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "showVisibleOnly": "Nakikita lang",
+    "freeFilterAll": "Lahat",
+    "freeFilterFreeOnly": "Libre lang",
+    "freeFilterPaidOnly": "Bayad lang",
     "sortFreeFirst": "__MISSING__:Free first",
-    "showHiddenOnly": "__MISSING__:Hidden only",
-    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "showHiddenOnly": "Nakatago lang",
+    "filterByVisibility": "I-filter ayon sa pagkakita",
     "autoHideFailed": "__MISSING__:Auto-hide failed models",
     "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Nakakonekta",
@@ -3974,8 +3977,8 @@
     "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
     "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
     "filterAll": "Lahat",
-    "filterVisible": "__MISSING__:Visible only",
-    "filterHidden": "__MISSING__:Hidden only",
+    "filterVisible": "Nakikita lang",
+    "filterHidden": "Nakatago lang",
     "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Babala",
     "noConnections": "Walang koneksyon",
@@ -4143,7 +4146,7 @@
     "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
     "hideFailedAuto": "__MISSING__:Auto-hide failed models",
     "selectAllModels": "Select all",
-    "hideAllModels": "__MISSING__:Hide all",
+    "hideAllModels": "Itago lahat",
     "modelsActive": "aktibo",
     "showModel": "Ipakita ang modelo",
     "hideModel": "Itago ang modelo",
@@ -4279,6 +4282,10 @@
     "targetFormatAuto": "__MISSING__:Default (auto)",
     "targetFormatGemini": "__MISSING__:Gemini",
     "targetFormatAntigravity": "__MISSING__:Antigravity",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
diff --git a/src/i18n/messages/pl.json b/src/i18n/messages/pl.json
index 3c69087a63..6ea76ab160 100644
--- a/src/i18n/messages/pl.json
+++ b/src/i18n/messages/pl.json
@@ -952,6 +952,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1541,6 +1542,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -3959,13 +3962,13 @@
     "testAllResults": "__MISSING__:{ok} of {total} models working",
     "noModelsToTest": "__MISSING__:No models match the current filter",
     "showAllModels": "__MISSING__:All",
-    "showVisibleOnly": "__MISSING__:Visible only",
-    "freeFilterAll": "__MISSING__:All",
-    "freeFilterFreeOnly": "__MISSING__:Free only",
-    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "showVisibleOnly": "Tylko widoczne",
+    "freeFilterAll": "Wszystkie",
+    "freeFilterFreeOnly": "Tylko darmowe",
+    "freeFilterPaidOnly": "Tylko płatne",
     "sortFreeFirst": "__MISSING__:Free first",
-    "showHiddenOnly": "__MISSING__:Hidden only",
-    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "showHiddenOnly": "Tylko ukryte",
+    "filterByVisibility": "Filtruj według widoczności",
     "autoHideFailed": "__MISSING__:Auto-hide failed models",
     "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Połączono",
@@ -3974,8 +3977,8 @@
     "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
     "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
     "filterAll": "Wszystkie",
-    "filterVisible": "__MISSING__:Visible only",
-    "filterHidden": "__MISSING__:Hidden only",
+    "filterVisible": "Tylko widoczne",
+    "filterHidden": "Tylko ukryte",
     "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Ostrzeżenie",
     "noConnections": "Brak połączeń",
@@ -4143,7 +4146,7 @@
     "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
     "hideFailedAuto": "__MISSING__:Auto-hide failed models",
     "selectAllModels": "Select all",
-    "hideAllModels": "__MISSING__:Hide all",
+    "hideAllModels": "Ukryj wszystkie",
     "modelsActive": "aktywne",
     "showModel": "Pokaż model",
     "hideModel": "Ukryj model",
@@ -4279,6 +4282,10 @@
     "targetFormatAuto": "__MISSING__:Default (auto)",
     "targetFormatGemini": "__MISSING__:Gemini",
     "targetFormatAntigravity": "__MISSING__:Antigravity",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
diff --git a/src/i18n/messages/pt-BR.json b/src/i18n/messages/pt-BR.json
index 637295d35e..758dd533a2 100644
--- a/src/i18n/messages/pt-BR.json
+++ b/src/i18n/messages/pt-BR.json
@@ -25,6 +25,7 @@
     "noData": "Nenhum dado disponível",
     "nothingHere": "Nothing here yet",
     "configure": "Configurar",
+    "manualConfig": "Configuração manual",
     "manage": "Gerenciar",
     "name": "Nome",
     "actions": "Ações",
@@ -33,6 +34,7 @@
     "model": "Modelo",
     "models": "modelos",
     "provider": "Provedor",
+    "unknownProvider": "Provedor desconhecido",
     "account": "Conta",
     "time": "Tempo",
     "details": "Detalhes",
@@ -843,6 +845,7 @@
     "batchActionRetryError": "Falha ao refazer requisições com falha. Tente novamente.",
     "batchConceptRetentionNote": "Arquivos de resultado e erro ficam retidos por 30 dias (Anthropic: 29 dias)"
   },
+  "disabled": "Desabilitado",
   "featureFlagOmnirouteEmergencyFallbackDescription": "__MISSING__:Route budget-exhausted requests to the emergency free fallback provider/model.",
   "featureFlagArenaEloSyncEnabledDescription": "__MISSING__:Enable periodic Arena AI leaderboard ELO sync for model intelligence rankings.",
   "sidebar": {
@@ -952,6 +955,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1114,7 +1118,10 @@
     "dragReorderItem": "__MISSING__:Drag to reorder",
     "cannotHide": "__MISSING__:This item cannot be hidden",
     "alwaysVisible": "__MISSING__:Always visible",
-    "groupSeparatorLabel": "__MISSING__:Separator"
+    "groupSeparatorLabel": "__MISSING__:Separator",
+    "discovery": "Descoberta",
+    "discoverySubtitle": "Buscar acesso gratuito em provedores",
+    "chaosConfig": "Chaos Mode"
   },
   "webhooks": {
     "title": "Webhooks",
@@ -1541,6 +1548,8 @@
     "chartModel": "Modelo",
     "chartProvider": "Provedor",
     "chartProviderBreakdown": "Detalhamento por Provedor",
+    "chartDate": "Data",
+    "chartRequestsByProviderDate": "Requisições por Provedor e Data",
     "filterAllKeys": "Todas as Chaves",
     "filterSearchKeys": "Buscar chaves…",
     "filterNoKeysMatch": "Nenhuma chave corresponde",
@@ -1758,6 +1767,8 @@
     "copyMaskedKey": "Copiar chave mascarada",
     "keyOnlyAvailableAtCreation": "Full key available only at creation time — copy it when you first create the key",
     "modelsCount": "{count, plural, one {# modelo} other {# modelos}}",
+    "devicesCount": "{count, plural, one {# dispositivo} other {# dispositivos}}",
+    "devicesTooltip": "{count, plural, one {# dispositivo distinto (IP/User-Agent) visto com esta chave (últimos 30 min)} other {# dispositivos distintos (IP/User-Agent) vistos com esta chave (últimos 30 min)}}",
     "lastUsedOn": "Último: {date}",
     "viewCostsFor": "__MISSING__:View costs for {name}",
     "editPermissions": "Editar permissões",
@@ -1770,6 +1781,8 @@
     "models": "{count} modelos",
     "permissionsTitle": "Permissões: {name}",
     "allowAllDesc": "Esta chave pode acessar todos os modelos disponíveis.",
+    "restrictLoading": "Carregando catálogo de modelos…",
+    "restrictCatalogUnavailable": "Catálogo de modelos indisponível; esta chave tem {selectedCount} restrições de modelo selecionadas.",
     "restrictDesc": "Esta chave pode acessar {selectedCount} de {totalModels} modelos.",
     "selectedCount": "{count} selecionados",
     "maxActiveSessions": "Máximo de sessões ativas",
@@ -1853,14 +1866,16 @@
       "webSearch": "Busca Web",
       "webFetch": "Web Fetch",
       "video": "Vídeo",
-      "music": "Música"
+      "music": "Música",
+      "ocr": "OCR"
     },
     "noProviders": "Nenhum provedor configurado para este tipo.",
     "addConnection": "Adicionar Conexão",
     "backToProviders": "Voltar para Provedores",
     "connections": "{count} Conexões",
     "noConnections": "Nenhuma conexão ainda — adicione uma na página do provedor.",
-    "loading": "Carregando..."
+    "loading": "Carregando...",
+    "suggestedModels": "Modelos sugeridos pelo provedor"
   },
   "search": {
     "searchQuery": "Search Query",
@@ -2388,6 +2403,14 @@
     "strictRandomDesc": "Baralho embaralhado — usa cada modelo uma vez antes de reembaralhar",
     "fusion": "__MISSING__:Fusion",
     "fusionDesc": "__MISSING__:Fans the prompt to every panel model in parallel, then a judge model synthesizes one final answer",
+    "fusionJudgeModel": "Modelo julgador",
+    "fusionJudgeModelHelp": "Modelo que sintetiza as respostas do painel em uma resposta final única. Deixe vazio para usar o primeiro modelo do painel.",
+    "fusionMinPanel": "Painel mínimo",
+    "fusionMinPanelHelp": "Respostas bem-sucedidas do painel necessárias antes que os retardatários recebam uma janela de tolerância (padrão 2).",
+    "fusionStragglerGraceMs": "Tolerância para retardatários (ms)",
+    "fusionStragglerGraceMsHelp": "Quanto tempo esperar por modelos lentos do painel após o quórum ser atingido (padrão 8000).",
+    "fusionPanelHardTimeoutMs": "Timeout máximo do painel (ms)",
+    "fusionPanelHardTimeoutMsHelp": "Limite absoluto para que um modelo travado não bloqueie o painel inteiro (padrão 90000).",
     "models": "Modelos",
     "autoBalance": "Auto-balancear",
     "advancedSettings": "Configurações Avançadas",
@@ -2497,7 +2520,8 @@
       "queueTimeout": "Tempo máximo em fila antes de expirar no round-robin.",
       "failoverBeforeRetry": "Quando ativado, qualquer erro upstream aciona o failover imediato para o próximo destino combinado, ignorando todas as novas tentativas e URLs substitutos.",
       "maxSetRetries": "Número de vezes para tentar novamente o destino completo definido quando todos os alvos falharem. 0 = nenhuma nova tentativa de nível definido.",
-      "setRetryDelayMs": "Atraso entre novas tentativas de nível definido, dando tempo para que problemas transitórios sejam resolvidos."
+      "setRetryDelayMs": "Atraso entre novas tentativas de nível definido, dando tempo para que problemas transitórios sejam resolvidos.",
+      "disableSessionStickiness": "Alterna para uma conexão diferente a cada requisição, em vez de fixar toda a conversa em uma conexão pelo hash da primeira mensagem. Sobrescreve o padrão global. Deixe em Herdar para preservar acertos de cache de prompt em conversas com múltiplos turnos."
     },
     "templatesTitle": "Templates rápidos",
     "templatesDescription": "Aplique um perfil inicial e depois ajuste modelos e configuração.",
@@ -2791,6 +2815,13 @@
     "browseLegacyCatalog": "Navegue pelo catálogo combinado legado",
     "agentFeaturesTitle": "Recursos do agente",
     "agentFeaturesDescription": "Habilite recursos avançados para agentes usando esta combinação",
+    "responseValidationTitle": "Validação de resposta",
+    "responseValidationHelp": "Faz failover para o próximo alvo quando um corpo 200 OK falha nestas verificações (conteúdo do assistente).",
+    "responseValidationForbidden": "Substrings proibidas (uma por linha)",
+    "responseValidationRequired": "Substrings obrigatórias (uma por linha)",
+    "responseValidationMinLength": "Tamanho mínimo do conteúdo (caracteres)",
+    "responseValidationJsonPaths": "Verificações de JSON-path",
+    "responseValidationAddCheck": "+ Adicionar verificação",
     "agentFeaturesSystemMessageOverride": "Substituir mensagem do sistema",
     "agentFeaturesSystemMessagePlaceholder": "Você é um assistente especialista...",
     "agentFeaturesSystemMessageHint": "Substituição de mensagens do sistema para agentes",
@@ -2804,7 +2835,10 @@
     "agentFeaturesContextLengthErrorInteger": "O comprimento do contexto precisa ser um número inteiro válido",
     "agentFeaturesContextLengthErrorRange": "O comprimento do contexto precisa estar entre 1.000 e 2.000.000",
     "compressionOverride": "Substituição de compactação",
-    "modePack": "Pacote de modos"
+    "modePack": "Pacote de modos",
+    "disableSessionStickiness": "Desabilitar fixação de sessão",
+    "sessionStickinessEnabled": "Fixação ativada",
+    "sessionStickinessDisabled": "Fixação desativada"
   },
   "costs": {
     "title": "Custos",
@@ -3407,6 +3441,10 @@
       "description": "Integração opcional com Qdrant para busca semântica escalável",
       "enableLabel": "Habilitar Qdrant",
       "enableDesc": "Quando habilitado, Qdrant é usado como vector store principal",
+      "banner": "Armazenamento vetorial Tier 2 — uma alternativa externa e escalável ao sqlite-vec embutido (Tier 1). Habilite apenas se você tiver um conjunto de memória muito grande ou quiser memória compartilhada entre instâncias; a maioria dos usuários fica bem com o sqlite-vec. Quando habilitado, ele se torna o armazenamento primário e volta automaticamente para o sqlite-vec se ficar inacessível.",
+      "hostHelp": "Docker local: http://localhost:6333 · Qdrant Cloud: a URL do seu cluster",
+      "collectionHelp": "Qualquer nome — o OmniRoute o cria no primeiro uso",
+      "embeddingModelHelp": "Define a dimensão do vetor automaticamente no primeiro uso. Memórias existentes não são retroalimentadas, e trocar o modelo depois que já existem dados exige uma coleção nova.",
       "testConnection": "Testar conexão",
       "testing": "Testando...",
       "statusActive": "Ativo",
@@ -3483,6 +3521,7 @@
     "noExecutions": "Nenhuma execução encontrada",
     "enabled": "Ativado",
     "disabled": "Desativado",
+    "delete": "Excluir",
     "version": "Versão",
     "tableDescription": "Descrição",
     "skill": "Skill",
@@ -3959,13 +3998,13 @@
     "testAllResults": "__MISSING__:{ok} of {total} models working",
     "noModelsToTest": "__MISSING__:No models match the current filter",
     "showAllModels": "__MISSING__:All",
-    "showVisibleOnly": "__MISSING__:Visible only",
-    "freeFilterAll": "__MISSING__:All",
-    "freeFilterFreeOnly": "__MISSING__:Free only",
-    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "showVisibleOnly": "Somente visíveis",
+    "freeFilterAll": "Todos",
+    "freeFilterFreeOnly": "Somente gratuitos",
+    "freeFilterPaidOnly": "Somente pagos",
     "sortFreeFirst": "__MISSING__:Free first",
-    "showHiddenOnly": "__MISSING__:Hidden only",
-    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "showHiddenOnly": "Somente ocultos",
+    "filterByVisibility": "Filtrar por visibilidade",
     "autoHideFailed": "__MISSING__:Auto-hide failed models",
     "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Conectado(s)",
@@ -3974,8 +4013,8 @@
     "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
     "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
     "filterAll": "Todos",
-    "filterVisible": "__MISSING__:Visible only",
-    "filterHidden": "__MISSING__:Hidden only",
+    "filterVisible": "Somente visíveis",
+    "filterHidden": "Somente ocultos",
     "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Aviso",
     "noConnections": "Sem conexões",
@@ -4062,6 +4101,8 @@
     "prefixHint": "Obrigatório. Prefixo único para nomes de modelos.",
     "nameHint": "Obrigatório. Um rótulo amigável para este nó.",
     "baseUrlHint": "Obrigatório. URL base da API do provedor.",
+    "iconUrlLabel": "URL do ícone",
+    "iconUrlHint": "Opcional. URL da imagem exibida como ícone deste provedor.",
     "anthropicPrefixPlaceholder": "ac-prod",
     "openaiPrefixPlaceholder": "oc-prod",
     "anthropicBaseUrlPlaceholder": "https://api.anthropic.com/v1",
@@ -4143,7 +4184,7 @@
     "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
     "hideFailedAuto": "__MISSING__:Auto-hide failed models",
     "selectAllModels": "Selecionar todos",
-    "hideAllModels": "__MISSING__:Hide all",
+    "hideAllModels": "Ocultar todos",
     "modelsActive": "ativos",
     "showModel": "Mostrar modelo",
     "hideModel": "Ocultar modelo",
@@ -4173,6 +4214,8 @@
     "optional": "Opcional",
     "anthropicCompatibleName": "Compatível Anthropic",
     "openaiCompatibleName": "Compatível OpenAI",
+    "compatibleDefaultModelLabel": "Modelo padrão",
+    "compatibleDefaultModelHint": "Digite o ID do modelo exatamente como seu endpoint compatível espera. Este modelo será salvo como o padrão da conexão.",
     "failedImportModels": "Falha ao importar modelos",
     "noModelsReturnedFromEndpoint": "Nenhum modelo retornado do endpoint /models.",
     "importingModelsProgress": "Importando {current} de {total} modelos...",
@@ -4279,6 +4322,29 @@
     "targetFormatAuto": "__MISSING__:Default (auto)",
     "targetFormatGemini": "__MISSING__:Gemini",
     "targetFormatAntigravity": "__MISSING__:Antigravity",
+    "compatParamFiltersLabel": "Filtros de parâmetros",
+    "compatBlockedParamsHint": "Parâmetros bloqueados (removidos das requisições)",
+    "compatAllowedParamsHint": "Parâmetros permitidos (readicionados após o bloqueio)",
+    "paramFiltersSectionTitle": "Filtros de parâmetros",
+    "paramFiltersSectionHint": "Remove ou readiciona parâmetros da requisição antes de enviá-la a este provedor. Usado para evitar erros 400 de provedores que rejeitam certos parâmetros (ex.: NVIDIA NIM rejeita <code>thinking</code>).",
+    "paramFiltersBlockedLabel": "Parâmetros bloqueados",
+    "paramFiltersBlockedHint": "Estes parâmetros são removidos das requisições de saída (lista de bloqueio).",
+    "paramFiltersAllowedLabel": "Parâmetros permitidos",
+    "paramFiltersAllowedHint": "Estes parâmetros são readicionados após a remoção pela lista de bloqueio (somente se o cliente os enviou).",
+    "paramFiltersAutoLearnLabel": "Aprender automaticamente com erros 400",
+    "paramFiltersAutoLearnHint": "Quando habilitado, se o upstream retornar 400 com \"Unsupported parameter: X\", o parâmetro é automaticamente adicionado à lista de bloqueio e a requisição é refeita.",
+    "paramFiltersSaving": "Salvando…",
+    "paramFiltersSaveChanges": "Salvar alterações",
+    "paramFiltersResetToDefault": "Restaurar padrão",
+    "paramFiltersLoadError": "Falha ao carregar configuração de filtro de parâmetros: {error}",
+    "paramFiltersSaveSuccess": "Configuração de filtro de parâmetros salva",
+    "paramFiltersSaveError": "Falha ao salvar configuração de filtro de parâmetros: {error}",
+    "paramFiltersResetSuccess": "Configuração de filtro de parâmetros restaurada ao padrão",
+    "paramFiltersResetError": "Falha ao restaurar configuração de filtro de parâmetros: {error}",
+    "contextWindowOverrideLabel": "Substituição de Janela de Contexto",
+    "contextWindowOverridePlaceholder": "ex.: 131072",
+    "contextWindowOverrideHint": "Define manualmente a janela de contexto real (tokens) deste modelo quando o provedor a reporta incorretamente. Tem prioridade sobre os valores detectados automaticamente/do catálogo e evita que o roteamento de combo descarte o modelo.",
+    "contextWindowOverrideInvalid": "A substituição de janela de contexto deve ser um número inteiro positivo de tokens",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
@@ -4475,6 +4541,8 @@
     "modelsPathLabel": "Models Endpoint Path",
     "modelsPathPlaceholder": "/models",
     "modelsPathHint": "Custom models path for validation (e.g. /v4/models)",
+    "clientIdentityLabel": "Identidade do cliente",
+    "clientIdentityHint": "Opcional. Adiciona cabeçalhos de fingerprint do cliente (ex.: User-Agent) correspondentes a um CLI conhecido, para gateways compatíveis que esperam um.",
     "statusDeactivated": "Desativado (Manual)",
     "statusBanned": "Banido / Sandbox Violation",
     "statusCreditsExhausted": "Saldo Insuficiente",
@@ -4597,6 +4665,11 @@
     "localProviderBaseUrlHint": "Obrigatório: cole a URL base OpenAI-compatible /v1 do seu {provider} (padrão: {baseUrl}). URLs locais/privadas exigem OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS=true para validação no dashboard.",
     "localProviders": "Local / Self-Hosted",
     "maxConcurrentWholeNumberError": "Max concurrent deve ser um número inteiro maior ou igual a 0.",
+    "m365TierLabel": "Nível do Copilot",
+    "m365TierHint": "Escolha qual superfície do Microsoft 365 Copilot esta conexão usa. Individual é o BizChat padrão para consumidores; Educação e Empresarial (trabalho) usam as superfícies do respectivo tenant.",
+    "m365TierIndividualOption": "Individual (padrão)",
+    "m365TierEduOption": "Educação",
+    "m365TierEnterpriseOption": "Empresarial / Trabalho",
     "museSparkWebCookieHint": "Cole o cookie abra_sess do meta.ai. Um cabeçalho de cookie completo também funciona.",
     "museSparkWebCookiePlaceholder": "Cole o valor de abra_sess",
     "oauth": "Oauth",
@@ -4780,6 +4853,7 @@
     "bedrockModelsDescription": "Os modelos Amazon Bedrock têm escopo definido por região da AWS. Importe de /models ou adicione IDs de modelo Bedrock habilitados na região selecionada.",
     "bedrockModelPlaceholder": "antrópico.claude-sonnet-4-6",
     "addProviderSessionCookieTitle": "Adicionar cookie de sessão {provider}",
+    "openWebProviderSite": "Abrir {host}",
     "addProviderWebTokenTitle": "Adicionar token da web {provider}",
     "addProviderConnectionTitle": "Adicionar conexão {provider}",
     "webTokenCredentialLabel": "Token de sessão da Web",
@@ -4813,7 +4887,11 @@
     "kimiWebLabel": "__MISSING__:Kimi Web",
     "kimiWebDesc": "__MISSING__:Moonshot AI consumer chat via www.kimi.com (international, Connect-RPC API)",
     "doubaoWebLabel": "__MISSING__:Doubao Web",
-    "doubaoWebDesc": "__MISSING__:ByteDance AI chat via doubao.com"
+    "doubaoWebDesc": "__MISSING__:ByteDance AI chat via doubao.com",
+    "overrideBaseUrlAdvanced": "Avançado: sobrescrever URL base",
+    "overrideBaseUrlHint": "Avançado: aponta este provedor embutido para um endpoint personalizado. Deixe em branco para usar o padrão.",
+    "bulkAddFormatHintCloudflare": "Uma chave por linha. Formato: nome|accountId|apiKey (ID de conta Cloudflare + token de API).",
+    "lmarenaWebCookieHint": "Abra arena.ai, faça login e depois copie o cabeçalho Cookie completo de uma requisição de rede. Inclua arena-auth-prod-v1.0 e arena-auth-prod-v1.1 (e outros fragmentos, se houver), preferencialmente com cf_clearance. Não cole apenas o cookie vazio arena-auth-prod-v1. Opcional: providerSpecificData.recaptchaV3Token se create-evaluation ainda retornar 403."
   },
   "settings": {
     "title": "Configurações",
@@ -4823,6 +4901,10 @@
     "routing": "Roteamento",
     "cache": "Cache",
     "resilience": "Resiliência",
+    "description": "Descrição",
+    "enable": "Habilitar",
+    "disable": "Desabilitar",
+    "update": "Atualizar",
     "routingSettingsIntro": "Controla como suas solicitações são roteadas, transformadas e enviadas aos provedores de IA.",
     "routingOpDropParagraphContainsLabel": "Remover parágrafo (contém)",
     "routingOpDropParagraphStartsWithLabel": "Remover parágrafo (começa com)",
@@ -4958,6 +5040,8 @@
     "modelsDevInfoOrder": "User Override → models.dev → LiteLLM → Hardcoded Default",
     "systemTheme": "Tema do Sistema",
     "debugToggle": "Enable Debug Mode",
+    "logToolSourcesToggle": "Registrar fontes de ferramentas",
+    "logToolSourcesDescription": "Emite uma linha de log de diagnóstico por requisição resumindo a contagem de ferramentas e a origem MCP/hospedada/cliente.",
     "homePinProviderQuotaToHome": "Fixar informações na página inicial",
     "homeProviderQuotaLimits": "Limites de cota dos provedores",
     "homeProviderQuotaLimitsDesc": "Fixe o painel de status de cotas dos provedores (com botão Atualizar tudo) no topo da página inicial.",
@@ -5351,6 +5435,9 @@
     "providerMaxRetriesAria": "{provider} tentativas máximas",
     "providerTimeoutAria": "timeout de {provider} em ms",
     "removeProviderOverrideAria": "Remover sobrescrita de {provider}",
+    "selectProviderPlaceholder": "Selecionar provedor...",
+    "searchProviderPlaceholder": "Buscar provedores...",
+    "searchProviderAria": "Buscar provedores",
     "newProviderNamePlaceholder": "ex.: google, openai...",
     "newProviderNameAria": "Nome do novo provedor",
     "retries": "tentativas",
@@ -5359,6 +5446,7 @@
     "maxNestingDepth": "Profundidade Máx. de Aninhamento",
     "concurrencyPerModel": "Concorrência / Modelo",
     "queueTimeout": "Timeout da Fila (ms)",
+    "queueDepth": "Profundidade da fila",
     "contextRelayHandoffThreshold": "Limite de Handoff",
     "contextRelayMaxMessages": "Máx. de Mensagens no Resumo",
     "contextRelaySummaryModel": "Modelo do Resumo",
@@ -5512,6 +5600,22 @@
     "maintenance": "Maintenance",
     "purgeExpiredLogs": "Purgar Logs Expirados",
     "purgeLogsFailed": "Falha ao purgar logs",
+    "logsDeleted": "{count, plural, =0 {Nenhum log expirado removido} one {# log expirado removido} other {# logs expirados removidos}}",
+    "resetUsageData": "Redefinir dados de uso",
+    "resetUsageDataDesc": "Selecione quanto tempo no passado você deseja excluir dados de uso. Esta ação não pode ser desfeita.",
+    "resetUsagePeriod_5m": "5 minutos",
+    "resetUsagePeriod_1h": "1 hora",
+    "resetUsagePeriod_3h": "3 horas",
+    "resetUsagePeriod_6h": "6 horas",
+    "resetUsagePeriod_12h": "12 horas",
+    "resetUsagePeriod_1d": "1 dia",
+    "resetUsagePeriod_7d": "7 dias",
+    "resetUsagePeriod_30d": "30 dias",
+    "resetUsagePeriod_all": "Todo o período",
+    "resetUsageSuccess": "{count, plural, =0 {Nenhuma linha de dados de uso excluída} one {Dados de uso redefinidos (# linha excluída)} other {Dados de uso redefinidos (# linhas excluídas)}}",
+    "resetUsageFailed": "Falha ao redefinir dados de uso",
+    "reset": "Redefinir",
+    "resetting": "Redefinindo...",
     "contextOpt": "Context Optimized",
     "contextOptDesc": "Routes based on context window requirements and conversation length",
     "priorityDesc": "Sequential fallback - tries provider 1 first, then provider 2, and so on",
@@ -5612,8 +5716,12 @@
     "compressionAutoTrigger": "Auto-Trigger Threshold",
     "compressionCacheTTL": "Cache TTL",
     "compressionPreserveSystem": "Preserve System Prompt",
+    "compressionPreserveSystemAlways": "Sempre",
+    "compressionPreserveSystemWhenNoCache": "Quando não há cache",
+    "compressionPreserveSystemNever": "Nunca",
     "compressionCavemanConfig": "Caveman Engine Configuration",
     "compressionCavemanConfigDesc": "Fine-tune the rule-based compression engine",
+    "compressionCavemanPanelHint": "Ativado/desativado e o nível são definidos no painel:",
     "compressionRoles": "Compress Message Roles",
     "compressionRoleUser": "User",
     "compressionRoleAssistant": "Assistant",
@@ -5820,6 +5928,17 @@
     "storageUsageTokenBufferDesc": "__MISSING__:Extra tokens added to reported usage to account for system prompt overhead.",
     "storageUsageTokenBufferHint": "__MISSING__:Set to 0 to report raw provider token counts. Default: 2000.",
     "storageUsageTokenBufferCurrent": "__MISSING__:Current: {value}",
+    "redisLauncherTitle": "Redis local",
+    "redisLauncherDesc": "Inicie com um clique um contêiner Redis 7 (Podman ou Docker) para cache de resposta, controle de cota e limitação de taxa.",
+    "redisLauncherRefresh": "Atualizar",
+    "redisLauncherStop": "Parar",
+    "redisLauncherLaunching": "Iniciando...",
+    "redisLauncherLaunch": "Iniciar Redis",
+    "redisLauncherContainer": "Contêiner",
+    "redisLauncherRunning": "Em execução",
+    "redisLauncherReachable": "Acessível",
+    "redisLauncherError": "Erro: {message}",
+    "redisLauncherHint": "Equivalente a executar `omniroute redis up`. O contêiner é chamado `omniroute-redis` e escuta em 127.0.0.1:6379.",
     "compressionSettingsAutoTriggerMode": "Modo de disparo automático",
     "compressionSettingsMcpDescriptionCompression": "Compressão de descrição MCP",
     "mcpAccessibilityTitle": "__MISSING__:MCP accessibility output",
@@ -5903,6 +6022,12 @@
     "claudeFastModeModelCheckbox": "Ativar modo rápido para {model}",
     "claudeFastModeSaveError": "Falha ao atualizar a configuração do modo rápido do Claude",
     "authz": {
+      "cors": {
+        "wildcard": {
+          "title": "CORS está aberto para qualquer origem (CORS_ALLOW_ALL=true)",
+          "desc": "Qualquer site pode chamar a API deste servidor a partir do navegador de um visitante. Use apenas em redes confiáveis — defina origens explícitas em ALLOWED_ORIGINS e desabilite o CORS_ALLOW_ALL em produção."
+        }
+      },
       "title": "Inventário de Authz",
       "description": "Classificação de rotas em 5 níveis com política de bypass em tempo real. A leitura mostra a taxonomia completa; as mutações solicitam a senha de gerenciamento.",
       "loading": "Carregando inventário…",
@@ -5991,6 +6116,14 @@
     "resilienceEnableServerWaitDesc": "Quando ativado, o OmniRoute aguarda o primeiro resfriamento expirar e tenta novamente automaticamente.",
     "resilienceMaxAttempts": "Máximo de tentativas",
     "resilienceMaxWaitPerAttempt": "Espera máxima por tentativa",
+    "resilienceComboCooldownWaitTitle": "Espera de cooldown do combo de cota compartilhada",
+    "resilienceComboCooldownWaitDesc": "Somente para combos de cota compartilhada: aguarda um cooldown transitório curto e reenvia em vez de retornar um 429 imediatamente. Nunca espera em quota_exhausted.",
+    "resilienceComboCooldownWaitToggleDesc": "Somente combos de cota compartilhada; nunca espera em quota_exhausted.",
+    "resilienceComboCooldownMaxWaitMs": "Espera máxima por tentativa",
+    "resilienceComboCooldownBudgetMs": "Orçamento total de espera",
+    "resilienceQuotaShareConcurrencyTitle": "Concorrência por conexão de cota compartilhada",
+    "resilienceQuotaShareConcurrencyDesc": "Somente para combos de cota compartilhada: quando uma conexão define um limite de Concorrência Máxima, serializa as requisições concorrentes para essa conta de assinatura para que nunca seja inundada além do teto. Requisições excedentes esperam na fila em vez de receber um 429. O limite vem do campo Concorrência Máxima de cada conexão; este botão apenas habilita ou desabilita seu respeito.",
+    "resilienceQuotaShareConcurrencyToggleDesc": "Somente combos de cota compartilhada; respeita o limite de Concorrência Máxima de cada conexão.",
     "resilienceProviderCooldownTitle": "__MISSING__:Provider Cooldown",
     "resilienceProviderCooldownScope": "__MISSING__:All combo requests",
     "resilienceProviderCooldownTrigger": "__MISSING__:When a provider/connection fails",
@@ -6059,7 +6192,47 @@
     "modelLockoutExponentialBackoff": "__MISSING__:Exponential Backoff",
     "modelLockoutExponentialBackoffDescription": "__MISSING__:When enabled, each consecutive failure increases the cooldown duration exponentially.",
     "modelLockoutMaxBackoffSteps": "__MISSING__:Max Backoff Steps",
-    "modelLockoutMaxBackoffStepsDescription": "__MISSING__:Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised."
+    "modelLockoutMaxBackoffStepsDescription": "__MISSING__:Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised.",
+    "disableSessionStickiness": "Desabilitar fixação de sessão",
+    "disableSessionStickinessDesc": "Combos round-robin e aleatórios alternam para uma conexão diferente a cada requisição, em vez de fixar toda a conversa em uma conexão pelo hash da primeira mensagem. Deixe desativado para preservar acertos de cache de prompt em conversas com múltiplos turnos. Sobrescritas por combo têm prioridade.",
+    "accountRoundRobin": "Round Robin",
+    "accountRoundRobinDesc": "Alterna entre contas para distribuir a carga",
+    "addKeyValue": "Adicionar valor da chave",
+    "comboRoundRobin": "Round Robin de Combo",
+    "comboRoundRobinDesc": "Alterna entre os alvos do combo em vez de sempre começar pelo primeiro",
+    "comboStickyLimit": "Limite de Fixação do Combo",
+    "comboStickyLimitDesc": "Chamadas por alvo do combo antes de trocar",
+    "configured": "configurado",
+    "modelOverrideLoadFailed": "Falha ao carregar substituições de modelo",
+    "modelOverrideRemoveFailed": "Falha ao remover substituição de modelo",
+    "modelOverrideRemoved": "Substituição de modelo removida",
+    "modelOverrideSaveFailed": "Falha ao salvar substituição de modelo",
+    "modelOverrideSaved": "Substituição de modelo salva",
+    "modelOverrideValuePlaceholder": "Valor numérico",
+    "modelOverridesDesc": "Substitui as capacidades de provedor/modelo usadas pelo roteamento e pela formatação de requisições. Os alvos usam o mesmo formato provedor/modelo dos combos.",
+    "modelOverridesTitle": "Substituições de Modelo",
+    "noModelOverrides": "Nenhuma substituição configurada para este modelo.",
+    "none": "Nenhum",
+    "providerAccountRoutingDesc": "Substitui a estratégia global de contas para este provedor (paridade com 9router).",
+    "providerAccountRoutingTitle": "Roteamento multi-conta",
+    "providerRoutingInheritGlobal": "Herdar padrão global",
+    "providerRoutingStrategy": "Estratégia de conta",
+    "routingStrategyAccountSummary": "Distribuindo requisições entre contas com {limit} chamadas por conta.",
+    "routingStrategyComboFallbackSummary": " Combos usam a estratégia configurada de cada combo (prioridade/fallback padrão).",
+    "routingStrategyComboSummary": " Combos giram após {limit} chamada(s) por alvo.",
+    "routingStrategyFillFirstSummary": "Usando contas em ordem de prioridade (Fill First).",
+    "routingStrategySubtitle": "Compatível com 9router: round-robin de contas, limites de fixação e rotação de combo",
+    "routingStrategyTitle": "Estratégia de Roteamento",
+    "searchModelOverrideTargets": "Buscar provedor/modelo...",
+    "selectedModel": "Modelo selecionado",
+    "proxyFreePoolSearchPlaceholder": "Buscar host…",
+    "proxyFreePoolSearchLabel": "Buscar proxies do pool gratuito",
+    "proxyFreePoolSortLabel": "Ordenar por",
+    "proxyFreePoolSortQuality": "Qualidade",
+    "proxyFreePoolSortLatency": "Latência",
+    "proxyFreePoolSortRecent": "Mais recentes",
+    "proxyFreePoolListTotal": "{count} proxies no total",
+    "proxyFreePoolLoadMore": "Carregar mais"
   },
   "contextRtk": {
     "title": "Motor RTK",
@@ -6632,6 +6805,8 @@
     "autoRefresh": "Atualização automática",
     "refreshAll": "Atualizar tudo",
     "loadingQuotas": "Carregando...",
+    "showMoreQuotas": "Mostrar mais {count}",
+    "showLessQuotas": "Mostrar menos",
     "account": "Conta",
     "modelQuotas": "Cotas de Modelo",
     "lastUsed": "Last Refreshed",
@@ -6682,6 +6857,11 @@
     "resetsIn": "Reseta em",
     "editCutoffs": "Editar pontos de corte",
     "forceRefresh": "Atualizar agora",
+    "resetCreditsLabel": "Créditos de redefinição",
+    "redeemResetCredit": "Resgatar redefinição",
+    "confirmRedeemResetCredit": "Resgatar um crédito de redefinição do Codex para esta conta? Isso consome um crédito de redefinição.",
+    "resetCreditRedeemed": "Redefinição resgatada",
+    "resetCreditRedeemFailed": "Falha ao resgatar crédito de redefinição",
     "suiteBuilderSaveFailed": "Falha ao salvar a suíte customizada",
     "clone": "Clonar",
     "exportSuite": "Exportar",
@@ -7834,7 +8014,45 @@
     "bulkImportMaxExceeded": "Máximo de 100 proxies por importação",
     "bulkImportPreview": "Visualização",
     "clearAssignment": "(atribuição clara)",
-    "bulkProxyAssignment": "Atribuição de proxy em massa"
+    "bulkProxyAssignment": "Atribuição de proxy em massa",
+    "testAll": "Testar todos",
+    "errorTestFailed": "Falha ao testar proxies",
+    "batchSelectedCount": "{count} selecionado(s)",
+    "batchDeleteSelected": "Excluir {count} selecionado(s)",
+    "batchActivateSelected": "Habilitar {count} selecionado(s)",
+    "testPassed": "✓ OK",
+    "close": "Fechar",
+    "managePool": "Gerenciar pool",
+    "poolTitle": "Pool e rotação de proxies",
+    "poolDescription": "Anexe múltiplos proxies a um escopo e alterne os IPs de saída entre eles. Um escopo com um único proxy se comporta exatamente como uma atribuição simples.",
+    "poolScopeIdLabel": "ID do escopo",
+    "poolScopeIdPlaceholder": "id do provedor / id da conexão / id do combo",
+    "poolScopeIdRequired": "Um ID de escopo é obrigatório para escopo de provedor, conta ou combo.",
+    "poolLoad": "Carregar pool",
+    "poolLoadFailed": "Falha ao carregar o pool de proxies",
+    "poolStrategyLabel": "Estratégia de rotação",
+    "poolStrategyHint": "round-robin percorre os membros em ordem; aleatório escolhe uniformemente; fixo mantém um membro por uma janela antes de avançar.",
+    "poolStrategyFailed": "Falha ao atualizar a estratégia de rotação",
+    "strategyRoundRobin": "Round-robin",
+    "strategyRandom": "Aleatório",
+    "strategySticky": "Fixo",
+    "poolMembersLabel": "Membros do pool ({count})",
+    "poolNoMembers": "Ainda não há proxies neste pool.",
+    "poolRemove": "Remover",
+    "poolRemoveFailed": "Falha ao remover o proxy do pool",
+    "poolAddLabel": "Adicionar um proxy",
+    "poolAddMember": "Adicionar",
+    "poolAddFailed": "Falha ao adicionar o proxy ao pool",
+    "poolSelectProxy": "Selecionar um proxy…",
+    "strategyLatency": "Otimizado por latência",
+    "repair": "Reparar",
+    "relayAuthMissing": "auth ausente",
+    "poolSaveFailed": "Falha ao salvar a atribuição do pool",
+    "relayRepairTooltip": "Recupera a autenticação do relay no lugar. Se o token for irrecuperável (ex.: após rotação da chave de criptografia), faça o redeploy do relay.",
+    "relayRepairRedeployRequired": "Autenticação do relay irrecuperável — faça o redeploy do relay para gravar um token novo.",
+    "relayRepairFailed": "Falha ao reparar o relay",
+    "relayRepairError": "falha no reparo",
+    "relayProbeSummary": "Probes do relay: {alive}/{tested} ativos"
   },
   "playground": {
     "title": "Title",
@@ -7896,6 +8114,10 @@
     "topP": "Top-p",
     "presencePenalty": "Penalidade de presença",
     "frequencyPenalty": "Penalidade de frequência",
+    "reasoningLabel": "Raciocínio",
+    "thinking": "Pensando",
+    "effort": "Esforço",
+    "effortDefault": "Padrão",
     "seedPlaceholder": "Aleatório (deixar vazio)",
     "presetsLabel": "Presets",
     "loadPreset": "Carregar preset",
@@ -8373,6 +8595,7 @@
     "saveMarketplaceUrl": "__MISSING__:Save & Reload",
     "marketplaceUrlSaved": "__MISSING__:Marketplace URL updated",
     "marketplaceEmpty": "__MISSING__:No plugins found in marketplace.",
+    "marketplaceInstallComingSoon": "Instalações via marketplace em breve.",
     "verified": "__MISSING__:Verified",
     "install": "__MISSING__:Install",
     "installedFromMarketplace": "__MISSING__:Plugin {name} installed!",
@@ -8505,6 +8728,7 @@
     "restartServer": "Reiniciar",
     "trustCert": "Confiar Cert",
     "downloadCert": "Baixar Cert",
+    "certManualTitle": "O certificado não pôde ser instalado automaticamente (ex.: dentro de um contêiner). A ponte ainda pode ser executada — confie na CA manualmente:",
     "regenerateCert": "Regenerar Cert",
     "starting": "Iniciando…",
     "stopping": "Parando…",
@@ -8931,6 +9155,68 @@
     "colScore": "__MISSING__:Score",
     "colAvgScore": "__MISSING__:Avg Score",
     "colModels": "__MISSING__:Models",
-    "colType": "__MISSING__:Type"
+    "colType": "__MISSING__:Type",
+    "filterConfiguredOnly": "Somente configurados",
+    "filterAvailableOnly": "Somente disponíveis",
+    "filterAvailableOnlyHelp": "Ocultar provedores cujas conexões estão todas limitadas por taxa ou sem cota.",
+    "configuredOnly": "Somente configurados",
+    "configuredOnlyHint": "Mostrar apenas provedores com conexões ativas",
+    "noConfiguredProviders": "Nenhum provedor configurado encontrado. Adicione uma conexão de provedor primeiro.",
+    "colConfigured": "Status"
+  },
+  "discovery": {
+    "title": "Descoberta de provedores",
+    "subtitle": "Busque métodos de acesso gratuito/ilimitado em provedores e revise os achados. Opcional, somente local.",
+    "scanLabel": "Provedor para buscar",
+    "scanPlaceholder": "ex.: huggingchat",
+    "scan": "Buscar",
+    "scanning": "Buscando…",
+    "scanQueued": "Busca concluída para {provider}.",
+    "scanFailed": "Falha na busca.",
+    "loadFailed": "Falha ao carregar os resultados da busca.",
+    "localOnlyNote": "Esta ferramenta é somente local (loopback). As buscas são executadas nesta máquina e nunca são acessíveis remotamente.",
+    "verify": "Verificar",
+    "verifyFailed": "Falha ao verificar o achado.",
+    "delete": "Excluir",
+    "deleteFailed": "Falha ao excluir o achado.",
+    "deleteTitle": "Excluir resultado de busca",
+    "deleteConfirm": "Excluir o achado de busca para {provider}? Isso não pode ser desfeito.",
+    "emptyTitle": "Ainda não há resultados de busca",
+    "emptyDescription": "Execute uma busca acima para procurar métodos de acesso gratuito em um provedor.",
+    "risk": "Risco",
+    "method": "Método",
+    "auth": "Autenticação",
+    "feasibility": "Viabilidade",
+    "models": "Modelos"
+  },
+  "chaosConfig": {
+    "addProvider": "Adicionar Provedor",
+    "configError": "Falha ao salvar a configuração do Chaos Mode",
+    "configReset": "Restaurar Padrões",
+    "configSaved": "Configuração do Chaos Mode salva com sucesso",
+    "enableChaos": "Ativar Chaos Mode",
+    "enableChaosDesc": "Permitir que chaves de API com o Chaos Mode ativado usem este recurso",
+    "keyPermission": "Acesso ao Chaos Mode",
+    "keyPermissionDesc": "Permitir que esta chave de API use o Chaos Mode (execução paralela multi-modelo)",
+    "loadingProviderModels": "Carregando provedores...",
+    "mode": "Modo Padrão",
+    "modeCollaborative": "Colaborativo",
+    "modeCollaborativeDesc": "Os modelos encadeiam saídas — cada um vê o resultado anterior",
+    "modeParallel": "Paralelo",
+    "modeParallelDesc": "Todos os modelos rodam simultaneamente — resultados mais rápidos",
+    "modelId": "Modelo",
+    "pageSubtitle": "Execute múltiplos modelos de IA em paralelo ou de forma colaborativa na mesma tarefa",
+    "pageTitle": "Chaos Mode",
+    "providerId": "Provedor",
+    "providerOverrides": "Substituições de Provedor",
+    "providerOverridesDesc": "Selecione modelos específicos por provedor para o Chaos Mode",
+    "removeProvider": "Remover",
+    "saveConfig": "Salvar Configuração",
+    "systemPrompt": "Prompt de Sistema (opcional)",
+    "systemPromptDesc": "Instruções personalizadas para todas as instâncias de modelo do Chaos Mode",
+    "testButton": "Testar Chaos Mode",
+    "testTask": "Escreva um poema curto sobre inteligência artificial",
+    "timeout": "Tempo Limite (ms)",
+    "timeoutDesc": "Tempo máximo por chamada de modelo (5000-600000ms)"
   }
 }
diff --git a/src/i18n/messages/pt.json b/src/i18n/messages/pt.json
index 7508b7a650..0b01ff143f 100644
--- a/src/i18n/messages/pt.json
+++ b/src/i18n/messages/pt.json
@@ -952,6 +952,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1541,6 +1542,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "Data",
+    "chartRequestsByProviderDate": "Requisições por Provedor e Data",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -3959,13 +3962,13 @@
     "testAllResults": "__MISSING__:{ok} of {total} models working",
     "noModelsToTest": "__MISSING__:No models match the current filter",
     "showAllModels": "__MISSING__:All",
-    "showVisibleOnly": "__MISSING__:Visible only",
-    "freeFilterAll": "__MISSING__:All",
-    "freeFilterFreeOnly": "__MISSING__:Free only",
-    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "showVisibleOnly": "Apenas visíveis",
+    "freeFilterAll": "Todos",
+    "freeFilterFreeOnly": "Apenas gratuitos",
+    "freeFilterPaidOnly": "Apenas pagos",
     "sortFreeFirst": "__MISSING__:Free first",
-    "showHiddenOnly": "__MISSING__:Hidden only",
-    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "showHiddenOnly": "Apenas ocultos",
+    "filterByVisibility": "Filtrar por visibilidade",
     "autoHideFailed": "__MISSING__:Auto-hide failed models",
     "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Conectado",
@@ -3974,8 +3977,8 @@
     "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
     "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
     "filterAll": "Todos",
-    "filterVisible": "__MISSING__:Visible only",
-    "filterHidden": "__MISSING__:Hidden only",
+    "filterVisible": "Apenas visíveis",
+    "filterHidden": "Apenas ocultos",
     "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Aviso",
     "noConnections": "Sem conexões",
@@ -4143,7 +4146,7 @@
     "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
     "hideFailedAuto": "__MISSING__:Auto-hide failed models",
     "selectAllModels": "Selecionar todos",
-    "hideAllModels": "__MISSING__:Hide all",
+    "hideAllModels": "Ocultar todos",
     "modelsActive": "ativos",
     "showModel": "Mostrar modelo",
     "hideModel": "Ocultar modelo",
@@ -4279,6 +4282,10 @@
     "targetFormatAuto": "__MISSING__:Default (auto)",
     "targetFormatGemini": "__MISSING__:Gemini",
     "targetFormatAntigravity": "__MISSING__:Antigravity",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
diff --git a/src/i18n/messages/ro.json b/src/i18n/messages/ro.json
index 4d3ae124df..635ce8f982 100644
--- a/src/i18n/messages/ro.json
+++ b/src/i18n/messages/ro.json
@@ -952,6 +952,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1541,6 +1542,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -3959,13 +3962,13 @@
     "testAllResults": "__MISSING__:{ok} of {total} models working",
     "noModelsToTest": "__MISSING__:No models match the current filter",
     "showAllModels": "__MISSING__:All",
-    "showVisibleOnly": "__MISSING__:Visible only",
-    "freeFilterAll": "__MISSING__:All",
-    "freeFilterFreeOnly": "__MISSING__:Free only",
-    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "showVisibleOnly": "Doar vizibile",
+    "freeFilterAll": "Toate",
+    "freeFilterFreeOnly": "Doar gratuite",
+    "freeFilterPaidOnly": "Doar plătite",
     "sortFreeFirst": "__MISSING__:Free first",
-    "showHiddenOnly": "__MISSING__:Hidden only",
-    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "showHiddenOnly": "Doar ascunse",
+    "filterByVisibility": "Filtrează după vizibilitate",
     "autoHideFailed": "__MISSING__:Auto-hide failed models",
     "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Conectat",
@@ -3974,8 +3977,8 @@
     "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
     "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
     "filterAll": "Toate",
-    "filterVisible": "__MISSING__:Visible only",
-    "filterHidden": "__MISSING__:Hidden only",
+    "filterVisible": "Doar vizibile",
+    "filterHidden": "Doar ascunse",
     "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Avertisment",
     "noConnections": "Fără conexiuni",
@@ -4143,7 +4146,7 @@
     "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
     "hideFailedAuto": "__MISSING__:Auto-hide failed models",
     "selectAllModels": "Select all",
-    "hideAllModels": "__MISSING__:Hide all",
+    "hideAllModels": "Ascunde tot",
     "modelsActive": "active",
     "showModel": "Afișează modelul",
     "hideModel": "Ascunde modelul",
@@ -4279,6 +4282,10 @@
     "targetFormatAuto": "__MISSING__:Default (auto)",
     "targetFormatGemini": "__MISSING__:Gemini",
     "targetFormatAntigravity": "__MISSING__:Antigravity",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
diff --git a/src/i18n/messages/ru.json b/src/i18n/messages/ru.json
index 87fc87a467..a3d025301a 100644
--- a/src/i18n/messages/ru.json
+++ b/src/i18n/messages/ru.json
@@ -952,6 +952,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1541,6 +1542,8 @@
     "chartModel": "Модель",
     "chartProvider": "Поставщик",
     "chartProviderBreakdown": "Разбивка по провайдерам",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "Все ключи",
     "filterSearchKeys": "Поиск ключей…",
     "filterNoKeysMatch": "Нет совпадающих ключей",
@@ -3959,13 +3962,13 @@
     "testAllResults": "__MISSING__:{ok} of {total} models working",
     "noModelsToTest": "__MISSING__:No models match the current filter",
     "showAllModels": "__MISSING__:All",
-    "showVisibleOnly": "__MISSING__:Visible only",
-    "freeFilterAll": "__MISSING__:All",
-    "freeFilterFreeOnly": "__MISSING__:Free only",
-    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "showVisibleOnly": "Только видимые",
+    "freeFilterAll": "Все",
+    "freeFilterFreeOnly": "Только бесплатные",
+    "freeFilterPaidOnly": "Только платные",
     "sortFreeFirst": "__MISSING__:Free first",
-    "showHiddenOnly": "__MISSING__:Hidden only",
-    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "showHiddenOnly": "Только скрытые",
+    "filterByVisibility": "Фильтр по видимости",
     "autoHideFailed": "__MISSING__:Auto-hide failed models",
     "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} подключено",
@@ -3974,8 +3977,8 @@
     "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
     "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
     "filterAll": "Все",
-    "filterVisible": "__MISSING__:Visible only",
-    "filterHidden": "__MISSING__:Hidden only",
+    "filterVisible": "Только видимые",
+    "filterHidden": "Только скрытые",
     "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Предупреждение",
     "noConnections": "Нет соединений",
@@ -4143,7 +4146,7 @@
     "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
     "hideFailedAuto": "__MISSING__:Auto-hide failed models",
     "selectAllModels": "Select all",
-    "hideAllModels": "__MISSING__:Hide all",
+    "hideAllModels": "Скрыть все",
     "modelsActive": "активные",
     "showModel": "Показать модель",
     "hideModel": "Скрыть модель",
@@ -4279,6 +4282,10 @@
     "targetFormatAuto": "__MISSING__:Default (auto)",
     "targetFormatGemini": "__MISSING__:Gemini",
     "targetFormatAntigravity": "__MISSING__:Antigravity",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens",
     "compatUpstreamHeadersLabel": "Дополнительные заголовки upstream",
     "compatUpstreamHeadersHint": "Настройка с высоким уровнем доверия - тот же уровень, что и редактирование API-учётных данных провайдера; использовать только доверенным администраторам. Применяется после того, как OmniRoute добавит авторизацию из API-ключа провайдера. Если пользовательский заголовок совпадает по имени с уже существующим (например, Authorization), ваше значение полностью заменяет автоматически созданный заголовок (включая Bearer token) - upstream увидит только введённое вами значение, а не ключ из настроек. Ошибка настройки может привести к 401 или поломке upstream-аутентификации. По одной строке на заголовок (например, дополнительный Authentication для некоторых шлюзов). Наведите курсор или сфокусируйте поле, чтобы увидеть предпросмотр. Сохраняется при потере фокуса, клике вне поля или закрытии панели.",
     "compatUpstreamHeaderName": "Имя заголовка",
diff --git a/src/i18n/messages/sk.json b/src/i18n/messages/sk.json
index 705dca444d..e65ced31e9 100644
--- a/src/i18n/messages/sk.json
+++ b/src/i18n/messages/sk.json
@@ -952,6 +952,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1541,6 +1542,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -3959,13 +3962,13 @@
     "testAllResults": "__MISSING__:{ok} of {total} models working",
     "noModelsToTest": "__MISSING__:No models match the current filter",
     "showAllModels": "__MISSING__:All",
-    "showVisibleOnly": "__MISSING__:Visible only",
-    "freeFilterAll": "__MISSING__:All",
-    "freeFilterFreeOnly": "__MISSING__:Free only",
-    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "showVisibleOnly": "Len viditeľné",
+    "freeFilterAll": "Všetky",
+    "freeFilterFreeOnly": "Len bezplatné",
+    "freeFilterPaidOnly": "Len platené",
     "sortFreeFirst": "__MISSING__:Free first",
-    "showHiddenOnly": "__MISSING__:Hidden only",
-    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "showHiddenOnly": "Len skryté",
+    "filterByVisibility": "Filtrovať podľa viditeľnosti",
     "autoHideFailed": "__MISSING__:Auto-hide failed models",
     "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Pripojené",
@@ -3974,8 +3977,8 @@
     "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
     "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
     "filterAll": "Všetky",
-    "filterVisible": "__MISSING__:Visible only",
-    "filterHidden": "__MISSING__:Hidden only",
+    "filterVisible": "Len viditeľné",
+    "filterHidden": "Len skryté",
     "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Upozornenie",
     "noConnections": "Žiadne spojenia",
@@ -4143,7 +4146,7 @@
     "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
     "hideFailedAuto": "__MISSING__:Auto-hide failed models",
     "selectAllModels": "Select all",
-    "hideAllModels": "__MISSING__:Hide all",
+    "hideAllModels": "Skryť všetky",
     "modelsActive": "aktívne",
     "showModel": "Zobraziť model",
     "hideModel": "Skryť model",
@@ -4279,6 +4282,10 @@
     "targetFormatAuto": "__MISSING__:Default (auto)",
     "targetFormatGemini": "__MISSING__:Gemini",
     "targetFormatAntigravity": "__MISSING__:Antigravity",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
diff --git a/src/i18n/messages/sv.json b/src/i18n/messages/sv.json
index 55bfc6dc2c..2a22581414 100644
--- a/src/i18n/messages/sv.json
+++ b/src/i18n/messages/sv.json
@@ -952,6 +952,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1541,6 +1542,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -3959,13 +3962,13 @@
     "testAllResults": "__MISSING__:{ok} of {total} models working",
     "noModelsToTest": "__MISSING__:No models match the current filter",
     "showAllModels": "__MISSING__:All",
-    "showVisibleOnly": "__MISSING__:Visible only",
-    "freeFilterAll": "__MISSING__:All",
-    "freeFilterFreeOnly": "__MISSING__:Free only",
-    "freeFilterPaidOnly": "__MISSING__:Paid only",
+    "showVisibleOnly": "Endast synliga",
+    "freeFilterAll": "Alla",
+    "freeFilterFreeOnly": "Endast gratis",
+    "freeFilterPaidOnly": "Endast betalda",
     "sortFreeFirst": "__MISSING__:Free first",
-    "showHiddenOnly": "__MISSING__:Hidden only",
-    "filterByVisibility": "__MISSING__:Filter by visibility",
+    "showHiddenOnly": "Endast dolda",
+    "filterByVisibility": "Filtrera efter synlighet",
     "autoHideFailed": "__MISSING__:Auto-hide failed models",
     "autoHideFailedHint": "__MISSING__:When enabled, Test all hides non-transient failures from public catalogs such as /v1/models. Single-model tests never auto-hide.",
     "connected": "{count} Ansluten",
@@ -3974,8 +3977,8 @@
     "testAllCompleted": "__MISSING__:Tested {total} models: {ok} OK, {failed} failed",
     "modelAutoHidden": "__MISSING__:Model {model} auto-hidden (test failed)",
     "filterAll": "Alla",
-    "filterVisible": "__MISSING__:Visible only",
-    "filterHidden": "__MISSING__:Hidden only",
+    "filterVisible": "Endast synliga",
+    "filterHidden": "Endast dolda",
     "modelsHiddenCount": "__MISSING__:{count} hidden",
     "warningCount": "{count} Varning",
     "noConnections": "Inga anslutningar",
@@ -4143,7 +4146,7 @@
     "testAllRateLimited": "__MISSING__:Rate limit reached, stopped early",
     "hideFailedAuto": "__MISSING__:Auto-hide failed models",
     "selectAllModels": "Select all",
-    "hideAllModels": "__MISSING__:Hide all",
+    "hideAllModels": "Dölj alla",
     "modelsActive": "aktiva",
     "showModel": "Visa modell",
     "hideModel": "Dölj modell",
@@ -4279,6 +4282,10 @@
     "targetFormatAuto": "__MISSING__:Default (auto)",
     "targetFormatGemini": "__MISSING__:Gemini",
     "targetFormatAntigravity": "__MISSING__:Antigravity",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens",
     "compatUpstreamHeadersLabel": "Extra upstream headers",
     "compatUpstreamHeadersHint": "High-privilege setting — same trust level as editing provider API credentials; only trusted admins should use it. Merged after OmniRoute adds auth from the provider API key. If a custom header uses the same name as an existing one (e.g. Authorization), your value fully replaces the auto-generated header (including the Bearer token) — the upstream only sees what you typed, not the key from settings. Misconfiguration can cause 401 or broken upstream auth. One row per header (e.g. extra Authentication for some gateways). Hover or focus the value to preview. Saves on blur, outside click, or closing this panel.",
     "compatUpstreamHeaderName": "Header name",
diff --git a/src/i18n/messages/sw.json b/src/i18n/messages/sw.json
index 9e8e0041f6..8d6c40741e 100644
--- a/src/i18n/messages/sw.json
+++ b/src/i18n/messages/sw.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "Inayotumika",
     "filterError": "Hitilafu",
     "filterBanned": "Imepigwa marufuku",
-    "filterCreditsExhausted": "Salio limeisha"
+    "filterCreditsExhausted": "Salio limeisha",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "Settings",
diff --git a/src/i18n/messages/ta.json b/src/i18n/messages/ta.json
index a2f02f55eb..8fa80330a8 100644
--- a/src/i18n/messages/ta.json
+++ b/src/i18n/messages/ta.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "செயலில்",
     "filterError": "பிழை",
     "filterBanned": "தடைசெய்யப்பட்டது",
-    "filterCreditsExhausted": "கிரெடிட் தீர்ந்தது"
+    "filterCreditsExhausted": "கிரெடிட் தீர்ந்தது",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "Settings",
diff --git a/src/i18n/messages/te.json b/src/i18n/messages/te.json
index 9b8c66f76d..2147b8325c 100644
--- a/src/i18n/messages/te.json
+++ b/src/i18n/messages/te.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "సక్రియం",
     "filterError": "లోపం",
     "filterBanned": "నిషేధించబడింది",
-    "filterCreditsExhausted": "క్రెడిట్‌లు అయిపోయాయి"
+    "filterCreditsExhausted": "క్రెడిట్‌లు అయిపోయాయి",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "Settings",
diff --git a/src/i18n/messages/th.json b/src/i18n/messages/th.json
index b138ae6608..c7e7cec0e8 100644
--- a/src/i18n/messages/th.json
+++ b/src/i18n/messages/th.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "ใช้งาน",
     "filterError": "ข้อผิดพลาด",
     "filterBanned": "ถูกแบน",
-    "filterCreditsExhausted": "เครดิตหมด"
+    "filterCreditsExhausted": "เครดิตหมด",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "การตั้งค่า",
diff --git a/src/i18n/messages/tr.json b/src/i18n/messages/tr.json
index 647bff4c57..13dc5b2267 100644
--- a/src/i18n/messages/tr.json
+++ b/src/i18n/messages/tr.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "Etkin",
     "filterError": "Hata",
     "filterBanned": "Yasaklandı",
-    "filterCreditsExhausted": "Krediler tükendi"
+    "filterCreditsExhausted": "Krediler tükendi",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "Ayarlar",
diff --git a/src/i18n/messages/uk-UA.json b/src/i18n/messages/uk-UA.json
index e7dbe77e58..3e3310ff63 100644
--- a/src/i18n/messages/uk-UA.json
+++ b/src/i18n/messages/uk-UA.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "Модель",
     "chartProvider": "Провайдер",
     "chartProviderBreakdown": "Розподіл за провайдерами",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "Усі ключі",
     "filterSearchKeys": "Пошук ключів…",
     "filterNoKeysMatch": "Жоден ключ не відповідає",
@@ -4420,7 +4423,11 @@
     "filterActive": "Активні",
     "filterError": "Помилка",
     "filterBanned": "Заблоковано",
-    "filterCreditsExhausted": "Кредити вичерпано"
+    "filterCreditsExhausted": "Кредити вичерпано",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "Налаштування",
diff --git a/src/i18n/messages/ur.json b/src/i18n/messages/ur.json
index 5f6fd9ce2d..23bb2cd677 100644
--- a/src/i18n/messages/ur.json
+++ b/src/i18n/messages/ur.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "فعال",
     "filterError": "خرابی",
     "filterBanned": "پابندی شدہ",
-    "filterCreditsExhausted": "کریڈٹ ختم"
+    "filterCreditsExhausted": "کریڈٹ ختم",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "Settings",
diff --git a/src/i18n/messages/vi.json b/src/i18n/messages/vi.json
index c439988609..f67c186783 100644
--- a/src/i18n/messages/vi.json
+++ b/src/i18n/messages/vi.json
@@ -948,6 +948,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1458,6 +1459,8 @@
     "chartModel": "__MISSING__:Model",
     "chartProvider": "__MISSING__:Provider",
     "chartProviderBreakdown": "__MISSING__:Provider Breakdown",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "__MISSING__:All Keys",
     "filterSearchKeys": "__MISSING__:Search keys…",
     "filterNoKeysMatch": "__MISSING__:No keys match",
@@ -4420,7 +4423,11 @@
     "filterActive": "Hoạt động",
     "filterError": "Lỗi",
     "filterBanned": "Bị cấm",
-    "filterCreditsExhausted": "Hết tín dụng"
+    "filterCreditsExhausted": "Hết tín dụng",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "Cài đặt",
diff --git a/src/i18n/messages/zh-CN.json b/src/i18n/messages/zh-CN.json
index c404df3866..5c5a3bbd13 100644
--- a/src/i18n/messages/zh-CN.json
+++ b/src/i18n/messages/zh-CN.json
@@ -949,6 +949,7 @@
     "contextLite": "Lite",
     "contextAggressive": "Aggressive",
     "contextUltra": "Ultra",
+    "contextOmniglyph": "OmniGlyph",
     "contextSettings": "Compression Settings",
     "contextHeadroom": "Headroom",
     "contextSessionDedup": "Session Dedup",
@@ -1531,6 +1532,8 @@
     "chartModel": "模型",
     "chartProvider": "提供商",
     "chartProviderBreakdown": "按提供商拆分",
+    "chartDate": "__MISSING__:Date",
+    "chartRequestsByProviderDate": "__MISSING__:Requests by Provider & Date",
     "filterAllKeys": "全部密钥",
     "filterSearchKeys": "搜索密钥…",
     "filterNoKeysMatch": "没有匹配的密钥",
@@ -4722,7 +4725,11 @@
     "rateLimitOverridesTpdHint": "此连接的每日最大令牌数。覆盖提供商默认值。",
     "rateLimitOverridesTpdLabel": "TPD（令牌/天）",
     "rateLimitOverridesTpmHint": "此连接的每分钟最大令牌数。覆盖提供商默认值。",
-    "rateLimitOverridesTpmLabel": "TPM（令牌/分钟）"
+    "rateLimitOverridesTpmLabel": "TPM（令牌/分钟）",
+    "contextWindowOverrideLabel": "__MISSING__:Context Window Override",
+    "contextWindowOverridePlaceholder": "__MISSING__:e.g. 131072",
+    "contextWindowOverrideHint": "__MISSING__:Manually set this model's real context window (tokens) when the provider misreports it. Wins over auto-detected/catalog values and prevents combo routing from dropping the model.",
+    "contextWindowOverrideInvalid": "__MISSING__:Context window override must be a positive whole number of tokens"
   },
   "settings": {
     "title": "设置",
@@ -5303,6 +5310,18 @@
     "errorDuringImport": "导入时发生错误",
     "modelPricing": "模型定价",
     "modelPricingDesc": "配置每个模型的成本费率 • 所有费率均以美元/100 万 Tokens 为单位",
+    "modelOverridesTitle": "模型覆盖",
+    "modelOverridesDesc": "覆盖路由和请求整形使用的 provider/model 能力。目标使用与 combo 相同的 provider/model 形式。",
+    "searchModelOverrideTargets": "搜索 provider/model...",
+    "selectedModel": "选中的模型",
+    "modelOverrideValuePlaceholder": "数字值",
+    "addKeyValue": "添加键值",
+    "noModelOverrides": "该模型尚未配置覆盖。",
+    "modelOverrideLoadFailed": "加载模型覆盖失败",
+    "modelOverrideSaved": "模型覆盖已保存",
+    "modelOverrideRemoved": "模型覆盖已移除",
+    "modelOverrideSaveFailed": "保存模型覆盖失败",
+    "modelOverrideRemoveFailed": "移除模型覆盖失败",
     "registry": "登记处",
     "priced": "定价",
     "searchProvidersModels": "搜索提供商或模型...",
diff --git a/src/i18n/messages/zh-TW.json b/src/i18n/messages/zh-TW.json
new file mode 100644
index 0000000000..b879139a9f
--- /dev/null
+++ b/src/i18n/messages/zh-TW.json
@@ -0,0 +1,9077 @@
+{
+  "common": {
+    "save": "儲存",
+    "cancel": "取消",
+    "delete": "刪除",
+    "loading": "正在載入...",
+    "error": "發生錯誤",
+    "success": "成功",
+    "confirm": "你確定嗎？",
+    "refresh": "重新整理",
+    "close": "關閉",
+    "add": "新增",
+    "edit": "編輯",
+    "search": "搜尋",
+    "back": "返回",
+    "next": "下一頁",
+    "submit": "提交",
+    "reset": "重置",
+    "copy": "複製",
+    "copied": "已複製！",
+    "enabled": "啟用",
+    "disabled": "已停用",
+    "active": "啟用中",
+    "inactive": "不活躍",
+    "noData": "無可用資料",
+    "nothingHere": "暫無內容",
+    "configure": "配置",
+    "manualConfig": "__MISSING__:Manual config",
+    "manage": "管理",
+    "name": "名稱",
+    "actions": "操作",
+    "status": "狀態",
+    "type": "型別",
+    "model": "模型",
+    "models": "模型",
+    "provider": "提供商",
+    "unknownProvider": "__MISSING__:Unknown provider",
+    "account": "帳戶",
+    "time": "時間",
+    "details": "詳情",
+    "created": "已建立",
+    "lastUsed": "最近重新整理",
+    "loadMore": "載入更多",
+    "noResults": "沒有找到結果",
+    "reloadPage": "重新載入頁面",
+    "connected": "已連線",
+    "disconnected": "已斷開連線",
+    "notConfigured": "未配置",
+    "testConnection": "測試連線",
+    "enable": "啟用",
+    "disable": "停用",
+    "columns": "列",
+    "newest": "最新",
+    "oldest": "最早",
+    "all": "全部",
+    "none": "無",
+    "yes": "是的",
+    "no": "否",
+    "on": "開啟",
+    "off": "關閉",
+    "warning": "警告",
+    "note": "注意事項",
+    "free": "免費",
+    "skipToContent": "跳至內容",
+    "maintenanceServerIssues": "伺服器當前存在異常，部分功能可能暫時不可用。",
+    "maintenanceServerUnreachable": "伺服器暫時無法連線，正在重新連線...",
+    "accept": "接受",
+    "accountId": "帳戶 ID",
+    "alias": "別名",
+    "apiKeyId": "API 金鑰 ID",
+    "apiKeyName": "API 金鑰名稱",
+    "apiKeySecret": "API 金鑰密文",
+    "authorization": "授權",
+    "content-type": "內容型別",
+    "content-length": "內容長度",
+    "cookie": "Cookie",
+    "file": "檔案",
+    "host": "主機",
+    "id": "ID",
+    "import": "匯入",
+    "limit": "限制",
+    "offset": "偏移量",
+    "open": "開啟",
+    "origin": "來源",
+    "promptTokens": "輸入 Tokens",
+    "completionTokens": "輸出 Tokens",
+    "totalTokens": "總 Tokens",
+    "rawModel": "原始模型",
+    "scope": "作用域",
+    "skill": "技能",
+    "sortBy": "排序依據",
+    "sortOrder": "排序順序",
+    "tab": "標籤頁",
+    "text": "文本",
+    "textarea": "文本域",
+    "tool": "工具",
+    "toolId": "工具 ID",
+    "web": "網頁",
+    "whereUsed": "使用位置",
+    "whitelist": "白名單",
+    "blacklist": "黑名單",
+    "resolve": "解析",
+    "force": "強制",
+    "base64url": "Base64 URL",
+    "hex": "十六進位制",
+    "range": "範圍",
+    "component": "元件",
+    "redirect_uri": "重定向 URI",
+    "idempotency-key": "冪等鍵",
+    "error_description": "錯誤描述",
+    "code": "程式碼",
+    "compatible": "相容",
+    "chat-completions": "對話補全",
+    "oauth": "OAuth",
+    "auth_token": "認證令牌",
+    "crypto": "加密",
+    "hours": "小時",
+    "selfsigned": "自簽名",
+    "proxy_id": "代理 ID",
+    "proxyId": "代理 ID",
+    "connectionId": "連線 ID",
+    "resolveConnectionId": "解析連線 ID",
+    "resolve_connection_id": "解析連線 ID",
+    "scope_id": "作用域 ID",
+    "scopeId": "作用域 ID",
+    "jwtSecret": "JWT 金鑰",
+    "keytar": "keytar",
+    "better-sqlite3": "better-sqlite3",
+    "undici": "undici",
+    "builder-id": "構建器 ID",
+    "musicDesc": "音樂描述",
+    "musicGeneration": "音樂生成",
+    "idc": "IDC",
+    "cloud-status-changed": "雲狀態已變更",
+    "where_used": "使用位置",
+    "windowMs": "時間視窗（ms）",
+    "social-github": "GitHub",
+    "social-google": "Google",
+    "TOOL_ALLOWLIST": "工具允許列表",
+    "TOOL_DENYLIST": "工具拒絕列表",
+    "Failed to save pricing": "儲存定價失敗",
+    "Failed to reset pricing": "重置定價失敗",
+    "apikey": "API 金鑰",
+    "http": "HTTP",
+    "goToDashboard": "前往儀表板",
+    "checkSystemStatus": "檢視系統狀態",
+    "selectModel": "選擇模型",
+    "combos": "組合",
+    "noModelsFound": "未找到 Model",
+    "clear": "清除",
+    "done": "完成",
+    "errorOccurred": "錯誤發生",
+    "comboDeleted": "Combo 已刪除",
+    "hide": "隱藏",
+    "creating": "正在建立",
+    "comboCreated": "Combo 已建立",
+    "swapFormats": "交換格式",
+    "daysAgo": "天前",
+    "retries": "重試次數",
+    "errorDuringRestore": "錯誤期間恢復",
+    "eventsAppearHint": "事件顯示提示",
+    "noLockouts": "無鎖定",
+    "webSearchDesc": "Web Search 功能說明",
+    "audioProvidersHeading": "音訊 Provider",
+    "cloudAgentProviders": "雲代理提供商",
+    "minutesAgo": "分鐘前",
+    "a": "A",
+    "liveAutoRefreshing": "即時自動重新整理中",
+    "webSearch": "網頁搜尋",
+    "anthropicPrefixPlaceholder": "Anthropic 字首",
+    "addModelToCombo": "新增模型到組合",
+    "failedToLoad": "載入失敗",
+    "categoryMedia": "類別媒體",
+    "enableCloud": "啟用雲端",
+    "expirationBannerExpiringSoon": "過期橫幅即將過期即將",
+    "retry": "重試",
+    "embeddings": "嵌入",
+    "errorCount": "錯誤數量",
+    "backupReasonManual": "備份原因手動",
+    "safeSearchModerate": "安全搜尋中等",
+    "activeLimiters": "活躍限制器",
+    "a2aCardTitle": "A2A",
+    "cloudWorkerUnreachable": "Cloud Worker 不可達",
+    "testFailed": "測試失敗",
+    "compatibleBaseUrlHint": "填寫相容 API 的 Base URL。",
+    "usageTracking": "使用量跟蹤",
+    "disableCloudTitle": "停用雲端",
+    "noConnections": "無連線",
+    "providerHealth": "提供商健康狀態",
+    "confirmDbImport": "確認DB匯入",
+    "notAvailableSymbol": "—",
+    "backupsAvailable": "可用備份",
+    "providerAuto": "自動提供商",
+    "newProviderNamePlaceholder": "新的提供商名稱",
+    "a2aQuickStartStep2": "A2A快速開始步驟2",
+    "ok": "確定",
+    "available": "可用",
+    "noBackupYet": "無備份暫無",
+    "more": "更多",
+    "noCompatibleYet": "無相容暫無",
+    "multiProvider": "多提供商",
+    "repairEnvHint": "修復環境提示",
+    "disablingCloud": "正在停用 Cloud",
+    "testBench": "測試臺",
+    "valid": "有效",
+    "cloudBenefitShare": "共享 Cloud 訪問能力",
+    "mcpCardTitle": "MCP",
+    "disableConfirm": "確認停用？",
+    "filters": "篩選器",
+    "expirationBannerExpiredDesc": "過期橫幅已過期說明",
+    "saveComboDefaults": "儲存組合預設值",
+    "cloudConnectedVerified": "Cloud 連線已驗證",
+    "uptime": "執行時間",
+    "compatibleProdPlaceholder": "相容生產佔位符",
+    "fallbackChainsTitle": "後備鏈",
+    "oauthLabel": "OAuth 標籤",
+    "a2aCardDescription": "通過 A2A 協議連線 Agent 工作流。",
+    "okShort": "確定短標籤",
+    "maintenance": "維護",
+    "formatConverter": "格式轉換器",
+    "zedImportNetworkError": "Zed 匯入網路錯誤",
+    "apiKeyLabel": "API key 標籤",
+    "noModelsForProvider": "此提供商沒有可用模型",
+    "mcpCardDescription": "通過 MCP 工具連線 Agent 和自動化流程。",
+    "apiTypeLabel": "API 型別標籤",
+    "configuredProvidersLabel": "已配置 Provider 標籤",
+    "maxRetriesLabel": "最大重試次數標籤",
+    "title": "標題",
+    "output": "輸出",
+    "prefixHint": "字首提示",
+    "skipWizard": "跳過嚮導",
+    "failedCount": "失敗數量",
+    "confirmDbImportDesc": "確認DB匯入說明",
+    "entries": "條目",
+    "until": "直到",
+    "disableCombo": "停用組合",
+    "liveMonitorDescriptionPrefix": "即時顯示請求流經 OmniRoute 時產生的事件。使用",
+    "runningCount": "執行中數量",
+    "noActiveConnectionsInGroup": "此分組中沒有活躍連線",
+    "savedSuccessfully": "儲存成功",
+    "systemStorage": "系統儲存",
+    "videoDesc": "影片說明",
+    "maxResults": "最大結果數",
+    "timeRangeMonth": "時間範圍月",
+    "testSummary": "測試摘要",
+    "failedSetPassword": "設定密碼失敗",
+    "audio": "音訊",
+    "restore": "恢復",
+    "disableWarning": "停用警告",
+    "moderationsDesc": "稽核說明",
+    "providerHealthStatusAria": "提供商健康狀態",
+    "modelNamePlaceholder": "模型名稱",
+    "mcpQuickStartStep2": "MCP 快速開始步驟 2",
+    "quickStart": "快速開始",
+    "fullExportFailedWithError": "完整匯出失敗：{error}",
+    "loadingBackups": "正在載入備份",
+    "anthropicBaseUrlPlaceholder": "Anthropic Base URL",
+    "description": "描述",
+    "noProviderFound": "未找到提供商",
+    "auto": "自動",
+    "protocolsDescription": "配置並測試支援的協議端點。",
+    "cloudSessionNote": "Cloud Session 提示",
+    "advancedSettings": "高階設定",
+    "defaultStrategy": "預設策略",
+    "purgeExpiredLogs": "清理已過期日誌",
+    "justNow": "剛剛現在",
+    "providerTestFailed": "提供商測試失敗",
+    "openaiBaseUrlPlaceholder": "OpenAI Base URL",
+    "image": "影像",
+    "failedCreateChain": "建立鏈失敗",
+    "importDatabase": "匯入資料庫",
+    "allDataLocal": "全部資料本地",
+    "sectionTitle": "分割槽標題",
+    "failedToggle": "切換失敗",
+    "editCombo": "編輯 Combo",
+    "testResults": "測試結果",
+    "searchQuery": "搜尋查詢",
+    "addCcCompatible": "新增 CC 相容",
+    "duplicate": "重複",
+    "createCombo": "建立組合",
+    "searchTypeWeb": "搜尋型別：Web",
+    "addChain": "新增鏈",
+    "prefixLabel": "字首標籤",
+    "listModelsDesc": "列出可用 Model。",
+    "databaseSize": "資料庫大小",
+    "chainCreated": "鏈已建立",
+    "providerTestTimeout": "提供商測試超時",
+    "routingStrategy": "路由策略",
+    "translateAction": "翻譯操作",
+    "exportFailed": "匯出失敗",
+    "connectedVerificationPending": "連線驗證待處理",
+    "a2aQuickStartTitle": "A2A 快速開始",
+    "couldNotTest": "無法測試",
+    "testAllCompatible": "測試所有相容項",
+    "anthropicCompatibleName": "Anthropic 相容名稱",
+    "disabling": "正在停用",
+    "failedEnable": "啟用失敗",
+    "categoryUtility": "工具類別",
+    "customUrlOptional": "自定義 URL（可選）",
+    "localProviders": "本地 Provider",
+    "comboNamePlaceholder": "Combo 名稱",
+    "memoryRss": "記憶體 RSS",
+    "disableProvider": "停用提供商",
+    "welcomeDesc": "歡迎使用 OmniRoute。",
+    "nameLabel": "名稱標籤",
+    "allOperational": "全部執行正常",
+    "backupNow": "備份現在",
+    "providerMaxRetriesAria": "提供商最大重試次數",
+    "textToSpeechDesc": "將文本轉換為語音音訊。",
+    "machineId": "機器 ID",
+    "globalProxy": "全域性代理",
+    "hitsMisses": "命中未命中",
+    "testDesc": "執行連線測試以驗證配置。",
+    "chatDesc": "聊天說明",
+    "importSuccess": "匯入成功",
+    "chat": "聊天",
+    "a2aQuickStartStep1": "A2A快速開始步驟1",
+    "importFailed": "匯入失敗",
+    "inputPlaceholder": "輸入內容...",
+    "providerModelsTitle": "提供商模型",
+    "lastBackup": "最近備份",
+    "yourEndpoint": "你的 Endpoint",
+    "autoDisableThresholdDesc": "觸發自動停用前允許的連續失敗次數。",
+    "rerankDesc": "重排說明",
+    "modelsPathPlaceholder": "Model 路徑",
+    "noCombosYet": "暫無 Combo",
+    "connectedVerificationPendingWithError": "已連線，驗證待完成：{error}",
+    "comboDefaultsGuideHint1": "配置 Combo 預設策略和目標。",
+    "enableCloudTitle": "啟用雲端",
+    "configuredProvidersHint": "僅顯示已配置的 Provider。",
+    "paused": "已暫停",
+    "llmProviders": "LLM Provider",
+    "enableCombo": "啟用組合",
+    "removeProviderOverrideAria": "移除提供商覆蓋",
+    "nodeVersion": "Node 版本",
+    "openai": "OpenAI",
+    "exportFailedWithError": "匯出失敗：{error}",
+    "proxyConfigured": "代理已配置",
+    "concurrencyPerModel": "每個模型併發數",
+    "protocolTasksLabel": "協議任務標籤",
+    "oauthProviders": "OAuth 提供商",
+    "lockedCount": "已鎖定數量",
+    "deleteChainConfirm": "刪除此後備鏈？",
+    "recentTranslations": "最近翻譯",
+    "zedImportButton": "從 Zed 匯入",
+    "responsesDesc": "Responses API 相容端點",
+    "testedCount": "已測試數量",
+    "providersCommaSeparatedPlaceholder": "以逗號分隔的 Provider",
+    "signatureDefaults": "簽名預設值",
+    "errorCreating": "錯誤建立",
+    "timeRangeYear": "時間範圍年",
+    "compatibleLabel": "相容",
+    "cloudDisabledSuccess": "雲端已停用",
+    "deleteConfirm": "確認刪除？",
+    "check": "檢查",
+    "safeSearch": "安全搜尋",
+    "protocolLastActivity": "協議最近活動",
+    "openMcpDashboard": "開啟 MCP Dashboard",
+    "testBenchTab": "測試臺",
+    "chatPathLabel": "聊天路徑標籤",
+    "retryDelay": "重試延遲",
+    "errorUpdating": "錯誤更新",
+    "ideCliIntegrations": "IDE 與 CLI 整合",
+    "imageGeneration": "影像生成",
+    "apiKeyRequired": "API key 為必填項",
+    "resetAllTitle": "全部重置",
+    "connectionError": "連線錯誤",
+    "modelName": "模型名稱",
+    "apiKeyForCheck": "用於檢查的 API 金鑰",
+    "cloudRequestTimeout": "雲端請求超時",
+    "showConfiguredOnly": "顯示已配置僅",
+    "showFreeOnly": "僅免費",
+    "addFirstProvider": "新增您的第一個提供商",
+    "addFirstProviderDesc": "連線 AI 提供商以開始通過 OmniRoute 路由請求。您可以使用免費提供商、API 金鑰或 OAuth 帳戶。",
+    "learnMore": "瞭解更多",
+    "includeDomains": "包含域名",
+    "promptCache": "提示快取",
+    "cloudConnected": "Cloud 已連線",
+    "deleteChain": "刪除鏈",
+    "chatPathPlaceholder": "聊天路徑佔位符",
+    "databasePath": "資料庫路徑",
+    "usingLocalServer": "正在使用本地 Server",
+    "globalComboConfig": "全域性 Combo 配置",
+    "backupFailed": "備份失敗",
+    "tabProtocols": "協議標籤頁",
+    "continue": "繼續",
+    "categorySearch": "類別搜尋",
+    "rateLimitStatus": "速率限制狀態",
+    "repairEnvSuccess": "環境修復成功",
+    "nameRequired": "名稱必填",
+    "country": "國家/地區",
+    "trackMetricsDesc": "跟蹤請求、延遲和成本指標。",
+    "durationSecondsShort": "時長秒短標籤",
+    "formatConverterDescription": "在不同 API 格式之間轉換請求。",
+    "cloudBenefitAccess": "訪問 Cloud 能力",
+    "maxRetries": "最大重試次數",
+    "queueTimeout": "佇列超時",
+    "queueDepth": "__MISSING__:Queue Depth",
+    "addProvider": "新增提供商",
+    "realtime": "即時",
+    "totalTranslations": "總計翻譯",
+    "protocolActiveStreamsLabel": "協議活躍 Stream",
+    "repairEnv": "修復環境",
+    "modelsCount": "Model 數量",
+    "viewBackups": "檢視備份",
+    "responsesApi": "Responses API",
+    "copyComboName": "複製 Combo 名稱",
+    "failures": "失敗",
+    "failedUpdate": "更新失敗",
+    "imageDesc": "影像說明",
+    "failedCreate": "建立失敗",
+    "remainingOfLimit": "剩餘Of限制",
+    "protocolsTitle": "協議",
+    "expirationBannerExpiringSoonDesc": "過期橫幅即將過期即將說明",
+    "source": "來源",
+    "failed": "失敗",
+    "apiKeyMgmt": "API key 管理",
+    "mcpQuickStartStep1": "MCP 快速開始步驟 1",
+    "runTest": "執行測試",
+    "loadingFallbackChains": "正在載入後備鏈",
+    "healthy": "健康",
+    "version": "版本",
+    "saveBlockWeighted": "儲存 Block Weighted",
+    "zedImportNone": "沒有可從 Zed 匯入的內容",
+    "noBackupsYet": "無備份暫無",
+    "noGlobalProxy": "無全域性代理",
+    "noModels": "無 Model",
+    "stickyLimit": "粘性限制",
+    "passedCount": "通過數量",
+    "zedImportFailed": "Zed 匯入失敗",
+    "saving": "正在儲存",
+    "testAll": "全部測試",
+    "globalProxyDesc": "全域性代理說明",
+    "latencyP99": "延遲P99",
+    "connectingToCloud": "正在連線雲端",
+    "responses": "響應",
+    "errorDeleting": "錯誤刪除",
+    "openaiPrefixPlaceholder": "OpenAI 字首",
+    "enterPassword": "輸入密碼",
+    "openA2aDashboard": "開啟 A2A Dashboard",
+    "enableProvider": "啟用提供商",
+    "modeTest": "測試模式",
+    "failedDeleteChain": "刪除鏈失敗",
+    "providerDesc": "提供商描述",
+    "templateLoadHint": "選擇模板以快速填充配置。",
+    "lastFailure": "最近失敗",
+    "moveDown": "移動下移",
+    "providerLabel": "提供商標籤",
+    "clearCacheFailed": "清除快取失敗",
+    "imagesGenerations": "影像生成",
+    "repairEnvWorking": "修復環境處理中",
+    "millisecondsShort": "毫秒短標籤",
+    "globalLabel": "全域性標籤",
+    "failuresPlural": "失敗複數",
+    "completionsLegacyDesc": "舊版 Completions API 相容端點。",
+    "searchProviders": "搜尋 Provider",
+    "chatPathHint": "聊天路徑提示",
+    "defaultStrategyDesc": "預設策略說明",
+    "latencyP95": "延遲P95",
+    "textToSpeech": "文本轉語音",
+    "searchType": "搜尋型別",
+    "messages": "訊息",
+    "aggregatorsGateways": "聚合器與閘道器",
+    "comboStrategyAria": "Combo 策略",
+    "input": "輸入",
+    "testingConnection": "正在測試連線",
+    "excludeDomains": "排除域名",
+    "webCookieProviders": "Web Cookie 提供商",
+    "allTestsPassed": "全部測試通過",
+    "openaiCompatibleName": "OpenAI 相容名稱",
+    "warningCostOptimizedPartialPricing": "部分模型缺少定價，成本最佳化結果可能不完整。",
+    "comboDefaultsGuideTitle": "組合預設值指南",
+    "hoursAgo": "小時前",
+    "notAvailable": "不可用",
+    "skipAndContinue": "跳過並繼續",
+    "moderations": "稽核",
+    "proxyConfig": "代理配置",
+    "upstreamProxyProviders": "上游代理 Provider",
+    "exportAll": "匯出全部",
+    "queuedCount": "排隊中數量",
+    "resetAll": "重置全部",
+    "noTranslations": "無翻譯",
+    "avgLatency": "平均延遲",
+    "throttleStatus": "限流狀態",
+    "backupRetentionDesc": "備份保留說明",
+    "noCBData": "無CB資料",
+    "chainDeleted": "鏈已刪除",
+    "timeLeft": "時間剩餘",
+    "expirationBannerExpired": "過期橫幅已過期",
+    "language": "語言",
+    "invalidFileType": "無效檔案型別",
+    "monitoredProviders": "監控中的 Provider",
+    "errors": "錯誤",
+    "heap": "堆記憶體",
+    "chatCompletions": "聊天補全",
+    "exampleTemplatesHint": "示例模板提示",
+    "retryDelayLabel": "重試延遲標籤",
+    "audioTranscription": "音訊轉寫",
+    "fallbackChainsDesc": "定義每個模型的提供商後備順序。",
+    "exampleTemplates": "示例模板",
+    "connectionsCount": "連線數量",
+    "modelsPathLabel": "Model 路徑",
+    "activeProvidersHint": "當前正在處理請求的 Provider。",
+    "activeLockouts": "活躍鎖定",
+    "invalid": "無效",
+    "skipPassword": "跳過密碼",
+    "moveUp": "移動上移",
+    "timeRange": "時間範圍",
+    "stickyLimitDesc": "粘性限制說明",
+    "cloudBenefitEdge": "邊緣 Cloud 能力",
+    "custom": "自定義",
+    "verifying": "正在驗證",
+    "baseUrlLabel": "Base URL 標籤",
+    "setPassword": "設定密碼",
+    "safeSearchStrict": "安全搜尋嚴格",
+    "noChangesSinceBackup": "無變更自從備份",
+    "modelsPathHint": "用於拉取 Model 列表的路徑。",
+    "audioTranscriptions": "音訊轉寫",
+    "testCombo": "測試組合",
+    "mcpQuickStartTitle": "MCP 快速開始",
+    "comboUpdated": "Combo 已更新",
+    "weighted": "加權",
+    "providers": "Provider",
+    "ccCompatibleLabel": "CC 相容",
+    "noFallbackChainsDesc": "建立一條鏈路，用於定義某個模型的提供商回退順序。",
+    "yesImport": "確認匯入",
+    "lockoutsAutoRefreshHint": "鎖定自動重新整理提示",
+    "tabApis": "API 標籤頁",
+    "sectionDescription": "分割槽描述",
+    "filter": "篩選",
+    "purgeLogsFailed": "清理日誌失敗",
+    "latency": "延遲",
+    "testAllOAuth": "測試所有 OAuth",
+    "mcpQuickStartStep3": "MCP 快速開始步驟 3",
+    "repairEnvFailed": "環境修復失敗",
+    "zedImportHint": "從 Zed 配置中匯入 Provider。",
+    "modelsAcrossEndpoints": "跨 Endpoint 的 Model",
+    "autoDisableBannedAccounts": "自動停用被封禁帳戶",
+    "securityDesc": "安全說明",
+    "listModels": "列出 Model",
+    "backupRestore": "備份恢復",
+    "target": "目標",
+    "zedImportSuccess": "Zed 匯入成功",
+    "lastHeaderUpdate": "上次請求頭更新",
+    "categoryCore": "類別核心",
+    "noFallbackChains": "無後備鏈",
+    "noSearchProviders": "無搜尋 Provider",
+    "autoBalance": "自動均衡",
+    "noModelsYet": "暫無 Model",
+    "signatureFamily": "簽名族",
+    "externalApiCalls": "外部 API 呼叫",
+    "providerOverridesDesc": "覆蓋每個提供商的超時和重試設定。",
+    "signatureTool": "簽名工具",
+    "connectionFailed": "連線失敗",
+    "activeLimitersPlural": "活躍限制器複數",
+    "doneDesc": "完成說明",
+    "down": "下移",
+    "noDataYet": "無資料暫無",
+    "activeProviders": "活躍 Provider",
+    "nameInvalid": "名稱無效",
+    "skip": "跳過",
+    "createChain": "建立鏈",
+    "audioSpeech": "語音合成",
+    "cacheCleared": "快取已清除",
+    "searchTypeNews": "搜尋型別：News",
+    "durationMillisecondsShort": "時長毫秒短標籤",
+    "addOpenAICompatible": "新增開啟Ai相容",
+    "chatTesterTab": "聊天測試標籤頁",
+    "queued": "排隊中",
+    "domainPlaceholder": "域名佔位符",
+    "durationMinutesShort": "時長分鐘短標籤",
+    "verifyingConnection": "正在驗證連線",
+    "imageProviders": "影像 Provider",
+    "protocolToolsLabel": "協議工具標籤",
+    "queryPlaceholder": "查詢佔位符",
+    "videoGeneration": "影片生成",
+    "timeRangeWeek": "時間範圍：周",
+    "limitExhausted": "限額已耗盡",
+    "failedDisable": "停用失敗",
+    "inMemoryNote": "資料僅儲存在記憶體中。",
+    "compatibleHint": "相容提示",
+    "errorShort": "錯誤短標籤",
+    "advancedHint": "顯示高階選項。",
+    "restoreFailed": "恢復失敗",
+    "searchProvidersHeading": "搜尋 Provider",
+    "comboName": "Combo 名稱",
+    "autoDisableDescription": "當檢測到永久封禁訊號時自動停用帳戶。",
+    "embeddingsDesc": "Embeddings API 相容端點。",
+    "operational": "執行正常",
+    "testAllApiKey": "測試所有 API 金鑰",
+    "backupCreated": "備份已建立",
+    "errorDuringImport": "錯誤期間匯入",
+    "comboDefaultsGuideHint2": "這些預設值會在新建 Combo 時使用。",
+    "connecting": "正在連線",
+    "fillModelAndProviders": "請填寫模型和提供商",
+    "syncing": "正在同步",
+    "resetConfirm": "重置確認",
+    "trackMetrics": "跟蹤指標",
+    "successful": "成功",
+    "recovering": "正在恢復",
+    "autoDisableThreshold": "自動停用閾值",
+    "anthropic": "Anthropic",
+    "syncingData": "正在同步資料",
+    "cloudBenefitPorts": "通過 Cloud 暴露埠",
+    "compatibleProviders": "相容 Provider",
+    "freeTierProviders": "免費層級提供商",
+    "freeTierLabel": "提供免費套餐",
+    "freeTierProvidersDesc": "提供免費套餐的提供商 — 有些需要 API 金鑰註冊，有些則根本不需要憑據。",
+    "clearCache": "清除快取",
+    "reqs": "請求數",
+    "addAnthropicCompatible": "新增 Anthropic 相容 Provider",
+    "apiKeyProviders": "API key Provider",
+    "tabsAria": "標籤頁",
+    "resetting": "正在重置",
+    "millisecondsAbbr": "毫秒縮寫",
+    "backupReasonPreRestore": "恢復前備份",
+    "disableCloud": "停用雲端",
+    "newProviderNameAria": "新的提供商名稱",
+    "passwordsMismatch": "密碼不匹配",
+    "a2aQuickStartStep3": "A2A快速開始步驟3",
+    "liveMonitorDescriptionSuffix": "或外部 API 呼叫來生成事件。",
+    "failedAddProvider": "新增提供商失敗",
+    "addAtLeastOneProvider": "至少新增一個提供商",
+    "reasonSeparator": "原因分隔符",
+    "zedImporting": "正在從 Zed 匯入",
+    "confirmPasswordPlaceholder": "確認密碼佔位符",
+    "whatYouGet": "你將獲得",
+    "signatureSession": "簽名 Session",
+    "errorCountNoCode": "無程式碼錯誤數",
+    "testing": "正在測試",
+    "providersCommaSeparated": "以逗號分隔的 Provider",
+    "exportDatabase": "匯出資料庫",
+    "hitRate": "命中率",
+    "completionsLegacy": "Completions 舊版",
+    "removeModel": "移除模型",
+    "timeRangeDay": "時間範圍：天",
+    "cloudRequestFailed": "雲端請求失敗",
+    "updatedAt": "更新時間",
+    "monitoredProvidersHint": "選擇需要監控的 Provider。",
+    "connectionSuccessful": "連線成功",
+    "latencyP50": "延遲P50",
+    "logsDeleted": "日誌已刪除",
+    "chatTester": "聊天測試器",
+    "safeSearchOff": "Safe Search 關閉",
+    "nameHint": "名稱提示",
+    "debugToggle": "除錯開關",
+    "embedding": "嵌入",
+    "issuesLabel": "問題標籤",
+    "optionAny": "任意選項",
+    "maxNestingDepth": "最大巢狀深度",
+    "rerank": "重新排序",
+    "checking": "正在檢查",
+    "getStarted": "開始使用",
+    "restoreSuccess": "恢復成功",
+    "issuesDetected": "檢測到問題",
+    "signatureCache": "簽名快取",
+    "modelLockouts": "模型鎖定",
+    "usingCloudProxy": "正在使用 Cloud 代理",
+    "loadingHealth": "正在載入健康狀態",
+    "providerOverrides": "提供商覆蓋",
+    "audioTranscriptionDesc": "音訊轉寫說明",
+    "learnedFromHeaders": "從響應頭學習",
+    "totalRequests": "總計請求",
+    "cloudUnstableNote": "Cloud 連線不穩定，部分功能可能受影響。",
+    "gamificationAdmin": "遊戲化管理員",
+    "monitorAnomaliesAndHealth": "監控異常和系統健康狀況",
+    "flaggedAnomalies": "標記的異常",
+    "noAnomaliesDetected": "未檢測到異常情況",
+    "apiKey": "API金鑰",
+    "xpLastHour": "XP（1 小時）",
+    "zScore": "Z 分數",
+    "tokensCommunityServers": "社群伺服器",
+    "tokensServerNamePlaceholder": "伺服器名稱",
+    "tokensApiKeyPlaceholder": "API金鑰",
+    "tokensTokenBalance": "代幣餘額",
+    "tokensSendTokens": "傳送代幣",
+    "tokensRecipientApiKeyId": "接收者 API 金鑰 ID",
+    "tokensRecipientApiKeyIdPlaceholder": "輸入收件人 API 金鑰 ID",
+    "tokensReasonOptional": "原因（可選）",
+    "tokensReasonPlaceholder": "例如獎金，獎勵",
+    "tokensTransactionHistory": "交易記錄",
+    "tokensNoTransactionsYet": "還沒有交易",
+    "tokensInviteCodes": "邀請碼",
+    "tokensMaxUses": "最大使用次數",
+    "tokensRedeemCode": "兌換程式碼",
+    "tokensRedeemCodePlaceholder": "輸入邀請碼",
+    "tokensYourActiveInvites": "您的有效邀請",
+    "tierCoverageTitle": "層級覆蓋範圍",
+    "tierCoverageSubtitle": "每個後備層配置的提供程式",
+    "batchDetailCopyId": "複製身份證件",
+    "batchDetailClose": "關閉",
+    "batchDetailEndpoint": "端點",
+    "batchDetailModel": "型號",
+    "batchDetailWindow": "窗戶",
+    "batchDetailCreated": "已建立",
+    "providerTopologyEmpty": "尚未連線提供商",
+    "badgeToastUnlocked": "徽章已解鎖！",
+    "batchListSearchPlaceholder": "按 ID、端點、型號搜尋...",
+    "batchListDeleteAllCompletedTitle": "刪除所有已完成的批次",
+    "batchListBatchesTable": "批次",
+    "changelogViewerLoading": "正在從 GitHub 載入變更日誌...",
+    "profileLoading": "正在載入個人資料...",
+    "profileHowToEarn": "如何賺取",
+    "bootstrapBannerDismiss": "解僱",
+    "batchListDeleteBatchTitle": "刪除批次及其檔案",
+    "leaderboardYourRank": "你的等級",
+    "leaderboardLoading": "正在載入排行榜...",
+    "batchFileDetailCopyId": "複製身份證件",
+    "batchFileDetailClose": "關閉",
+    "batchFileDetailFailedToLoad": "無法載入檔案內容",
+    "batchFilesListSearchPlaceholder": "按 ID 或檔名搜尋...",
+    "batchFilesListFilesTable": "檔案",
+    "batchPageLoadingMore": "載入更多...",
+    "recommended": "推薦",
+    "understand": "我明白",
+    "batchConceptTitle": "批處理",
+    "batchConceptSubtitle": "以約 50% 的成本非同步處理數千個請求（24 小時間隔）。非常適合評估、批次分類和嵌入。",
+    "batchConceptHowItWorks": "工作原理",
+    "batchConceptBenefit50pct": "輸入 + 輸出令牌享受 50% 折扣",
+    "batchConceptAsync24h": "非同步處理，24 小時完成視窗",
+    "batchConceptUseCases": "最適合批次分類、評估和嵌入",
+    "filesConceptTitle": "批處理檔案",
+    "filesConceptSubtitle": "批處理使用的 JSONL 檔案：輸入請求、結果和錯誤。",
+    "filesConceptInput": "輸入 — 每行一個請求的 JSONL",
+    "filesConceptOutput": "輸出 — 已完成請求的結果",
+    "filesConceptError": "錯誤 — 失敗的請求",
+    "filesConceptRetention": "保留期：預設為 30 天（Anthropic 為 29 天）",
+    "wizardTitle": "新建批處理",
+    "wizardClose": "關閉",
+    "wizardNext": "下一步",
+    "wizardBack": "上一步",
+    "wizardCancel": "取消",
+    "wizardCreate": "建立批處理",
+    "wizardCreating": "建立中…",
+    "wizardStep1Destination": "目標",
+    "wizardStep2Input": "輸入",
+    "wizardStep3Validate": "驗證",
+    "wizardStep4Cost": "成本與建立",
+    "wizardProviderLabel": "提供商",
+    "wizardEndpointLabel": "端點",
+    "wizardModelLabel": "模型",
+    "wizardInputKindJsonl": "JSONL",
+    "wizardInputKindCsv": "CSV（我們將轉換）",
+    "wizardDropOrPick": "拖放檔案或點選選擇",
+    "wizardCsvMappingTitle": "將 CSV 列對映到請求欄位",
+    "wizardCsvMappingAddField": "新增欄位",
+    "wizardValidationOk": "所有行有效",
+    "wizardValidationErrors": "驗證錯誤",
+    "wizardValidationPreview": "預覽（前 5 個請求）",
+    "wizardValidationSamplingNote": "檔案較大 — 通過抽樣驗證（前 1000 行 + 後 100 行）。完整驗證在伺服器端執行。",
+    "wizardCostSync": "同步成本",
+    "wizardCostBatch": "批處理成本（-50%）",
+    "wizardCostSavings": "節省",
+    "wizardCostEstimatedNotice": "估算成本 — 實際計費可能有所不同。",
+    "wizardErrorUpload": "上傳檔案失敗。請重試。",
+    "wizardErrorCreate": "建立批處理失敗。請重試。",
+    "wizardEmptyProviders": "先連線支援批處理的提供商（OpenAI、Anthropic 或 Gemini）以建立批處理。",
+    "uploadModalTitle": "上傳批處理檔案",
+    "uploadModalDropOrPick": "拖放 .jsonl 檔案或點選選擇",
+    "uploadModalUpload": "上傳",
+    "uploadModalCancel": "取消",
+    "uploadModalError": "上傳失敗。請重試。",
+    "uploadModalSuccess": "已上傳",
+    "uploadModalSizeLimit": "最大 512 MB",
+    "batchListNewButton": "新建批處理",
+    "batchListAutoRefresh": "自動重新整理 30 秒",
+    "batchListCostColumn": "成本",
+    "batchActionCancel": "取消",
+    "batchActionDownloadOutput": "下載輸出",
+    "batchActionDownloadErrors": "下載錯誤",
+    "batchActionRetry": "重試失敗的",
+    "batchActionRetryConfirm": "重試 {n} 個失敗請求？最終成本取決於實際消耗的令牌。",
+    "expirationBadgeCritical": "緊急",
+    "expirationBadgeWarning": "即將",
+    "expirationBadgeNormal": "待處理",
+    "expirationBadgeExpired": "已過期",
+    "filesListUploadButton": "上傳",
+    "filesListUsedByColumn": "被使用",
+    "filesListUsedByNone": "無",
+    "filesListUsedByRoleInput": "輸入",
+    "filesListUsedByRoleOutput": "輸出",
+    "filesListUsedByRoleError": "錯誤",
+    "filesListSizeColumn": "大小",
+    "batchListProgressPartial": "（部分）",
+    "batchListProviderColumn": "提供商",
+    "batchListProviderUnknown": "—",
+    "batchListProviderOther": "其他",
+    "batchListTitle": "批處理",
+    "batchListCount": "{count} 個批處理",
+    "batchListRemovingCompleted": "移除中…",
+    "batchListRemoveCompleted": "移除已完成",
+    "batchListTableStatus": "狀態",
+    "batchListTableId": "ID",
+    "batchListTableEndpoint": "端點",
+    "batchListTableModel": "模型",
+    "batchListTableProgress": "進度",
+    "batchListTableCreated": "建立時間",
+    "batchListTableExpires": "過期時間",
+    "batchListLoading": "載入中…",
+    "batchListEmpty": "未找到批處理",
+    "batchListValidating": "驗證中…",
+    "batchStatusAll": "所有狀態",
+    "batchStatusInProgress": "進行中",
+    "batchStatusValidating": "驗證中",
+    "batchStatusFinalizing": "最終處理中",
+    "batchStatusCompleted": "已完成",
+    "batchStatusFailed": "已失敗",
+    "batchStatusCancelled": "已取消",
+    "batchStatusCancelling": "取消中",
+    "batchStatusExpired": "已過期",
+    "batchStatusCompletedWithFailures": "已完成（有失敗）",
+    "batchStatusInProgressWithFailures": "進行中（有失敗）",
+    "batchStatusFinalizingWithFailures": "最終處理中（有失敗）",
+    "batchStatusCancelledWithFailures": "已取消（有失敗）",
+    "batchStatusExpiredWithFailures": "已過期（部分）",
+    "wizardCostEstimating": "估算成本…",
+    "wizardCostRequests": "請求數",
+    "wizardCostInputTok": "輸入 tok",
+    "wizardCostOutputTok": "輸出 tok",
+    "wizardCostWindow": "視窗",
+    "wizardDestinationSelectProvider": "選擇提供商…",
+    "wizardDestinationSelectModel": "選擇模型…",
+    "wizardDestinationConnectProvider": "連線提供商",
+    "batchListBatchCreated": "批處理 {id} 已建立 — 重新整理列表中…",
+    "batchListBatchCreatedDismiss": "關閉",
+    "batchListRefreshing": "重新整理中…",
+    "batchListRefresh": "重新整理",
+    "uploadFileModalRemove": "移除",
+    "uploadFileModalUploading": "上傳中…",
+    "wizardInputReading": "讀取檔案…",
+    "wizardInputReady": "就緒",
+    "wizardInputLargeFileLabel": "大檔案 — 抽樣驗證",
+    "wizardInputCsvJsonlReady": "JSONL 已生成 — 可以驗證。",
+    "wizardInputLargeFileWarning": "檢測到大檔案 — 通過抽樣驗證（前 5 MB + 後 100 KB）。完整驗證在伺服器端進行。",
+    "wizardCostWindow24h": "24 小時完成視窗",
+    "wizardValidationFieldsOk": "必填欄位有效",
+    "filesListDelete": "刪除",
+    "filesListDownload": "下載",
+    "batchDetailActionCancel": "取消批處理",
+    "batchDetailActionRetry": "重試失敗請求",
+    "batchDetailCancelling": "取消中…",
+    "batchDetailRetrying": "準備重試…",
+    "batchDetailCancelConfirm": "取消此批處理？進行中的請求將停止。",
+    "batchActionCancelError": "取消批處理失敗。請重試。",
+    "batchActionRetryError": "重試失敗請求失敗。請重試。",
+    "batchConceptRetentionNote": "結果和錯誤檔案保留 30 天（Anthropic：29 天）"
+  },
+  "disabled": "__MISSING__:Disabled",
+  "featureFlagOmnirouteEmergencyFallbackDescription": "__MISSING__:Route budget-exhausted requests to the emergency free fallback provider/model.",
+  "featureFlagArenaEloSyncEnabledDescription": "__MISSING__:Enable periodic Arena AI leaderboard ELO sync for model intelligence rankings.",
+  "sidebar": {
+    "home": "首頁",
+    "dashboard": "儀表板",
+    "providers": "提供商",
+    "combos": "組合",
+    "usage": "用量",
+    "analytics": "分析",
+    "costs": "成本",
+    "health": "健康",
+    "proxy": "代理",
+    "limits": "限制與配額",
+    "cliTools": "CLI 工具",
+    "media": "媒體",
+    "settings": "設定",
+    "translator": "翻譯器",
+    "playground": "演練場",
+    "searchTools": "搜尋工具",
+    "agents": "智慧體",
+    "cloudAgents": "雲代理",
+    "memory": "記憶",
+    "skills": "技能",
+    "omniSkills": "全方位技能",
+    "agentSkills": "代理技能",
+    "docs": "文件",
+    "issues": "問題反饋",
+    "endpoints": "端點",
+    "endpointsSubtitle": "您的 AI 連線 URL",
+    "apiManager": "API 管理",
+    "apiManagerSubtitle": "管理 API 金鑰和訪問",
+    "embeddedServices": "內嵌服務",
+    "embeddedServicesSubtitle": "管理本地代理服務",
+    "logs": "日誌",
+    "webhooks": "Webhook",
+    "webhooksSubtitle": "獲取事件通知",
+    "combosSubtitle": "用於故障轉移的組提供程式",
+    "batchSubtitle": "處理多個請求",
+    "contextCavemanSubtitle": "迅速壓縮",
+    "contextRtkSubtitle": "輸出濾波",
+    "auditLog": "審計日誌",
+    "shutdown": "停止服務",
+    "restart": "重啟服務",
+    "shutdownConfirm": "確定要停止 OmniRoute 嗎？",
+    "restartConfirm": "確定要重啟 OmniRoute 嗎？",
+    "version": "v{version}",
+    "debug": "除錯",
+    "system": "系統",
+    "help": "幫助",
+    "primarySection": "主導航",
+    "cliSection": "CLI",
+    "debugSection": "除錯",
+    "systemSection": "系統",
+    "helpSection": "幫助",
+    "serverDisconnected": "伺服器已斷開連線",
+    "serverDisconnectedMsg": "代理伺服器已停止，或正在重啟。",
+    "expandSidebar": "展開側邊欄",
+    "collapseSidebar": "收起側邊欄",
+    "themes": "主題",
+    "presetColors": "熱門配色",
+    "createTheme": "建立主題",
+    "chooseColor": "選擇一種顏色",
+    "themeCoral": "珊瑚",
+    "themeBlue": "藍色",
+    "themeRed": "紅色",
+    "themeGreen": "綠色",
+    "themeViolet": "紫羅蘭",
+    "themeOrange": "橙色",
+    "themeCyan": "青色",
+    "cliToolsShort": "工具",
+    "cache": "快取",
+    "cacheShort": "快取",
+    "batch": "批次任務",
+    "themeSystem": "主題系統",
+    "whitelabelingDesc": "自定義品牌展示與主題外觀。",
+    "switchThemes": "切換主題",
+    "themeAccentDesc": "選擇用於按鈕、連結和高亮狀態的強調色。",
+    "uploadFavicon": "上傳 Favicon",
+    "themeDark": "深色主題",
+    "customLogoDesc": "上傳用於側邊欄和登入頁的自定義 Logo。",
+    "sidebarVisibilityToggle": "側邊欄可見性開關",
+    "themeAccent": "主題強調色",
+    "resetFavicon": "重置 Favicon",
+    "whitelabeling": "白標",
+    "darkMode": "深色模式",
+    "uploadLogo": "上傳 Logo",
+    "themeLight": "淺色主題",
+    "appName": "應用名稱",
+    "appNameDesc": "設定在介面和瀏覽器標題中顯示的名稱。",
+    "resetLogo": "重置 Logo",
+    "customFavicon": "自定義 Favicon",
+    "hideHealthLogs": "隱藏健康檢查日誌",
+    "customLogo": "自定義 Logo",
+    "appearance": "外觀",
+    "themeSelectionAria": "主題選擇",
+    "themeCreate": "建立主題",
+    "customFaviconDesc": "上傳用於瀏覽器標籤頁的自定義 Favicon。",
+    "logoPreview": "Logo 預覽",
+    "themeCustom": "自定義主題",
+    "hideHealthLogsDesc": "隱藏健康檢查日誌說明",
+    "faviconPreview": "Favicon 預覽",
+    "changelog": "更新日誌",
+    "contextSection": "上下文與快取",
+    "contextCaveman": "Caveman",
+    "contextRtk": "RTK",
+    "contextCombos": "引擎組合",
+    "contextLite": "Lite",
+    "contextAggressive": "Aggressive",
+    "contextUltra": "Ultra",
+    "contextSettings": "Compression Settings",
+    "contextHeadroom": "Headroom",
+    "contextSessionDedup": "Session Dedup",
+    "contextCcr": "CCR",
+    "contextLlmlingua": "LLMLingua",
+    "combosLive": "Combo Studio",
+    "compressionStudio": "Compression Studio",
+    "routingSection": "路由",
+    "protocolsSection": "協議",
+    "agentsAiSection": "代理與 AI",
+    "cacheContextSection": "快取與上下文",
+    "analyticsSection": "分析",
+    "costsSection": "成本",
+    "monitoringSection": "監控",
+    "auditSecuritySection": "審計與安全",
+    "devtoolsSection": "開發工具",
+    "configurationSection": "配置",
+    "aiFeaturesSection": "AI 功能",
+    "mcp": "MCP",
+    "a2a": "A2A",
+    "plugins": "__MISSING__:Plugins",
+    "apiEndpoints": "API 端點",
+    "batchFiles": "檔案",
+    "analyticsEvals": "評估",
+    "analyticsSearch": "搜尋",
+    "analyticsUtilization": "利用率",
+    "analyticsComboHealth": "組合健康",
+    "analyticsCompression": "壓縮",
+    "costsBudget": "預算",
+    "costsFreeTiers": "免費層預算",
+    "costsFreeTiersSubtitle": "每月免費令牌配額",
+    "freeProviderRankings": "__MISSING__:Free Provider Rankings",
+    "freeProviderRankingsSubtitle": "__MISSING__:Best free providers ranked by model ELO scores",
+    "costsQuotaShare": "配額共享",
+    "costsPricing": "定價",
+    "logsProxy": "代理日誌",
+    "logsConsole": "控制台",
+    "logsActivity": "活動",
+    "auditMcp": "MCP 審計",
+    "auditA2a": "A2A稽核",
+    "settingsGeneral": "通用",
+    "settingsAppearance": "外觀",
+    "settingsAi": "AI 設定",
+    "settingsSecurity": "安全",
+    "settingsAccessTokens": "__MISSING__:Access Tokens",
+    "settingsFeatureFlags": "功能標誌",
+    "settingsAuthz": "授權",
+    "settingsRouting": "路由",
+    "settingsResilience": "彈性",
+    "modelLockout": "__MISSING__:Model Lockout",
+    "settingsAdvanced": "高階",
+    "omniProxySection": "OmniProxy",
+    "quotaTracker": "提供商配額",
+    "providerQuota": "提供商配額",
+    "runtime": "執行時",
+    "consoleLogs": "控制台日誌",
+    "globalRouting": "全域性路由",
+    "mitmProxy": "MITM 代理",
+    "oneProxy": "1Proxy",
+    "agenticFeaturesSection": "代理功能",
+    "otherFeaturesSection": "其他功能",
+    "compressionContextGroup": "壓縮上下文",
+    "gamificationGroup": "Gamification",
+    "toolsGroup": "工具",
+    "integrationsGroup": "整合",
+    "proxyGroup": "代理",
+    "costsParametersGroup": "成本引數",
+    "auditGroup": "審計",
+    "batchGroup": "批處理",
+    "homeSubtitle": "儀表盤概覽",
+    "providersSubtitle": "管理 AI 提供商",
+    "quotaTrackerSubtitle": "跟蹤使用限制",
+    "providerQuotaSubtitle": "跟蹤提供商使用限制",
+    "runtimeSubtitle": "即時彈性與會話",
+    "contextCombosSubtitle": "組合壓縮引擎",
+    "cliToolsSubtitle": "配置 CLI 執行時",
+    "agentsSubtitle": "管理本地代理",
+    "cloudAgentsSubtitle": "管理基於雲的代理",
+    "apiEndpointsSubtitle": "暴露自定義端點",
+    "proxySubtitle": "HTTP 代理設定",
+    "mitmProxySubtitle": "MITM 攔截",
+    "oneProxySubtitle": "公共代理閘道器",
+    "leaderboard": "排行榜",
+    "profile": "個人資料",
+    "tokens": "令牌",
+    "leaderboardSubtitle": "排名與成就",
+    "profileSubtitle": "帳戶與偏好",
+    "tokensSubtitle": "令牌使用和預算",
+    "usageSubtitle": "流量和使用統計",
+    "analyticsComboHealthSubtitle": "組合目標可靠性",
+    "analyticsUtilizationSubtitle": "提供商利用率",
+    "costsSubtitle": "支出明細",
+    "cacheSubtitle": "快取命中率",
+    "analyticsCompressionSubtitle": "令牌節省統計",
+    "analyticsSearchSubtitle": "搜尋工具分析",
+    "analyticsEvalsSubtitle": "評估套件結果",
+    "providerStats": "提供商統計",
+    "providerStatsSubtitle": "延遲和效能指標",
+    "logsSubtitle": "應用日誌",
+    "logsProxySubtitle": "代理流量日誌",
+    "consoleLogsSubtitle": "控制台輸出",
+    "logsActivitySubtitle": "使用者活動日誌",
+    "healthSubtitle": "系統健康檢查",
+    "costsPricingSubtitle": "按模型定價規則",
+    "costsBudgetSubtitle": "預算限制",
+    "costsQuotaShareSubtitle": "跨金鑰共享提供商配額",
+    "auditLogSubtitle": "授權審計",
+    "auditMcpSubtitle": "MCP 伺服器審計",
+    "auditA2aSubtitle": "A2A 協議審計",
+    "translatorSubtitle": "格式轉換",
+    "playgroundSubtitle": "即時測試提示",
+    "searchToolsSubtitle": "搜尋工具登錄檔",
+    "memorySubtitle": "持久的代理記憶",
+    "omniSkillsSubtitle": "沙箱技能登錄檔",
+    "agentSkillsSubtitle": "A2A 技能登錄檔",
+    "mcpSubtitle": "MCP 伺服器控制",
+    "a2aSubtitle": "A2A 協議伺服器",
+    "pluginsSubtitle": "__MISSING__:Plugin marketplace & installs",
+    "mediaSubtitle": "快取的媒體檔案",
+    "batchFilesSubtitle": "批處理輸入/輸出檔案",
+    "settingsSubtitle": "所有設定",
+    "settingsGeneralSubtitle": "應用基礎",
+    "settingsAppearanceSubtitle": "主題與佈局",
+    "settingsAiSubtitle": "AI 行為預設值",
+    "globalRoutingSubtitle": "全域性路由規則",
+    "settingsResilienceSubtitle": "重試與斷路器",
+    "settingsAdvancedSubtitle": "高階使用者選項",
+    "settingsSecuritySubtitle": "認證與加密",
+    "settingsAccessTokensSubtitle": "__MISSING__:Scoped CLI tokens for remote mode",
+    "settingsFeatureFlagsSubtitle": "切換系統功能",
+    "settingsSidebar": "側邊欄",
+    "settingsSidebarSubtitle": "自定義側邊欄佈局",
+    "settingsAuthzSubtitle": "路由清單與繞過策略",
+    "docsSubtitle": "文件",
+    "issuesSubtitle": "報告錯誤",
+    "changelogSubtitle": "釋出說明",
+    "costsQuotaPlans": "計劃與配額",
+    "costsQuotaPlansSubtitle": "按提供商配置計劃",
+    "activity": "活動",
+    "activitySubtitle": "近期事件的友好動態",
+    "logsGroup": "日誌",
+    "systemGroup": "系統",
+    "costsOverview": "概述",
+    "costsOverviewSubtitle": "綜合成本分析",
+    "agentBridge": "代理橋接",
+    "agentBridgeSubtitle": "攔截 IDE 代理流量",
+    "trafficInspector": "流量檢查器",
+    "trafficInspectorSubtitle": "監控 LLM 呼叫 + 除錯任何 HTTPS 流量",
+    "cliCode": "CLI 程式碼的",
+    "cliCodeSubtitle": "指向 OmniRoute 的程式碼工具",
+    "cliAgents": "CLI 代理",
+    "cliAgentsSubtitle": "自主 CLI 代理",
+    "acpAgents": "ACP 代理",
+    "acpAgentsSubtitle": "由 OmniRoute 生成的 CLI",
+    "skipToContent": "跳到內容",
+    "unpinSection": "取消固定分割槽",
+    "pinSectionOpen": "固定分割槽開啟",
+    "reloadPage": "重新載入頁面",
+    "dragReorderSection": "拖拽以重新排序分割槽",
+    "dragReorderItem": "拖拽以重新排序",
+    "cannotHide": "此項無法隱藏",
+    "alwaysVisible": "始終可見",
+    "groupSeparatorLabel": "隔斷",
+    "discovery": "__MISSING__:Discovery",
+    "discoverySubtitle": "__MISSING__:Scan providers for free access"
+  },
+  "webhooks": {
+    "title": "Webhook",
+    "description": "配置系統事件的 HTTP 回撥。",
+    "configuredWebhooks": "已配置的 Webhook",
+    "configuredWebhooksDesc": "管理投遞端點、訂閱事件、狀態和測試傳送。",
+    "addWebhook": "新增 Webhook",
+    "editWebhook": "編輯 Webhook",
+    "name": "名稱",
+    "namePlaceholder": "生產監控",
+    "unnamedWebhook": "未命名 Webhook",
+    "url": "端點 URL",
+    "events": "事件",
+    "allEvents": "所有事件",
+    "secret": "金鑰",
+    "secretPlaceholder": "留空將自動生成金鑰",
+    "secretEditPlaceholder": "留空以保留當前金鑰",
+    "status": "狀態",
+    "active": "活動",
+    "inactive": "未活動",
+    "errored": "出錯",
+    "total": "總計",
+    "lastTriggered": "上次觸發",
+    "actions": "操作",
+    "enabled": "已啟用",
+    "enabledDesc": "停用的 Webhook 會繼續儲存，但不會接收投遞。",
+    "refresh": "重新整理",
+    "loading": "正在載入 Webhook...",
+    "never": "從未",
+    "failureCount": "{count, plural, =0 {no failures} one {# 次失敗} other {# 次失敗}}",
+    "testWebhook": "傳送測試",
+    "testSuccess": "測試 Webhook 傳送成功。",
+    "testFailed": "測試 Webhook 失敗。",
+    "saveSuccess": "Webhook 儲存成功。",
+    "saveFailed": "儲存 Webhook 失敗。",
+    "loadFailed": "載入 Webhook 失敗。",
+    "delete": "刪除",
+    "deleteConfirm": "確定要刪除此 Webhook 嗎？",
+    "deleteSuccess": "Webhook 刪除成功。",
+    "deleteFailed": "刪除 Webhook 失敗。",
+    "edit": "編輯",
+    "enable": "啟用",
+    "disable": "停用",
+    "noWebhooks": "尚未配置 Webhook。",
+    "signatureTitle": "Webhook 簽名",
+    "signatureDescription": "每次投遞都會包含一個 X-Webhook-Signature 請求頭，該簽名使用 Webhook 金鑰通過 HMAC-SHA256 生成。信任載荷前請先驗證簽名。",
+    "wizard": {
+      "cancel": "取消",
+      "step1Title": "選擇整合",
+      "step2Title": "配置目標",
+      "step3Title": "事件與測試",
+      "back": "返回",
+      "next": "下一步",
+      "finish": "完成",
+      "step1Desc": "選擇此 Webhook 要對接的目標整合系統。"
+    },
+    "howItWorks": {
+      "step1": "選擇一個整合提供商（如 Slack、Discord、自定義 Webhook）並配置連線詳情。",
+      "step2": "配置要訂閱的系統事件（如補全錯誤、模型回退或用量限制）。",
+      "step3": "傳送測試負載以驗證端點是否能正常接收資料。",
+      "step4": "使用 Webhook 金鑰對 X-Webhook-Signature HMAC-SHA256 頭進行驗證，以確保端點安全。",
+      "title": "Webhook 工作原理",
+      "customOnly": "僅適用於自定義端點整合。",
+      "hmacRecipeTitle": "HMAC 驗證方案",
+      "hmacRecipe": "在 Node.js 中驗證 Webhook 負載：使用金鑰對原始請求體計算 HMAC-SHA256，然後通過 timingSafeEqual 與 X-Webhook-Signature 頭進行比對。",
+      "timeoutNote": "Webhook 投遞超時時間為 10 秒。",
+      "retryNote": "投遞失敗將最多重試 5 次，採用指數退避策略。",
+      "docsLink": "閱讀完整的 Webhook 開發者指南",
+      "hmacRecipePython": "Python HMAC 驗證：hmac.new(secret, body, hashlib.sha256).hexdigest()",
+      "hmacRecipeBash": "Bash HMAC 驗證：echo -n \"$body\" | openssl dgst -sha256 -hmac \"$secret\""
+    },
+    "deliveries": {
+      "title": "投遞日誌",
+      "loadFailed": "載入 Webhook 投遞日誌失敗。",
+      "empty": "暫無投遞記錄。觸發一個事件或傳送測試負載。",
+      "status": "狀態",
+      "event": "事件",
+      "latency": "延遲",
+      "at": "傳送時間"
+    },
+    "kinds": {
+      "comingSoon": "即將推出",
+      "slack": "Slack",
+      "slackDesc": "將系統事件直接釋出到 Slack 頻道",
+      "telegram": "Telegram",
+      "telegramDesc": "通過 Telegram 機器人傳送事件訊息",
+      "discord": "Discord",
+      "discordDesc": "將即時更新直接推送到 Discord 伺服器",
+      "custom": "自定義 Webhook",
+      "customDesc": "將系統事件負載投遞到任意 HTTPS 端點",
+      "email": "郵件通知",
+      "emailDesc": "通過郵件接收摘要更新",
+      "pagerduty": "PagerDuty",
+      "pagerdutyDesc": "在 PagerDuty 上為關鍵系統問題觸發告警",
+      "teams": "Microsoft Teams",
+      "teamsDesc": "將系統通知轉發到 Microsoft Teams 頻道"
+    },
+    "testPayloadSent": "測試負載已傳送",
+    "testResponse": "測試響應",
+    "validateUrl": {
+      "checking": "正在檢查 URL...",
+      "ok": "URL 有效",
+      "blockedPrivate": "URL 是被阻止的私有地址",
+      "invalidUrl": "URL 格式無效"
+    },
+    "custom": {
+      "endpointUrl": "端點 URL",
+      "endpointUrlPlaceholder": "https://api.yourdomain.com/webhook",
+      "secretKey": "金鑰",
+      "secretKeyPlaceholder": "輸入金鑰或留空以自動生成",
+      "secretKeyHint": "用於對負載頭進行簽名以進行身份驗證。"
+    },
+    "discord": {
+      "webhookUrl": "Discord Webhook URL",
+      "webhookUrlPlaceholder": "https://discord.com/api/webhooks/...",
+      "webhookUrlHint": "從 Discord 頻道整合設定中複製的 Webhook URL。",
+      "tutorial": "如何建立 Discord Webhook："
+    },
+    "slack": {
+      "webhookUrl": "Slack Webhook URL",
+      "webhookUrlPlaceholder": "https://hooks.slack.com/services/...",
+      "webhookUrlHint": "從 Slack Incoming Webhooks 整合中複製的 Webhook URL。",
+      "tutorial": "如何建立 Slack Webhook："
+    },
+    "telegram": {
+      "botToken": "Telegram 機器人令牌",
+      "botTokenPlaceholder": "123456789:ABCdefGhIJKlmNoPQRsTUVwxyZ",
+      "botTokenHint": "建立機器人時從 @BotFather 獲取的 HTTP API 令牌。",
+      "chatId": "Telegram 聊天 ID / 頻道",
+      "chatIdPlaceholder": "-100123456789 或 @channelname",
+      "chatIdHint": "聊天/頻道的唯一數字識別符號或公開使用者名稱。",
+      "tutorial": "如何配置 Telegram Webhook："
+    }
+  },
+  "compliance": {
+    "auditTitle": "審計",
+    "auditDescription": "在一個運維檢視中檢視合規事件和 MCP 工具呼叫。",
+    "complianceTab": "合規",
+    "mcpTab": "MCP 審計",
+    "title": "合規審計",
+    "description": "合規審計日誌記錄的策略、訪問、提供商和安全事件。",
+    "eventType": "事件型別",
+    "eventTypePlaceholder": "按操作或事件型別篩選",
+    "severity": "嚴重級別",
+    "allSeverities": "所有嚴重級別",
+    "info": "資訊",
+    "warning": "警告",
+    "critical": "嚴重",
+    "sourceIp": "來源 IP",
+    "userOrKey": "使用者 / 金鑰",
+    "action": "操作",
+    "result": "結果",
+    "details": "詳情",
+    "timestamp": "時間戳",
+    "from": "起始",
+    "to": "結束",
+    "refresh": "重新整理",
+    "export": "匯出",
+    "clearFilters": "清除篩選",
+    "loading": "正在載入審計事件...",
+    "showing": "正在顯示 {total} 個事件中的 {count} 個",
+    "policyViolation": "策略違規",
+    "accessDenied": "訪問被拒絕",
+    "injectionBlocked": "注入已阻止",
+    "noEvents": "尚未記錄合規事件。",
+    "failedFetch": "獲取合規審計日誌失敗。",
+    "viewDetails": "檢視詳情",
+    "closeDetails": "關閉詳情",
+    "notAvailable": "—",
+    "system": "系統",
+    "previous": "上一頁",
+    "next": "下一頁",
+    "mcpAudit": "MCP 審計",
+    "mcpAuditDesc": "MCP 伺服器記錄的工具呼叫審計條目。",
+    "failedFetchMcpAudit": "獲取 MCP 審計日誌失敗。",
+    "tool": "工具",
+    "toolPlaceholder": "按工具名稱篩選",
+    "duration": "持續時間",
+    "apiKey": "API 金鑰",
+    "output": "輸出",
+    "allResults": "所有結果",
+    "success": "成功",
+    "failure": "失敗",
+    "noMcpEvents": "尚未記錄 MCP 審計事件。",
+    "a2aAudit": "A2A稽核",
+    "a2aAuditDesc": "A2A伺服器記錄的任務執行審計跟蹤。",
+    "a2aShowingTasks": "顯示 {count} 個任務（共 {total} 個）",
+    "a2aSkill": "技能",
+    "a2aSkillPlaceholder": "按技能名稱過濾",
+    "a2aState": "狀態",
+    "a2aAllStates": "所有州",
+    "a2aStateSubmitted": "已提交",
+    "a2aStateWorking": "工作",
+    "a2aStateCompleted": "已完成",
+    "a2aStateFailed": "失敗",
+    "a2aStateCancelled": "取消",
+    "a2aTaskId": "任務編號",
+    "a2aEvents": "活動",
+    "a2aArtifacts": "文物",
+    "a2aNoTasks": "沒有記錄 A2A 任務。",
+    "a2aLoadingTasks": "正在載入 A2A 任務...",
+    "actor": "演員",
+    "actorPlaceholder": "按演員篩選",
+    "eventTypes": {
+      "apiKey.activate": "API 金鑰已啟用",
+      "apiKey.ban": "API 金鑰已被禁止",
+      "apiKey.deactivate": "API 金鑰已停用",
+      "apiKey.regenerate": "API 金鑰已重新生成",
+      "apiKey.scopes.grant": "API 金鑰範圍已授予",
+      "apiKey.scopes.revoke": "API 金鑰範圍已被撤銷",
+      "apiKey.scopes.update": "API 金鑰範圍已更新",
+      "apiKey.unban": "API 金鑰已解禁",
+      "auth.login.error": "登入錯誤",
+      "auth.login.failed": "登入失敗",
+      "auth.login.locked": "登入被鎖定",
+      "auth.login.misconfigured": "登入配置錯誤",
+      "auth.login.setup_required": "需要登入設定",
+      "auth.login.success": "登入成功",
+      "auth.logout.success": "登出成功",
+      "compliance.cleanup": "合規清理",
+      "provider.credentials.applied": "提供者憑據已應用",
+      "provider.credentials.batch_revoked": "提供者憑據批次已撤銷",
+      "provider.credentials.bulk_created": "提供者憑據批次建立",
+      "provider.credentials.bulk_imported": "提供者憑據已批次匯入",
+      "provider.credentials.created": "提供者憑據已建立",
+      "provider.credentials.imported": "提供者憑據已匯入",
+      "provider.credentials.revoked": "提供者憑據已被撤銷",
+      "provider.credentials.updated": "提供者憑據已更新",
+      "provider.validation.ssrf_blocked": "提供者 SSRF 被阻止",
+      "quota.plan.updated": "配額計劃已更新",
+      "quota.pool.created": "配額池已建立",
+      "quota.pool.deleted": "配額池已刪除",
+      "quota.pool.updated": "配額池已更新",
+      "quota.store.driver_changed": "配額儲存驅動程式已更改",
+      "server.start": "伺服器啟動",
+      "service.reveal_api_key": "服務 API 金鑰已洩露",
+      "settings.update": "設定已更新",
+      "settings.update_failed": "設定更新失敗",
+      "sync.token.created": "同步令牌已建立",
+      "sync.token.revoked": "同步令牌已撤銷"
+    }
+  },
+  "themesPage": {
+    "title": "主題",
+    "description": "選擇預設主題，或僅用一種顏色建立自定義主題",
+    "presetColors": "熱門配色",
+    "customTheme": "自定義主題",
+    "customThemeDesc": "點選建立主題，然後選擇一種顏色",
+    "createTheme": "建立主題",
+    "activePreset": "當前主題"
+  },
+  "header": {
+    "logout": "退出登入",
+    "language": "語言",
+    "providers": "提供商",
+    "providerDescription": "管理 AI 提供商連線",
+    "combos": "組合",
+    "comboDescription": "支援故障回退的模型組合",
+    "usage": "用量與分析",
+    "usageDescription": "監控 API 用量、Token 消耗和請求日誌",
+    "analytics": "分析",
+    "analyticsDescription": "檢視圖表、趨勢和評測洞察",
+    "cliTools": "CLI 工具",
+    "cliToolsDescription": "配置 CLI 工具",
+    "home": "首頁",
+    "homeDescription": "歡迎使用 OmniRoute",
+    "endpoint": "端點",
+    "endpointDescription": "管理代理端點、MCP、A2A 和 API 端點",
+    "mcp": "MCP",
+    "mcpDescription": "Model Context Protocol 服務管理與工具",
+    "a2a": "A2A",
+    "a2aDescription": "Agent-to-Agent 協議任務與可觀測性",
+    "settings": "設定",
+    "settingsDescription": "管理你的偏好設定",
+    "openaiCompatible": "OpenAI 相容",
+    "anthropicCompatible": "Anthropic 相容",
+    "media": "媒體",
+    "mediaDescription": "生成影像、影片和音樂",
+    "themes": "主題",
+    "themesDescription": "為整個儀表板選擇顏色主題",
+    "costsDescription": "跟蹤支出，分析趨勢，管理所有 AI 提供商的預算",
+    "cacheDescription": "監控提供商提示快取效率和本地語義響應複用。",
+    "limitsDescription": "為每個 API 金鑰和提供商配置速率限制和配額",
+    "runtimeDescription": "即時執行時可觀測性 — 斷路器、冷卻、模型鎖定、會話和配額告警",
+    "apiManagerDescription": "管理 OmniRoute 例項的 API 金鑰和訪問控制",
+    "batchDescription": "通過批次 API 呼叫非同步處理大量請求",
+    "contextCavemanDescription": "基於規則的訊息壓縮、語言包、分析和輸出模式控制。",
+    "contextRtkDescription": "針對工具輸出、終端日誌和構建結果的命令感知壓縮。",
+    "contextCombosDescription": "定義如何為不同路由場景組合引擎。",
+    "changelogDescription": "瞭解最新平臺功能和公告。",
+    "agentsDescription": "管理和配置 AI 代理工具：Codex、Devin、Jules 和自定義代理",
+    "cloudAgentsDescription": "編排基於雲的 AI 代理，支援即時任務跟蹤和計劃審批",
+    "memoryDescription": "持久的對話記憶，支援語義搜尋和 FTS5 全文索引",
+    "skillsDescription": "安裝和管理沙箱技能，實現自動提示和執行",
+    "agentSkillsDescription": "代理就緒技能目錄，一鍵複製 URL 以整合 AI 客戶端",
+    "translatorDescription": "跨 API 格式翻譯和測試提示：OpenAI ↔ Claude ↔ Gemini",
+    "playgroundDescription": "互動式測試提示，即時檢視提供商響應和格式檢查",
+    "searchToolsDescription": "搜尋分析、提供商細分、快取命中率和成本跟蹤",
+    "logsDescription": "即時請求日誌、錯誤追蹤和流式事件檢查器",
+    "auditDescription": "API 金鑰使用、MCP 工具呼叫和策略事件的合規審計追蹤",
+    "webhooksDescription": "配置 Webhook 端點以接收即時事件通知",
+    "healthDescription": "系統健康概覽：提供商、斷路器、速率限制和資料庫",
+    "proxyDescription": "為出站提供商連線配置上游代理設定",
+    "apiEndpointsDescription": "管理自定義 API 端點配置和路由覆蓋",
+    "batchFilesDescription": "瀏覽和管理批處理作業輸出檔案和結果",
+    "analyticsEvalsDescription": "模型評估結果和效能基準",
+    "analyticsSearchDescription": "搜尋查詢分析、快取命中率和成本跟蹤",
+    "analyticsUtilizationDescription": "提供商利用率指標和容量規劃",
+    "analyticsComboHealthDescription": "組合路由配置的即時健康與效能",
+    "analyticsCompressionDescription": "上下文壓縮分析和令牌節省",
+    "costsBudgetDescription": "每個 API 金鑰和提供商的預算限制和支出告警",
+    "costsPricingDescription": "用於令牌成本計算的自定義定價配置",
+    "logsProxyDescription": "上游代理請求日誌和流量檢查",
+    "logsConsoleDescription": "應用控制台輸出和除錯日誌",
+    "logsActivityDescription": "使用者操作和系統事件的審計追蹤",
+    "auditMcpDescription": "MCP 工具呼叫審計追蹤和合規記錄",
+    "auditA2a": "A2A稽核",
+    "auditA2aDescription": "A2A任務執行審計追蹤、狀態轉換、技能呼叫記錄",
+    "settingsGeneralDescription": "儲存、資料庫和通用例項配置",
+    "settingsAppearanceDescription": "主題、品牌和視覺自定義",
+    "settingsAiDescription": "AI 行為、思維預算、視覺和記憶設定",
+    "settingsSecurityDescription": "認證、授權和訪問控制設定",
+    "featureFlags": "功能標誌",
+    "featureFlagsDescription": "控制系統能力和實驗特點",
+    "featureFlagsActive": "{count} 活躍",
+    "featureFlagsInactive": "{count} 無效",
+    "featureFlagsOverrides": "{count} 資料庫覆蓋",
+    "featureFlagsSearch": "搜尋標誌...",
+    "featureFlagsCategoryAll": "全部",
+    "featureFlagsCategorySecurity": "安全性",
+    "featureFlagsCategoryNetwork": "網路",
+    "featureFlagsCategoryPolicies": "政策",
+    "featureFlagsCategoryRuntime": "執行時",
+    "featureFlagsCategoryCli": "命令列介面",
+    "featureFlagsCategoryHealth": "健康",
+    "featureFlagsSourceDb": "資料庫",
+    "featureFlagsSourceEnv": "環境電壓",
+    "featureFlagsSourceDefault": "預設",
+    "featureFlagsReset": "重置",
+    "featureFlagsResetAll": "重置所有覆蓋",
+    "featureFlagsResetAllConfirm": "您確定要重置所有功能標誌覆蓋嗎？這會將所有標誌恢復為其 ENV 或預設值。",
+    "featureFlagsRestartRequired": "需要重啟才能申請",
+    "featureFlagsNoResults": "沒有符合您搜尋條件的標誌",
+    "featureFlagsSaved": "標誌已更新",
+    "featureFlagsError": "更新標誌失敗",
+    "settingsRoutingDescription": "路由規則、模型別名、組合預設值和降級設定",
+    "settingsResilienceDescription": "斷路器、重試和回退配置",
+    "settingsAdvancedDescription": "高階負載規則、請求限制和代理 API 設定",
+    "mitmProxyDescription": "配置 MITM 代理設定以進行流量檢查和除錯",
+    "oneProxyDescription": "配置 1Proxy 設定以實現高階代理鏈",
+    "omniSkillsDescription": "安裝和管理用於自動提示和工具執行的沙箱技能"
+  },
+  "home": {
+    "quickStart": "快速入門",
+    "quickStartDesc": "4 個步驟快速上手：連線提供商、路由模型並監控全域性執行情況。",
+    "fullDocs": "完整文件",
+    "step1Title": "1. 建立 API 金鑰",
+    "step1Desc": "前往 <endpoint>端點</endpoint> -> 已註冊金鑰。為每個環境生成一個獨立金鑰。",
+    "step2Title": "2. 連線提供商",
+    "step2Desc": "在 <providers>提供商</providers> 中新增帳戶。支援 OAuth、API Key 和免費套餐。",
+    "step3Title": "3. 配置客戶端",
+    "step3Desc": "在 IDE 或 API 客戶端中將基本 URL 設定為 {url}。",
+    "step4Title": "4. 監控與最佳化",
+    "step4Desc": "在 <logs>請求日誌</logs> 和 <analytics>分析</analytics> 中跟蹤 Token、成本與錯誤。",
+    "providersOverview": "提供商概覽",
+    "configuredOf": "{total} 個可用提供商中已配置 {configured} 個",
+    "noModelsAvailable": "該提供商當前沒有可用模型。",
+    "noProvidersConfigured": "尚未配置提供商",
+    "addProvider": "新增提供商",
+    "configureFirst": "首先在 {providers} 中配置連線",
+    "configureProvider": "配置提供商",
+    "modelAvailable": "{count} 模型可用",
+    "modelsAvailable": "{count} 個模型可用",
+    "connectionsActive": "{count} 連線處於活動狀態",
+    "connectionsActivePlural": "{count} 連線處於活動狀態",
+    "copyModelName": "複製模型名稱",
+    "documentation": "文件",
+    "healthMonitor": "健康監測",
+    "reportIssue": "報告問題",
+    "activeError": "{active} 有效 · {errors} 錯誤",
+    "oauthLabel": "OAuth",
+    "apiKeyLabel": "API金鑰",
+    "requestsShort": "{count} 次請求",
+    "providerModelsTitle": "{provider} - 模型",
+    "copiedModel": "已複製：{model}",
+    "aliasLabel": "別名",
+    "updateNow": "立即更新",
+    "updating": "更新中...",
+    "updateAvailableDesc": "有新版本可用。點選更新。",
+    "updateStarted": "更新已開始...",
+    "reloadingPageAutomatically": "自動重新載入頁面...",
+    "providerTopology": "提供商拓撲"
+  },
+  "analytics": {
+    "title": "分析",
+    "usageAnalyticsTitle": "用量分析",
+    "diversityScoreTitle": "供應商多元化",
+    "diversityScoreDesc": "近期流量視窗內提供商集中度的快照。",
+    "diversityShannonEntropy": "夏農熵",
+    "diversityWindow": "視窗:{count} 次請求 · 最近 {mins} 分鐘",
+    "diversityHealthy": "分佈健康",
+    "diversityRiskHigh": "供應商鎖定風險高",
+    "diversityRiskModerate": "分佈一般",
+    "diversityScoreLabel": "得分",
+    "diversityHigherExplanation": "數值越高,表示流量分散到的提供商越多。",
+    "diversityNoData": "暫無近期用量資料。",
+    "chartRequests": "請求數",
+    "chartInput": "輸入",
+    "chartOutput": "輸出",
+    "chartTotal": "合計",
+    "chartCost": "成本",
+    "chartShare": "佔比",
+    "chartServiceTier": "服務層級",
+    "chartServiceTierSplit": "Fast / Standard 成本拆分",
+    "chartCostPct": "佔成本 {pct}%",
+    "chartUsageDetail": "用量明細",
+    "chartCacheRead": "快取讀取",
+    "chartCostByProvider": "按提供商劃分的成本",
+    "chartNoCostData": "無成本資料",
+    "chartModelUsageOverTime": "模型用量趨勢",
+    "chartNoData": "無資料",
+    "chartWeekly": "每週",
+    "chartModelBreakdown": "按模型拆分",
+    "chartModel": "模型",
+    "chartProvider": "提供商",
+    "chartProviderBreakdown": "按提供商拆分",
+    "filterAllKeys": "全部金鑰",
+    "filterSearchKeys": "搜尋金鑰…",
+    "filterNoKeysMatch": "沒有匹配的金鑰",
+    "filterOneKey": "1 個金鑰",
+    "filterMultipleKeys": "{count} 個金鑰",
+    "rangeToday": "今天",
+    "rangeYesterday": "昨天",
+    "rangeLast3Days": "最近 3 天",
+    "rangeThisWeek": "本週",
+    "rangeLast14Days": "最近 14 天",
+    "rangeThisMonth": "本月",
+    "rangeQuickSelect": "快速選擇",
+    "rangeStart": "起始",
+    "rangeEnd": "結束",
+    "rangeCancel": "取消",
+    "rangeApply": "應用",
+    "rangeErrorInvalid": "起始時間必須早於結束時間",
+    "period1D": "1 天",
+    "period7D": "7 天",
+    "period30D": "30 天",
+    "period90D": "90 天",
+    "periodYTD": "年初至今",
+    "periodAll": "全部",
+    "totalTokens": "總 Token 數",
+    "inputTokens": "輸入 Token",
+    "outputTokens": "輸出 Token",
+    "estCost": "預估成本",
+    "infraTitle": "基礎設施",
+    "infraAccounts": "帳號",
+    "infraProviders": "提供商",
+    "infraApiKeys": "API 金鑰",
+    "infraModels": "模型",
+    "perfTitle": "效能",
+    "perfAvgTokens": "平均 Token / 請求",
+    "perfCostReq": "成本 / 請求",
+    "perfIoRatio": "輸入/輸出比",
+    "perfFastReq": "Fast 請求",
+    "highlightsTitle": "亮點",
+    "highlightsTopModel": "熱門模型",
+    "highlightsTopProvider": "熱門提供商",
+    "highlightsBusiestDay": "最繁忙的一天",
+    "highlightsDiversity": "多樣性",
+    "highlightsFallbackRate": "回退率",
+    "customRange": "自定義",
+    "overviewDescription": "監控所有提供商和模型的 API 使用模式、令牌消耗、成本和活動趨勢。",
+    "evalsDescription": "執行評估套件來測試和驗證您的 LLM 端點。比較模型質量、檢測迴歸和基準延遲。",
+    "overview": "概述",
+    "evals": "評測",
+    "utilization": "利用率",
+    "utilizationDescription": "提供商配額使用趨勢和速率限制跟蹤",
+    "modelStatus": "模型狀態",
+    "modelStatusCooldown": "冷卻中",
+    "modelStatusUnavailable": "不可用",
+    "modelStatusError": "錯誤",
+    "comboHealth": "組合健康狀況",
+    "comboHealthDescription": "組合級別配額、使用分佈和效能指標",
+    "compressionAnalyticsTitle": "壓縮分析",
+    "compressionAnalyticsDescription": "壓縮分析 — token 節省、模式分佈和提供商統計。",
+    "autoRoutingTotalAutoRequests": "自動請求總數",
+    "autoRoutingAvgSelectionScore": "平均選擇分數",
+    "autoRoutingExplorationRate": "探索率",
+    "autoRoutingLkgpHitRate": "LKGP命中率",
+    "autoRoutingRequestsByVariant": "變體請求",
+    "autoRoutingTopRoutedProviders": "頂級路由提供商",
+    "comboHealthWorstQuotaLeft": "剩餘最差名額",
+    "comboHealthUsageSkew": "使用偏差",
+    "comboHealthSuccessRate": "成功率",
+    "comboHealthQuotaHealth": "配額健康",
+    "comboHealthRequests": "要求",
+    "comboHealthTokens": "代幣",
+    "comboHealthAvgLatency": "平均延遲",
+    "comboHealthTotalRequests": "請求總數",
+    "comboHealthExecutionTargets": "執行目標",
+    "comboHealthSuccess": "成功",
+    "comboHealthLatency": "延遲",
+    "comboHealthQuota": "配額",
+    "comboHealthTitle": "組合健康",
+    "comboHealthUnableToLoad": "無法載入組合生命值",
+    "comboHealthGettingStarted": "開始使用",
+    "compressionAnalyticsTotalRequests": "請求總數",
+    "compressionAnalyticsTokensSaved": "已儲存代幣",
+    "compressionAnalyticsAvgSavings": "平均節省",
+    "compressionAnalyticsAvgDuration": "平均持續時間",
+    "compressionAnalyticsReceipts": "收據",
+    "compressionAnalyticsFallbacks": "後備措施",
+    "compressionAnalyticsPromptTokens": "提示標記",
+    "compressionAnalyticsCompletionTokens": "完成標記",
+    "compressionAnalyticsTotalTokens": "代幣總數",
+    "compressionAnalyticsCacheTokens": "快取令牌",
+    "compressionAnalyticsNoDataYet": "還沒有壓縮資料",
+    "searchAnalyticsTotalSearches": "總搜尋次數",
+    "searchAnalyticsCacheHitRate": "快取命中率",
+    "searchAnalyticsTotalCost": "總成本",
+    "searchAnalyticsAvgResponse": "平均響應",
+    "searchAnalyticsNoSearchesYet": "還沒有搜尋",
+    "providerUtilizationTitle": "提供商利用率",
+    "providerUtilizationFailedToLoad": "無法載入利用率資料",
+    "providerUtilizationNoData": "沒有可用的利用率資料",
+    "providerUtilizationGettingStarted": "開始使用",
+    "providerUtilizationLatestSnapshot": "最新配額快照",
+    "providerUtilizationRemainingCapacity": "剩餘容量"
+  },
+  "apiManager": {
+    "title": "API 金鑰",
+    "createKey": "建立 API 金鑰",
+    "key": "金鑰",
+    "revokeKey": "撤銷金鑰",
+    "revokeConfirm": "確定要撤銷這個 API 金鑰嗎？",
+    "noKeys": "還沒有 API 金鑰",
+    "noKeysDesc": "建立你的第一個 API 金鑰，用於驗證發往端點的請求",
+    "keyLabel": "金鑰標籤",
+    "permissions": "許可權",
+    "expiresAt": "過期時間",
+    "never": "永不過期",
+    "revoke": "撤銷",
+    "showKey": "顯示金鑰",
+    "hideKey": "隱藏金鑰",
+    "copyKey": "複製 API 金鑰",
+    "allModels": "全部模型",
+    "selectedModels": "已選模型",
+    "readOnly": "只讀",
+    "fullAccess": "完全訪問",
+    "keyManagement": "API 金鑰管理",
+    "keyManagementDesc": "建立和管理用於訪問端點的 API 金鑰",
+    "totalKeys": "金鑰總數",
+    "restricted": "受限",
+    "totalRequests": "請求總數",
+    "modelsAvailable": "可用模型",
+    "registeredKeys": "已註冊金鑰",
+    "keysRegistered": "已註冊 {count} 個金鑰",
+    "keyRegistered": "已註冊 {count} 個金鑰",
+    "keysSecurityNote": "每個金鑰的用量跟蹤彼此隔離，並且可以單獨撤銷。出於安全考慮，金鑰建立後會被遮罩顯示。",
+    "createFirstKey": "建立第一個金鑰",
+    "name": "名稱",
+    "usage": "用量",
+    "created": "建立時間",
+    "actions": "操作",
+    "reqs": "請求",
+    "neverUsed": "從未使用",
+    "deleteConfirm": "刪除這個 API 金鑰？",
+    "usageTips": "使用提示",
+    "tipAuth": "在 Authorization 請求頭中以 Bearer YOUR_KEY 的形式使用 API 金鑰",
+    "tipSecure": "金鑰只會在建立時顯示一次，請妥善儲存",
+    "tipSeparate": "建議為不同客戶端或環境建立獨立金鑰",
+    "tipRestrict": "將金鑰限制到特定模型，可提升安全性並更好控制成本",
+    "keyName": "金鑰名稱",
+    "keyNamePlaceholder": "例如：生產環境金鑰、開發環境金鑰",
+    "keyNameDesc": "使用清晰的名稱標識該金鑰的用途",
+    "managementAccessDesc": "允許此 API 金鑰管理 OmniRoute 配置。",
+    "selfServiceVisibility": "自助可見性",
+    "selfServiceVisibilityDesc": "控制此金鑰可檢視自身用量和共享上游配額的範圍。",
+    "ownUsageVisibility": "自身成本和 Token 用量",
+    "ownUsageVisibilityDesc": "允許此金鑰呼叫狀態端點，檢視自身美元用量、預算佔比和 Token 總量。",
+    "sharedAccountQuotaVisibility": "共享帳號配額",
+    "sharedAccountQuotaVisibilityDesc": "當配置了一個明確連線時，允許此金鑰檢視共享上游帳號配額。",
+    "localUsageCommand": "__MISSING__:Allow local usage command",
+    "localUsageCommandDesc": "__MISSING__:Allows this API key to use @@om-usage to retrieve cached usage and quota information without calling an upstream provider.",
+    "localUsageCommandBadge": "__MISSING__:Usage cmd",
+    "keyCreated": "API 金鑰已建立",
+    "keyCreatedSuccess": "金鑰建立成功！",
+    "keyCreatedNote": "請立即複製並儲存此金鑰，它不會再次顯示。",
+    "done": "完成",
+    "savePermissions": "儲存許可權",
+    "endpointRestrictions": "允許的端點",
+    "allEndpointsAllowed": "此金鑰可以訪問所有 API 端點。",
+    "endpointsRestricted": "僅限 {count} 個端點。",
+    "autoResolve": "自動解析",
+    "autoResolveDesc": "為這個 API 金鑰自動將有歧義的模型名解析到原生提供商。",
+    "streamDefaultMode": "流預設相容性",
+    "streamDefaultModeDesc": "此鍵省略了 `stream` 標誌。JSON 模式返回非流式響應，除非客戶端明確請求 SSE。",
+    "streamDefaultLegacy": "遺留",
+    "streamDefaultJson": "JSON 相容",
+    "streamDefaultBadge": "JSON 流預設",
+    "keyActive": "金鑰啟用狀態",
+    "keyActiveDesc": "啟用或停用此 API 金鑰。被停用的金鑰會立即返回 403。",
+    "accessSchedule": "訪問時段",
+    "accessScheduleDesc": "將訪問限制在一週中的特定日期和時段。",
+    "scheduleFrom": "開始時間",
+    "scheduleUntil": "結束時間",
+    "scheduleDays": "日期",
+    "scheduleTimezone": "時區",
+    "scheduleTimezoneHint": "使用 IANA 時區名稱，例如 America/New_York、Europe/Berlin",
+    "scheduleActive": "時段限制",
+    "disabled": "已停用",
+    "daySun": "週日",
+    "dayMon": "週一",
+    "dayTue": "週二",
+    "dayWed": "週三",
+    "dayThu": "週四",
+    "dayFri": "週五",
+    "daySat": "週六",
+    "allowAll": "允許全部",
+    "restrict": "限制訪問",
+    "allowAllInfo": "該金鑰可訪問所有可用模型。",
+    "restrictInfo": "該金鑰可訪問 {total} 個模型中的 {selected} 個。",
+    "selected": "已選擇 {count} 個",
+    "all": "全部",
+    "clear": "清空",
+    "searchModels": "按名稱或提供商搜尋模型...",
+    "noModelsFound": "未找到模型",
+    "keyNameRequired": "金鑰名稱不能為空",
+    "keyNameTooLong": "金鑰名稱長度不能超過 {max} 個字元",
+    "keyNameInvalid": "金鑰名稱只能包含字母、數字、空格、連字元和下劃線",
+    "invalidKeyName": "金鑰名稱無效",
+    "failedCreateKey": "建立金鑰失敗",
+    "failedCreateKeyRetry": "建立金鑰失敗，請重試。",
+    "invalidKeyId": "金鑰 ID 無效",
+    "failedDeleteKey": "刪除金鑰失敗",
+    "failedDeleteKeyRetry": "刪除金鑰失敗，請重試。",
+    "invalidModelsSelection": "模型選擇無效",
+    "cannotSelectMoreThanModels": "最多隻能選擇 {max} 個模型",
+    "failedUpdatePermissions": "更新許可權失敗",
+    "failedUpdatePermissionsRetry": "更新許可權失敗，請重試。",
+    "unknownProvider": "未知",
+    "copyMaskedKey": "複製遮罩後的金鑰",
+    "keyOnlyAvailableAtCreation": "完整金鑰僅會在建立時顯示一次，請在首次建立時立即複製儲存",
+    "modelsCount": "{count, plural, one {# 個模型} other {# 個模型}}",
+    "devicesCount": "__MISSING__:{count, plural, one {# device} other {# devices}}",
+    "devicesTooltip": "__MISSING__:{count, plural, one {# distinct IP/User-Agent device seen with this key (last 30 min)} other {# distinct IP/User-Agent devices seen with this key (last 30 min)}}",
+    "lastUsedOn": "最近使用：{date}",
+    "viewCostsFor": "檢視 {name} 的費用",
+    "editPermissions": "編輯許可權",
+    "deleteKey": "刪除金鑰",
+    "regenerateKey": "重新生成金鑰",
+    "regenerateConfirm": "您確定要重新生成此 API 金鑰嗎？舊金鑰將立即失效。",
+    "failedRegenerateKey": "無法重新生成 API 金鑰",
+    "failedRegenerateKeyRetry": "無法重新生成 API 金鑰。請再試一次。",
+    "model": "{count} 個模型",
+    "models": "{count} 個模型",
+    "permissionsTitle": "許可權：{name}",
+    "allowAllDesc": "該金鑰可訪問所有可用模型。",
+    "restrictDesc": "該金鑰可訪問 {totalModels} 個模型中的 {selectedCount} 個。",
+    "selectedCount": "已選擇 {count} 個",
+    "maxActiveSessions": "最大活動會話數",
+    "apiManagerCustomRateLimits": "自定義費率限制",
+    "apiManagerCustomRateLimitsDesc": "覆蓋全域性預設限制。留空以使用預設值。",
+    "apiManagerRateLimitRequestsPlaceholder": "要求",
+    "apiManagerRateLimitReqPer": "請求/",
+    "apiManagerRateLimitSecondsPlaceholder": "秒數",
+    "apiManagerRemoveLimitTitle": "移除限制",
+    "apiManagerTimezonePlaceholder": "美洲/聖保羅",
+    "noLogPayloadPrivacy": "無日誌有效負載隱私",
+    "bannedStatus": "禁止狀態",
+    "managementApiAccess": "管理API訪問",
+    "expirationDate": "有效期",
+    "managementAccess": "管理訪問",
+    "allowedConnections": "允許的連線",
+    "searchPlaceholder": "按名稱或 token 搜尋...",
+    "activeOnly": "僅顯示啟用",
+    "filterStatus": "狀態",
+    "filterType": "型別",
+    "filterAll": "全部",
+    "filterStatusActive": "啟用",
+    "filterStatusDisabled": "已停用",
+    "filterStatusBanned": "已封禁",
+    "filterStatusExpired": "已過期",
+    "filterTypeStandard": "標準",
+    "filterTypeManage": "管理",
+    "filterTypeRestricted": "受限",
+    "shownOf": "已顯示 {shown} / {total}",
+    "emptyFilterTitle": "沒有金鑰匹配當前篩選條件",
+    "emptyFilterClear": "清除篩選",
+    "disableNonPublicModels": "停用非公開模型",
+    "disableNonPublicModelsDesc": "拒絕對未發現或未標記為公共的模型在提供者目錄中的請求",
+    "normalKeysSection": "普通鍵",
+    "quotaKeysSection": "配額金鑰",
+    "quotaPill": "配額",
+    "quotaModeOnly": "僅配額"
+  },
+  "auditLog": {
+    "title": "稽核日誌",
+    "searchPlaceholder": "搜尋操作...",
+    "action": "操作",
+    "actor": "操作人",
+    "target": "目標",
+    "ipAddress": "IP地址",
+    "timestamp": "時間戳",
+    "noEntries": "未找到稽核條目",
+    "filterByAction": "按操作過濾...",
+    "filterByActor": "按操作人篩選...",
+    "filterEntriesAria": "過濾稽核日誌條目",
+    "filterByActionTypeAria": "按操作型別過濾",
+    "filterByActorAria": "按操作人篩選",
+    "refreshAuditLogAria": "重新整理稽核日誌",
+    "tableAria": "稽核日誌條目",
+    "failedFetchAuditLog": "無法獲取稽核日誌",
+    "notAvailable": "—",
+    "description": "行政行為和安全事件",
+    "showing": "顯示 {count} 條目（偏移量 {offset}）",
+    "previous": "上一頁"
+  },
+  "media": {
+    "title": "媒體",
+    "subtitle": "生成影像、影片和音樂",
+    "model": "模型",
+    "prompt": "提示詞",
+    "generate": "生成",
+    "generating": "生成中...",
+    "loadingModels": "正在載入可用模型...",
+    "noModels": "暫無可用模型。請先配置支援媒體能力的提供商。",
+    "error": "生成失敗",
+    "result": "結果",
+    "imageDescription": "使用 OpenAI、xAI、Together、Hyperbolic、SD WebUI、ComfyUI 等根據文本提示生成影像。",
+    "videoDescription": "通過 ComfyUI 或 SD WebUI 使用 AnimateDiff、Stable Video Diffusion 建立影片。",
+    "musicDescription": "通過 ComfyUI 使用 Stable Audio Open 或 MusicGen 生成音樂。",
+    "kinds": {
+      "embedding": "向量嵌入",
+      "image": "影像",
+      "imageToText": "影像轉文字",
+      "tts": "文字轉語音",
+      "stt": "語音轉文字",
+      "webSearch": "網路搜尋",
+      "webFetch": "網頁抓取",
+      "video": "影片",
+      "music": "音樂",
+      "ocr": "__MISSING__:OCR"
+    },
+    "noProviders": "尚未為此型別配置任何提供商。",
+    "addConnection": "新增連線",
+    "backToProviders": "返回提供商列表",
+    "connections": "{count} 個連線",
+    "noConnections": "暫無連線 —— 請從提供商頁面新增。",
+    "loading": "正在載入...",
+    "suggestedModels": "__MISSING__:Suggested models from provider"
+  },
+  "search": {
+    "searchQuery": "搜尋詞",
+    "searchResults": "搜尋結果",
+    "cachedResult": "已快取",
+    "searchCost": "成本",
+    "searchTools": "搜尋工具",
+    "searchToolsDesc": "支援提供商對比的高階搜尋測試",
+    "compareProviders": "對比提供商",
+    "rerankResults": "結果重排",
+    "searchHistory": "搜尋歷史",
+    "urlOverlap": "URL 重疊度",
+    "noSearchProviders": "尚未配置搜尋提供商。請前往設定新增。",
+    "noRerankModels": "沒有可用的重排模型",
+    "webSearch": "網頁搜尋",
+    "provider": "提供商",
+    "searchType": "搜尋型別",
+    "maxResults": "最大結果數",
+    "filters": "篩選條件",
+    "country": "國家",
+    "language": "語言",
+    "timeRange": "時間範圍",
+    "includeDomains": "包含域名",
+    "excludeDomains": "排除域名",
+    "safeSearch": "安全搜尋",
+    "safeSearchOff": "關閉",
+    "safeSearchModerate": "中等",
+    "safeSearchStrict": "嚴格",
+    "queryPlaceholder": "輸入搜尋詞...",
+    "providerAuto": "自動（最低成本）",
+    "searchTypeWeb": "網頁",
+    "searchTypeNews": "新聞",
+    "optionAny": "任意",
+    "timeRangeDay": "過去一天",
+    "timeRangeWeek": "過去一週",
+    "timeRangeMonth": "過去一個月",
+    "timeRangeYear": "過去一年",
+    "domainPlaceholder": "example.com",
+    "requestTimedOut": "請求超時（{seconds}s）",
+    "networkError": "網路錯誤",
+    "formatted": "格式化檢視",
+    "rawJson": "JSON",
+    "cacheMiss": "未命中快取",
+    "cacheHit": "命中快取",
+    "latency": "延遲",
+    "cost": "成本",
+    "results": "結果",
+    "rerank": "重排",
+    "rerankModel": "重排模型",
+    "positionDelta": "排名變化",
+    "emptyState": "傳送搜尋請求後即可檢視結果",
+    "copy": "複製",
+    "resetToDefault": "重置為預設值",
+    "tabSearch": "搜尋",
+    "tabScrape": "抓取",
+    "tabCompare": "比較",
+    "modalitiesGuide": "模態指南",
+    "searchConceptTitle": "搜尋",
+    "searchConceptDesc": "搜尋 = 獲取網頁結果列表（標題、URL、摘要、相關性分數）",
+    "scrapeConceptTitle": "抓取",
+    "scrapeConceptDesc": "抓取 = 提取 URL 的完整內容（Markdown、文本或 HTML）",
+    "compareConceptTitle": "比較",
+    "compareConceptDesc": "比較 = 跨 N 個提供商並排執行相同查詢，比較延遲、成本和結果重疊",
+    "rerankConceptTitle": "重新排序",
+    "rerankConceptDesc": "重新排序 = 通過 LLM 重新排序結果以基於查詢提高相關性",
+    "autoConceptTitle": "自動（最便宜）",
+    "autoConceptDesc": "自動（最便宜）= 自動選擇具有已配置憑據的最便宜可用提供商",
+    "providerCatalogTitle": "提供商目錄",
+    "kindSearch": "搜尋",
+    "kindFetch": "獲取/抓取",
+    "statusConfigured": "已配置",
+    "statusMissing": "無憑據",
+    "statusRateLimited": "速率受限",
+    "configureProvider": "在提供商中配置",
+    "loadingProviders": "載入提供商…",
+    "failedToLoadProviders": "載入提供商失敗",
+    "costPerQuery": "成本/查詢",
+    "freeQuota": "免費配額/月",
+    "scrapeUrl": "要抓取的 URL",
+    "scrapeUrlPlaceholder": "https://example.com",
+    "scrapeUrlRequired": "__MISSING__:URL is required",
+    "scrapeUrlInvalid": "__MISSING__:Invalid URL — it must start with http:// or https://",
+    "scrapeExtract": "提取",
+    "scrapeExtracting": "提取中…",
+    "scrapeFullPage": "整頁",
+    "scrapeFormat": "格式",
+    "formatMarkdown": "Markdown",
+    "formatHtml": "HTML",
+    "formatText": "文本",
+    "scrapePreview": "預覽",
+    "scrapeRaw": "原始",
+    "scrapeContentTruncated": "（已截斷，檢視原始）",
+    "scrapeMetadata": "後設資料",
+    "scrapeProvider": "提供商",
+    "scrapeSize": "大小",
+    "scrapeEmptyState": "__MISSING__:Enter a URL to extract its content",
+    "scrapeProvidersAvailable": "__MISSING__:Available providers: Firecrawl, Jina Reader, Tavily.",
+    "compareRun": "比較",
+    "compareRunning": "比較中…",
+    "autoProvider": "自動（最便宜）",
+    "configuredStatus": "已配置",
+    "rateLimitedStatus": "速率受限",
+    "noCredential": "無憑據",
+    "searchTypeLabel": "型別",
+    "rerankModelLabel": "重新排序模型",
+    "noneOption": "無",
+    "size": "大小"
+  },
+  "cliTools": {
+    "title": "CLI 工具",
+    "noActiveProviders": "當前沒有活躍的提供商",
+    "noActiveProvidersDesc": "請先新增並連線提供商以配置 CLI 工具。",
+    "mapModels": "對映模型",
+    "testConnection": "測試連線",
+    "connectionStatus": "連線狀態",
+    "configureEndpoint": "配置端點",
+    "instructions": "使用說明",
+    "modelMapping": "模型對映",
+    "baseUrl": "基礎 URL",
+    "apiKey": "API金鑰",
+    "configured": "已配置",
+    "notConfigured": "未配置",
+    "notInstalled": "未安裝",
+    "custom": "自定義",
+    "unknown": "未知",
+    "lastSavedAt": "最後儲存：{date}",
+    "never": "從來沒有",
+    "justNow": "剛才",
+    "minutesAgoShort": "{count} 分鐘前",
+    "hoursAgoShort": "{count} 小時前",
+    "daysAgoShort": "{count} 天前",
+    "monthsAgoShort": "{count} 個月前",
+    "yearsAgoShort": "{count}年前",
+    "runtimeCheckFailed": "執行時檢查失敗",
+    "yourApiKeyPlaceholder": "你的 API 金鑰",
+    "modelPlaceholder": "provider/model-id",
+    "configurationSaved": "配置儲存成功。",
+    "failedToSave": "儲存配置失敗。",
+    "noApiKeysCreateOne": "無 API 金鑰 - 在“金鑰”頁面建立一個",
+    "defaultOmnirouteKey": "sk_omniroute（預設）",
+    "selectModel": "選擇模型",
+    "selectModelForAlias": "選擇 {alias} 的模型",
+    "selectModelForTool": "選擇 {tool} 的模型",
+    "select": "選擇",
+    "clear": "清除",
+    "comingSoon": "即將推出",
+    "checkingRuntime": "正在檢查執行時狀態...",
+    "guideOnlyIntegration": "僅指南整合（無需本地執行時）",
+    "cliRuntimeDetected": "CLI 執行時已檢測到並準備就緒",
+    "cliFoundNotRunnable": "CLI 已找到但無法執行{reason}",
+    "cliRuntimeNotDetected": "未檢測到 CLI 執行時",
+    "binary": "二進位制",
+    "configPath": "配置路徑",
+    "configPathShort": "配置",
+    "failedCheckRuntimeStatus": "無法檢查執行時狀態。",
+    "copy": "複製",
+    "copied": "已複製",
+    "copyConfig": "複製配置",
+    "saveConfig": "儲存配置",
+    "selectionSaved": "選擇已儲存",
+    "guide": "指南",
+    "detected": "檢測到",
+    "notReady": "還沒準備好",
+    "active": "活躍",
+    "inactive": "不活躍",
+    "startMitm": "啟動中間人",
+    "stopMitm": "停止中間人",
+    "mitmStarted": "MITM 啟動成功！",
+    "mitmStopped": "MITM 已成功停止！",
+    "failedStart": "啟動 MITM 失敗",
+    "failedStop": "停止 MITM 失敗",
+    "saveMappings": "儲存對映",
+    "mappingsSaved": "對映已儲存！",
+    "failedSaveMappings": "儲存對映失敗",
+    "howItWorks": "工作原理：",
+    "antigravityHowWorksDesc": "Antigravity 會向 Google 端點發起請求，MITM 會攔截這些請求並重定向到 OmniRoute。",
+    "antigravityStep1": "1. 啟動 MITM，讓請求通過 OmniRoute 路由。",
+    "antigravityStep2Prefix": "2. 新增",
+    "antigravityStep2Suffix": "新增到您的主機檔案中作為 127.0.0.1。",
+    "antigravityStep3": "3. 開啟 Antigravity，請求就會被代理。",
+    "mitmHowWorksDesc": "{toolName} 會先向原始提供商端點發起請求，隨後由 MITM 攔截並重定向到 OmniRoute。",
+    "mitmStep1": "1. 啟動 MITM，讓請求經由 OmniRoute 路由。",
+    "mitmStep2Prefix": "2. 將",
+    "mitmStep2Suffix": "新增到你的 hosts 檔案，並指向 127.0.0.1。",
+    "mitmStep3": "3. 開啟 {toolName}，後續請求就會自動通過代理轉發。",
+    "sudoPasswordRequiredTitle": "需要 sudo 密碼",
+    "sudoPasswordHint": "修改主機檔案和系統代理設定需要管理員密碼。",
+    "enterSudoPassword": "輸入 sudo 密碼",
+    "sudoPasswordRequiredError": "必須提供 sudo 密碼。",
+    "cancel": "取消",
+    "confirm": "確認",
+    "settingsApplied": "設定應用成功！",
+    "failedApplySettings": "無法應用設定",
+    "settingsReset": "設定重置成功！",
+    "failedResetSettings": "重置設定失敗",
+    "backupRestored": "備份已恢復！",
+    "failedRestore": "恢復失敗",
+    "checkingCli": "正在檢查 {tool} CLI...",
+    "cliNotRunnable": "{tool} CLI 已安裝但無法執行",
+    "cliNotInstalled": "{tool} CLI 未安裝",
+    "cliNotDetected": "未檢測到 {tool} CLI",
+    "cliDetectedReady": "{tool} CLI 已檢測到並準備就緒",
+    "cliFoundFailedHealthcheck": "找到 {tool} CLI，但執行時執行狀況檢查失敗{reason}。",
+    "installCliPrompt": "請安裝 {tool} CLI 以使用此功能。",
+    "installCodexPrompt": "請先安裝 Codex CLI，才能使用自動應用功能。",
+    "hide": "隱藏",
+    "howToInstall": "如何安裝",
+    "installationGuide": "安裝指南",
+    "platforms": "macOS / Linux / Windows：",
+    "afterInstallationRun": "安裝後，執行",
+    "toVerify": "來驗證。",
+    "current": "當前",
+    "baseUrlPlaceholder": "https://.../v1",
+    "resetToDefault": "重置為預設值",
+    "providerModelPlaceholder": "提供商/模型 ID",
+    "apply": "應用",
+    "reset": "重置",
+    "manualConfig": "手動配置",
+    "backups": "備份",
+    "configBackups": "配置備份",
+    "noBackupsYet": "還沒有備份。每次應用或重置之前都會自動建立備份。",
+    "restore": "恢復",
+    "backupRestoredReloading": "備份已恢復！正在重新載入狀態...",
+    "failedRestoreBackup": "恢復備份失敗",
+    "applied": "已應用！",
+    "failed": "失敗",
+    "resetDone": "重置！",
+    "omnirouteConfiguredOpenAiCompatible": "OmniRoute 已配置為 OpenAI 相容提供商",
+    "provider": "提供商",
+    "model": "模型",
+    "providers": "提供商",
+    "auth": "授權",
+    "noApiKeysAvailable": "沒有可用的 API 金鑰",
+    "usingDefaultOmniroute": "使用預設值：sk_omniroute",
+    "updateConfig": "更新配置",
+    "applyConfig": "應用配置",
+    "noBackupsAvailable": "沒有可用的備份。",
+    "profileSaved": "配置檔案“{name}”已儲存！",
+    "failedSaveProfile": "儲存配置檔案失敗",
+    "profileActivated": "配置檔案已啟用！",
+    "failedActivateProfile": "啟用配置檔案失敗",
+    "profiles": "配置檔案",
+    "savedProfiles": "儲存的配置檔案",
+    "noProfilesYet": "尚未儲存配置檔案。將當前配置儲存為下面的配置檔案。",
+    "activate": "啟用",
+    "deleteProfile": "刪除配置檔案",
+    "profileNamePlaceholder": "配置檔案名稱（例如：個人帳戶）",
+    "saveCurrent": "儲存當前",
+    "codexAuthNotePrefix": "Codex 使用",
+    "codexAuthNoteMiddle": "與",
+    "codexAuthNoteSuffix": "單擊“應用”進行自動配置。",
+    "claudeManualConfiguration": "Claude CLI - 手動配置",
+    "codexManualConfiguration": "Codex CLI - 手動配置",
+    "droidManualConfiguration": "Factory Droid - 手動配置",
+    "openClawManualConfiguration": "OpenClaw - 手動配置",
+    "clineManualConfiguration": "Cline - 手動配置",
+    "kiloManualConfiguration": "Kilo - 手動配置",
+    "whenToUseLabel": "何時使用",
+    "openToolDocs": "開啟工具文件",
+    "toolUseCases": {
+      "claude": "當您需要強大的規劃工作流程和使用 Claude Code 進行長的多檔案重構時使用。",
+      "codex": "當您的團隊在 OpenAI Codex CLI 流程和基於配置檔案的身份驗證方面實現標準化時使用。",
+      "droid": "當您需要專注於快速編碼和命令執行迴圈的輕量級終端代理時使用。",
+      "openclaw": "當您需要 Open Claw 風格的編碼代理但通過 OmniRoute 策略進行路由時使用。",
+      "cline": "當您在編輯器內配置編碼代理並希望使用 OmniRoute 模型進行引導設定時使用。",
+      "kilo": "當您的工作流程依賴於 Kilo Code 命令和快速迭代編輯時使用。",
+      "cursor": "在 Cursor 中編碼並且需要通過 OmniRoute 自定義 OpenAI 相容模型時使用。",
+      "continue": "在 IDE 中執行“Continue”並且需要可移植的基於 JSON 的提供程式配置時使用。",
+      "opencode": "當您更喜歡通過 OpenCode 進行終端本機代理執行和指令碼自動化時使用。",
+      "kiro": "在整合 Kiro 並從 OmniRoute 集中控制模型路由時使用。",
+      "windsurf": "當您需要 Windsurf AI IDE 並通過 OmniRoute 路由模型時使用。",
+      "antigravity": "當必須通過 MITM 攔截 Antigravity/Kiro 流量並將其路由到 OmniRoute 時使用。",
+      "copilot": "當您想要 Copilot 聊天風格的 UX 同時強制執行 OmniRoute 鍵和路由規則時使用。",
+      "amp": "當您想要 Amp 簡寫工作流，但仍需要 OmniRoute 別名和路由規則支援時使用。",
+      "qwen": "當您需要使用阿里雲 Qwen Code CLI 進行編碼任務時使用。",
+      "hermes": "當您需要輕量級終端原生 AI 助手來處理快速任務時使用。",
+      "hermes-agent": "需要使用 Hermes Agent (by Nousresearch) 時使用,預設、委派、視覺與輔助模型均通過 OmniRoute 路由。",
+      "custom": "用於自定義工具實現或通用 OpenAI 相容配置。"
+    },
+    "toolDescriptions": {
+      "antigravity": "帶 MITM 的 Google Antigravity IDE",
+      "claude": "Claude Code CLI",
+      "codex": "OpenAI Codex CLI",
+      "droid": "Factory Droid AI 助手",
+      "openclaw": "OpenClaw AI 助手",
+      "cline": "Cline AI 編碼助手 CLI",
+      "kilo": "Kilo Code AI 助手 CLI",
+      "cursor": "Cursor AI 程式碼編輯器",
+      "continue": "繼續AI助手",
+      "opencode": "OpenCode AI 編碼智慧體（終端）",
+      "kiro": "Amazon Kiro - AI 驅動 IDE",
+      "windsurf": "Windsurf AI Code Editor",
+      "copilot": "GitHub Copilot AI Assistant",
+      "qwen": "Alibaba Qwen Code CLI",
+      "amp": "Sourcegraph Amp 程式設計助手 CLI",
+      "hermes": "Hermes AI 終端助手",
+      "hermes-agent": "Hermes Agent (by Nousresearch) — 支援多模型(委派、視覺、壓縮等)的高階終端 AI。",
+      "custom": "通用 OpenAI 相容 CLI 或 SDK 配置生成器"
+    },
+    "guides": {
+      "cursor": {
+        "notes": {
+          "0": "使用該功能需要 Cursor Pro 帳戶。",
+          "1": "Cursor 會通過自己的伺服器轉發請求，因此不支援本地端點。請在設定中啟用雲端點。"
+        },
+        "steps": {
+          "1": {
+            "title": "開啟設定",
+            "desc": "轉到設定 -> 模型"
+          },
+          "2": {
+            "title": "啟用 OpenAI API",
+            "desc": "開啟 “OpenAI API key” 選項"
+          },
+          "3": {
+            "title": "Base URL"
+          },
+          "4": {
+            "title": "API金鑰"
+          },
+          "5": {
+            "title": "新增自定義模型",
+            "desc": "點選“檢視所有模型”->“新增自定義模型”"
+          },
+          "6": {
+            "title": "選擇模型"
+          }
+        }
+      },
+      "continue": {
+        "steps": {
+          "1": {
+            "title": "開啟配置",
+            "desc": "開啟繼續配置檔案"
+          },
+          "2": {
+            "title": "API金鑰"
+          },
+          "3": {
+            "title": "選擇模型"
+          },
+          "4": {
+            "title": "新增模型配置",
+            "desc": "將以下配置新增到您的模型陣列中："
+          }
+        },
+        "notes": {
+          "0": "Continue 使用 JSON 配置檔案。"
+        }
+      },
+      "opencode": {
+        "steps": {
+          "1": {
+            "title": "安裝 OpenCode",
+            "desc": "通過 npm 安裝：npm install -g opencode-ai"
+          },
+          "2": {
+            "title": "API 金鑰"
+          },
+          "3": {
+            "title": "設定 Base URL",
+            "desc": "opencode config set baseUrl {baseUrl}"
+          },
+          "4": {
+            "title": "選擇模型"
+          },
+          "5": {
+            "title": "使用 Thinking 變體",
+            "desc": "對於思考模型，請使用 --variant high/low/max 執行（示例命令見下方）。"
+          }
+        },
+        "notes": {
+          "0": "OpenCode 需要配置 API 金鑰。",
+          "1": "將基礎 URL 設定為您的 OmniRoute 端點。"
+        }
+      },
+      "kiro": {
+        "steps": {
+          "1": {
+            "title": "開啟 Kiro 設定",
+            "desc": "前往 Settings → AI Provider"
+          },
+          "2": {
+            "title": "Base URL",
+            "desc": "貼上你的 OmniRoute 端點 URL"
+          },
+          "3": {
+            "title": "API 金鑰"
+          },
+          "4": {
+            "title": "選擇模型"
+          }
+        },
+        "notes": {
+          "0": "Kiro 需要 Amazon 帳戶。"
+        }
+      },
+      "windsurf": {
+        "steps": {
+          "1": {
+            "title": "開啟 AI 設定",
+            "desc": "點選 Windsurf 中的 AI Settings 圖示，或前往 Settings"
+          },
+          "2": {
+            "title": "新增自定義提供商",
+            "desc": "選擇 \"Add custom provider\" (OpenAI 相容)"
+          },
+          "3": {
+            "title": "Base URL",
+            "desc": "http://127.0.0.1:20128/v1"
+          },
+          "4": {
+            "title": "API Key",
+            "desc": "選擇你的 OmniRoute API 金鑰"
+          },
+          "5": {
+            "title": "選擇模型",
+            "desc": "從下拉選單中選擇模型"
+          }
+        }
+      }
+    },
+    "autoConfiguredTab": "自動配置",
+    "toolCategoriesDesc": "配置 AI 程式設計助手通過 OmniRoute 路由",
+    "allToolsTab": "所有工具",
+    "guidedClientsTab": "引導客戶端",
+    "mitmClientsTab": "MITM 客戶端",
+    "customCliTab": "自定義 CLI",
+    "toolCategories": "工具分類",
+    "visibleToolsCount": "{count} 個工具可用",
+    "customCliBuilderTitle": "相容 OpenAI 的 CLI 構建器",
+    "customCliBuilderDescription": "為任何接受 OpenAI 相容的基本 URL、API 金鑰和模型 ID 的 CLI 或 SDK 生成環境變數和 JSON 片段。",
+    "customCliNoModels": "連線至少一個提供者以填充模型選擇器。",
+    "customCliNameLabel": "CLI 名稱",
+    "customCliNamePlaceholder": "例如我的團隊 CLI",
+    "customCliDefaultModelLabel": "預設型號",
+    "customCliDefaultModelHelp": "使用任何 OmniRoute 模型 ID 或組合。大多數與 OpenAI 相容的 CLI 只需要 /v1 基本 URL 加上模型字串。",
+    "customCliKeyHelper": "對於本地安裝 OmniRoute 可以使用 sk_omniroute。在雲模式下，選擇您的管理 API 金鑰之一。",
+    "customCliAliasMappingsLabel": "別名對映",
+    "customCliAliasMappingsHelp": "需要穩定簡寫名稱的包裝器指令碼或配置檔案的可選幫助程式別名。",
+    "customCliAddAlias": "新增別名",
+    "customCliNoMappings": "還沒有別名對映。如果您的包裝器或團隊指令碼使用穩定的短名稱，請新增一個。",
+    "customCliAliasPlaceholder": "例如評論",
+    "customCliTargetModelLabel": "目標型號",
+    "customCliEndpointHintLabel": "如何連線端點",
+    "customCliEndpointHint": "將任何 OpenAI 相容客戶端指向 OmniRoute /v1 基本 URL。原始聊天完成端點是 {endpoint}。當工具需要提供程式物件時使用 JSON 塊，或者在讀取 OPENAI_* 變數時使用 env 指令碼。",
+    "customCliEnvBlockTitle": "環境 / shell 片段",
+    "customCliJsonBlockTitle": "提供者 JSON 塊",
+    "copilotConfigGenerator": "GitHub Copilot 配置生成器",
+    "copilotApiKey": "API金鑰",
+    "copilotFilterModelsPlaceholder": "過濾器型號...",
+    "copilotMaxInputTokens": "最大輸入令牌數",
+    "copilotMaxOutputTokens": "最大輸出代幣",
+    "copilotToolCalling": "工具呼叫",
+    "copilotPasteInto": "貼上到：",
+    "wireApiChatCompletions": "聊天完成 (/chat/completions)",
+    "wireApiResponses": "響應 API (/responses)"
+  },
+  "combos": {
+    "title": "組合",
+    "description": "建立支援權重路由與故障回退的模型組合",
+    "autoCatalogTitle": "自動路由目錄",
+    "autoCatalogTemplateCount": "{count} 個模板",
+    "autoCatalogDescription": "內建 auto/* 組合，從已連線的提供商動態解析。直接將這些 ID 作為 model 欄位使用——無需設定。",
+    "autoCatalogExpand": "展開自動路由目錄",
+    "autoCatalogCollapse": "收起自動路由目錄",
+    "createCombo": "建立組合",
+    "editCombo": "編輯組合",
+    "deleteCombo": "刪除組合",
+    "noModels": "沒有模型",
+    "noModelsYet": "尚未新增模型",
+    "addModel": "新增模型",
+    "addModelToCombo": "向組合中新增模型",
+    "routingStrategy": "路由策略",
+    "maxRetries": "最大重試次數",
+    "timeout": "超時時間（毫秒）",
+    "healthcheck": "健康檢查",
+    "priority": "優先順序",
+    "fallback": "回退",
+    "roundRobin": "輪詢",
+    "random": "隨機",
+    "leastLatency": "最低延遲",
+    "comboName": "組合名稱",
+    "comboNamePlaceholder": "my-combo",
+    "comboDescription": "__MISSING__:Description",
+    "comboDescriptionPlaceholder": "__MISSING__:Optional note describing this combo",
+    "deleteConfirm": "刪除這個組合？",
+    "noCombosYet": "還沒有組合",
+    "comboCreated": "組合建立成功",
+    "comboUpdated": "組合更新成功",
+    "comboDeleted": "組合已刪除",
+    "failedCreate": "建立組合失敗",
+    "failedUpdate": "更新組合失敗",
+    "errorCreating": "建立組合時出錯",
+    "errorUpdating": "更新組合時出錯",
+    "errorDeleting": "刪除組合時出錯",
+    "testFailed": "測試請求失敗",
+    "failedToggle": "切換組合狀態失敗",
+    "testResults": "測試結果 — {name}",
+    "resolvedBy": "最終由以下模型處理：",
+    "more": "另有 +{count} 個",
+    "reqs": "請求",
+    "success": "成功",
+    "proxyConfigured": "已配置代理",
+    "copyComboName": "複製組合名稱",
+    "enableCombo": "啟用組合",
+    "disableCombo": "停用組合",
+    "testCombo": "測試組合",
+    "duplicate": "複製",
+    "proxyConfig": "代理配置",
+    "nameRequired": "名稱不能為空",
+    "nameInvalid": "僅允許字母、數字、-、_、/ 和 .",
+    "nameHint": "僅允許字母、數字、-、_、/ 和 .",
+    "priorityDesc": "順序回退：優先嚐試模型 1，其次模型 2，以此類推",
+    "weightedDesc": "按照權重百分比分配流量，並支援失敗回退",
+    "roundRobinDesc": "迴圈分發：每個請求按順序輪到下一個模型",
+    "contextRelay": "上下文接力",
+    "contextRelayDesc": "在帳戶輪換時通過交接摘要保持會話連續性",
+    "randomDesc": "均勻隨機選擇，失敗後回退到剩餘模型",
+    "leastUsedDesc": "優先選擇請求數最少的模型，隨時間平衡負載",
+    "costOptimizedDesc": "根據定價優先路由到最便宜的模型",
+    "resetAware": "復位感知RR",
+    "resetAwareDesc": "平衡剩餘配額與 5 小時和每週重置，然後對相似分數進行迴圈賽",
+    "strictRandom": "嚴格隨機",
+    "strictRandomDesc": "洗牌池模式：每個模型使用一次後再重新洗牌",
+    "fusion": "__MISSING__:Fusion",
+    "fusionDesc": "__MISSING__:Fans the prompt to every panel model in parallel, then a judge model synthesizes one final answer",
+    "fusionJudgeModel": "__MISSING__:Judge model",
+    "fusionJudgeModelHelp": "__MISSING__:Model that synthesizes the panel answers into one final response. Leave empty to use the first panel model.",
+    "fusionMinPanel": "__MISSING__:Min panel",
+    "fusionMinPanelHelp": "__MISSING__:Successful panel answers required before stragglers get a grace window (default 2).",
+    "fusionStragglerGraceMs": "__MISSING__:Straggler grace (ms)",
+    "fusionStragglerGraceMsHelp": "__MISSING__:How long to wait for slow panel models once quorum is reached (default 8000).",
+    "fusionPanelHardTimeoutMs": "__MISSING__:Panel hard timeout (ms)",
+    "fusionPanelHardTimeoutMsHelp": "__MISSING__:Absolute cap so one hung model can't stall the whole panel (default 90000).",
+    "models": "模型",
+    "autoBalance": "自動平衡",
+    "advancedSettings": "高階設定",
+    "retryDelay": "重試延遲（毫秒）",
+    "concurrencyPerModel": "每模型併發數",
+    "queueTimeout": "排隊超時（毫秒）",
+    "contextRelayHandoffThreshold": "交接閾值",
+    "contextRelayHandoffThresholdHelp": "當配額使用達到該閾值時，OmniRoute 會在當前活躍帳戶耗盡前生成結構化交接摘要。",
+    "contextRelayMaxMessages": "摘要最大訊息數",
+    "contextRelayMaxMessagesHelp": "限制壓縮排接力摘要中的最近歷史訊息數量。",
+    "contextRelaySummaryModel": "摘要模型",
+    "contextRelaySummaryModelHelp": "僅用於生成交接摘要的可選覆蓋模型。留空則複用當前活躍的 combo 模型。",
+    "contextRelayProviderNote": "Context Relay 當前主要為 Codex 帳戶輪換生成交接摘要。與同一提供商的多個帳戶配合使用時，連續性效果最佳。",
+    "advancedHint": "留空則使用全域性預設值。這些設定會覆蓋每個提供商的配置。",
+    "failoverBeforeRetry": "重試之前進行故障轉移",
+    "maxSetRetries": "最大設定重試次數",
+    "setRetryDelayMs": "設定重試延遲（毫秒）",
+    "moveUp": "上移",
+    "moveDown": "下移",
+    "removeModel": "移除",
+    "saving": "儲存中...",
+    "weighted": "加權",
+    "leastUsed": "最少使用",
+    "costOpt": "成本最佳化",
+    "strategyGuideTitle": "如何使用這種策略",
+    "strategyGuideWhen": "適用場景",
+    "strategyGuideAvoid": "不適用場景",
+    "strategyGuideExample": "示例",
+    "strategyGuide": {
+      "priority": {
+        "when": "你有一個首選模型，只希望在失敗時才切換到備用模型。",
+        "avoid": "你需要在多個模型之間分配流量。",
+        "example": "主力編碼模型 + 發生故障時切換到更便宜的備份模型。"
+      },
+      "weighted": {
+        "when": "你需要在多個模型之間按比例分配流量。",
+        "avoid": "你無法長期維護準確的權重。",
+        "example": "80% 穩定模型 + 20% 金絲雀模型的釋出方案。"
+      },
+      "round-robin": {
+        "when": "你希望流量分佈可預測且均勻。",
+        "avoid": "模型之間的延遲或成本差異很大。",
+        "example": "同一模型掛在多個帳號上，用於分攤吞吐。"
+      },
+      "random": {
+        "when": "你只需要簡單分流，且不想做太多配置。",
+        "avoid": "你需要嚴格的流量保證。",
+        "example": "對等模型之間的快速原型驗證。"
+      },
+      "least-used": {
+        "when": "你希望根據即時負載動態均衡。",
+        "avoid": "流量太低，無法體現按使用量均衡的價值。",
+        "example": "混合負載場景下，某個模型常常更容易過載。"
+      },
+      "cost-optimized": {
+        "when": "降低成本是你的首要目標。",
+        "avoid": "定價資料缺失或已經過期。",
+        "example": "後臺任務或批處理作業，優先考慮更低成本。"
+      },
+      "reset-aware": {
+        "when": "您可以使用配額遙測和不同的重置視窗跨多個帳戶進行路由。",
+        "avoid": "大多數帳戶無法使用配額遙測。",
+        "example": "寧願明天每週重置 60% 的帳戶，也不願稍後重置 80% 的帳戶。"
+      },
+      "strict-random": {
+        "when": "適用於希望實現絕對均勻分配的場景，每個模型在重複前都會恰好使用一次。",
+        "avoid": "如果模型之間的質量或延遲差異較大，且呼叫順序很重要，則不建議使用。",
+        "example": "例如：同一模型掛載多個帳戶，用於更均勻地分攤使用量。"
+      },
+      "p2c": {
+        "when": "當您希望使用 Power-of-Two-Choices 演算法進行低延遲選擇時使用。",
+        "avoid": "對於少於等於 2 個模型的小型組合避免使用 — 與輪詢相比沒有優勢。",
+        "example": "示例：在 4 個或更多等效模型端點之間進行高吞吐量推理。"
+      },
+      "context-relay": {
+        "when": "當長會話必須在帳戶輪換時保持工作上下文不丟失時使用。",
+        "avoid": "當帳戶切換很少發生或您不希望額外的摘要請求時避免使用。",
+        "example": "示例：在接近配額耗盡時輪換多個帳戶的 Codex 會話。"
+      },
+      "fill-first": {
+        "when": "當您希望在轉移到下一個提供商之前完全耗盡一個提供商的配額時使用。",
+        "avoid": "當您需要在提供商之間進行請求級負載均衡時避免使用。",
+        "example": "示例：在使用完所有 200 美元的 Deepgram 額度後再回退到 Groq。"
+      },
+      "auto": {
+        "when": "當您需要基於成本、延遲和質量的多因素評分路由時使用。",
+        "avoid": "當您需要嚴格的優先順序排序或歷史永續性時避免使用。",
+        "example": "示例：在具有不同優勢的模型之間平衡請求。"
+      },
+      "lkgp": {
+        "when": "當您希望基於歷史成功率和效能進行路由時使用。",
+        "avoid": "當歷史資料有限或不可靠時避免使用。",
+        "example": "示例：路由到在特定任務上有良好記錄的模型。"
+      },
+      "context-optimized": {
+        "when": "當您需要最佳化模型間的上下文視窗使用時使用。",
+        "avoid": "當模型具有相似的上下文長度或任務簡單時避免使用。",
+        "example": "示例：在具有大上下文視窗的模型之間分配長對話。"
+      }
+    },
+    "advancedHelp": {
+      "maxRetries": "請求失敗前最多會嘗試多少次重試。",
+      "retryDelay": "兩次重試之間的初始等待時間。值越大越能降低突發壓力。",
+      "timeout": "請求被中止前允許的最長持續時間。",
+      "healthcheck": "路由決策時跳過不健康的模型或提供商。",
+      "concurrencyPerModel": "輪詢模式下每個模型允許的最大併發請求數。",
+      "queueTimeout": "請求在佇列中等待超時前允許停留的最長時間。",
+      "failoverBeforeRetry": "啟用後，任何上游錯誤都會觸發立即故障轉移到下一個組合目標，跳過所有重試和回退 URL。",
+      "maxSetRetries": "每個目標失敗時重試完整目標集的次數。 0 = 沒有設定級別重試。",
+      "setRetryDelayMs": "設定級別重試嘗試之間的延遲，為暫時性問題提供解決時間。",
+      "disableSessionStickiness": "__MISSING__:Rotate to a different connection on every request instead of pinning a whole conversation to one connection by the first-message hash. Overrides the global default. Leave on Inherit to preserve prompt-cache hits for multi-turn chats."
+    },
+    "templatesTitle": "快捷模板",
+    "templatesDescription": "先套用一個初始模板，再按需調整模型和配置。",
+    "templateApply": "應用模板",
+    "templateHighAvailability": "高可用",
+    "templateHighAvailabilityDesc": "優先順序路由，配合健康檢查和安全重試。",
+    "templateCostSaver": "節省成本",
+    "templateCostSaverDesc": "面向預算優先場景的成本最佳化路由。",
+    "templateBalanced": "均衡負載",
+    "templateBalancedDesc": "使用最少使用策略，隨時間均衡需求。",
+    "usageGuideHide": "隱藏",
+    "usageGuideDontShowAgain": "不再顯示",
+    "usageGuideShow": "顯示指南",
+    "quickTestTitle": "組合已準備好驗證",
+    "quickTestDescription": "現在執行一次測試，確認回退與延遲行為是否符合預期。",
+    "testNow": "立即測試",
+    "pricingCoverage": "定價覆蓋率",
+    "pricingCoverageHint": "成本最佳化策略在組合內所有模型都有定價資訊時效果最佳。",
+    "pricingAvailable": "已有定價",
+    "pricingMissing": "無定價",
+    "pricingAvailableShort": "已定價",
+    "pricingMissingShort": "無定價",
+    "warningRoundRobinSingleModel": "輪詢策略至少有 2 個模型時才最有價值。",
+    "warningCostOptimizedPartialPricing": "在 {total} 個模型中，只有 {priced} 個有定價資訊。路由可能只具備部分成本感知能力。",
+    "warningCostOptimizedNoPricing": "該組合未找到任何定價資料。成本最佳化策略的路由結果可能不符合預期。",
+    "filterAll": "全部",
+    "filterIntelligent": "智慧路由",
+    "filterDeterministic": "確定性",
+    "filterEmptyTitle": "沒有組合匹配此策略篩選。",
+    "filterEmptyIntelligentDescription": "建立自動或 LKGP 組合以填充智慧路由儀表盤。",
+    "filterEmptyDeterministicDescription": "當前僅存在自動和 LKGP 組合。切換回\"全部\"或建立確定性組合。",
+    "readinessTitle": "可以儲存了嗎？",
+    "readinessDescription": "在建立或更新組合前，請先檢查以下專案。",
+    "readinessCheckName": "組合名稱有效",
+    "readinessCheckModels": "至少選擇了一個模型",
+    "readinessCheckWeights": "加權總和為 100%",
+    "readinessCheckWeightsOptional": "當前策略無需權重規則",
+    "readinessCheckPricing": "已有定價資料",
+    "readinessCheckPricingOptional": "當前策略無需定價規則",
+    "saveBlockedTitle": "以下問題修復前無法儲存：",
+    "saveBlockName": "請先填寫組合名稱。",
+    "saveBlockModels": "請至少新增一個模型。",
+    "saveBlockWeighted": "請將權重總和設定為 100%（當前：{total}%）。",
+    "saveBlockPricing": "請至少為一個模型補充定價資訊，或改用其他策略。",
+    "recommendationsLabel": "推薦配置",
+    "applyRecommendations": "應用推薦",
+    "recommendationsUpdated": "已為 {strategy} 更新推薦配置。",
+    "recommendationsApplied": "推薦配置已應用到當前組合。",
+    "intelligentPanelTitle": "智慧路由儀表盤",
+    "intelligentPanelDesc": "此自動路由組合的即時評分和健康狀態。",
+    "configOnlyStatus": "配置檢視",
+    "configOnlyHint": "此面板僅顯示路由輸入,即時熔斷器狀態請到健康頁面檢視。",
+    "routingInputs": "路由輸入",
+    "routingInputsHint": "模式包與權重保留在此處;熔斷器執行狀態保留在健康頁面。",
+    "emailVisibilityHint": "此處帳號郵箱遵循全域性隱私開關。",
+    "emailVisibilityTooltip": "使用眼睛圖示可在組合、提供商與配額頁面間全域性切換帳號郵箱的顯示與隱藏。",
+    "manualModel": "手動模型",
+    "manualModelInvalid": "請按 provider/model 格式填寫。",
+    "manualModelUnknownProvider": "未知的提供商字首。",
+    "builderDynamicAccountShort": "動態帳號",
+    "builderNeedValidName": "請先填寫有效的組合名稱再繼續。",
+    "statusOverview": "狀態概覽",
+    "normalOperation": "正常執行",
+    "allProvidersHealthy": "供應商報告路由狀況良好。",
+    "incidentMode": "事件模式",
+    "highCircuitBreakerRate": "檢測到熔斷器頻繁觸發。",
+    "activeModePack": "當前模式包",
+    "modePackUpdated": "模式包已更新為 {pack}。",
+    "modePackHint": "切換預設以調整路由引擎偏向，無需重建組合。",
+    "providerScores": "供應商評分",
+    "allProvidersEvaluated": "未配置候選池。執行時評估所有活躍供應商。",
+    "excludedProviders": "已排除的供應商",
+    "excludedProvidersHint": "熔斷器處於 OPEN 狀態的供應商將被臨時排除在路由之外。",
+    "noExcludedProviders": "當前沒有供應商被排除。",
+    "cooldownMinutes": "冷卻：{minutes} 分鐘",
+    "builderIntelligentTitle": "智慧路由配置",
+    "builderIntelligentDesc": "為此自動路由組合配置多因子評分引擎。",
+    "candidatePoolLabel": "候選池",
+    "candidatePoolHint": "選擇引擎應評估的供應商。留空則使用所有活躍供應商。",
+    "candidatePoolEmpty": "暫無可用活躍供應商。",
+    "candidatePoolAllProviders": "所有供應商",
+    "modePackLabel": "模式包",
+    "routerStrategyLabel": "路由策略",
+    "strategyRules": "規則（6 因子評分）",
+    "explorationRateLabel": "探索率",
+    "explorationRateHint": "{percent}% 的請求可以探索非最優供應商。",
+    "budgetCapLabel": "預算上限（美元/請求）",
+    "budgetCapPlaceholder": "無限制",
+    "advancedWeightsTitle": "高階：評分權重",
+    "weightQuota": "配額",
+    "weightHealth": "健康度",
+    "weightCostInv": "成本",
+    "weightLatencyInv": "延遲",
+    "weightTaskFit": "任務適配",
+    "weightStability": "穩定性",
+    "weightTierPriority": "層級",
+    "reviewIntelligentTitle": "智慧路由配置",
+    "strategyRecommendations": {
+      "priority": {
+        "title": "穩妥基線",
+        "description": "使用一個主模型，並保持回退鏈路簡短且可靠。",
+        "tip1": "把最可靠的模型放在第一位。",
+        "tip2": "保留 1 到 2 個質量相近的備用模型。",
+        "tip3": "開啟安全重試，吸收臨時性的提供商故障。"
+      },
+      "weighted": {
+        "title": "可控流量分配",
+        "description": "非常適合金絲雀釋出和模型漸進遷移。",
+        "tip1": "建議從 90/10 這樣的保守配比開始。",
+        "tip2": "始終保持總權重為 100%，並在調整後自動平衡。",
+        "tip3": "在提高金絲雀權重前，先觀察成功率和延遲。"
+      },
+      "round-robin": {
+        "title": "可預測的負載分攤",
+        "description": "適合模型能力接近、且需要平滑分佈流量的場景。",
+        "tip1": "至少使用 2 個模型。",
+        "tip2": "設定併發限制，避免突發流量打滿單個模型。",
+        "tip3": "結合佇列超時，在飽和時快速失敗。"
+      },
+      "random": {
+        "title": "低配置快速分散",
+        "description": "適用於不需要嚴格保證、只想簡單分流的場景。",
+        "tip1": "儘量選擇延遲特徵相近的模型。",
+        "tip2": "保留重試機制，以吸收隨機命中的失敗。",
+        "tip3": "更適合實驗場景，不建議用於嚴格 SLA。"
+      },
+      "least-used": {
+        "title": "自適應均衡",
+        "description": "優先路由到使用更少的模型，隨著時間降低熱點。",
+        "tip1": "持續穩定流量下效果更好。",
+        "tip2": "結合健康檢查，能獲得更穩妥的均衡效果。",
+        "tip3": "跟蹤各模型用量，驗證分佈改善情況。"
+      },
+      "cost-optimized": {
+        "title": "預算優先路由",
+        "description": "在具備定價後設資料時，優先路由到成本更低的模型。",
+        "tip1": "確保所有已選模型都具備定價資訊。",
+        "tip2": "為高難度提示保留一個質量更高的回退模型。",
+        "tip3": "適合批處理或後臺任務等成本是主要指標的場景。"
+      },
+      "reset-aware": {
+        "title": "重置感知帳戶輪換",
+        "description": "根據重置時間平衡剩餘的提供商配額。",
+        "tip1": "對具有配額遙測的提供商使用顯式帳戶步驟或帳戶標籤路由。",
+        "tip2": "當短期疲勞風險更大時，調整訓練次數與每週重量。",
+        "tip3": "保持領帶較小，這樣等值帳戶仍然可以公平地輪換。"
+      },
+      "strict-random": {
+        "title": "洗牌池分配",
+        "description": "每輪中每個模型都會被恰好使用一次，然後再重新洗牌。",
+        "tip1": "至少使用 2 個模型，才能體現分配效果。",
+        "tip2": "最適合效能相近的模型。",
+        "tip3": "非常適合在多個 API 帳戶之間做負載均衡。"
+      },
+      "fill-first": {
+        "description": "在切換到鏈中的下一個提供商之前，先耗盡一個提供商的配額。",
+        "tip1": "按免費配額大小排列模型 — 最大的放在第一位。",
+        "tip2": "啟用健康檢查以跳過已耗盡的提供商。",
+        "tip3": "非常適合免費層級堆疊（Deepgram → Groq → NIM）。",
+        "title": "配額耗盡策略"
+      },
+      "auto": {
+        "description": "基於成本、延遲、質量和健康的即時評分進行路由。",
+        "tip1": "讓引擎自動平衡多個因素。",
+        "tip2": "在日誌中監控哪些因素驅動路由決策。",
+        "tip3": "用於複雜工作負載，其中沒有單一因素佔主導。",
+        "title": "多因素最佳化"
+      },
+      "lkgp": {
+        "description": "基於歷史成功率和永續性能資料進行路由。",
+        "tip1": "在依賴此策略之前讓成功歷史積累足夠資料。",
+        "tip2": "最適合具有穩定效能特徵的工作負載。",
+        "tip3": "定期審查歷史資料，確保路由決策保持準確。",
+        "title": "歷史路由"
+      },
+      "context-optimized": {
+        "description": "基於上下文視窗使用情況和令牌效率最佳化路由。",
+        "tip1": "將長對話路由到具有更大上下文視窗的模型。",
+        "tip2": "監控上下文利用率以避免令牌浪費。",
+        "tip3": "最適合需要大量上下文保留的對話式 AI。",
+        "title": "上下文最佳化"
+      },
+      "context-relay": {
+        "description": "當預期帳戶輪換且下一個帳戶必須繼承簡化的任務摘要時效果最佳。",
+        "tip1": "與為同一模型系列輪換帳戶的提供商配合使用。",
+        "tip2": "將交接閾值設定在硬配額截止值以下，以便有時間生成摘要。",
+        "tip3": "僅在主模型太貴或不穩定時，才設定專用摘要模型。",
+        "title": "會話連續性優先"
+      },
+      "p2c": {
+        "description": "每次請求從隨機候選中選出負載較輕的一個 — 低延遲，高擴充套件性。",
+        "tip1": "配合 4 個或更多模型使用效果最佳。",
+        "tip2": "需要在設定中啟用延遲遙測。",
+        "tip3": "是高吞吐量組合中輪詢的絕佳替代方案。",
+        "title": "雙選負載均衡"
+      }
+    },
+    "templateFreeStack": "免費棧（$0）",
+    "templateFreeStackDesc": "在所有免費提供商之間進行輪詢：Kiro（Claude）、Qoder（5 個模型）、Qwen（4 個模型）。零成本，編碼不中斷。",
+    "auto": "自動組合",
+    "autoDesc": "自愈型智慧路由池（效能最佳化）",
+    "lkgp": "LKGP 模式",
+    "lkgpDesc": "最後已知良好提供商（可預測的彈性）",
+    "wizardGuideTitle": "組合入門指南",
+    "wizardGuideDesc": "建立模型組合以智慧路由 AI 流量",
+    "wizardGuideHint": "或點選上方「+ 建立組合」",
+    "createFirstCombo": "建立您的第一個組合",
+    "wizardStep1Title": "命名您的組合",
+    "wizardStep1Desc": "為您的組合指定唯一名稱，以便在路由規則中識別",
+    "wizardStep2Title": "新增模型",
+    "wizardStep2Desc": "選擇 AI 模型並排列其故障轉移優先順序順序",
+    "wizardStep3Title": "選擇策略",
+    "wizardStep3Desc": "選擇請求在模型之間的分發方式 — 提供 13 種策略",
+    "wizardStep4Title": "審查並儲存",
+    "wizardStep4Desc": "審查您的配置並激活組合",
+    "emailVisibilityStateOn": "開啟",
+    "emailVisibilityStateOff": "關閉",
+    "reorderHandle": "拖拽排序",
+    "failedReorder": "模型重排序失敗",
+    "builderFlowTitle": "組合構建流程",
+    "builderStage": {
+      "basics": {
+        "label": "基礎",
+        "description": "名稱和起始模板"
+      },
+      "steps": {
+        "label": "步驟",
+        "description": "提供商、模型和帳戶選擇"
+      },
+      "strategy": {
+        "label": "策略",
+        "description": "路由行為和高階設定"
+      },
+      "intelligent": {
+        "label": "智慧路由",
+        "description": "自動路由候選池、預設和評分"
+      },
+      "review": {
+        "label": "審查",
+        "description": "儲存前的最終驗證"
+      }
+    },
+    "builderStageVisited": "階段已完成",
+    "builderStageCurrent": "當前階段",
+    "builderStagePending": "待處理",
+    "builderStageLocked": "已鎖定 — 請先完成上一步",
+    "builderTitle": "構建組合",
+    "builderBrowseCatalog": "瀏覽目錄",
+    "builderProvider": "提供商",
+    "builderLoadingProviders": "載入提供商中...",
+    "builderSelectProvider": "選擇提供商",
+    "builderModel": "模型",
+    "builderSelectModel": "選擇模型",
+    "builderProviderFirst": "請先選擇提供商",
+    "builderAccount": "帳戶",
+    "builderPreview": "預覽",
+    "builderAddStep": "新增步驟",
+    "builderDuplicateExact": "該提供商/模型/帳戶步驟已存在於組合中。",
+    "builderComboRef": "組合引用",
+    "builderAddComboRef": "新增組合引用",
+    "builderComboRefStep": "新增組合引用步驟",
+    "builderPinnedAccount": "固定帳戶",
+    "builderLegacyEntry": "舊版條目",
+    "reviewName": "名稱",
+    "reviewStrategy": "策略",
+    "reviewSteps": "步驟",
+    "reviewAccounts": "帳戶",
+    "reviewProviders": "提供商",
+    "reviewComboRefs": "組合引用",
+    "reviewAdvanced": "高階設定",
+    "reviewAgentFlags": "Agent 標誌",
+    "reviewSequence": "模型序列",
+    "reviewNoSteps": "未配置任何步驟",
+    "builderStagesDescription": "按順序完成各個階段以定義組合、構建步驟、選擇路由策略並審查結果。",
+    "builderStepsDescription": "按順序構建每個組合步驟：提供商、模型，然後是帳戶。這允許在不同帳戶上重複使用相同的提供商和模型。",
+    "selectProvider": "選擇提供商",
+    "selectProviderPlaceholder": "選擇提供商",
+    "selectModel": "選擇模型",
+    "selectModelPlaceholder": "請先選擇提供商",
+    "selectAccount": "選擇帳戶",
+    "selectComboToReference": "選擇要引用的現有組合",
+    "comboReference": "組合引用",
+    "addComboReference": "新增組合引用",
+    "addStepBeforeContinue": "在繼續到下一階段之前，請至少新增一個步驟。",
+    "previewNextStep": "選擇提供商和模型以預覽下一步。",
+    "autoSelectAccount": "執行時自動選擇帳戶",
+    "modePackBalanced": "均衡",
+    "modePackBudget": "預算優先",
+    "modePackPerformance": "效能優先",
+    "modePackCustom": "自定義",
+    "browseLegacyCatalog": "瀏覽舊版模型目錄",
+    "agentFeaturesTitle": "智慧代理功能",
+    "agentFeaturesDescription": "— 可選，用於智慧體/工具工作流",
+    "responseValidationTitle": "__MISSING__:Response validation",
+    "responseValidationHelp": "__MISSING__:Fail over to the next target when a 200 OK body fails these checks (assistant content).",
+    "responseValidationForbidden": "__MISSING__:Forbidden substrings (one per line)",
+    "responseValidationRequired": "__MISSING__:Required substrings (one per line)",
+    "responseValidationMinLength": "__MISSING__:Minimum content length (chars)",
+    "responseValidationJsonPaths": "__MISSING__:JSON-path checks",
+    "responseValidationAddCheck": "__MISSING__:+ Add check",
+    "agentFeaturesSystemMessageOverride": "系統訊息覆蓋",
+    "agentFeaturesSystemMessagePlaceholder": "覆蓋通過此組合路由的所有請求的系統提示…",
+    "agentFeaturesSystemMessageHint": "替換客戶端傳送的任何系統訊息。留空則透傳客戶端系統訊息。",
+    "agentFeaturesToolFilterRegex": "工具過濾器正則",
+    "agentFeaturesToolFilterHint": "只有名稱匹配此正則的工具才會轉發給供應商。留空則轉發所有工具。",
+    "agentFeaturesContextCacheHint": "跨輪次鎖定供應商/模型以保持快取會話。內部標籤在轉發給供應商前會被移除。",
+    "agentFeaturesContextCacheProtection": "上下文快取保護",
+    "agentFeaturesContextLength": "上下文長度",
+    "agentFeaturesContextLengthPlaceholder": "例如128000",
+    "agentFeaturesContextLengthHint": "在 /v1/models 中定義此組合的上下文視窗。",
+    "agentFeaturesContextLengthErrorInteger": "上下文長度必須是有效整數",
+    "agentFeaturesContextLengthErrorRange": "上下文長度必須介於 1000 到 2000000 之間",
+    "compressionOverride": "壓縮覆蓋",
+    "modePack": "模式包",
+    "disableSessionStickiness": "__MISSING__:Disable session stickiness",
+    "sessionStickinessEnabled": "__MISSING__:Stickiness on",
+    "sessionStickinessDisabled": "__MISSING__:Stickiness off"
+  },
+  "costs": {
+    "title": "成本",
+    "pageDescription": "跟蹤支出、分析趨勢，並管理所有提供商的 AI 預算",
+    "overview": "概覽",
+    "budget": "預算",
+    "totalCost": "總成本",
+    "breakdown": "成本明細",
+    "noData": "無成本資料",
+    "byModel": "按模型",
+    "byProvider": "按提供商",
+    "range7d": "7 天",
+    "range30d": "30 天",
+    "range90d": "90 天",
+    "rangeAll": "全部時間",
+    "spend30d": "30 天支出",
+    "activeModels": "活躍 Model",
+    "selectedWindow": "已選視窗",
+    "activeProviders": "活躍 Provider",
+    "overviewTitle": "概覽",
+    "spend7d": "7 天支出",
+    "avgCostPerRequest": "平均每次請求成本",
+    "noCostDataDescription": "發起請求後，成本資料會顯示在這裡。",
+    "spendToday": "今日支出",
+    "overviewLoadFailed": "載入成本概覽失敗",
+    "overviewDescription": "按提供商、模型和時間段彙總成本。",
+    "providerShare": "提供商佔比",
+    "topProviders": "熱門 Provider",
+    "costTrend": "成本趨勢",
+    "noCostDataTitle": "暫無成本資料",
+    "topModels": "熱門 Model",
+    "requestsInWindow": "視窗內請求數",
+    "tokenUsage": "Token 用量",
+    "totalTokens": "Token 總數",
+    "inputTokens": "輸入 Token",
+    "outputTokens": "輸出 Token",
+    "inputOutputRatio": "輸入/輸出比例",
+    "tokens": "token",
+    "routingEfficiency": "路由效率",
+    "fallbackCount": "回退請求數",
+    "fallbackRate": "回退率",
+    "modelCoverage": "模型覆蓋率",
+    "modelCoverageDesc": "帶有明確模型的請求佔比",
+    "outOfRequests": "共 {total} 個請求",
+    "costByApiKey": "按 API 金鑰統計成本",
+    "costByAccount": "按帳戶統計成本",
+    "apiKeyName": "API 金鑰",
+    "account": "帳戶",
+    "requests": "請求數",
+    "cost": "成本",
+    "dayStreak": "連續天數",
+    "weeklyUsagePattern": "每週使用模式",
+    "activityHeatmap": "活動熱力圖（365 天）",
+    "less": "較少",
+    "more": "較多",
+    "monthlyForecast": "月度預測",
+    "forecastBasis": "基於最近 {days} 天",
+    "avgDailyCost": "平均每日成本",
+    "daysRemaining": "剩餘 {days} 天",
+    "periodComparison": "週期對比",
+    "previousPeriod": "上半期",
+    "currentPeriod": "當前半期",
+    "exportCSV": "匯出為 CSV",
+    "exportJSON": "匯出為 JSON",
+    "legacyFreeLabel": "舊版 / 免費",
+    "costExplorerTitle": "成本探索器",
+    "costExplorerDescription": "按提供商、模型、API 金鑰、帳戶或服務層級探索支出。",
+    "groupProvider": "提供商",
+    "groupModel": "模型",
+    "groupApiKey": "API 金鑰",
+    "groupAccount": "帳戶",
+    "groupServiceTier": "服務層級",
+    "serviceTierFast": "快速",
+    "serviceTierFlex": "彈性",
+    "serviceTierStandard": "標準",
+    "serviceTierBreakdownTitle": "服務層級",
+    "serviceTierBreakdownSubtitle": "快速 / 彈性 / 標準 分佈",
+    "serviceTierUsageSaved": "已節省用量",
+    "serviceTierCostSaved": "已節省",
+    "serviceTierCostShareSuffix": "成本佔比",
+    "dimension": "維度",
+    "share": "佔比",
+    "legacyOrFree": "舊版 / 免費",
+    "filterRows": "篩選行…",
+    "filterCostExplorerRows": "篩選成本探索器行",
+    "noMatchingCostRows": "沒有匹配的成本行",
+    "noMatchingCostRowsDescription": "調整搜尋文本、分組或所選時間視窗。",
+    "showingCostRows": "正在顯示 {total} 個匹配行中的 {shown} 個。",
+    "showingTopCostRows": "正在顯示 {total} 個匹配行中的 {shown} 個（前 50 個）。"
+  },
+  "endpoint": {
+    "title": "API 端點",
+    "available": "可用端點",
+    "cloudProxy": "雲代理",
+    "disableConfirm": "確定要停用雲代理嗎？",
+    "baseUrl": "基礎 URL",
+    "apiKeyLabel": "API 金鑰",
+    "registeredKeys": "已註冊金鑰",
+    "chatCompletions": "對話補全",
+    "responses": "響應",
+    "listModels": "列出模型",
+    "usingCloudProxy": "當前使用雲代理",
+    "usingLocalServer": "當前使用本地伺服器",
+    "machineId": "機器 ID：{id}...",
+    "disableCloud": "停用雲端",
+    "enableCloud": "啟用雲端",
+    "modelsAcrossEndpoints": "{endpoints} 個端點共提供 {models} 個模型",
+    "loadingModels": "正在載入可用模型...",
+    "chatDesc": "支援所有提供商的流式與非流式聊天",
+    "embeddings": "嵌入",
+    "embeddingsDesc": "用於搜尋和 RAG 流程的文本向量",
+    "imageGeneration": "影像生成",
+    "imageDesc": "根據文本提示生成影像",
+    "rerank": "重排",
+    "rerankDesc": "按與查詢的相關性重新排序文件",
+    "audioTranscription": "音訊轉錄",
+    "audioTranscriptionDesc": "將音訊檔案轉錄為文本（Whisper）",
+    "textToSpeech": "文本轉語音",
+    "textToSpeechDesc": "將文本轉換為自然語音",
+    "musicGeneration": "音樂生成",
+    "musicDesc": "通過 ComfyUI 生成音樂和音軌（Stable Audio、MusicGen）",
+    "moderations": "內容稽核",
+    "moderationsDesc": "內容安全稽核與分類",
+    "responsesDesc": "適用於 Codex 和高階智慧體工作流的 OpenAI Responses API",
+    "listModelsDesc": "列出所有已連線提供商下的可用模型",
+    "settingsApiDesc": "通過 API 讀取和修改 OmniRoute 配置",
+    "settingsApi": "設定 API",
+    "categoryCore": "核心 API",
+    "categoryMedia": "媒體與多模態",
+    "categorySearch": "搜尋與發現",
+    "categoryUtility": "工具與管理",
+    "webSearch": "網頁搜尋",
+    "webSearchDesc": "統一接入多個提供商的網頁搜尋，支援自動故障轉移與快取",
+    "searchProvider": "搜尋提供商",
+    "searchProviderDesc": "該提供商會用於 `POST /v1/search` 的網頁搜尋。無需配置模型，只要連線 API 金鑰即可使用。",
+    "enableCloudTitle": "啟用雲代理",
+    "whatYouGet": "啟用後可獲得",
+    "cloudBenefitAccess": "從世界任何地方訪問你的 API",
+    "cloudBenefitShare": "方便與團隊共享端點",
+    "cloudBenefitPorts": "無需開放埠或配置防火牆",
+    "cloudBenefitEdge": "全球邊緣網路加速",
+    "cloudSessionNote": "雲端會保留你的認證會話 1 天；若未使用，將自動刪除。",
+    "cloudUnstableNote": "目前雲端在部分 Claude Code OAuth 場景下仍不夠穩定。",
+    "cloudConnected": "雲代理已連線！",
+    "connectingToCloud": "正在連線雲端...",
+    "verifyingConnection": "正在驗證連線...",
+    "connecting": "連線中...",
+    "verifying": "驗證中...",
+    "connected": "已連線！",
+    "disableCloudTitle": "停用雲代理",
+    "disableWarning": "所有認證會話都會從雲端刪除。",
+    "syncingData": "正在同步最新資料...",
+    "disablingCloud": "正在停用雲端...",
+    "syncing": "同步中...",
+    "disabling": "停用中...",
+    "cloudConnectedVerified": "雲代理已連線並驗證成功！",
+    "connectedVerificationPending": "已連線，等待驗證",
+    "connectedVerificationPendingWithError": "已連線，等待驗證：{error}",
+    "cloudDisabledSuccess": "雲端已成功停用",
+    "syncedSuccess": "同步成功",
+    "failedDisable": "停用雲端失敗",
+    "failedEnable": "啟用雲端失敗",
+    "cloudRequestTimeout": "雲端請求超時",
+    "cloudRequestFailed": "雲端請求失敗",
+    "cloudWorkerUnreachable": "無法連線到雲 Worker。請確認雲服務已執行（在 `/cloud` 中執行 `npm run dev`）。",
+    "connectionFailed": "連線失敗",
+    "syncFailed": "同步雲端資料失敗",
+    "cloudflaredTitle": "Cloudflare 快速隧道",
+    "cloudflaredDescription": "為當前端點建立 Cloudflare Quick Tunnel。",
+    "cloudflaredUrlNotice": "建立一個臨時的 Cloudflare Quick Tunnel。每次重啟後 URL 都會變化。",
+    "cloudflaredEnable": "啟用 Tunnel",
+    "cloudflaredInstallAndEnable": "安裝並啟用",
+    "cloudflaredDisable": "停止 Tunnel",
+    "cloudflaredRunning": "執行中",
+    "cloudflaredStarting": "啟動中",
+    "cloudflaredStoppedState": "已停止",
+    "cloudflaredNotInstalled": "未安裝",
+    "cloudflaredUnsupported": "不支援",
+    "cloudflaredError": "錯誤",
+    "cloudflaredStarted": "Cloudflare Tunnel 已啟動",
+    "cloudflaredStopped": "Cloudflare Tunnel 已停止",
+    "cloudflaredRequestFailed": "更新 Cloudflare Tunnel 失敗",
+    "cloudflaredTemporaryNote": "Quick Tunnel URL 是臨時地址，每次重啟後都會變化。",
+    "cloudflaredUnsupportedNote": "當前平臺不支援託管安裝。請自行安裝 cloudflared，或通過 CLOUDFLARED_BIN 指向已有二進位制檔案。",
+    "cloudflaredIdleNote": "為當前端點建立一個臨時的 Cloudflare Quick Tunnel。",
+    "cloudflaredLastError": "最近錯誤：{error}",
+    "providerModelsTitle": "{provider} — 模型",
+    "noModelsForProvider": "該提供商當前沒有可用模型。",
+    "chat": "聊天",
+    "embedding": "向量",
+    "image": "影像",
+    "custom": "自定義",
+    "modelsCount": "{count, plural, one {# 個模型} other {# 個模型}}",
+    "sectionTitle": "整合入口",
+    "sectionDescription": "OpenAI 相容 API 與操作協議端點",
+    "tabApis": "OpenAI 相容 API",
+    "tabProtocols": "協議",
+    "tabsAria": "端點分割槽",
+    "protocolsTitle": "協議",
+    "protocolsDescription": "MCP 和 A2A 是一等端點，具備專用的可觀測與控制能力。",
+    "mcpCardTitle": "MCP 服務",
+    "mcpCardDescription": "基於 stdio 的 Model Context Protocol",
+    "a2aCardTitle": "A2A 服務",
+    "a2aCardDescription": "Agent2Agent JSON-RPC 端點",
+    "protocolToolsLabel": "工具數",
+    "protocolTasksLabel": "任務數",
+    "protocolActiveStreamsLabel": "活躍流數",
+    "protocolLastActivity": "最近活動",
+    "quickStart": "快速開始",
+    "openMcpDashboard": "開啟 MCP 管理",
+    "openA2aDashboard": "開啟 A2A 管理",
+    "mcpQuickStartTitle": "MCP 快速開始",
+    "mcpQuickStartStep1": "通過 `omniroute --mcp` 啟動 MCP 服務。",
+    "mcpQuickStartStep2": "將你的 MCP 客戶端配置為通過 stdio 傳輸連線。",
+    "mcpQuickStartStep3": "呼叫 `omniroute_get_health`、`omniroute_list_combos` 等工具驗證連通性。",
+    "a2aQuickStartTitle": "A2A 快速開始",
+    "a2aQuickStartStep1": "通過 `/.well-known/agent.json` 發現 Agent Card。",
+    "a2aQuickStartStep2": "向 `POST /a2a` 傳送 `message/send` 或 `message/stream` JSON-RPC 請求。",
+    "a2aQuickStartStep3": "使用 `tasks/get` 與 `tasks/cancel` 跟蹤和控制任務。",
+    "completionsLegacy": "Completions（舊版）",
+    "completionsLegacyDesc": "舊版 OpenAI 文本補全介面，同時接受 `prompt` 字串和 `messages` 陣列格式",
+    "messagesApi": "留言",
+    "messagesApiDesc": "適用於 Claude 相容提供程式的本機人性訊息 API 格式",
+    "imageEdits": "影像編輯",
+    "imageEditsDesc": "使用 AI 編輯和修改現有影像（修復、修復、變體）",
+    "batchApi": "批次API",
+    "batchApiDesc": "非同步處理大批次請求（相容 OpenAI）",
+    "filesApi": "檔案API",
+    "filesApiDesc": "上傳和管理檔案以進行批處理",
+    "videoGeneration": "影片生成",
+    "videoDesc": "使用 ComfyUI 和 Stable Video Diffusion 等 AI 模型生成影片。",
+    "tailscaleRequestFailed": "載入 Tailscale 狀態失敗",
+    "tailscaleEnableFailed": "啟用 Tailscale Funnel 失敗",
+    "tailscaleWaitingForLogin": "請在開啟的瀏覽器標籤頁中完成 Tailscale 登入。OmniRoute 會自動重試。",
+    "tailscaleLoginTimedOut": "等待 Tailscale 登入超時",
+    "tailscaleWaitingForFunnel": "請在開啟的瀏覽器標籤頁中為此裝置啟用 Funnel。OmniRoute 會繼續輪詢。",
+    "tailscaleFunnelTimedOut": "等待啟用 Tailscale Funnel 超時",
+    "tailscaleStarted": "Tailscale Funnel 已啟用",
+    "tailscaleDisableFailed": "停用 Tailscale Funnel 失敗",
+    "tailscaleStopped": "Tailscale Funnel 已停用",
+    "tailscaleInstallFailed": "安裝 Tailscale 失敗",
+    "tailscaleInstallProgress": "處理中...",
+    "tailscaleInstalled": "Tailscale 安裝成功",
+    "tailscaleRunning": "執行中",
+    "tailscaleNeedsLogin": "需要登入",
+    "tailscaleStoppedState": "已停止",
+    "tailscaleNotInstalled": "未安裝",
+    "tailscaleUnsupported": "不支援",
+    "tailscaleError": "錯誤",
+    "tailscaleDisable": "停止 Funnel",
+    "tailscaleInstallAndEnable": "安裝並啟用",
+    "tailscaleLoginAndEnable": "登入並啟用",
+    "tailscaleEnable": "啟用 Funnel",
+    "tailscaleUrlNotice": "使用你的 Tailscale .ts.net 地址。首次使用時可能需要登入並批准 Funnel。",
+    "tailscaleTitle": "Tailscale Funnel",
+    "tailscaleNeedsLoginHint": "先使用 Tailscale 認證此機器，然後啟用 Funnel。",
+    "tailscaleBinaryPath": "二進位制檔案：{path}",
+    "tailscaleLastError": "最近錯誤：{error}",
+    "tailscaleInstallTitle": "安裝 Tailscale",
+    "tailscaleInstallIntro": "在此機器上安裝 Tailscale，並準備讓 OmniRoute 啟用 Funnel。",
+    "tailscaleInstallPasswordHint": "在 macOS 和 Linux 上，安裝軟體包和啟動守護程序可能需要 sudo。",
+    "tailscaleSudoPlaceholder": "可選 sudo 密碼",
+    "tailscaleInstalling": "正在安裝",
+    "tailscaleSudoLabel": "Sudo 密碼（macOS/Linux 上必需）",
+    "ngrokTitle": "ngrok 隧道",
+    "ngrokRunning": "執行中",
+    "ngrokStarting": "正在啟動",
+    "ngrokStoppedState": "已停止",
+    "ngrokNeedsAuth": "需要認證",
+    "ngrokNotInstalled": "未安裝",
+    "ngrokUnsupported": "不支援",
+    "ngrokError": "錯誤",
+    "ngrokEnable": "啟用隧道",
+    "ngrokDisable": "停止隧道",
+    "ngrokUrlNotice": "建立一個公開的 ngrok 隧道。",
+    "ngrokAuthTokenLabel": "Authtoken（未設定 NGROK_AUTHTOKEN 時必需）",
+    "ngrokAuthTokenPlaceholder": "輸入你的 ngrok authtoken",
+    "ngrokLastError": "上次錯誤：{error}",
+    "ngrokStarted": "ngrok 隧道已啟動",
+    "ngrokStopped": "ngrok 隧道已停止",
+    "ngrokRequestFailed": "更新 ngrok 隧道失敗",
+    "apiEndpointsCatalogUnavailable": "API目錄不可用",
+    "apiEndpointsSearchPlaceholder": "搜尋端點...",
+    "apiEndpointsRequiresAuth": "需要授權",
+    "apiEndpointsNoMatch": "沒有端點與您的過濾器匹配",
+    "vscodeAliasTitle": "VS Code 令牌別名",
+    "vscodeAliasDescriptionReady": "使用 /api/v1/vscode/TOKEN/... 介面的可貼上相容性 URL。",
+    "vscodeAliasDescriptionError": "由於當前會話無法載入 CLI 金鑰，正在顯示佔位符 URL。",
+    "vscodeAliasDescriptionLoading": "正在載入 CLI 金鑰。在金鑰可用之前將顯示佔位符 URL。",
+    "vscodeAliasDescriptionPlaceholder": "正在顯示佔位符 URL。請在 CLI 工具中建立或啟用 API 金鑰以替換 TOKEN。",
+    "vscodeAliasManage": "CLI 工具",
+    "vscodeAliasBaseLabel": "VS Code 基礎",
+    "vscodeAliasModelsLabel": "VS Code 模型",
+    "vscodeAliasChatLabel": "VS Code 聊天",
+    "localServer": "本地伺服器",
+    "cloudOmniroute": "雲全路由",
+    "copyUrl": "複製網址",
+    "badgeLoopbackTooltip": "此端點僅可本地訪問（僅限迴環）",
+    "badgeAlwaysProtectedTooltip": "此端點始終受保護，需要授權",
+    "badgeInternalTooltip": "這是系統內部端點",
+    "tierAll": "全部",
+    "tierAuth": "需認證",
+    "tierLoopback": "迴環",
+    "tierAlwaysProtected": "始終受保護",
+    "tierPublic": "公開",
+    "hideInternal": "隱藏內部端點",
+    "showInternal": "顯示內部端點",
+    "customSystemPromptTitle": "Custom System Prompt",
+    "customSystemPromptDescription": "Inject a custom system prompt into every model request",
+    "customSystemPromptPlaceholder": "e.g. Always respond in pirate speak..."
+  },
+  "endpoints": {
+    "tabProxy": "端點代理",
+    "tabApiEndpoints": "API 端點",
+    "apiEndpointsTitle": "API 端點",
+    "apiEndpointsDescription": "可被其他應用程式和服務使用的後端API端點。",
+    "comingSoon": "即將推出",
+    "plannedFeatures": "計劃的功能",
+    "featureRestApi": "REST API目錄與互動式文件",
+    "featureWebhooks": "Webhook配置和事件訂閱",
+    "featureSwagger": "OpenAPI / Swagger規範自動生成",
+    "featureAuth": "每個端點的API金鑰和OAuth範圍管理"
+  },
+  "mcpDashboard": {
+    "loading": "正在載入 MCP 儀表板...",
+    "activate": "啟用",
+    "deactivate": "停用",
+    "confirmSwitchCombo": "確定要將組合“{combo}”設為{action}嗎？",
+    "switchComboFailed": "切換組合狀態失敗。",
+    "switchComboSuccess": "組合“{combo}”已更新。",
+    "confirmApplyProfile": "確定要應用彈性配置“{profile}”嗎？",
+    "applyProfileFailed": "應用彈性配置失敗。",
+    "applyProfileSuccess": "已應用配置“{profile}”。",
+    "confirmResetBreakers": "確定要重置全部斷路器嗎？",
+    "resetBreakersFailed": "重置斷路器失敗。",
+    "resetBreakersSuccess": "斷路器已重置。",
+    "processStatus": "程序狀態",
+    "online": "線上",
+    "offline": "離線",
+    "disableLabel": "停用 {label}",
+    "enableLabel": "啟用 {label}",
+    "transportMode": "傳輸模式",
+    "transportStdioDesc": "本地 — IDE 通過 omniroute --mcp 啟動程序",
+    "transportSseDesc": "遠端 — 基於 HTTP 的 Server-Sent Events",
+    "transportStreamableHttpDesc": "遠端 — 現代雙向 HTTP",
+    "copy": "複製",
+    "mcpDashboardCopyUrl": "複製網址",
+    "mcpDisabledTitle": "MCP 已停用",
+    "mcpDisabledDesc": "在上方啟用 MCP 後即可配置傳輸模式並檢視伺服器遙測。",
+    "mcpIntro": "Model Context Protocol — {tools} 個工具,覆蓋 {scopes} 個作用域,支援 {transports} 種傳輸方式(stdio / SSE / Streamable HTTP)。",
+    "mcpStep1": "通過 {code} 執行",
+    "mcpStep2": "將 MCP 客戶端配置為通過 stdio 傳輸連線。",
+    "mcpStep3": "呼叫 {code1} 和 {code2} 等工具。",
+    "pid": "PID",
+    "sessionUptime": "會話執行時長",
+    "lastHeartbeat": "最近心跳",
+    "activity24h": "近 24 小時活動",
+    "totalCalls": "呼叫總數",
+    "successRate": "成功率",
+    "avgLatency": "平均延遲",
+    "topTools": "熱門工具",
+    "noToolCalls24h": "最近 24 小時沒有工具呼叫。",
+    "runtimeDetails": "執行時詳情",
+    "transport": "傳輸方式",
+    "scopesEnforced": "已啟用作用域控制",
+    "yes": "是",
+    "no": "否",
+    "lastCall": "最近呼叫",
+    "heartbeatPath": "心跳檔案路徑",
+    "operationalControls": "執行控制",
+    "switchCombo": "切換組合",
+    "inactive": "未啟用",
+    "active": "已啟用",
+    "activateCombo": "啟用組合",
+    "deactivateCombo": "停用組合",
+    "applyResilienceProfile": "應用彈性配置",
+    "profileAggressive": "激進",
+    "profileBalanced": "平衡",
+    "profileConservative": "保守",
+    "applyProfile": "應用配置",
+    "resetCircuitBreakers": "重置斷路器",
+    "resetCircuitBreakersHelp": "清除當前斷路器狀態及提供商失敗計數。",
+    "resetAllBreakers": "重置全部斷路器",
+    "toolsAndScopes": "工具與作用域",
+    "tableTool": "工具",
+    "tableScopes": "作用域",
+    "tablePhase": "階段",
+    "tableAudit": "審計",
+    "auditLog": "審計日誌",
+    "auditSummary": "呼叫數：{total}｜第 {page} / {totalPages} 頁",
+    "allTools": "全部工具",
+    "allResults": "全部結果",
+    "success": "成功",
+    "failure": "失敗",
+    "apiKeyIdPlaceholder": "apiKeyId",
+    "loadingAuditEntries": "正在載入審計記錄...",
+    "noAuditEntriesForFilters": "當前篩選條件下沒有審計記錄。",
+    "tableTimestamp": "時間戳",
+    "tableDuration": "耗時",
+    "tableResult": "結果",
+    "tableApiKey": "API 金鑰",
+    "failed": "失敗",
+    "previous": "上一頁",
+    "next": "下一頁",
+    "apiKeyId": "API Key ID",
+    "offset": "偏移量",
+    "limit": "限制",
+    "tool": "工具"
+  },
+  "a2aDashboard": {
+    "loading": "正在載入 A2A 儀表板...",
+    "confirmCancelTask": "確定要取消任務 {taskId} 嗎？",
+    "cancelTaskFailed": "取消任務失敗。",
+    "cancelTaskSuccess": "任務 {taskId} 已取消。",
+    "smokeSendFailed": "`message/send` 冒煙測試失敗。",
+    "smokeSendSuccessWithTask": "`message/send` 呼叫成功（任務 {taskId}）。",
+    "smokeSendSuccess": "`message/send` 呼叫成功。",
+    "smokeStreamFailed": "`message/stream` 冒煙測試失敗。",
+    "smokeStreamSuccessWithTask": "`message/stream` 呼叫成功（任務 {taskId}{stateSuffix}）。",
+    "smokeStreamNoTaskId": "`message/stream` 完成，但未返回任務 ID。",
+    "health": "健康狀態",
+    "ok": "正常",
+    "totalTasks": "任務總數",
+    "activeStreams": "活躍流數",
+    "lastTask": "最近任務",
+    "taskStateOverview": "任務狀態概覽",
+    "state": {
+      "submitted": "已提交",
+      "working": "處理中",
+      "completed": "已完成",
+      "failed": "失敗",
+      "cancelled": "已取消"
+    },
+    "agentCard": "智慧體卡片",
+    "agentCardPath": "/.well-known/agent.json",
+    "version": "版本",
+    "url": "URL",
+    "capabilities": "能力",
+    "agentCardNotAvailable": "Agent Card 不可用。",
+    "quickValidation": "快速驗證",
+    "quickValidationDescription": "通過即時 `/a2a` 端點執行冒煙呼叫。",
+    "runMessageSend": "執行 message/send",
+    "runMessageStream": "執行 message/stream",
+    "taskManagement": "任務管理",
+    "taskSummary": "任務總數：{total}｜第 {page} / {totalPages} 頁",
+    "allStates": "全部狀態",
+    "allSkills": "全部技能",
+    "loadingTasks": "正在載入任務...",
+    "noTasksForFilters": "當前篩選條件下沒有任務。",
+    "tableTask": "任務",
+    "tableSkill": "技能",
+    "tableState": "狀態",
+    "tableUpdated": "更新時間",
+    "tableActions": "操作",
+    "view": "檢視",
+    "cancel": "取消",
+    "previous": "上一頁",
+    "next": "下一頁",
+    "taskDetail": "任務詳情",
+    "close": "關閉",
+    "metadata": "後設資料",
+    "events": "事件",
+    "artifacts": "產物",
+    "tablePhase": "階段",
+    "offset": "偏移量",
+    "limit": "限制",
+    "skill": "技能",
+    "rpcEndpoint": "釋出 /a2a",
+    "rpcMethodSend": "留言/傳送",
+    "rpcMethodStream": "訊息/流",
+    "rpcMethodGet": "任務/獲取",
+    "rpcMethodCancel": "任務/取消",
+    "serviceLabel": "A2A",
+    "online": "線上",
+    "offline": "離線",
+    "disableLabel": "停用 {label}",
+    "enableLabel": "啟用 {label}",
+    "a2aDisabledTitle": "A2A 已停用",
+    "a2aDisabledDesc": "在上方啟用 A2A 後即可檢視任務遙測、代理詳情與校驗工具。",
+    "a2aIntro": "Agent2Agent JSON-RPC 2.0 端點 — 傳送任務、流式響應、取消執行中的任務。",
+    "a2aStep1": "在 {code} 處發現代理卡片。",
+    "a2aStep2": "向 {code1} 傳送 JSON-RPC,使用 {code2} 或 {code3}。",
+    "a2aStep3": "使用 {code1} 和 {code2} 跟蹤並取消任務。"
+  },
+  "memory": {
+    "a": "A",
+    "actions": "操作",
+    "addMemory": "新增記憶",
+    "allTypes": "全部型別",
+    "cancel": "取消",
+    "checkHealth": "檢查健康狀況",
+    "checkingHealth": "正在檢查...",
+    "compactOld": "緊湊舊版",
+    "concept": {
+      "title": "對話記憶",
+      "description": "OmniRoute 從每次對話中學習，記住事實、事件、程式和語義概念，使響應更加準確和上下文感知。",
+      "howWorksToggle": "它是如何工作的",
+      "howWorksContent": "1. 自動提取：在每個響應結束時，事實和事件會被自動檢測並儲存。\n2. 檢索：在每個響應之前，通過FTS5（精確）、向量（語義）或混合RRF搜尋最相關的記憶。\n3. 注入：相關記憶被注入到助手上下文中，以提高響應質量。\n4. 管理：使用此頁面檢視、編輯、匯出和壓縮舊記憶。"
+    },
+    "content": "內容",
+    "contentPlaceholder": "要記住的值或 JSON 內容",
+    "created": "建立時間",
+    "delete": "刪除",
+    "deleteConfirmDesc": "此操作無法撤銷。記憶體將被永久刪除。",
+    "deleteConfirmTitle": "刪除記憶體？",
+    "description": "檢視並管理已儲存的記憶條目",
+    "editMemory": "編輯記憶體",
+    "editModal": {
+      "title": "編輯記憶體",
+      "metadataLabel": "後設資料 (JSON)",
+      "metadataInvalid": "無效的 JSON",
+      "saveFailed": "儲存記憶體失敗"
+    },
+    "embedding": {
+      "autoLabel": "自動",
+      "autoDesc": "使用最佳可用選項：遠端提供者 > 靜態 > 轉換器",
+      "remoteLabel": "遠端提供者",
+      "remoteDesc": "通過提供者 API 使用嵌入（需要 API 金鑰）",
+      "staticLabel": "靜態本地（藥水）",
+      "staticDesc": "不使用WASM或外部依賴的本地嵌入",
+      "transformersLabel": "Transformers.js (MiniLM)",
+      "transformersDesc": "通過 @huggingface/transformers 本地嵌入 (~400MB RAM)",
+      "providerModelLabel": "提供者 / 模型",
+      "noRemoteProviders": "沒有配置 API 金鑰的提供者",
+      "selectProviderModel": "選擇一個模型",
+      "staticEnabledLabel": "啟用靜態藥水",
+      "staticEnabledDesc": "在本地下載並使用 potion-base-8M 模型",
+      "transformersEnabledLabel": "啟用 Transformers.js",
+      "transformersEnabledDesc": "選擇本地 MiniLM（約 400MB RAM，約 3 秒冷啟動）",
+      "transformersWarning": "需要約400MB記憶體，並在第一次語義查詢時冷啟動約3秒。"
+    },
+    "emptyState": {
+      "title": "還沒有記憶",
+      "description": "記憶是從對話中自動建立的。您也可以使用上面的按鈕手動新增它們。"
+    },
+    "engine": {
+      "statusTitle": "引擎狀態",
+      "embeddingTitle": "嵌入源",
+      "rerankTitle": "重新排序（可選）",
+      "reindexNow": "立即重新索引",
+      "reindexStarted": "重新索引已開始（{pending} 個待處理）",
+      "reindexFailed": "重新索引啟動失敗",
+      "keywordLabel": "關鍵字 (FTS5)",
+      "keywordReason": "關鍵字搜尋始終可用",
+      "embeddingLabel": "嵌入",
+      "vectorStoreLabel": "向量儲存",
+      "qdrantLabel": "Qdrant",
+      "rerankLabel": "重新排序",
+      "qdrantDisabled": "停用",
+      "qdrantOk": "健康 ({latencyMs}ms)",
+      "qdrantError": "連線錯誤",
+      "needsReindex": "{count} 個記憶體需要重新索引",
+      "configureCta": "配置",
+      "vectorStoreInstallHint": "要啟用向量搜尋：npm install sqlite-vec（需要本地 Node.js，而不是 WASM），然後重啟。"
+    },
+    "episodic": "情景型",
+    "export": "匯出",
+    "factual": "事實型",
+    "healthUnknown": "健康狀況不明",
+    "hitRate": "命中率",
+    "import": "匯入",
+    "importError": "匯入檔案失敗",
+    "importResult": "{imported} 匯入, {skipped} 跳過",
+    "key": "鍵",
+    "keyPlaceholder": "例如使用者偏好主題",
+    "loading": "正在載入記憶...",
+    "memories": "記憶",
+    "next": "下一步",
+    "noMemories": "未找到記憶條目",
+    "pageInfo": "第 {page} 頁，共 {totalPages}（共 {total}）",
+    "pipelineError": "管道錯誤",
+    "pipelineOk": "管道正常 ({latencyMs}ms)",
+    "playground": {
+      "infoTitle": "記憶體遊樂場",
+      "infoDesc": "模擬將為給定查詢檢索到的內容。沒有修改任何記憶 — 只讀預覽。",
+      "queryLabel": "測試查詢",
+      "queryPlaceholder": "輸入問題或測試短語...",
+      "strategyLabel": "策略",
+      "strategyExact": "精確 (FTS5)",
+      "strategySemantic": "語義（向量）",
+      "strategyHybrid": "混合 (RRF)",
+      "budgetLabel": "預算（代幣）",
+      "simulate": "模擬",
+      "resultsTitle": "{count} 個結果",
+      "resolutionTitle": "搜尋解析度",
+      "resolutionEmbedding": "嵌入",
+      "resolutionStore": "向量儲存",
+      "resolutionStrategy": "使用的策略",
+      "rerankApplied": "重新排序已應用",
+      "fallback": "後備",
+      "noResults": "未找到與此查詢相關的記憶。",
+      "tokensUsed": "已使用的令牌",
+      "none": "無",
+      "errorFetch": "獲取預覽失敗"
+    },
+    "previous": "上一頁",
+    "procedural": "程式型",
+    "qdrant": {
+      "title": "Qdrant（向量儲存 Tier 2）",
+      "description": "可選的 Qdrant 整合用於可擴充套件的語義搜尋",
+      "enableLabel": "啟用 Qdrant",
+      "enableDesc": "啟用後，Qdrant 將作為主要向量儲存使用",
+      "banner": "__MISSING__:Tier 2 vector store — an external, scalable alternative to the built-in sqlite-vec (Tier 1). Enable it only if you have a very large memory set or want shared memory across instances; most users are fine on sqlite-vec. When enabled it becomes the primary store and automatically falls back to sqlite-vec if unreachable.",
+      "hostHelp": "__MISSING__:Local Docker: http://localhost:6333 · Qdrant Cloud: your cluster URL",
+      "collectionHelp": "__MISSING__:Any name — OmniRoute creates it on first use",
+      "embeddingModelHelp": "__MISSING__:Sets the vector dimension automatically on first use. Existing memories are not back-filled, and changing the model after data exists needs a fresh collection.",
+      "testConnection": "測試連線",
+      "testing": "測試中...",
+      "statusActive": "活動",
+      "statusError": "錯誤",
+      "statusDisabled": "停用",
+      "healthOk": "連線正常 ({latencyMs}ms)",
+      "healthError": "連線錯誤",
+      "saved": "設定已儲存",
+      "saveError": "儲存失敗",
+      "portLabel": "埠",
+      "embeddingModelLabel": "嵌入模型",
+      "optional": "可選",
+      "apiKeyKeepPlaceholder": "留空以保持當前金鑰",
+      "apiKeyOptional": "如果不使用身份驗證，請留空",
+      "removeApiKey": "移除",
+      "quickSelectModel": "快速選擇",
+      "searchTestTitle": "語義搜尋測試",
+      "searchPlaceholder": "輸入測試查詢...",
+      "searching": "搜尋中...",
+      "search": "搜尋",
+      "cleanupTitle": "清理舊積分",
+      "cleanupDesc": "刪除過期記憶（保留期）的 Qdrant 點。",
+      "cleaning": "清理中...",
+      "cleanNow": "立即清理",
+      "cleanupSuccess": "已移除 {count} 點數",
+      "cleanupFailed": "清理失敗"
+    },
+    "rerank": {
+      "enableLabel": "啟用重新排序",
+      "enableDesc": "在搜尋後使用重新排序模型對結果進行重新排序",
+      "warning": "Rerank 會增加 +200-500ms 的延遲和每個請求的額外成本。請謹慎使用。",
+      "providerModelLabel": "重新排序提供者 / 模型",
+      "noProviderWithKey": "沒有配置 API 金鑰的提供者。請配置一個提供者以使用 rerank。",
+      "selectProviderModel": "選擇一個提供者/模型"
+    },
+    "save": "儲存",
+    "saving": "儲存中...",
+    "search": "搜尋記憶...",
+    "semantic": "語義型",
+    "summarize": {
+      "title": "壓縮舊記憶",
+      "noCandidates": "沒有符合壓縮條件的記憶（標準：超過30天）。",
+      "candidatesDesc": "{count} 個記憶將被壓縮為摘要。此操作無法撤銷。",
+      "confirm": "立即緊湊"
+    },
+    "tabs": {
+      "memories": "記憶",
+      "playground": "遊樂場",
+      "engine": "引擎"
+    },
+    "title": "記憶管理",
+    "tokensUsed": "已用 Tokens",
+    "tooltip": {
+      "totalEntries": "此 API 金鑰儲存的總記憶數",
+      "tokensUsed": "活動記憶佔用的估計總令牌數",
+      "hitRate": "按 ID 讀取的快取命中率（不是語義回憶準確性）",
+      "factual": "使用者上下文中的客觀、永久性事實",
+      "episodic": "對話歷史中的事件和經歷",
+      "procedural": "助手應遵循的程式、工作流程和指令",
+      "semantic": "概念、偏好和領域知識"
+    },
+    "totalEntries": "總條目數",
+    "type": "型別",
+    "memoryEnabled": "記憶體已啟用"
+  },
+  "skills": {
+    "title": "技能",
+    "description": "管理並監控 AI 技能",
+    "skillsTab": "技能",
+    "executionsTab": "執行記錄",
+    "sandboxTab": "沙箱",
+    "loading": "正在載入技能...",
+    "noSkills": "未找到技能",
+    "noExecutions": "未找到執行記錄",
+    "enabled": "已啟用",
+    "disabled": "已停用",
+    "delete": "__MISSING__:Delete",
+    "version": "版本",
+    "tableDescription": "說明",
+    "skill": "技能",
+    "status": "狀態",
+    "duration": "耗時",
+    "time": "時間",
+    "sandboxConfig": "沙箱配置",
+    "cpuLimit": "CPU 限制",
+    "cpuLimitDesc": "單個技能允許的最長執行時間",
+    "memoryLimit": "記憶體限制",
+    "memoryLimitDesc": "允許分配的最大記憶體",
+    "timeout": "超時",
+    "timeoutDesc": "等待響應的最長時間",
+    "networkAccess": "網路訪問",
+    "networkAccessDesc": "允許發起出站網路請求",
+    "mode": "模式",
+    "q": "問",
+    "filterSkillsPlaceholder": "按名稱、描述或標籤過濾技能",
+    "allModes": "所有模式",
+    "totalSkills": "技能總數",
+    "enabledSkills": "已啟用",
+    "totalExecutions": "執行次數",
+    "successRate": "成功率",
+    "marketplaceTab": "市場",
+    "applyFilters": "應用篩選",
+    "popularDefaultsLabel": "所選提供商的預設熱門技能:",
+    "onMode": "開",
+    "offMode": "關",
+    "autoMode": "自動",
+    "installSkillButton": "安裝技能",
+    "installSkillModalTitle": "安裝技能",
+    "installJsonPlaceholder": "在此貼上技能清單 JSON...",
+    "installing": "正在安裝...",
+    "installSuccess": "技能已安裝({id})",
+    "installError": "安裝失敗",
+    "invalidJson": "無效的 JSON",
+    "searchMarketplacePlaceholder": "搜尋技能...",
+    "searchMarketplace": "搜尋市場",
+    "marketplaceEmpty": "市場中未找到技能",
+    "marketplaceError": "搜尋失敗",
+    "installingFromMarketplace": "正在從市場安裝...",
+    "popularSkills": "熱門技能",
+    "skillsMarketplace": "技能市場",
+    "searching": "正在搜尋...",
+    "pageInfo": "第 {page} / {totalPages} 頁(共 {total} 條)",
+    "previous": "上一頁",
+    "next": "下一頁",
+    "activeProvider": "當前提供商:",
+    "changeInSettings": "可在 設定 → 記憶與技能 中修改。",
+    "installs": "安裝",
+    "marketplaceSkillsMpHint": "請在設定中配置 SkillsMP API 金鑰以瀏覽市場。",
+    "marketplaceSkillsShHint": "搜尋 skills.sh 公開目錄以發現並安裝代理技能。",
+    "installSkillModalDesc": "貼上技能清單 JSON 或上傳 .json 檔案。",
+    "uploadJson": "上傳 JSON",
+    "cancel": "取消",
+    "installSkill": "安裝技巧"
+  },
+  "health": {
+    "title": "系統健康狀況",
+    "description": "即時監控您的 OmniRoute 例項",
+    "healthy": "健康",
+    "degraded": "降級",
+    "down": "下線",
+    "uptime": "正常執行時間",
+    "memory": "記憶體",
+    "memoryRss": "記憶體（RSS）",
+    "heap": "堆",
+    "cpu": "CPU",
+    "database": "資料庫",
+    "version": "版本",
+    "lastCheck": "最後檢查",
+    "providerHealth": "提供商健康",
+    "systemMetrics": "系統指標",
+    "tokenHealth": "令牌健康",
+    "refreshAll": "全部重新整理",
+    "checkNow": "立即檢視",
+    "loadingHealth": "正在載入健康資料...",
+    "failedToLoad": "無法載入健康資料：{error}",
+    "retry": "重試",
+    "allOperational": "所有系統均可執行",
+    "issuesDetected": "檢測到系統問題",
+    "updatedAt": "更新了 {time}",
+    "latency": "延遲",
+    "latencyP50": "p50",
+    "latencyP95": "p95",
+    "latencyP99": "p99",
+    "millisecondsShort": "{value} 毫秒",
+    "notAvailable": "—",
+    "totalRequests": "請求總數",
+    "noDataYet": "還沒有資料",
+    "promptCache": "提示快取",
+    "entries": "條目",
+    "hitRate": "命中率",
+    "hitsMisses": "命中/未命中",
+    "signatureCache": "簽名快取",
+    "signatureDefaults": "預設值",
+    "signatureTool": "工具",
+    "signatureFamily": "家庭",
+    "signatureSession": "會話",
+    "recovering": "正在恢復中",
+    "noCBData": "當前沒有可用的斷路器資料，請先發起一些請求。",
+    "providerHealthStatusAria": "提供商健康狀況",
+    "issuesLabel": "檢測到的問題",
+    "operational": "執行中",
+    "providers": "提供商",
+    "configuredProvidersLabel": "在儀表板中配置",
+    "configuredProvidersHint": "指已在 /dashboard/providers 中配置憑證的提供商，無論當前執行時狀態如何。",
+    "activeProviders": "{count} 個活躍",
+    "activeProvidersHint": "指當前已啟用並可參與請求路由的已配置提供商。",
+    "monitoredProviders": "{count} 個監控中",
+    "monitoredProvidersHint": "指當前由斷路器健康監控器持續跟蹤的提供商。",
+    "healthyCount": "{count} 健康",
+    "nodeVersion": "節點 {version}",
+    "failures": "{count} 失敗",
+    "failuresPlural": "{count} 失敗",
+    "lastFailure": "最近一次",
+    "rateLimitStatus": "速率限制狀態",
+    "activeLimiters": "{count} 主動限制器",
+    "activeLimitersPlural": "{count} 主動限制器",
+    "queued": "排隊中",
+    "queuedCount": "{count} 已排隊",
+    "running": "執行中",
+    "runningCount": "{count} 正在執行",
+    "ok": "正常",
+    "activeLockouts": "主動鎖定",
+    "resetConfirm": "將所有斷路器重置為正常狀態？這將清除所有故障計數並將所有提供商恢復到執行狀態。",
+    "resetAllTitle": "將所有斷路器重置為正常狀態",
+    "resetting": "正在重置...",
+    "resetAll": "全部重置",
+    "until": "直到 {time}",
+    "limitExhausted": "已耗盡",
+    "learnedFromHeaders": "從響應頭學習",
+    "remainingOfLimit": "剩餘 {remaining}/{limit}",
+    "throttleStatus": "限流：{value}",
+    "lastHeaderUpdate": "響應頭更新：{age}",
+    "databaseHealth": "資料庫健康狀況",
+    "stickyBoundSessions": "粘性繫結會話",
+    "sessionsByApiKey": "按 API 金鑰進行的會話",
+    "noActiveSessionsTracked": "尚未跟蹤任何活動會話。",
+    "noSessionQuotaMonitorsActive": "沒有活動的會話配額監視器。",
+    "gracefulDegradationStatus": "優雅降級狀態",
+    "additionalModels": "+{count} 更多型號",
+    "providerHealthMatrixTitle": "提供商健康矩陣",
+    "providerHealthMatrixDescription": "來自熔斷器、冷卻、鎖定和日誌的提供商 × 帳戶 × 模型狀態。",
+    "healthMatrixRange": "健康矩陣時間範圍",
+    "providerFilter": "提供商篩選",
+    "onlyIssues": "僅顯示問題",
+    "refresh": "重新整理",
+    "accounts": "帳戶",
+    "models": "模型",
+    "issues": "問題",
+    "loadingProviderHealthMatrix": "正在載入提供商健康矩陣...",
+    "failedProviderHealthMatrix": "載入提供商健康矩陣失敗：{error}",
+    "noProvidersMatchedFilters": "沒有提供商匹配當前篩選條件。",
+    "modelPillSummary": "{requests} 請求 · {successRate} 成功率 · {latency} 平均延遲",
+    "modelLockoutSummary": "{reason} · 剩餘 {duration}",
+    "locked": "已鎖定",
+    "inferred": "推斷",
+    "inactive": "不活躍",
+    "noConnectionId": "無連線 ID",
+    "accountModelSummary": "{connectionId} · {count} 個模型",
+    "cooldown": "冷卻中",
+    "durationRemaining": "剩餘 {duration}",
+    "noSyncedModelsOrTraffic": "暫無同步模型或近期流量。",
+    "providerRowSummary": "{active}/{total} 活躍帳戶 · {requests} 請求 · {successRate} 成功率 · {latency} 平均延遲",
+    "cooldownCount": "{count} 個冷卻中",
+    "lockoutCount": "{count} 個鎖定",
+    "issueCount": "{count} 個問題",
+    "score": "評分",
+    "lastRequest": "最近請求",
+    "lastError": "最近錯誤"
+  },
+  "telemetry": {
+    "title": "系統遙測",
+    "description": "來自此 OmniRoute 程序的滾動請求、執行時、會話和記憶體訊號。",
+    "uptime": "執行時間",
+    "totalRequests": "請求總數",
+    "avgLatency": "平均延遲",
+    "errorRate": "錯誤率",
+    "activeConnections": "活動連線",
+    "memoryUsage": "記憶體使用",
+    "latencyTrend": "延遲趨勢",
+    "throughputTrend": "吞吐趨勢",
+    "memoryTrend": "記憶體趨勢",
+    "refresh": "重新整理",
+    "updatedAt": "更新於 {time}",
+    "loadFailed": "載入遙測失敗。",
+    "partialData": "遙測資料部分可用：{error}"
+  },
+  "mitm": {
+    "title": "MITM 代理",
+    "description": "用於攔截和路由客戶端請求的透明代理。",
+    "enable": "啟用 MITM 代理",
+    "enableDesc": "啟動或停止本地攔截程序和 DNS 覆蓋。",
+    "status": "狀態",
+    "running": "執行中",
+    "stopped": "已停止",
+    "start": "啟動",
+    "stop": "停止",
+    "refresh": "重新整理",
+    "port": "代理埠",
+    "apiKey": "路由器 API 金鑰",
+    "apiKeyPlaceholder": "可選；留空則回退到本地金鑰",
+    "sudoPassword": "Sudo 密碼",
+    "cachedPassword": "已為此程序快取",
+    "saveSettings": "儲存設定",
+    "settingsSaved": "MITM 設定已儲存。",
+    "startedSuccess": "MITM 代理已啟動。",
+    "stoppedSuccess": "MITM 代理已停止。",
+    "saveFailed": "更新 MITM 設定失敗。",
+    "loadFailed": "載入 MITM 設定失敗。",
+    "invalidPort": "透明 MITM 攔截當前要求使用埠 443。",
+    "certificate": "CA 證書",
+    "certificateReady": "證書已可用於客戶端信任安裝。",
+    "certificateMissing": "尚未生成證書。",
+    "available": "可用",
+    "missing": "缺失",
+    "downloadCert": "下載 CA 證書",
+    "regenerateCert": "重新生成證書",
+    "regenerateConfirm": "這會使現有客戶端信任失效。要繼續嗎？",
+    "regenerateSuccess": "MITM 證書已重新生成。",
+    "regenerateFailed": "重新生成 MITM 證書失敗。",
+    "targetRoutes": "目標路由",
+    "interceptedRequests": "已攔截請求",
+    "activeConnections": "活動連線",
+    "dnsConfigured": "DNS 已配置",
+    "pid": "PID",
+    "lastIntercept": "上次攔截",
+    "target": "目標",
+    "host": "主機",
+    "localPort": "本地埠",
+    "endpoints": "端點",
+    "enabled": "已啟用",
+    "configured": "已配置",
+    "yes": "是",
+    "no": "否",
+    "noTargets": "未配置目標路由。"
+  },
+  "limits": {
+    "title": "限制和配額",
+    "rateLimit": "速率限制",
+    "remaining": "剩餘",
+    "requestsPerMinute": "請求/分鐘",
+    "tokensPerMinute": "Tokens/分鐘",
+    "dailyLimit": "每日限額"
+  },
+  "logs": {
+    "title": "日誌",
+    "requestLogs": "請求日誌",
+    "proxyLogs": "代理日誌",
+    "auditLog": "稽核日誌",
+    "console": "控制台",
+    "auditLogDesc": "行政行為和安全事件",
+    "loading": "正在載入...",
+    "refresh": "重新整理",
+    "filterByAction": "按操作過濾...",
+    "filterByActor": "按操作人篩選...",
+    "filterEntriesAria": "過濾稽核日誌條目",
+    "filterByActionTypeAria": "按操作型別過濾",
+    "filterByActorAria": "按操作人篩選",
+    "refreshAuditLogAria": "重新整理稽核日誌",
+    "tableAria": "稽核日誌條目",
+    "failedFetchAuditLog": "無法獲取稽核日誌",
+    "showing": "顯示 {count} 條目（偏移量 {offset}）",
+    "search": "搜尋",
+    "timestamp": "時間戳",
+    "action": "操作",
+    "actor": "操作人",
+    "target": "目標",
+    "details": "詳情",
+    "ipAddress": "IP地址",
+    "notAvailable": "—",
+    "noEntries": "未找到稽核日誌條目",
+    "previous": "上一頁",
+    "next": "下一頁",
+    "providerWarningTitle": "提供商警告",
+    "viewDetails": "檢視詳情",
+    "eventMetadata": "事件後設資料",
+    "eventPayload": "事件負載",
+    "requestId": "請求 ID",
+    "providerWarningDesc": "上游提供商返回了警告。請檢視詳情以瞭解更多資訊。",
+    "a": "A",
+    "offset": "偏移量",
+    "limit": "限制",
+    "status": "狀態",
+    "resourceType": "資源型別",
+    "totalEntries": "總條目數",
+    "tab": "標籤頁",
+    "auditModalSubtitle": "審計詳情",
+    "close": "關閉",
+    "runningRequests": "活躍請求",
+    "runningRequestsDesc": "當前正在執行的上游請求即時檢視",
+    "clearAll": "全部清除",
+    "confirmClearActiveRequests": "清除所有活躍請求？",
+    "model": "模型",
+    "provider": "提供商",
+    "account": "帳戶",
+    "elapsed": "已耗時",
+    "activeStage": "階段",
+    "activeStageUnknown": "尚未傳送到上游",
+    "activeStageRegistered": "已註冊",
+    "activeStagePayloadPrepared": "負載已準備",
+    "activeStageWaitingAccountSlot": "等待帳戶槽位",
+    "activeStageWaitingRateLimit": "等待速率限制器",
+    "activeStageRateLimitSlotAcquired": "已獲取速率限制槽位",
+    "activeStageSendingToProvider": "正在傳送到上游",
+    "activeStageProviderResponseStarted": "上游響應已開始",
+    "count": "數量",
+    "payloads": "Payload",
+    "viewPayloads": "檢視",
+    "activeCount": "{count} 個活躍",
+    "clientPayload": "客戶端請求載荷",
+    "upstreamPayload": "上游提供商載荷",
+    "upstreamNotSentYet": "尚未傳送到上游",
+    "runningRequestDetailMeta": "Account：{account} — 已耗時：{elapsed}",
+    "export": "匯出",
+    "exporting": "正在匯出...",
+    "exportFailed": "匯出失敗",
+    "cleanHistoryButton": "__MISSING__:Clean history",
+    "cleanHistoryTitle": "__MISSING__:Clean log history?",
+    "cleanHistoryMessage": "__MISSING__:This permanently clears all request log rows, legacy detail rows, and local artifact files under DATA_DIR/call_logs. The live page will refresh after cleanup.",
+    "cleanHistoryConfirm": "__MISSING__:Clean history",
+    "cleanHistoryCancel": "__MISSING__:Cancel",
+    "cleanHistorySuccess": "__MISSING__:Cleaned {deleted} log entries, {deletedArtifacts} artifacts, and {deletedDetailedLogs} legacy detail rows.",
+    "cleanHistoryEmpty": "__MISSING__:No request log history was found.",
+    "cleanHistoryFailed": "__MISSING__:Failed to clean log history.",
+    "timeRange": "時間範圍",
+    "lastNHours": "最近 {hours} 小時",
+    "defaultRange": "預設",
+    "consoleViewer": {
+      "fetchFailed": "獲取日誌失敗",
+      "copyFailed": "複製日誌條目失敗",
+      "copyLogEntry": "複製日誌條目"
+    },
+    "compressionLogTitle": "壓縮日誌",
+    "compressionLogEmpty": "尚未有壓縮請求。啟用壓縮處理請求時，壓縮統計資訊將出現在此處。",
+    "tokens": "令牌"
+  },
+  "onboarding": {
+    "welcome": "歡迎",
+    "tiers": "__MISSING__:Tiers",
+    "security": "安全",
+    "test": "測試",
+    "ready": "準備好了！",
+    "setPassword": "設定密碼",
+    "addProvider": "新增您的第一個提供商",
+    "getStarted": "開始使用",
+    "skip": "跳過",
+    "skipWizard": "完全跳過嚮導",
+    "skipPassword": "跳過密碼設定",
+    "skipAndContinue": "跳過並繼續",
+    "passwordLabel": "密碼",
+    "confirmPassword": "確認密碼",
+    "enterPassword": "輸入密碼",
+    "confirmPasswordPlaceholder": "確認密碼",
+    "passwordsMismatch": "密碼不匹配",
+    "setupComplete": "設定完成！",
+    "goToDashboard": "轉到儀表板→",
+    "welcomeDesc": "OmniRoute 是您的本地 AI API 代理。它通過負載均衡、故障轉移和使用情況跟蹤將請求路由到多個 AI 提供商。",
+    "multiProvider": "多提供商",
+    "usageTracking": "使用情況追蹤",
+    "securityDesc": "設定密碼以保護您的儀表板，或暫時跳過。",
+    "providerDesc": "連線你的第一個 AI 提供商。你之後還可以繼續新增。",
+    "apiKeyRequired": "API 金鑰（必填）",
+    "customUrlOptional": "自定義 URL（可選）",
+    "testDesc": "讓我們驗證您的提供商連線是否有效。",
+    "runTest": "執行連線測試",
+    "testingConnection": "測試連線...",
+    "connectionSuccessful": "連線成功！您的提供商已準備就緒。",
+    "noProviderFound": "未找到提供商。您可以稍後從儀表板新增一個。",
+    "testFailed": "測試失敗，但您可以稍後配置。",
+    "couldNotTest": "現在無法測試。您可以從儀表板進行測試。",
+    "doneDesc": "你都準備好了！您的 OmniRoute 例項已配置並準備好代理 AI 請求。",
+    "yourEndpoint": "您的端點：",
+    "continue": "繼續",
+    "retry": "重試",
+    "failedSetPassword": "設定密碼失敗。再試一次。",
+    "failedAddProvider": "新增提供商失敗。再試一次。",
+    "connectionError": "連線錯誤。請再試一次。",
+    "provider": "提供商",
+    "apiKeyHelp": "API金鑰是AI服務的密碼。從提供商的網站（例如 platform.openai.com、console.anthropic.com）獲取一個。",
+    "tier": {
+      "subtitle": "OmniRoute 將提供商組織為三層，因此路由首先優先選擇最可靠、成本最低的路徑。",
+      "tier1": {
+        "label": "優質客戶",
+        "description": "具有本機身份驗證流程和推理模型的一流 CLI。"
+      },
+      "tier2": {
+        "label": "成本最佳化",
+        "description": "用於日常流量的廉價、高吞吐量提供商。"
+      },
+      "tier3": {
+        "label": "後備和專業",
+        "description": "本地託管或專用端點用作後備。"
+      },
+      "configure": "配置提供商"
+    },
+    "tierFlowDiagramAlt": "OmniRoute 3 層回退圖",
+    "apiKeyMgmt": "API金鑰管理"
+  },
+  "providers": {
+    "title": "提供商",
+    "Account Deactivated": "帳戶已停用",
+    "allProviders": "所有提供商",
+    "audioProviders": "音訊提供商",
+    "showFreeOnly": "僅顯示免費",
+    "addProvider": "新增提供商",
+    "addFirstProvider": "新增您的第一個提供商",
+    "addFirstProviderDesc": "連線 AI 提供商以開始通過 OmniRoute 路由請求。您可以使用免費提供商、API 金鑰或 OAuth 帳戶。",
+    "learnMore": "瞭解更多",
+    "adaptaTutorial": {
+      "title": "__MISSING__:How to connect Adapta Web",
+      "introPrefix": "__MISSING__:Adapta authenticates through Clerk. The token",
+      "introSuffix": "__MISSING__:is a long-lived JWT that lets OmniRoute refresh sessions automatically.",
+      "or": "__MISSING__:or",
+      "step1Title": "__MISSING__:Open Adapta chat",
+      "step1DescPrefix": "__MISSING__:Open",
+      "step1DescSuffix": "__MISSING__:and sign in with your Gold or Business account.",
+      "step2Title": "__MISSING__:Open DevTools",
+      "step2DescPrefix": "__MISSING__:Press",
+      "step2DescSuffix": "__MISSING__:to open Developer Tools.",
+      "step3Title": "__MISSING__:Go to Application → Cookies",
+      "step3DescPrefix": "__MISSING__:In the",
+      "step3DescMiddle": "__MISSING__:expand",
+      "step3DescSuffix": "__MISSING__:and click",
+      "step4Title": "__MISSING__:Copy the cookie value for",
+      "step4DescPrefix": "__MISSING__:Find the cookie named",
+      "step4DescMiddle": "__MISSING__:in the list. Click it and copy the content from the",
+      "step4DescSuffix": "__MISSING__:column. It starts with",
+      "step5Title": "__MISSING__:Paste it here and save",
+      "step5DescPrefix": "__MISSING__:Click",
+      "step5DescMiddle": "__MISSING__:paste the",
+      "step5DescSuffix": "__MISSING__:value into the API Key field, then save. OmniRoute will refresh the session automatically.",
+      "tipLabel": "__MISSING__:Tip:",
+      "tipPrefix": "__MISSING__:The",
+      "tipSuffix": "__MISSING__:cookie is long-lived, usually for months. You only need to renew it if you sign out or Adapta invalidates the session."
+    },
+    "editProvider": "編輯提供商",
+    "deleteProvider": "刪除提供商",
+    "noProviders": "沒有配置提供商",
+    "modelAvailability": "模型可用性",
+    "accounts": "帳戶",
+    "newAccount": "新帳戶",
+    "deleteConfirm": "您確定要刪除該提供商嗎？",
+    "testing": "測試...",
+    "testConnection": "測試連線",
+    "testSuccess": "連線成功",
+    "testFailed": "連線失敗",
+    "available": "可用",
+    "cooldown": "冷卻時間",
+    "unavailable": "不可用",
+    "unknown": "未知",
+    "oauthLabel": "OAuth",
+    "compatibleLabel": "相容",
+    "chat": "聊天",
+    "responses": "回應",
+    "messages": "留言",
+    "oauthProviders": "OAuth 提供商",
+    "freeProviders": "免費提供商",
+    "apiKeyProviders": "API 金鑰提供商",
+    "compatibleProviders": "API 金鑰相容提供商",
+    "testAll": "測試全部",
+    "distributeProxies": "分配代理",
+    "distributing": "分配中...",
+    "selectedCount": "已選 {count} 個",
+    "accountsCount": "{count} 個帳戶",
+    "testAllOAuth": "測試所有 OAuth 連線",
+    "testAllFree": "測試所有免費連線",
+    "testAllApiKey": "測試所有 API 金鑰連線",
+    "testAllCompatible": "測試所有相容連線",
+    "testAllModels": "測試所有模型",
+    "testAllModelsConfirm": "測試所有可見模型？如果啟用了自動隱藏，失敗的模型將被隱藏。",
+    "testingAllModels": "測試中 {done}/{total}...",
+    "testAllResults": "{total} 個模型中 {ok} 個可用",
+    "noModelsToTest": "沒有模型匹配當前篩選條件",
+    "showAllModels": "全部",
+    "showVisibleOnly": "僅可見",
+    "freeFilterAll": "全部",
+    "freeFilterFreeOnly": "僅免費",
+    "freeFilterPaidOnly": "僅付費",
+    "sortFreeFirst": "__MISSING__:Free first",
+    "showHiddenOnly": "僅隱藏",
+    "filterByVisibility": "按可見性篩選",
+    "autoHideFailed": "自動隱藏失敗模型",
+    "autoHideFailedHint": "啟用後，測試全部會把非臨時失敗的模型從 /v1/models 等公共目錄中隱藏。單模型測試永遠不會自動隱藏。",
+    "connected": "{count} 已連線",
+    "errorCount": "{count} 錯誤 ({code})",
+    "errorCountNoCode": "{count} 錯誤",
+    "testAllCompleted": "已測試 {total} 個模型：{ok} 個通過，{failed} 個失敗",
+    "modelAutoHidden": "模型 {model} 已自動隱藏（測試失敗）",
+    "filterAll": "全部",
+    "filterVisible": "僅可見",
+    "filterHidden": "僅隱藏",
+    "modelsHiddenCount": "已隱藏 {count} 個",
+    "warningCount": "{count} 警告",
+    "noConnections": "無連線",
+    "expiredBadge": "已過期",
+    "expiringSoonBadge": "即將過期",
+    "freeTier": "免費額度",
+    "freeTierAvailable": "有免費額度",
+    "hasFreeTooltip": "提供免費層",
+    "noAuthLabel": "免鑑權",
+    "noAuthProviders": "免鑑權提供商",
+    "upstreamProxyLabel": "上游代理",
+    "freeAggregated": "所有提供免費層的提供商(同時也會顯示在各自的原生分類中)",
+    "deprecated": "已棄用",
+    "deprecatedProvider": "此提供商已棄用",
+    "riskNotice": {
+      "title": "繼續之前",
+      "tooltip": "該提供商有使用注意事項 —— 點選檢視詳情",
+      "oauth": "此提供商使用你官方產品的會話 / OAuth,這並未被授權用於代理或路由用途。 不建議進行高強度的自主代理使用(OpenCloud 風格、長鏈路多步流程、大批次請求)—— 上游可能因此限制甚至封禁帳號。 使用風險自負。",
+      "webCookie": "此提供商通過你的網頁會話 Cookie 進行鑑權。上游服務可能隨時讓會話失效,屆時你需要重新登入。不建議用於長時間無人值守的操作。 使用風險自負。",
+      "deprecated": "此提供商已被上游下線,可能隨時停止工作。已存在的連線可能在上游完全關閉訪問前繼續可用。建議考慮替代方案。",
+      "dontShowAgain": "對此提供商不再顯示此提示",
+      "understand": "我已瞭解,繼續",
+      "cancel": "取消"
+    },
+    "disabled": "已停用",
+    "enableProvider": "啟用提供商",
+    "disableProvider": "停用提供商",
+    "testResults": "測試結果",
+    "noCompatibleYet": "尚未新增相容的提供商",
+    "compatibleHint": "使用上面的按鈕新增 OpenAI 或 Anthropic 相容端點",
+    "addOpenAICompatible": "新增 OpenAI 相容",
+    "addAnthropicCompatible": "新增 Anthropic 相容端點",
+    "addNewProvider": "新增新提供商",
+    "backToProviders": "返回提供商",
+    "configureNewProvider": "配置新的 AI 提供商以與您的應用程式一起使用。",
+    "providerLabel": "提供商",
+    "selectProvider": "選擇提供商",
+    "selectedProvider": "選定的提供商",
+    "authMethod": "認證方式",
+    "apiKeyLabel": "API key",
+    "apiKeyRequired": "需要 API 金鑰",
+    "selectProviderRequired": "請選擇提供商",
+    "enterApiKey": "輸入您的 API 金鑰",
+    "apiKeySecure": "您的 API 金鑰將被加密並安全儲存。",
+    "oauth2Connect": "使用 OAuth2 連線",
+    "oauth2Label": "OAuth2",
+    "oauth2Desc": "使用 OAuth2 身份驗證連線您的帳戶。",
+    "displayName": "顯示名稱",
+    "displayNamePlaceholder": "例如，生產 API、開發環境",
+    "displayNameHint": "可選。用於標識此配置的友好名稱。",
+    "active": "活躍",
+    "activeDescription": "啟用此提供商以在您的應用程式中使用",
+    "cancel": "取消",
+    "createProvider": "建立提供商",
+    "failedCreate": "建立提供商失敗",
+    "errorOccurred": "發生錯誤。請再試一次。",
+    "modelStatus": "模型狀態",
+    "showConfiguredOnly": "僅顯示已配置",
+    "allModelsOperational": "所有模型執行正常",
+    "modelsWithIssues": "{count} 有問題的模型",
+    "allModelsNormal": "所有模型當前響應正常。",
+    "cooldownCleared": "{model} 的冷卻時間已清除",
+    "failedClearCooldown": "無法清除冷卻時間",
+    "loadingAvailability": "正在載入模型可用性...",
+    "clearCooldown": "清除",
+    "clearing": "清算...",
+    "until": "直到 {time}",
+    "providerTestFailed": "提供商測試失敗",
+    "providerTestTimeout": "提供商測試超時，可能是同時測試的連線過多",
+    "modeTest": "{mode} 測試",
+    "passedCount": "{count} 通過",
+    "failedCount": "{count} 失敗",
+    "testedCount": "{count} 已測試",
+    "millisecondsAbbr": "{value} 毫秒",
+    "okShort": "好的",
+    "errorShort": "錯誤",
+    "noActiveConnectionsInGroup": "未找到該組的活動連線。",
+    "allTestsPassed": "所有 {total} 測試均已通過",
+    "testSummary": "{passed}/{total} 通過，{failed} 失敗",
+    "nameLabel": "名稱",
+    "prefixLabel": "字首",
+    "baseUrlLabel": "基礎 URL",
+    "apiTypeLabel": "API 型別",
+    "prefixHint": "必填。模型名稱使用的唯一字首。",
+    "nameHint": "必填。該節點的友好標籤。",
+    "baseUrlHint": "必填。 提供商 API 基本 URL。",
+    "iconUrlLabel": "__MISSING__:Icon URL",
+    "iconUrlHint": "__MISSING__:Optional. Image URL shown as this provider's icon.",
+    "anthropicPrefixPlaceholder": "ac-prod",
+    "openaiPrefixPlaceholder": "oc-prod",
+    "anthropicBaseUrlPlaceholder": "https://api.anthropic.com/v1",
+    "openaiBaseUrlPlaceholder": "https://api.openai.com/v1",
+    "validateConnection": "驗證連線",
+    "validating": "正在驗證...",
+    "connectionValid": "連線有效！",
+    "connectionFailed": "連線失敗。檢查 URL 和金鑰。",
+    "testKeyLabel": "測試 API 金鑰",
+    "testKeyPlaceholder": "sk-...（僅用於驗證）",
+    "providerNotFound": "未找到提供商",
+    "deleteConnectionConfirm": "刪除這個連線嗎？",
+    "batchDeleteSelected": "刪除選中（{count}）",
+    "batchDeleteConfirm": "刪除 {count} 個連線？此操作無法撤銷。",
+    "batchDeleteSuccess": "已刪除 {count} 個連線",
+    "batchActivateSelected": "批次啟用",
+    "batchDeactivateSelected": "批次停用",
+    "batchRetestSelected": "批次測試",
+    "batchActivateSuccess": "已啟用 {count} 個連線",
+    "batchDeactivateSuccess": "已停用 {count} 個連線",
+    "batchUpdatePartial": "__MISSING__:{count} updated, {skipped} skipped (no longer exist)",
+    "batchUpdateNone": "__MISSING__:No connections were updated (they may no longer exist)",
+    "batchRetestLimit": "__MISSING__:Retest up to {max} connections at a time",
+    "noConnectionsToTest": "__MISSING__:No matching connections to test",
+    "batchDeleteConfirmTitle": "刪除連線",
+    "batchDeleteConfirmButton": "刪除",
+    "filterActive": "健康",
+    "filterError": "錯誤",
+    "filterBanned": "封禁",
+    "filterCreditsExhausted": "額度耗盡",
+    "noFilteredConnections": "沒有符合當前篩選條件的連線。",
+    "failedSetAlias": "設定別名失敗",
+    "setAliasSuccess": "別名 {alias} 已設定",
+    "deleteAliasSuccess": "別名 {alias} 已刪除",
+    "failedSaveConnection": "儲存連線失敗",
+    "failedSaveConnectionRetry": "無法儲存連線。請再試一次。",
+    "failedRetestConnection": "重新測試連線失敗",
+    "deleteCompatibleNodeConfirm": "刪除此 {type} 相容節點？",
+    "anthropicCompatibleDetails": "Anthropic 相容詳情",
+    "openaiCompatibleDetails": "OpenAI 相容詳情",
+    "messagesApi": "Messages API",
+    "responsesApi": "Responses API",
+    "embeddings": "嵌入",
+    "audioTranscriptions": "音訊轉寫",
+    "audioSpeech": "語音合成",
+    "imagesGenerations": "影像生成",
+    "chatCompletions": "聊天完成",
+    "importingModels": "正在匯入...",
+    "importFromModels": "從 /models 匯入",
+    "modelsImported": "已匯入 {count} 個模型",
+    "allModelsAlreadyImported": "所有模型已匯入",
+    "noNewModelsToImport": "沒有新模型可匯入 — 所有模型已在登錄檔或自定義模型列表中",
+    "skippingExistingModels": "跳過 {count} 個已有模型",
+    "autoSync": "自動同步",
+    "autoSyncTooltip": "每 24 小時自動重新整理模型列表（可通過 MODEL_SYNC_INTERVAL_HOURS 配置）",
+    "autoSyncEnabled": "自動同步已啟用 — 模型將定期重新整理",
+    "autoSyncDisabled": "自動同步已停用",
+    "autoSyncToggleFailed": "切換自動同步失敗",
+    "clearAllModels": "清除所有模型",
+    "clearAllModelsConfirm": "您確定要刪除此提供商的所有模型嗎？",
+    "clearAllModelsSuccess": "所有模型已清除",
+    "clearAllModelsFailed": "清除模型失敗",
+    "addConnectionToImport": "新增連線以啟用匯入。",
+    "noModelsConfigured": "尚未配置模型",
+    "connectionCount": "{count} 連線",
+    "fetchingModels": "正在獲取可用模型...",
+    "failedFetchModels": "獲取模型失敗",
+    "noFreeModelsFound": "__MISSING__:No free models found for this provider — nothing imported.",
+    "fetchModelsSuccess": "找到 {count} 個新模型",
+    "fetchModelsFailed": "無法自動獲取模型（可從設定中重試）",
+    "noModelsFound": "未找到模型",
+    "importFailed": "匯入失敗",
+    "noNewModelsAdded": "沒有新增新模型。",
+    "adding": "新增...",
+    "close": "關閉",
+    "importingModelsTitle": "匯入模型",
+    "copyModel": "複製模型",
+    "filterModels": "篩選模型…",
+    "testAllRateLimited": "達到速率限制，已提前停止",
+    "hideFailedAuto": "自動隱藏失敗模型",
+    "selectAllModels": "全選",
+    "hideAllModels": "全部隱藏",
+    "modelsActive": "已啟用",
+    "showModel": "顯示模型",
+    "hideModel": "隱藏模型",
+    "removeModel": "刪除模型",
+    "rateLimitProtected": "受保護",
+    "rateLimitUnprotected": "無保護",
+    "enableRateLimitProtection": "單擊啟用速率限制保護",
+    "disableRateLimitProtection": "單擊以停用速率限制保護",
+    "testAllProgress": "已測試 {done}/{total}",
+    "testAllFailedHidden": "已隱藏 {count} 個失敗模型",
+    "testAllDone": "所有模型已測試",
+    "productionKey": "生產金鑰",
+    "enterNewApiKey": "輸入新的 API 金鑰",
+    "codexApplyModalTitle": "適用於當地法典",
+    "codexApplyTargetLabel": "目標路徑",
+    "codexApplyBackupLabel": "備份",
+    "codexApplyWarning": "這將替換現有的 auth.json。繼續？",
+    "codexApplyConfirmCheckbox": "我確認我想替換現有的 auth.json",
+    "codexApply": "申請",
+    "bulkTabSingle": "單個",
+    "bulkTabBulkAdd": "批次新增",
+    "bulkAddFormatHint": "每行一個金鑰。格式：名稱|API金鑰 或僅 API金鑰（按序號自動命名）。",
+    "bulkValidateKeys": "儲存前驗證每個金鑰（較慢）",
+    "bulkAddAllKeys": "新增所有金鑰",
+    "bulkAddedCount": "{count, plural, other {已新增 # 個金鑰}}",
+    "bulkFailedCount": "{count, plural, other {# 個失敗}}",
+    "optional": "可選",
+    "anthropicCompatibleName": "Anthropic 相容",
+    "openaiCompatibleName": "OpenAI 相容",
+    "compatibleDefaultModelLabel": "__MISSING__:Default Model",
+    "compatibleDefaultModelHint": "__MISSING__:Enter the model ID exactly as your compatible endpoint expects it. This model will be saved as the connection default.",
+    "failedImportModels": "匯入模型失敗",
+    "noModelsReturnedFromEndpoint": "/models 端點沒有返回任何模型。",
+    "importingModelsProgress": "正在匯入 {current} 個模型（共 {total} 個）...",
+    "foundModelsStartingImport": "找到 {count} 模型。開始匯入...",
+    "importingModelById": "正在匯入 {modelId}...",
+    "importSuccessCount": "成功匯入 {count, plural, one {# 個模型} other {# 個模型}}！",
+    "noNewModelsAddedExisting": "沒有新增新模型（全部已存在）。",
+    "importDoneCount": "✓ 完成！{count, plural, one {已匯入 # 個模型。} other {已匯入 # 個模型。}}",
+    "unexpectedErrorOccurred": "發生意外錯誤",
+    "connectionCountLabel": "{count, plural, one {# 個連線} other {# 個連線}}",
+    "messagesPath": "messages",
+    "responsesPath": "responses",
+    "chatCompletionsPath": "chat/completions",
+    "add": "新增",
+    "edit": "編輯",
+    "delete": "刪除",
+    "anthropic": "Anthropic",
+    "openai": "OpenAI",
+    "singleConnectionPerCompatible": "每個相容節點僅允許一個連線。如果需要更多連線，請新增另一個節點。",
+    "connections": "連線",
+    "providerProxyTitleConfigured": "提供商代理：{host}",
+    "configured": "已配置",
+    "providerProxyConfigureHint": "為該提供商的所有連線配置代理",
+    "providerProxy": "提供商代理",
+    "repairEnv": "修復 .env",
+    "repairEnvWorking": "修復中...",
+    "repairEnvHint": "將缺失的 OAuth 預設值補充到 .env 中，不會覆蓋現有值。",
+    "repairEnvSuccess": "OAuth 預設值已恢復",
+    "repairEnvFailed": "修復 .env 失敗",
+    "noConnectionsYet": "還沒有連線",
+    "addFirstConnectionHint": "新增您的第一個連線以開始使用",
+    "addConnection": "新增連線",
+    "availableModels": "可用模型",
+    "builtInModels": "內建模型",
+    "builtInModelsHint": "該提供商的登錄檔模型。點選鉛筆可設定相容選項。",
+    "pageAutoRefresh": "頁面會自動重新整理...",
+    "statusDisabled": "已停用",
+    "statusConnected": "已連線",
+    "statusRuntimeIssue": "執行時問題",
+    "statusAuthFailed": "驗證失敗",
+    "statusRateLimited": "被限流",
+    "statusNetworkIssue": "網路問題",
+    "statusTestUnsupported": "測試不受支援",
+    "statusUnavailable": "不可用",
+    "statusFailed": "失敗",
+    "statusError": "錯誤",
+    "oauthAccount": "OAuth 帳戶",
+    "errorTypeRuntime": "本地執行時",
+    "errorTypeUpstreamAuth": "上游授權",
+    "errorTypeMissingCredential": "缺少憑證",
+    "errorTypeRefreshFailed": "重新整理失敗",
+    "errorTypeTokenExpired": "令牌已過期",
+    "errorTypeRateLimited": "速率有限",
+    "errorTypeUpstreamUnavailable": "上游不可用",
+    "errorTypeNetworkError": "網路錯誤",
+    "errorTypeTestUnsupported": "測試不支援",
+    "errorTypeUpstreamError": "上游錯誤",
+    "errorTypeCreditsExhausted": "額度已用完",
+    "errorTypeBanned": "403 禁止訪問",
+    "proxySourceGlobal": "全域性",
+    "proxySourceProvider": "提供商",
+    "proxySourceKey": "金鑰",
+    "proxyConfiguredBySource": "代理 ({source})：{host}",
+    "proxyOn": "代理開啟",
+    "proxyOff": "代理關閉",
+    "proxyEnabledTitle": "此連線已啟用代理",
+    "proxyDisabledTitle": "此連線已停用代理",
+    "perKeyProxyOn": "按金鑰",
+    "perKeyProxyOff": "連線",
+    "perKeyProxyEnabledTitle": "已為此提供商啟用按金鑰代理分配",
+    "perKeyProxyDisabledTitle": "已為此提供商停用按金鑰代理分配",
+    "autoPriority": "自動：{priority}",
+    "proxy": "代理",
+    "retestAuthentication": "重新驗證身份",
+    "retest": "重新測試",
+    "disableConnection": "停用連線",
+    "enableConnection": "啟用連線",
+    "reauthenticateConnection": "重新驗證此連線",
+    "proxyConfig": "代理配置",
+    "aliasExistsAlert": "別名“{alias}”已存在。請使用不同的模型或編輯現有別名。",
+    "aliasInputPlaceholder": "alias name",
+    "clickToSetAlias": "Click to set alias",
+    "clickToEditAlias": "Alias: {alias} (click to edit)",
+    "openRouterAnyModelHint": "OpenRouter 支援任意模型。新增模型並建立別名後即可快速訪問。",
+    "modelIdFromOpenRouter": "模型 ID（來自 OpenRouter）",
+    "openRouterModelPlaceholder": "anthropic/claude-3-opus",
+    "customModels": "自定義模型",
+    "customModelsHint": "新增預設列表中沒有的模型 ID，這些模型也能參與路由。",
+    "normalizeToolCallIdLabel": "將工具呼叫 ID 規範為 9 位（如 Mistral）",
+    "preserveDeveloperRoleLabel": "保留 Responses 的 developer 角色（不對映為 system）",
+    "compatAdjustmentsTitle": "相容性",
+    "compatButtonLabel": "相容性",
+    "compatToolIdShort": "工具 ID 9 位",
+    "compatDeveloperShort": "developer 角色",
+    "compatDoNotPreserveDeveloper": "不保留 developer 角色",
+    "compatBadgeNoPreserve": "不保留",
+    "compatProtocolLabel": "客戶端請求協議",
+    "compatProtocolHint": "以下選項在 OmniRoute 識別到該請求形態（OpenAI Chat、Responses API 或 Anthropic Messages）時生效。",
+    "compatProtocolOpenAI": "OpenAI Chat Completions",
+    "compatProtocolOpenAIResponses": "OpenAI Responses API",
+    "compatProtocolClaude": "Anthropic Messages",
+    "targetFormatLabel": "__MISSING__:Target Format",
+    "targetFormatHint": "__MISSING__:Override the upstream wire format. Use 'Anthropic Messages' to route OpenAI-compatible providers (e.g. opencode-go) through the /v1/messages endpoint.",
+    "targetFormatAuto": "__MISSING__:Default (auto)",
+    "targetFormatGemini": "__MISSING__:Gemini",
+    "targetFormatAntigravity": "__MISSING__:Antigravity",
+    "compatUpstreamHeadersLabel": "上游額外請求頭",
+    "compatUpstreamHeadersHint": "與修改廠商連線/API 配置同屬高許可權能力，僅可信管理員應使用。這些頭會在 OmniRoute 按廠商 API Key 自動加好鑑權頭之後再合併。若「名稱」與系統已加的頭相同（例如都叫 Authorization），則以你填的值為準，會整段替換自動那條（含 Bearer 令牌），上游請求裡不再使用面板裡儲存的金鑰來生成 Authorization。填錯可能導致 401，請謹慎。每個請求頭單獨一行；部分閘道器需要額外 Authentication 等可在此加。滑鼠移入或聚焦「值」可暫時看明文。點空白處、關閉本面板或切走焦點即儲存。",
+    "compatUpstreamHeaderName": "請求頭名稱",
+    "compatUpstreamHeaderValue": "值",
+    "compatUpstreamAddRow": "新增請求頭",
+    "compatUpstreamRemoveRow": "刪除此行",
+    "compatBadgeUpstreamHeaders": "請求頭",
+    "perModelQuotaLabel": "按模型配額",
+    "perModelQuotaDescription": "啟用後，429/404 錯誤只會鎖定特定 Model，而不是整個連線。適用於具有按 Model 速率限制的 Provider（例如 ModelScope）。",
+    "importFreeModelsOnlyLabel": "__MISSING__:Import only free models",
+    "importFreeModelsOnlyHint": "__MISSING__:When enabled, only this provider's free models are imported. Paid models are skipped.",
+    "perModelQuotaToggle": "按模型配額開關",
+    "modelId": "模型 ID",
+    "customModelPlaceholder": "例如：gpt-4.5-turbo",
+    "loading": "正在載入...",
+    "removeCustomModel": "刪除自定義模型",
+    "noCustomModels": "尚未新增自定義模型。",
+    "allSuggestedAliasesExist": "所有建議別名都已存在。請選擇其他模型，或刪除衝突的別名。",
+    "failedSaveCustomModel": "儲存自定義模型失敗",
+    "modelAddedSuccess": "模型 {modelId} 新增成功",
+    "failedAddModelTryAgain": "新增模型失敗，請重試。",
+    "failedSaveImportedModel": "無法將匯入的模型儲存到自定義資料庫",
+    "failedImportModelsTryAgain": "匯入模型失敗。請再試一次。",
+    "failedRemoveModelFromDatabase": "無法從資料庫中刪除模型",
+    "modelRemovedSuccess": "模型刪除成功",
+    "failedDeleteModelTryAgain": "刪除模型失敗。請再試一次。",
+    "compatibleModelsDescription": "可手動新增 {type} 相容模型，或從 `/models` 端點匯入。",
+    "anthropicCompatibleModelPlaceholder": "claude-3-opus-20240229",
+    "openaiCompatibleModelPlaceholder": "gpt-4o",
+    "apiKeyValidationFailed": "API 金鑰驗證失敗。請檢查您的金鑰並重試。",
+    "addProviderApiKeyTitle": "新增 {provider} API 金鑰",
+    "checking": "正在檢查...",
+    "check": "檢查",
+    "valid": "有效",
+    "invalid": "無效",
+    "creating": "創造...",
+    "validationChecksAnthropicCompatible": "驗證會通過檢查 API 金鑰來確認 {provider} 是否可用。",
+    "validationChecksOpenAiCompatible": "驗證會通過你填寫的 Base URL 上的 `/models` 介面來檢查 {provider}。",
+    "priorityLabel": "優先順序",
+    "saving": "正在儲存...",
+    "save": "儲存",
+    "editConnection": "編輯連線",
+    "accountName": "帳戶名稱",
+    "email": "電子郵件",
+    "healthCheckMinutes": "健康檢查（分鐘）",
+    "healthCheckHint": "主動令牌重新整理間隔。 0 = 停用。",
+    "deselectAllModels": "取消全選",
+    "modelsActiveCount": "{active}/{total} 已啟用",
+    "noModelsMatch": "沒有匹配 \"{filter}\" 的模型",
+    "groupLabel": "環境",
+    "groupPlaceholder": "例如：eKaizen、Personal",
+    "failedTestConnection": "測試連線失敗",
+    "failed": "失敗",
+    "leaveBlankKeepCurrentApiKey": "留空以保留當前的 API 金鑰。",
+    "editCompatibleTitle": "編輯 {type} 相容",
+    "compatibleBaseUrlHint": "{type} 相容 API 的根 URL。若端點路徑是自定義的，請在高階設定中配置。",
+    "apiKeyForCheck": "API 金鑰（用於檢查）",
+    "testModelIdLabel": "__MISSING__:Model ID (optional)",
+    "testModelIdPlaceholder": "__MISSING__:e.g. my-model-id",
+    "testModelIdHint": "__MISSING__:If the provider lacks a /models endpoint, enter a model ID to validate via /chat/completions instead.",
+    "compatibleProdPlaceholder": "{type} 相容（產品）",
+    "tokenRefreshed": "Token 重新整理成功",
+    "tokenRefreshFailed": "Token 重新整理失敗",
+    "applyCodexAuthLocal": "應用認證",
+    "exportCodexAuthFile": "匯出認證",
+    "applyClaudeAuthLocal": "申請授權",
+    "exportClaudeAuthFile": "匯出授權",
+    "importClaudeAuth": "匯入授權",
+    "claudeApplyModalTitle": "適用於當地克勞德程式碼",
+    "claudeApplyTargetLabel": "目標路徑",
+    "claudeApplyBackupLabel": "備份",
+    "claudeApplyMcpHint": "現有的 MCP OAuth 狀態將被保留。",
+    "claudeApplyWarning": "這將取代現有的 claudeAiOauth 部分。繼續？",
+    "claudeApplyConfirmCheckbox": "我確認我想替換現有的 claudeAiOauth 部分",
+    "claudeApply": "申請",
+    "claudeAuthAppliedLocal": "克勞德授權在本地應用",
+    "claudeAuthApplyFailed": "本地申請Claude auth失敗",
+    "claudeAuthExported": "克勞德授權檔案匯出",
+    "claudeAuthExportFailed": "無法匯出 Claude 身份驗證檔案",
+    "claudeImportModalTitle": "匯入克勞德·奧特",
+    "claudeImportTabSingle": "單人",
+    "claudeImportTabBulk": "散裝",
+    "claudeImportTabUpload": "上傳檔案",
+    "claudeImportTabPaste": "貼上 JSON",
+    "claudeImportFileLabel": "選擇.credentials.json",
+    "claudeImportPasteLabel": "貼上 JSON 內容",
+    "claudeImportEmailLabel": "帳戶郵箱",
+    "claudeImportNameLabel": "連線名稱（可選）",
+    "claudeImportOverwriteLabel": "如果帳戶已存在，則替換現有連線",
+    "claudeImportSubmit": "進口",
+    "claudeImportSuccess": "克勞德連線匯入成功",
+    "claudeImportInvalidJson": "無法將檔案解析為 JSON",
+    "claudeImportInvalidShape": "該檔案不是有效的 .credentials.json",
+    "claudeImportDuplicate": "帳戶已存在 - 啟用“替換現有”以覆蓋",
+    "claudeImportIdentityUnverified": "Bootstrap 無法驗證該帳戶。啟用“替換現有”或提供電子郵件。",
+    "claudeImportFailed": "匯入克勞德授權失敗",
+    "claudeImportBulkModeUpload": "上傳檔案",
+    "claudeImportBulkModePaste": "貼上 JSON 陣列",
+    "claudeImportBulkModeZip": "上傳ZIP",
+    "claudeImportBulkUploadHint": "拖放或拾取最多 50 個 .credentials.json 檔案（每個 256KB，總共 10MB）。",
+    "claudeImportBulkPasteHint": "貼上物件陣列：[{ json, name?, email? }...]",
+    "claudeImportBulkZipHint": "包含 .json 條目的 ZIP。最多 50 個條目，解壓後 10MB。",
+    "claudeImportBulkSubmit": "全部匯入",
+    "claudeImportBulkSuccess": "匯入 {count} Claude 連線",
+    "claudeImportBulkFailed": "部分條目匯入失敗",
+    "claudeImportBulkZipExtracting": "正在提取 ZIP...",
+    "claudeImportBulkZipError": "無法提取 ZIP",
+    "geminiAuthAppliedLocal": "Gemini 身份驗證在本地應用",
+    "geminiAuthApplyFailed": "本地申請 Gemini 身份驗證失敗",
+    "geminiAuthExported": "Gemini 驗證檔案已匯出",
+    "geminiAuthExportFailed": "匯出 Gemini 身份驗證檔案失敗",
+    "geminiImportModalTitle": "匯入 Gemini 授權",
+    "geminiImportTabSingle": "單人",
+    "geminiImportTabBulk": "散裝",
+    "geminiImportTabUpload": "上傳檔案",
+    "geminiImportTabPaste": "貼上 JSON",
+    "geminiImportFileLabel": "選擇 oauth_creds.json",
+    "geminiImportPasteLabel": "貼上 JSON 內容",
+    "geminiImportEmailLabel": "帳戶郵箱",
+    "geminiImportNameLabel": "連線名稱（可選）",
+    "geminiImportOverwriteLabel": "如果帳戶已存在，則替換現有連線",
+    "geminiImportSubmit": "進口",
+    "geminiImportSuccess": "Gemini 連線匯入成功",
+    "geminiImportInvalidJson": "無法將檔案解析為 JSON",
+    "geminiImportInvalidShape": "該檔案不是有效的 oauth_creds.json",
+    "geminiImportDuplicate": "帳戶已存在 - 啟用“替換現有”以覆蓋",
+    "geminiImportIdentityUnverified": "無法通過 id_token 驗證身份。啟用“替換現有”或提供電子郵件。",
+    "geminiImportFailed": "匯入 Gemini 身份驗證失敗",
+    "geminiImportBulkModeUpload": "上傳檔案",
+    "geminiImportBulkModePaste": "貼上 JSON 陣列",
+    "geminiImportBulkModeZip": "上傳ZIP",
+    "geminiImportBulkUploadHint": "拖放或拾取最多 50 個 oauth_creds.json 檔案（每個 256KB，總共 10MB）。",
+    "geminiImportBulkPasteHint": "貼上物件陣列：[{ json, name?, email? }...]",
+    "geminiImportBulkZipHint": "包含 oauth_creds.json 條目的 ZIP。最多 50 個條目，解壓後 10MB。",
+    "geminiImportBulkSubmit": "全部匯入",
+    "geminiImportBulkSuccess": "匯入 {count} Gemini 連線",
+    "geminiImportBulkFailed": "部分條目匯入失敗",
+    "geminiImportBulkZipExtracting": "正在提取 ZIP...",
+    "geminiImportBulkZipError": "無法提取 ZIP",
+    "codexAuthAppliedLocal": "Codex auth.json 已在本地應用",
+    "codexAuthApplyFailed": "在本地應用 Codex auth.json 失敗",
+    "codexAuthExported": "Codex auth.json 已匯出",
+    "codexAuthExportFailed": "匯出 Codex auth.json 失敗",
+    "codexCliGuideButton": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideTitle": "__MISSING__:Codex CLI Guide",
+    "codexCliGuideLoading": "__MISSING__:Loading guide...",
+    "codexCliGuideLoadFailed": "__MISSING__:Could not load the guide.",
+    "codexExternalLinkButton": "__MISSING__:External Codex link",
+    "codexExternalLinkModalTitle": "__MISSING__:External Codex link",
+    "codexExternalLinkModalDescription": "__MISSING__:Share this single-use link with the person who will authenticate the Codex account. They open it in their own browser, complete the OpenAI login, and the connection is registered here. The link expires in 15 minutes.",
+    "codexExternalLinkGenerating": "__MISSING__:Generating link...",
+    "codexExternalLinkWaiting": "__MISSING__:Waiting for browser authentication. This window refreshes automatically.",
+    "codexExternalLinkCreateFailed": "__MISSING__:Failed to generate the link.",
+    "codexExternalLinkNetworkError": "__MISSING__:Could not contact the server.",
+    "codexExternalLinkConnected": "__MISSING__:Codex account connected through the external link.",
+    "codexExternalLinkExpired": "__MISSING__:The link expired before completion.",
+    "importCodexAuth": "匯入授權",
+    "codexImportModalTitle": "匯入法典認證",
+    "codexImportTabSingle": "單人",
+    "codexImportTabBulk": "散裝",
+    "codexImportTabUpload": "上傳檔案",
+    "codexImportTabPaste": "貼上 JSON",
+    "codexImportFileLabel": "選擇 auth.json",
+    "codexImportFileHint": "選擇從 Codex 或 OmniRoute 匯出的 auth.json 檔案。",
+    "codexImportPasteLabel": "貼上 JSON 內容",
+    "codexImportEmailLabel": "帳戶郵箱",
+    "codexImportEmailHint": "從檔案中自動檢測；如果需要的話進行編輯。",
+    "codexImportNameLabel": "連線名稱（可選）",
+    "codexImportOverwriteLabel": "如果帳戶已存在，則替換現有連線",
+    "codexImportSubmit": "進口",
+    "codexImportSuccess": "Codex 連線匯入成功",
+    "codexImportInvalidJson": "無法將檔案解析為 JSON",
+    "codexImportInvalidShape": "該檔案不是有效的 Codex auth.json",
+    "codexImportDuplicate": "帳戶已存在 - 啟用“替換現有”以覆蓋",
+    "codexImportFailed": "匯入 Codex 驗證失敗",
+    "codexImportDetectedEmail": "檢測到：{email}",
+    "codexImportNoEmailDetected": "檔案中未檢測到電子郵件",
+    "codexImportBulkModeUpload": "上傳檔案",
+    "codexImportBulkModePaste": "貼上列表",
+    "codexImportBulkModeZip": "ZIP 存檔",
+    "codexImportBulkUploadHint": "選擇多個 .json 檔案或拖放",
+    "codexImportBulkPasteHint": "JSON 陣列 [ {...}, {...} ] 或由 --- 分隔的多個 JSON 在其自己的行上",
+    "codexImportBulkZipHint": "上傳包含 auth.json 檔案的 .zip（最多 50 個檔案，10 MB）",
+    "codexImportBulkSubmit": "匯入 {count} 帳戶",
+    "codexImportBulkLimit": "每次匯入最多 50 個檔案",
+    "codexImportBulkSuccess": "{count} 已匯入",
+    "codexImportBulkFailed": "{count} 失敗",
+    "codexImportBulkZipExtracting": "正在提取 ZIP...",
+    "codexImportBulkZipError": "無法提取 ZIP",
+    "advancedSettings": "高階設定",
+    "chatPathLabel": "聊天端點路徑",
+    "chatPathPlaceholder": "/chat/completions",
+    "chatPathHint": "為非標準 API 的提供商自定義聊天路徑（例如：/v4/chat/completions）",
+    "modelsPathLabel": "模型端點路徑",
+    "modelsPathPlaceholder": "/models",
+    "modelsPathHint": "為驗證流程自定義模型路徑（例如：/v4/models）",
+    "clientIdentityLabel": "__MISSING__:Client Identity",
+    "clientIdentityHint": "__MISSING__:Optional. Adds client fingerprint headers (e.g. User-Agent) matching a known CLI for compatible gateways that expect one.",
+    "statusDeactivated": "已停用（手動）",
+    "statusBanned": "已封禁 / 沙箱違規",
+    "statusCreditsExhausted": "餘額不足 / 配額已耗盡",
+    "showEmails": "顯示所有郵箱",
+    "hideEmails": "隱藏所有郵箱",
+    "a": "A",
+    "accountConcurrencyCapHint": "限制此 Account 可同時處理的請求數。",
+    "accountConcurrencyCapLabel": "Account 併發上限",
+    "accountIdHint": "用於區分同一 Provider 下的多個 Account。",
+    "accountIdLabel": "Account ID",
+    "accountIdPlaceholder": "Account ID 佔位符",
+    "addAnotherApiKey": "新增另一個 API 金鑰或貼上多個金鑰",
+    "addCcCompatible": "新增 CC 相容",
+    "aggregatorsGateways": "聚合器與閘道器",
+    "enterpriseCloud": "企業與雲",
+    "apiFormatLabel": "API 格式",
+    "apiKeyOptionalHint": "如果上游不需要認證，可以留空 API key。",
+    "apiKeyOptionalLabel": "API key（可選）",
+    "apiRegionChina": "中國區",
+    "apiRegionHint": "選擇此 Provider 的 API 區域。",
+    "apiRegionInternational": "國際區",
+    "apiRegionLabel": "API 區域",
+    "apikey": "API key",
+    "audio": "音訊",
+    "audioProvidersHeading": "音訊 Provider",
+    "cloudAgentProviders": "雲代理提供商",
+    "audioShortLabel": "音訊",
+    "azureOpenAiBaseUrlHint": "Azure OpenAI 資源的 Base URL。",
+    "bailianBaseUrlHint": "阿里雲百鍊服務的 Base URL。",
+    "claudeWebCookieHint": "開啟 claude.ai → 開發者工具 → 應用 → Cookie → claude.ai，複製 sessionKey 值。還需要從同一頁面複製 cf_clearance 值。",
+    "claudeWebCookiePlaceholder": "sessionKey=sk-ant-...",
+    "blackboxWebCookieHint": "從 Blackbox Web 會話複製 Cookie。",
+    "blackboxWebCookiePlaceholder": "Blackbox Web Cookie",
+    "t3ChatWebCookieHint": "開啟 t3.chat → 開發工具 → 應用程式 → 本地儲存 → https://t3.chat，複製“凸會話 ID”。然後開啟 DevTools → Network，從任何聊天請求中複製完整的 Cookie 標頭。將這兩個值貼上到下面的欄位中。",
+    "t3ChatWebCookiePlaceholder": "凸會話 ID=abc123...",
+    "blockClaudeExtraUsageDescription": "隱藏部分 Provider 返回的重複 Claude 額外用量記錄，避免和主 token 統計重複。",
+    "blockClaudeExtraUsageLabel": "遮蔽重複 Claude 用量",
+    "disableCoolingDescription": "__MISSING__:Skip the transient cooldown so this connection stays eligible even after recoverable errors (terminal states like banned/expired still apply).",
+    "disableCoolingLabel": "__MISSING__:Disable cooldown for this connection",
+    "bulkPasteAdded": "{count, plural, one {已新增 1 個 key} other {已新增 # 個 key}}",
+    "bulkPasteDuplicatesIgnored": "{count, plural, one {已跳過 1 個重複項} other {已跳過 # 個重複項}}",
+    "bulkPasteHint": "每行貼上一個 API 金鑰。空行會被忽略，重複金鑰會被跳過。",
+    "ccCompatibleBaseUrlHint": "Claude Code 專用中轉站的 Base URL，不要包含 /messages。",
+    "ccCompatibleBaseUrlPlaceholder": "https://relay.example.com/v1",
+    "ccCompatibleChatPathHint": "預設使用 Claude Code 嚴格的 Messages API 路徑。僅在中轉站文件要求時修改。",
+    "ccCompatibleContext1mDescription": "當所選 Claude 模型支援時，新增 context-1m beta header。",
+    "ccCompatibleContext1mLabel": "啟用 1M context beta",
+    "ccCompatibleRedactThinkingDescription": "為要求隱藏 Claude 思考流的 CC Compatible 上游新增 redact-thinking beta header。",
+    "ccCompatibleRedactThinkingLabel": "啟用 redact-thinking beta",
+    "ccCompatibleSummarizeThinkingDescription": "為 CC Compatible 的 thinking 請求新增 `display: \"summarized\"`，讓支援的 Claude 模型流式返回可見思考增量。",
+    "ccCompatibleSummarizeThinkingLabel": "啟用 summarized thinking display",
+    "ccCompatibleDetailsTitle": "CC 相容中轉站詳情",
+    "ccCompatibleLabel": "CC 相容",
+    "ccCompatibleModelsDescription": "CC 相容中轉站不提供模型列表。請新增該中轉站接受的 Claude 模型 ID。",
+    "ccCompatibleNameHint": "這個 Claude Code 專用中轉站的顯示名稱。",
+    "ccCompatibleNamePlaceholder": "CC 中轉站生產環境",
+    "ccCompatiblePrefixHint": "用於 prefix/model-id 這類模型別名。",
+    "ccCompatiblePrefixPlaceholder": "cc",
+    "ccCompatibleValidationHint": "這個 Provider 只適用於僅向 Claude Code 客戶端提供服務的中轉站。OmniRoute 會把任何進入的請求改寫為 Claude Code 相容的傳輸格式，以通過這些中轉站的驗證。如果你只是想使用 Claude Code CLI，或者不清楚這類中轉站是什麼，請使用普通 Anthropic-compatible Provider。",
+    "claudeExtraUsageShort": "額外用量",
+    "claudeExtraUsageToggleTitle": "為此連線遮蔽 Claude 額外用量統計",
+    "codex5hToggleTitle": "為此連線跟蹤 Codex 5 小時配額",
+    "codexFastServiceTierDescription": "可用時為 Codex 請求使用 priority 服務層。",
+    "codexFastServiceTierLabel": "Codex 快速服務層",
+    "codexWeeklyToggleTitle": "為此連線跟蹤 Codex 周配額",
+    "compatUpstreamHeaderNamePlaceholder": "上游 Header 名稱",
+    "compatUpstreamHeaderValuePlaceholder": "上游 Header 值",
+    "compatible": "相容",
+    "configuredCount": "已配置數量",
+    "consoleApiKeyOracleHint": "用於從 Console 獲取或驗證 API key 的輔助配置。",
+    "consoleApiKeyOracleLabel": "Console API key Oracle",
+    "consoleApiKeyOraclePlaceholder": "Console API key Oracle 佔位符",
+    "cpaModeDisabledTitle": "CLIProxyAPI 相容模式已關閉",
+    "cpaModeEnabledTitle": "CLIProxyAPI 相容模式已開啟",
+    "customUserAgentHint": "傳送給上游 Provider 的自定義 User-Agent。",
+    "customUserAgentLabel": "自定義 User-Agent",
+    "databricksBaseUrlHint": "Databricks Serving Endpoint 的 Base URL。",
+    "defaultThinkingStrengthHint": "請求未指定 reasoning effort 時使用。",
+    "defaultThinkingStrengthLabel": "預設思考強度",
+    "deleteAllExtraApiKeys": "全部刪除",
+    "excludedModelsHint": "這些 Model 不會出現在路由和選擇器中。",
+    "excludedModelsLabel": "排除的 Model",
+    "excludedModelsPlaceholder": "以逗號分隔的 Model ID",
+    "expirationBannerExpired": "憑據已過期",
+    "expirationBannerExpiredDesc": "此 Provider 的憑據已過期，請更新後繼續使用。",
+    "expirationBannerExpiringSoon": "憑據即將過期",
+    "expirationBannerExpiringSoonDesc": "此 Provider 的憑據即將過期，請提前更新。",
+    "extraApiKeyMasked": "金鑰 {index}：{prefix}••••{suffix}",
+    "extraApiKeysHint": "為同一提供商新增額外 API 金鑰，以便輪換和回退使用。",
+    "extraApiKeysLabel": "額外 API 金鑰",
+    "apiKeyHealthLabel": "API 金鑰健康狀態",
+    "apiKeyStatusActive": "正常",
+    "apiKeyStatusWarning": "異常（{count} 次失敗）",
+    "apiKeyStatusInvalid": "無效",
+    "primaryKey": "主金鑰",
+    "apiKeyInvalidAlert": "{count} 個 API 金鑰因認證失敗被標記為無效：{connections}。輪換時將跳過它們。點選檢視。",
+    "apiKeyInvalidAlertTitle": "API 金鑰健康提醒",
+    "apiKeyWarningAlert": "{count} 個 API 金鑰在以下連線中處於警告狀態：{connections}。請檢查以防止輪換問題。",
+    "apiKeyWarningAlertTitle": "API 金鑰警告",
+    "googlePseInfo": "配置 Google Programmable Search Engine 以啟用 Web Search。",
+    "antigravityProjectIdHint": "反重力雲程式碼請求的可選覆蓋。留空以使用 Google OAuth 期間發現的專案。",
+    "antigravityClientProfileLabel": "客戶端配置",
+    "antigravityClientProfileHint": "選擇 OmniRoute 向 API 呈現的 Antigravity 客戶端身份。",
+    "antigravityClientProfileIde": "IDE",
+    "antigravityClientProfileHarness": "Harness / CLI",
+    "codexFastTierActiveChip": "Codex Fast 層級已啟用",
+    "tierFast": "快速",
+    "antigravityProjectIdLabel": "谷歌雲專案 ID",
+    "antigravityProjectIdPlaceholder": "我的 GCP 專案 ID",
+    "grokWebCookieHint": "從 Grok Web 會話複製 Cookie。",
+    "grokWebCookiePlaceholder": "Grok Web Cookie",
+    "herokuBaseUrlHint": "Heroku 部署的 Base URL。",
+    "hideEmail": "隱藏郵箱",
+    "imageProviders": "影像 Provider",
+    "videoProviders": "影片生成",
+    "embeddingRerankProviders": "嵌入與重排序",
+    "imagesShortLabel": "影像",
+    "llmProviders": "LLM Provider",
+    "localProviderApiKeyOptionalHint": "本地提供商的 API 金鑰通常是可選的。",
+    "localProviderBaseUrlHint": "輸入本地提供商的 Base URL。",
+    "localProviders": "本地 Provider",
+    "maxConcurrentWholeNumberError": "最大併發必須是整數",
+    "museSparkWebCookieHint": "從 Muse Spark Web 會話複製 Cookie。",
+    "museSparkWebCookiePlaceholder": "Muse Spark Web Cookie",
+    "oauth": "OAuth",
+    "openCliTools": "開啟 CLI Tools",
+    "openSettings": "開啟設定",
+    "openaiResponsesStoreDescription": "允許相容的 Responses API 請求保留已儲存的響應狀態。",
+    "openaiResponsesStoreLabel": "OpenAI Responses 儲存",
+    "perplexitySearchSharedKeyInfo": "Perplexity Search 可使用共享 key 配置。",
+    "perplexityWebCookieHint": "從 Perplexity Web 會話複製 Cookie。",
+    "perplexityWebCookiePlaceholder": "Perplexity Web Cookie",
+    "personalAccessTokenLabel": "個人訪問令牌",
+    "qoderPatHint": "輸入 Qoder Personal Access Token。",
+    "qoderPatPlaceholder": "Qoder PAT",
+    "rateLimitOverridesSection": "速率限制覆蓋",
+    "rateLimitOverridesMaxConcurrentHint": "此連線的最大併發請求覆蓋。覆蓋帳戶級別的上限。",
+    "rateLimitOverridesMaxConcurrentLabel": "最大併發（速率限制）",
+    "rateLimitOverridesMinTimeHint": "請求之間的最小時間（毫秒）。覆蓋預設速率限制器延遲。",
+    "rateLimitOverridesMinTimeLabel": "最小間隔（毫秒）",
+    "rateLimitOverridesRpmHint": "此連線的每分鐘最大請求數。覆蓋提供商預設值。",
+    "rateLimitOverridesRpmLabel": "RPM（請求/分鐘）",
+    "rateLimitOverridesTpdHint": "此連線的每日最大令牌數。覆蓋提供商預設值。",
+    "rateLimitOverridesTpdLabel": "TPD（令牌/天）",
+    "rateLimitOverridesTpmHint": "此連線的每分鐘最大令牌數。覆蓋提供商預設值。",
+    "rateLimitOverridesTpmLabel": "TPM（令牌/分鐘）",
+    "refreshOauthTokenTitle": "重新整理 OAuth Token",
+    "regionHint": "選擇此 Provider 使用的區域。",
+    "regionLabel": "區域",
+    "removeThisKey": "移除此 key",
+    "routingTagsHint": "新增標籤以便在路由規則中匹配此連線。",
+    "routingTagsLabel": "路由標籤",
+    "routingTagsPlaceholder": "例如 coding, fast, cheap",
+    "search": "搜尋",
+    "searchEngineIdHint": "Google Programmable Search Engine 的 ID。",
+    "searchEngineIdLabel": "Search Engine ID",
+    "searchEngineIdRequired": "Search Engine ID 為必填項",
+    "searchProvider": "搜尋提供商",
+    "searchProviderDesc": "按名稱、能力或類別查詢提供商。",
+    "searchProviders": "搜尋 Provider",
+    "searchByModel": "__MISSING__:Search by model…",
+    "searchProvidersHeading": "搜尋 Provider",
+    "searxngBaseUrlHint": "SearXNG 例項的 Base URL。",
+    "searxngInfo": "配置 SearXNG 以啟用自託管 Web Search。",
+    "sessionCookieLabel": "Session Cookie",
+    "showEmail": "顯示郵箱",
+    "snowflakeBaseUrlHint": "Snowflake Cortex 服務的 Base URL。",
+    "supportedEndpointAudio": "音訊",
+    "supportedEndpointChat": "聊天",
+    "supportedEndpointEmbeddings": "嵌入",
+    "supportedEndpointImages": "影像",
+    "supportedEndpointsLabel": "支援的端點",
+    "tagGroupHint": "用於篩選和組織 Provider 的標籤分組。",
+    "tagGroupLabel": "標籤分組",
+    "tagGroupPlaceholder": "標籤分組佔位符",
+    "testModel": "測試模型",
+    "testingModel": "正在測試模型",
+    "toggleOffShort": "關",
+    "toggleOnShort": "開",
+    "tokenExpiredBadge": "Token 已過期",
+    "tokenExpiredTitle": "Token 已過期",
+    "tokenExpiresSoonTitle": "Token 即將過期",
+    "tokenShort": "Token",
+    "totalKeysRotating": "{count, plural, one {1 個 key 正在輪換} other {# 個 key 正在輪換}}",
+    "unhideModel": "取消隱藏模型",
+    "upstreamProxyProviders": "上游代理 Provider",
+    "validationModelIdHint": "用於驗證此提供商連線的模型 ID。",
+    "validationModelIdLabel": "驗證模型 ID",
+    "validationModelIdPlaceholder": "輸入用於測試的模型 ID",
+    "vertexServiceAccountPlaceholder": "貼上 Service Account JSON（{\"type\":\"service_account\"...}）或 OAuth access_token",
+    "webCookieProviders": "Web Cookie Provider",
+    "weeklyShort": "每週",
+    "xiaomiMimoBaseUrlHint": "小米 Mimo 服務的 Base URL。",
+    "zedImportButton": "從 Zed 匯入",
+    "zedImportFailed": "Zed 匯入失敗",
+    "zedImportHint": "從 Zed 配置中匯入 Provider。",
+    "zedImportNetworkError": "Zed 匯入網路錯誤",
+    "zedImportNone": "沒有可從 Zed 匯入的內容",
+    "zedImportSuccess": "Zed 匯入成功",
+    "zedImporting": "正在從 Zed 匯入",
+    "freeTierProviders": "免費層提供商",
+    "freeTierLabel": "有免費額度",
+    "freeTierProvidersDesc": "提供免費層的提供商——有些需要註冊 API 金鑰，有些無需任何憑證。",
+    "providerSummaryAll": "全部",
+    "ideProviders": "IDE 提供商",
+    "ideProvidersDesc": "內建 AI 訂閱的編輯器。使用提供商頁面直接從 IDE 金鑰鏈匯入憑據。",
+    "noIdeProviders": "沒有符合當前篩選條件的 IDE 提供商。",
+    "providerDetailFastTierTooltip": "預設對所有 Codex 連線應用 Codex Fast 層級",
+    "providerDetailFastDefaultLabel": "快速預設",
+    "providerDetailBrowserManualConnect": "瀏覽器/手動連線",
+    "providerDetailAuthUrl": "認證 URL",
+    "providerDetailCallbackUrl": "回撥 URL",
+    "providerDetailValidClaudeCredentialsFile": "有效的 Claude 憑據檔案",
+    "providerDetailPathAutoDetectedAllOs": "路徑按作業系統自動檢測（Linux/Mac/Windows）。",
+    "providerDetailMyClaudeAccountPlaceholder": "我的克勞德帳戶",
+    "providerDetailPathAutoDetected": "根據作業系統 (Linux/Mac) 自動檢測路徑。",
+    "webFetch": "網頁抓取",
+    "webFetchTooltip": "從網頁 URL 抽取內容的提供商(HTML → Markdown、抓取、截圖)",
+    "webFetchProvidersHeading": "網頁抓取提供商",
+    "compatibleProvidersDesc": "您託管或配置的 OpenAI 相容和 Anthropic 相容端點。將任意 OpenAI SDK 指向您的 URL 並在此處路由請求。",
+    "oauthProvidersDesc": "通過 OAuth 認證的提供商——登入一次，OmniRoute 自動處理令牌輪換。",
+    "webCookieProvidersDesc": "這些提供商使用瀏覽器網路會話、cookie 或網路令牌而不是 API 金鑰。開啟提供程式以新增所需的會話憑據。",
+    "apiKeyProvidersDesc": "標準 API 金鑰提供商。新增金鑰後，OmniRoute 代為路由、重試和限流。",
+    "noAuthProvidersDesc": "無需憑證的開放端點——無需註冊即可立即使用。",
+    "upstreamProxyProvidersDesc": "通過上游代理路由出站流量。適用於企業網路或流量審計場景。",
+    "webFetchProvidersDesc": "從網頁 URL 抓取和提取內容的提供商。用於將即時網頁資料注入提示詞。",
+    "aggregatorsGatewaysDesc": "多提供商聚合器和 AI 閘道器，通過單一統一 API 對接數十個底層模型。",
+    "enterpriseCloudDesc": "企業級和雲託管模型，提供增強 SLA、合規認證和專用容量。",
+    "cloudAgentProvidersDesc": "自主雲代理，可執行長時間執行的任務，支援計劃審批和即時狀態跟蹤。",
+    "localProvidersDesc": "在您自己的硬體上執行的自託管模型。資料不會離開您的基礎設施。",
+    "searchProvidersDesc": "網頁和文件搜尋提供商。可附加到 LLM 呼叫以實現檢索增強生成（RAG）。",
+    "audioProvidersDesc": "文本轉語音和語音轉文本提供商，用於語音輸入輸出和音訊轉錄管道。",
+    "embeddingRerankProvidersDesc": "向量嵌入和重排序提供商，用於語義搜尋、RAG 管道和相似度評分。",
+    "imageProvidersDesc": "影像生成和視覺提供商——從文本建立影像或分析現有影像。",
+    "videoProvidersDesc": "影片生成提供商。從文本提示或影像建立短影片片段。",
+    "onboardingWizard": "提供商入職嚮導",
+    "onboardingWizardShort": "入職嚮導",
+    "onboardingWizardDescription": "通過驗證、永續性和即時連線測試連線 API 金鑰、自定義相容和 OAuth 提供商。",
+    "onboardingStepType": "型別",
+    "onboardingStepProvider": "提供商",
+    "onboardingStepCredentials": "憑證",
+    "onboardingStepResult": "結果",
+    "onboardingTypeApiKeyTitle": "API 金鑰提供商",
+    "onboardingTypeApiKeyText": "使用內建提供程式，例如 OpenAI、Anthropic、Gemini、Groq、Azure 等。",
+    "onboardingTypeCustomTitle": "自定義相容提供商",
+    "onboardingTypeCustomText": "建立與 OpenAI、Anthropic 或 Claude Code 相容的端點並新增其金鑰。",
+    "onboardingTypeOAuthTitle": "OAuth 提供商",
+    "onboardingTypeOAuthText": "為編碼提供商重用現有的 OAuth、裝置程式碼或本地匯入流程。",
+    "onboardingChooseOAuthProvider": "選擇 OAuth 提供商",
+    "onboardingChooseApiKeyProvider": "選擇 API 金鑰提供商",
+    "onboardingChooseProviderDescription": "選擇一個提供商，然後嚮導將指導您完成憑據和測試。",
+    "onboardingChangeType": "變更型別",
+    "onboardingChangeProvider": "更換提供商",
+    "onboardingSearchProviders": "搜尋提供商...",
+    "onboardingApiKeyOptional": "API 金鑰可選",
+    "onboardingProviderConnected": "提供商已連線",
+    "onboardingProviderSavedWithWarnings": "提供者儲存時帶有警告",
+    "onboardingProviderFinished": "提供商入職完成",
+    "onboardingYourProviderConnection": "您的提供商連線",
+    "onboardingTestPassed": "測試通過",
+    "onboardingTestFailed": "測試失敗",
+    "onboardingOpenProviderDetails": "開放提供商詳細資訊",
+    "onboardingTryInPlayground": "去遊樂場試試",
+    "onboardingDefaultConnectionName": "{provider} 主要",
+    "onboardingTestingConnection": "測試提供商連線...",
+    "onboardingValidatingCredentials": "正在驗證憑據...",
+    "onboardingSavingConnection": "正在儲存提供商連線...",
+    "onboardingProviderFailed": "提供商加入失敗",
+    "onboardingCreatingCompatibleProvider": "建立相容的提供者...",
+    "onboardingSavingCompatibleConnection": "正在儲存相容的提供商連線...",
+    "onboardingCustomProviderFallbackName": "定製提供商",
+    "onboardingCustomProviderFailed": "自定義提供商加入失敗",
+    "onboardingLoadingOAuthConnection": "正在載入 OAuth 連線...",
+    "onboardingOAuthNoConnectionFound": "OAuth 已完成，但未找到提供者連線。",
+    "onboardingOAuthFailed": "OAuth 登入失敗",
+    "onboardingAddProvider": "新增 {provider}",
+    "onboardingConnectionName": "連線名稱",
+    "onboardingApiKeyOptionalLabel": "API 金鑰（可選）",
+    "onboardingBaseUrlOverride": "基本 URL 覆蓋",
+    "onboardingBaseUrlOverrideHint": "可選。儲存為providerSpecificData.baseUrl。",
+    "onboardingRegion": "地區",
+    "onboardingSearchCx": "搜尋 CX/引擎 ID",
+    "onboardingProviderSpecificIdPlaceholder": "可選的提供商特定 ID",
+    "onboardingCustomUserAgent": "自定義使用者代理",
+    "onboardingWorking": "工作…",
+    "onboardingValidateSaveTest": "驗證、儲存和測試",
+    "onboardingBack": "返回",
+    "onboardingCreateCustomCompatibleProvider": "建立自定義相容提供商",
+    "onboardingCreateCustomCompatibleDescription": "該向導首先建立一個提供程式節點，然後儲存並測試其 API 金鑰連線。",
+    "onboardingProtocol": "協議",
+    "onboardingOpenAiCompatible": "相容 OpenAI",
+    "onboardingAnthropicCompatible": "人類相容",
+    "onboardingClaudeCodeCompatible": "克勞德程式碼相容",
+    "onboardingProviderPrefix": "提供商字首",
+    "onboardingProviderPrefixHint": "用於生成託管提供商 ID。",
+    "onboardingChatPath": "聊天路徑",
+    "onboardingModelsPath": "模型路徑",
+    "onboardingCreateSaveTest": "建立、儲存和測試",
+    "onboardingConnectProvider": "連線 {provider}",
+    "onboardingOAuthFlowDescription": "OmniRoute 將開啟該提供商的現有 OAuth 流程。登入後，嚮導將重新載入已儲存的連線並執行與提供程式頁面相同的連線測試。",
+    "onboardingStartOAuthFlow": "啟動 OAuth 流程",
+    "passthroughModelsDescription": "{provider} 接受提供者本機模型 ID。從 /models 匯入或新增用於路由的自定義 ID。",
+    "bedrockModelsDescription": "Amazon Bedrock 模型的範圍按 AWS 區域劃分。從 /models 匯入或新增在所選區域中啟用的基岩模型 ID。",
+    "bedrockModelPlaceholder": "人類.克勞德十四行詩-4-6",
+    "addProviderSessionCookieTitle": "新增 {provider} 會話 cookie",
+    "addProviderWebTokenTitle": "新增 {provider} 網路令牌",
+    "addProviderConnectionTitle": "新增 {provider} 連線",
+    "webTokenCredentialLabel": "網路會話令牌",
+    "webNoAuthCredentialLabel": "無需任何憑證",
+    "webCookieCredentialHint": "所需 cookie：{credential}。貼上您自己登入的 {provider} Web 會話中的 Cookie 標頭值。請勿包含 Cookie: 字首。",
+    "webTokenCredentialHint": "憑證：{credential}。貼上您自己登入的 {provider} Web 會話中的令牌值，或者貼上 DevTools HAR 匯出（如果提供商支援）的令牌值。",
+    "webCookieEditHint": "留空以保留當前會話 cookie。所需 cookie：{credential}。",
+    "webTokenEditHint": "留空以保留當前的 ​​Web 會話令牌。憑證：{credential}。",
+    "webSessionGuideTitle": "如何獲取會話憑證",
+    "webSessionGuideIntro": "{provider} 使用瀏覽器網路會話而不是 API 金鑰。",
+    "webCookieRequiredCredential": "所需 cookie：{credential}",
+    "webTokenRequiredCredential": "所需令牌：{credential}",
+    "webSessionGuideStep1": "在瀏覽器中登入 {provider}。",
+    "webSessionGuideStep2": "開啟瀏覽器開發人員工具並檢查 Web 應用程式發出的請求。",
+    "webSessionGuideStep3": "從提供商自己的域複製所需的憑據。對於 cookie，僅複製 Cookie 標頭值並省略 Cookie:。",
+    "webSessionGuideStep4": "將其貼上到此處並檢查連線。如果它停止工作，請重新登入並將其替換為新值。",
+    "webSessionSecurityHint": "將其視為密碼：它可以訪問您登入的網路帳戶，直到其過期或被撤銷。",
+    "webNoAuthGuideTitle": "無需任何憑證",
+    "webNoAuthGuideBody": "{provider} 不需要 API 金鑰或 cookie。儲存連線以使用其免費 Web 端點。",
+    "webSessionCredentialValidationFailed": "會話憑據驗證失敗。重新登入，複製新的憑據，然後重試。",
+    "checkCookie": "檢查cookie",
+    "checkWebToken": "檢查令牌",
+    "huggingchatLabel": "HuggingChat（免費）",
+    "huggingchatDesc": "通過 huggingface.co/chat 免費使用 LLM 聊天",
+    "poeWebLabel": "Poe 網頁",
+    "poeWebDesc": "通過 poe.com 進行多模型聊天",
+    "veniceWebLabel": "威尼斯網路",
+    "veniceWebDesc": "隱私專注的 AI 聊天",
+    "v0VercelWebLabel": "v0 Vercel Web",
+    "v0VercelWebDesc": "通過 v0.dev 的 AI 程式碼生成",
+    "kimiWebLabel": "Kimi Web",
+    "kimiWebDesc": "通過 www.kimi.com 訪問 Moonshot AI 聊天（國際版，Connect-RPC API）",
+    "doubaoWebLabel": "Dola Web",
+    "doubaoWebDesc": "通過 dola.com 訪問字節跳動 AI 聊天",
+    "overrideBaseUrlAdvanced": "__MISSING__:Advanced: override base URL",
+    "overrideBaseUrlHint": "__MISSING__:Advanced: point this built-in provider at a custom endpoint. Leave blank to use the default.",
+    "bulkAddFormatHintCloudflare": "__MISSING__:One key per line. Format: name|accountId|apiKey (Cloudflare account ID + API token)."
+  },
+  "settings": {
+    "title": "設定",
+    "general": "常規",
+    "security": "安全",
+    "appearance": "外觀",
+    "routing": "路由",
+    "cache": "快取",
+    "resilience": "韌性",
+    "description": "__MISSING__:Description",
+    "enable": "__MISSING__:Enable",
+    "disable": "__MISSING__:Disable",
+    "update": "__MISSING__:Update",
+    "routingSettingsIntro": "控制您的請求如何路由、轉換和傳送給 AI 提供商。",
+    "routingOpDropParagraphContainsLabel": "丟棄段落(包含)",
+    "routingOpDropParagraphStartsWithLabel": "丟棄段落(開頭匹配)",
+    "routingOpReplaceTextLabel": "替換文本",
+    "routingOpReplaceRegexLabel": "替換正則",
+    "routingOpDropBlockContainsLabel": "丟棄塊(包含)",
+    "routingOpPrependSystemBlockLabel": "在系統塊開頭插入",
+    "routingOpAppendSystemBlockLabel": "在系統塊末尾追加",
+    "routingOpInjectBillingHeaderLabel": "注入計費頭",
+    "routingOpObfuscateWordsLabel": "混淆詞語(ZWJ)",
+    "routingOpDropParagraphContainsDesc": "移除系統提示中包含任意指定子串的段落(以空行分割的文本塊)。用於剝離 Anthropic 分類器會標記的第三方客戶端指紋,例如 'github.com/anomalyco/opencode' 或 'docs.openwebui.com'。",
+    "routingOpDropParagraphStartsWithDesc": "移除以任一指定字首開頭的段落。用於剝離宣告呼叫方客戶端的身份行,例如 'You are OpenCode' 或 'You are Open WebUI'。",
+    "routingOpReplaceTextDesc": "用一個字面子串替換另一個字面子串。用於已知的觸發短語 — 例如把 'Here is some useful information about the environment you are running in:' 改寫為 'Environment context you are running in:'(經驗證的觸發短語)。",
+    "routingOpReplaceRegexDesc": "替換匹配正規表示式的文本。當你需要字元類、可選空白或錨點等模式時使用。執行時會捕獲語法錯誤的正則。",
+    "routingOpDropBlockContainsDesc": "移除整個系統塊(而非僅段落),只要其文本包含任一指定子串。當一整塊帶指紋時使用,例如注入的 MCP 伺服器描述。",
+    "routingOpPrependSystemBlockDesc": "在系統陣列的開頭插入一個新的文本塊。用於新增 Anthropic 分類器期望的 SDK 身份宣告 'You are a Claude agent, built on Anthropic's Claude Agent SDK.'。",
+    "routingOpAppendSystemBlockDesc": "在系統陣列末尾追加一個新文本塊。用於不必置於 [0] 位置的修飾性內容。",
+    "routingOpInjectBillingHeaderDesc": "在前置位置插入特殊的 'x-anthropic-billing-header: cc_version=...; cc_entrypoint=...; cch=...;' 文本塊,用於通過 Anthropic 分類器校驗。CC 橋接轉發端點必須使用;原生 claude 提供商已自帶計費行,在那裡通常無需此操作。",
+    "routingOpObfuscateWordsDesc": "在每個指定詞的首字母后插入零寬連字元,例如 'opencode' 變為 'o‍pencode'。視覺上對人類完全相同,但能繞過分類器的詞匹配。作用於系統塊、使用者/助手訊息以及工具描述。",
+    "routingNeedlesHint": "子串列表。段落只要包含其中任一項即匹配。通過「新增條目」逐行新增。",
+    "routingPrefixesHint": "字串列表。段落以其中任一項開頭即匹配(匹配前會去除前導空白)。",
+    "routingCaseSensitiveHint": "開啟時 'OpenCode' 與 'opencode' 視為不同字串。關閉(預設)時忽略大小寫。",
+    "routingMatchLiteralHint": "要查詢的精確字面子串,不解析為正則 — . * ? 等特殊字元按字面處理。",
+    "routingReplacementTextHint": "替換字串。留空則刪除匹配項,周圍文本保持不變。",
+    "routingAllOccurrencesHint": "開啟(預設)時替換所有出現位置;關閉時僅替換第一次匹配。",
+    "routingPatternHint": "JavaScript 正規表示式源,不要用斜槓包裹 — 直接寫 'foo(.*)bar'。無法編譯的模式將被服務端拒絕。",
+    "routingRegexFlagsHint": "JavaScript 正則修飾符(g = 全部匹配,i = 忽略大小寫,s = 點匹配換行,m = 多行)。預設 'g'。",
+    "routingBlockTextHint": "新系統塊的完整文本。使用字面字串;系統塊僅儲存文本。",
+    "routingIdempotencyKeyHint": "可選。設定後,如果已有以該鍵開頭的塊存在,則跳過此操作,避免重試時重複插入。",
+    "routingBillingEntrypointHint": "作為 'cc_entrypoint=' 注入的值。Anthropic 接受 'sdk-cli'(Agent SDK)、'cli'(Claude Code CLI)或其他文件化的值。",
+    "routingBillingVersionFormatHint": "cc_version= 後 3 字元構建雜湊的計算方式。'ex-machina' = sha256(CCH_SALT + 第一條使用者訊息字元 + 版本)(每條訊息獨立)。'omniroute-daystamp' = sha256(YYYY-MM-DD + 版本)(按天穩定)。",
+    "routingBillingCchAlgoHint": "5 字元 cch= 令牌的計算方式。'sha256-first-user' = 第一條使用者訊息文本的 sha256;'xxhash64-body' = 由請求體級簽名稍後填充;'static-zero' = 字面佔位符 '00000'。",
+    "routingObfuscateWordsHint": "要混淆的小寫詞語。ZWJ 插入對大小寫不敏感,所以 'opencode' 也會匹配 'OpenCode' 與 'OPENCODE'。",
+    "routingObfuscateTargetsHint": "掃描詞語的請求體範圍:系統塊、使用者/助手訊息以及工具描述。",
+    "routingObfuscateTargetsLabel": "目標",
+    "routingSummarizeDropParagraphContains": "丟棄包含的段落:{items}",
+    "routingSummarizeDropParagraphStartsWith": "丟棄開頭匹配的段落:{items}",
+    "routingSummarizeReplaceText": "將 \"{match}\" 替換為 \"{replacement}\"",
+    "routingSummarizeReplaceRegex": "正則 /{pattern}/{flags} → \"{replacement}\"",
+    "routingSummarizeDropBlockContains": "丟棄包含的塊:{items}",
+    "routingSummarizePrependSystemBlock": "前置塊:\"{text}\"",
+    "routingSummarizeAppendSystemBlock": "追加塊:\"{text}\"",
+    "routingSummarizeInjectBillingHeader": "注入計費頭(entrypoint={entrypoint},version={versionFormat},cch={cchAlgo})",
+    "routingSummarizeObfuscateWords": "通過 ZWJ 在 {targets} 中混淆 {count} 個詞",
+    "routingDefaultAutoVariantLKGP": "上次正常的提供商",
+    "routingDefaultAutoVariantLKGPDesc": "上次正常的提供商",
+    "routingDefaultAutoVariantCoding": "程式碼場景質量優先",
+    "routingDefaultAutoVariantCodingDesc": "程式碼場景質量優先",
+    "routingDefaultAutoVariantFast": "低延遲路由",
+    "routingDefaultAutoVariantFastDesc": "低延遲路由",
+    "routingDefaultAutoVariantCheap": "成本優先",
+    "routingDefaultAutoVariantCheapDesc": "成本優先",
+    "routingDefaultAutoVariantOffline": "高可用",
+    "routingDefaultAutoVariantOfflineDesc": "高可用",
+    "routingDefaultAutoVariantSmart": "最佳探索(10% 探索率)",
+    "routingDefaultAutoVariantSmartDesc": "最佳探索(10% 探索率)",
+    "routingOpSummaryCount": "{count, plural, =0 {無操作} other {# 個操作}}",
+    "routingOpEnabled": "已啟用",
+    "routingOpDisabled": "已停用",
+    "routingOpStatusSeparator": "·",
+    "resilienceSettingsIntro": "提供程式失敗時自動重試、冷卻和回退。",
+    "aiSettingsIntro": "用於思考預算、模型行為和壓縮的 AI 特定設定。",
+    "systemPrompt": "系統提示",
+    "thinkingBudget": "思考預算",
+    "proxy": "代理",
+    "httpProxy": "HTTP 代理",
+    "1proxy": "1proxy",
+    "proxySubTabsAria": "代理設定分割槽",
+    "requestBodyLimitTitle": "請求體大小限制",
+    "requestBodyLimitDescription": "解析請求體前允許的最大 API 載荷大小。專用上傳路由仍至少保留其內建的 100 MB 限制。",
+    "requestBodyLimitInputLabel": "請求體限制（MB）",
+    "requestBodyLimitEmptyError": "請輸入 MB 限制值",
+    "requestBodyLimitWholeNumberError": "請使用整數",
+    "requestBodyLimitMinimumError": "最小值為 {min} MB",
+    "requestBodyLimitMaximumError": "最大值為 {max} MB",
+    "requestBodyLimitLoadFailed": "載入請求限制設定失敗",
+    "requestBodyLimitSaveSuccess": "請求體限制已儲存",
+    "requestBodyLimitSaveFailed": "儲存請求體限制失敗",
+    "requestBodyLimitSaving": "正在儲存...",
+    "requestBodyLimitSave": "儲存",
+    "requestBodyLimitCurrent": "當前：{value}",
+    "mitmProxy": "MITM 代理",
+    "pricing": "定價",
+    "storage": "儲存",
+    "policies": "策略",
+    "ipFilter": "IP過濾器",
+    "comboDefaults": "組合預設值",
+    "fallbackChains": "後備鏈",
+    "changePassword": "更改密碼",
+    "enablePassword": "啟用密碼",
+    "darkMode": "深色模式",
+    "lightMode": "淺色模式",
+    "memoryTitle": "記憶",
+    "memoryDesc": "跨會話持久化對話記憶",
+    "memoryEnabled": "啟用記憶",
+    "memoryEnabledDesc": "啟用後，OmniRoute 會注入相關的歷史上下文。",
+    "memoryTokenCostWarning": "__MISSING__:Heads up: with memory enabled, OmniRoute injects up to {tokens} tokens of retrieved context into every chat request — this increases token usage and cost. To skip injection for a specific request, send the \"x-omniroute-no-memory: true\" header.",
+    "maxTokens": "最大 Tokens",
+    "retentionDays": "保留時長",
+    "recent": "最近",
+    "recentDesc": "按時間順序的時間窗",
+    "semantic": "語義",
+    "semanticDesc": "向量搜尋",
+    "hybrid": "混合",
+    "hybridDesc": "最近 + 語義",
+    "skillsTitle": "技能",
+    "skillsDesc": "供模型呼叫的工具",
+    "skillsEnabled": "啟用技能",
+    "skillsEnabledDesc": "允許智慧體觸發函式。",
+    "skillsComingSoon": "技能市場即將推出。",
+    "memorySkillsTitle": "記憶與技能",
+    "memorySkillsDesc": "持久化上下文與能力",
+    "modelsDevTitle": "模型資料庫",
+    "modelsDevDesc": "從 models.dev 自動同步定價、能力和規格",
+    "modelsDevEnabled": "啟用 models.dev 同步",
+    "modelsDevEnabledDesc": "從開源的 models.dev 資料庫獲取模型定價、能力和規格",
+    "modelsDevInterval": "同步間隔",
+    "syncNow": "立即同步",
+    "syncing": "同步中...",
+    "lastSync": "上次同步",
+    "never": "從未",
+    "justNow": "剛才",
+    "modelsDevStats": "同步統計",
+    "modelsDevStatsDesc": "當前 models.dev 資料覆蓋情況",
+    "providers": "提供商",
+    "modelsWithPricing": "已有定價的模型",
+    "capabilities": "能力",
+    "lastSyncCount": "上次同步數量",
+    "lastSyncFull": "上次完整同步",
+    "modelsDevInfo": "工作原理",
+    "modelsDevInfoDesc": "models.dev 是由 SST/OpenCode 團隊維護的開源 AI 模型規格資料庫，提供 100+ 提供商、4,000+ 模型的定價、能力、上下文限制和模態資訊。",
+    "modelsDevInfoResolution": "定價解析順序（優先順序從高到低）：",
+    "modelsDevInfoOrder": "使用者覆蓋 → models.dev → LiteLLM → 硬編碼預設值",
+    "systemTheme": "系統主題",
+    "debugToggle": "啟用除錯模式",
+    "logToolSourcesToggle": "__MISSING__:Log Tool Sources",
+    "logToolSourcesDescription": "__MISSING__:Emit a diagnostic log line per request summarizing tool count and MCP/hosted/client source breakdown.",
+    "homePinProviderQuotaToHome": "將資訊固定到首頁",
+    "homeProviderQuotaLimits": "提供商配額限制",
+    "homeProviderQuotaLimitsDesc": "將提供商配額狀態容器（含全部重新整理按鈕）固定到首頁頂部。",
+    "homeQuickStart": "快速入門",
+    "homeQuickStartDesc": "在首頁上顯示快速入門面板。",
+    "homeProviderTopology": "提供商拓撲",
+    "homeProviderTopologyDesc": "在首頁上顯示提供商拓撲。",
+    "accountEmailVisibility": "帳號郵箱可見性",
+    "accountEmailVisibilityDesc": "在提供商、組合、日誌、配額和 Playground 頁面顯示完整帳號郵箱。關閉後預設打碼顯示。",
+    "sidebarVisibilityToggle": "顯示側邊欄專案",
+    "enableCache": "啟用快取",
+    "cacheTTL": "快取生存時間",
+    "maxCacheSize": "最大快取大小",
+    "clearCache": "清除快取",
+    "cacheCleared": "快取已成功清除",
+    "clearCacheFailed": "清除快取失敗",
+    "cacheHits": "快取命中",
+    "cacheMisses": "快取未命中",
+    "hitRate": "命中率",
+    "cacheEntries": "快取條目",
+    "cacheSettings": "快取設定",
+    "semanticCache": "語義快取",
+    "maxEntries": "最大條目數",
+    "ttlMinutes": "TTL（分鐘）",
+    "promptCache": "提示快取",
+    "strategy": "策略",
+    "preserveClientCache": "保留客戶端快取",
+    "enabled": "已啟用",
+    "loading": "載入中...",
+    "saving": "正在儲存...",
+    "save": "儲存",
+    "circuitBreaker": "斷路器",
+    "retryPolicy": "重試策略",
+    "maxRetries": "最大重試次數",
+    "retryDelay": "重試延遲",
+    "timeoutMs": "超時（毫秒）",
+    "enableSystemPrompt": "啟用系統提示",
+    "systemPromptText": "系統提示文字",
+    "autoDisableBannedAccounts": "自動停用被封禁帳戶",
+    "autoDisableDescription": "若提供商連線返回特定的永久封禁訊號（如 HTTP 403\"請驗證您的帳戶\"），則將其永久標記為停用。這會將其從組合輪換中移除。",
+    "autoDisableThreshold": "封禁閾值",
+    "autoDisableThresholdDesc": "觸發永久停用所需的連續封禁訊號次數。",
+    "customBannedSignals": "__MISSING__:Banned Keywords",
+    "customBannedSignalsDesc": "__MISSING__:Additional keywords that trigger permanent account ban detection. Built-in keywords always apply.",
+    "customBannedSignalsPlaceholder": "__MISSING__:e.g. api key revoked",
+    "noCustomBannedSignals": "__MISSING__:No custom keywords. Only built-in keywords are active.",
+    "resilienceStructureTitle": "彈性結構",
+    "resilienceStructureDesc": "此頁面僅配置行為。即時斷路器狀態顯示在執行狀況頁面上。組合特定的重試和迴圈槽控制保留在組合設定上。",
+    "enableThinking": "激發思考",
+    "maxThinkingTokens": "最大思考令牌",
+    "enableProxy": "啟用代理",
+    "perKeyProxyEnabled": "啟用按金鑰代理分配",
+    "perKeyProxyEnabledDesc": "啟用後，每個提供商連線可以使用自己的代理分配",
+    "proxyUrl": "代理網址",
+    "pricingRates": "定價費率格式",
+    "currentPricing": "當前定價概述",
+    "loadingPricing": "正在載入定價資料...",
+    "noPricing": "無可用定價資料",
+    "input": "輸入",
+    "output": "輸出",
+    "cached": "快取",
+    "reasoning": "推理",
+    "cacheCreation": "快取建立",
+    "customPricing": "定製定價",
+    "databaseSize": "資料庫大小",
+    "backupDb": "備份資料庫",
+    "restoreDb": "恢復資料庫",
+    "exportData": "匯出資料",
+    "importData": "匯入資料",
+    "clearData": "清除所有資料",
+    "clearDataConfirm": "這將永久刪除所有資料。你確定嗎？",
+    "enableRequestLogs": "啟用請求日誌",
+    "logRetention": "日誌保留",
+    "ipWhitelist": "IP白名單",
+    "ipBlacklist": "IP黑名單",
+    "addIP": "新增IP",
+    "savedSuccessfully": "設定儲存成功",
+    "ai": "人工智慧",
+    "advanced": "高階",
+    "localMode": "本地模式 - 所有資料都儲存在你的裝置上",
+    "settingsSectionsAria": "設定部分",
+    "switchThemes": "在淺色和深色主題之間切換",
+    "themeSelectionAria": "主題選擇",
+    "themeLight": "淺色",
+    "themeDark": "深色",
+    "themeSystem": "系統",
+    "endpointTunnelVisibility": "端點隧道可見性",
+    "endpointTunnelVisibilityDesc": "隱藏端點頁面中的隧道控制項，但不改變隧道執行狀態。",
+    "showCloudflareTunnel": "Cloudflare 快速隧道",
+    "showCloudflareTunnelDesc": "在端點頁面顯示 Cloudflare Quick Tunnel 控制項。",
+    "showTailscaleFunnel": "Tailscale Funnel",
+    "showTailscaleFunnelDesc": "在端點頁面顯示 Tailscale Funnel 控制項。",
+    "showNgrokTunnel": "ngrok 隧道",
+    "showNgrokTunnelDesc": "在端點頁面顯示 ngrok Tunnel 控制項。",
+    "sidebarVisibility": "隱藏側邊欄專案",
+    "sidebarVisibilityDesc": "可以隱藏任意側邊欄導航項，以減少視覺負擔，但不會停用任何功能",
+    "sidebarVisibilityHint": "當某個側邊欄分組中的所有專案都被隱藏時，該分組會自動隱藏",
+    "hideHealthLogs": "隱藏健康檢查日誌",
+    "hideHealthLogsDesc": "開啟後，將抑制伺服器控制台中的 [HealthCheck] 訊息",
+    "themeAccent": "主題顏色",
+    "themeAccentDesc": "選擇預設顏色，或使用單一顏色建立你自己的主題",
+    "themeCreate": "建立主題",
+    "themeCustom": "自定義主題",
+    "themeBlue": "藍色",
+    "themeRed": "紅色",
+    "themeGreen": "綠色",
+    "themeViolet": "紫色",
+    "themeOrange": "橙色",
+    "themeCyan": "青色",
+    "whitelabeling": "品牌定製",
+    "whitelabelingDesc": "自定義應用名稱和 Logo",
+    "appName": "應用名稱",
+    "appNameDesc": "顯示在側邊欄和瀏覽器標籤頁中的名稱",
+    "customLogo": "自定義 Logo URL",
+    "customLogoDesc": "你的自定義 Logo 圖片地址",
+    "uploadLogo": "上傳 Logo",
+    "resetLogo": "恢復預設",
+    "logoPreview": "預覽",
+    "customFavicon": "瀏覽器 Favicon",
+    "customFaviconDesc": "你的自定義 Favicon 地址（顯示在瀏覽器標籤頁中）",
+    "uploadFavicon": "上傳 Favicon",
+    "resetFavicon": "重置 Favicon",
+    "faviconPreview": "Favicon 預覽",
+    "flushCache": "重新整理快取",
+    "flushing": "正在重新整理...",
+    "size": "尺寸",
+    "hits": "命中次數",
+    "evictions": "驅逐",
+    "loadingCacheStats": "正在載入快取統計資訊...",
+    "globalProxy": "全域性代理",
+    "globalProxyDesc": "為所有 API 呼叫配置全域性出站代理。單獨的提供商、組合和鍵可以覆蓋此設定。",
+    "noGlobalProxy": "沒有配置全域性代理",
+    "proxyPool": "代理池",
+    "freePool": "免費池",
+    "proxyDocumentation": "代理文件",
+    "proxyGlobalConfigTab": "全域性配置",
+    "proxyPoolTab": "代理池",
+    "freePoolTab": "免費泳池",
+    "proxyDocumentationTab": "文件",
+    "bulkHealthcheck": "批次健康檢查",
+    "bulkHealthcheckDesc": "針對目標 URL 測試所有已配置代理，找出可用代理。",
+    "healthcheckTesting": "測試中...",
+    "healthcheckAll": "全部健康檢查",
+    "healthcheckFailed": "執行健康檢查失敗",
+    "healthcheckTestingAll": "正在並行測試所有代理...",
+    "healthcheckTotal": "總數",
+    "healthcheckWorking": "可用",
+    "healthcheckFailedLabel": "失敗",
+    "healthcheckStatus": "狀態",
+    "healthcheckProxyUrl": "代理 URL",
+    "healthcheckLatency": "延遲",
+    "proxyDocumentationScopeTitle": "代理作用域解析",
+    "proxyDocumentationScopeDescBefore": "OmniRoute 按優先順序順序解析出站代理：",
+    "proxyDocumentationScopeOrder": "組合 → 帳戶 → 提供商 → 全域性",
+    "proxyDocumentationScopeDescAfter": "。最具體的作用域優先。",
+    "proxyDocumentationAddTitle": "新增自定義代理",
+    "proxyDocumentationAddDescBefore": "轉到",
+    "proxyDocumentationAddDescMiddle": "選項卡 → 點選",
+    "proxyDocumentationAddCta": "+ 新增代理",
+    "proxyDocumentationAddDescAfter": "。填寫型別（http/https/socks5）、主機和埠。可選擇將其分配給作用域。",
+    "proxyDocumentationBulkTitle": "批次匯入格式",
+    "proxyDocumentationBulkDesc": "管道符分隔的欄位：",
+    "proxyDocumentationSocks5DescBefore": "SOCKS5 代理預設停用。設定",
+    "proxyDocumentationFreePoolDesc": "免費池選項卡聚合來自 1proxy、Proxifly 和 IPLocate 的代理。使用 ⊕ 測試並將代理提升到您的登錄檔中。只有通過連通性測試的代理才會被新增。",
+    "proxyDocumentationVercelRelayDescBefore": "Vercel Relay 是一個出站邊緣中繼，而不是入站隧道。部署後，LLM API 呼叫將通過 Vercel 的動態 IP 傳送，繞過資料中心地理封鎖和速率限制。中繼由生成的金鑰頭保護",
+    "proxyDocumentationVercelRelayDescAfter": "您的 Vercel 令牌僅在部署期間使用，不會儲存。",
+    "vercelRelayTokenRequired": "需要令牌",
+    "vercelRelayDeployFailed": "部署失敗",
+    "vercelRelayTokenHint": "令牌僅在部署期間使用——從不儲存。",
+    "denoRelayTokenRequired": "__MISSING__:Deno Deploy token is required",
+    "denoRelayOrgDomainRequired": "__MISSING__:Organization domain is required",
+    "denoRelayDeployFailed": "__MISSING__:Deno Deploy failed",
+    "denoRelayTokenHint": "__MISSING__:Organization token (prefix ddo_) from console.deno.com → Organization → Settings → Organization Tokens. Used once for deploy and never stored.",
+    "denoRelayOrgDomainHint": "__MISSING__:Your Deno Deploy organization's default domain (e.g. acme.deno.net). The relay will be reachable at https://<app-name>.<org-slug>.deno.net.",
+    "proxyFreePoolFilterProtocol": "按協議篩選",
+    "proxyFreePoolProtocol": "協議",
+    "proxyFreePoolCountryPlaceholder": "國家（例如 US）",
+    "proxyFreePoolFilterCountry": "按國家篩選",
+    "proxyFreePoolMinQualityPlaceholder": "最低質量",
+    "proxyFreePoolMinQualityLabel": "最低質量分數",
+    "proxyFreePoolSyncAll": "同步全部",
+    "proxyFreePoolTotal": "總計",
+    "proxyFreePoolInPool": "池中",
+    "proxyFreePoolAvgQuality": "平均質量",
+    "proxyFreePoolSelected": "已選 {count} 個",
+    "proxyFreePoolAddSelected": "將選中項新增到池",
+    "proxyFreePoolAddVisible": "將所有可見項新增到池",
+    "proxyFreePoolSource": "來源",
+    "proxyFreePoolHostPort": "主機:埠",
+    "proxyFreePoolType": "型別",
+    "proxyFreePoolCountry": "國家",
+    "proxyFreePoolQuality": "質量",
+    "proxyFreePoolLatency": "延遲",
+    "proxyFreePoolEmpty": "未找到代理。點選同步全部從來源獲取。",
+    "close": "關閉",
+    "cancel": "取消",
+    "globalLabel": "全域性",
+    "configure": "配置",
+    "globalSystemPrompt": "全域性系統提示",
+    "saved": "已儲存",
+    "beforePromptLabel": "提示詞前置",
+    "beforePromptDesc": "注入到代理/提供商系統指令之前",
+    "beforePromptPlaceholder": "插入到代理/提供商提示詞之前的指令...",
+    "afterPromptLabel": "提示詞後置",
+    "afterPromptDesc": "注入到代理/提供商系統指令之後",
+    "afterPromptPlaceholder": "插入到代理/提供商提示詞之後的指令...",
+    "chars": "{count} 字元",
+    "thinkingBudgetTitle": "思考預算",
+    "thinkingBudgetDesc": "控制所有請求中 AI 推理令牌的使用",
+    "passthrough": "直通",
+    "passthroughDesc": "沒有變化——客戶控制思維預算",
+    "auto": "自動",
+    "autoDesc": "丟棄所有思考配置，由提供商自行決定",
+    "custom": "定製",
+    "customDesc": "為所有請求設定固定的 Token 預算",
+    "adaptive": "自適應",
+    "adaptiveDesc": "根據請求複雜性調整預算",
+    "effortNone": "無（0 Tokens）",
+    "effortLow": "低（1K Tokens）",
+    "effortMedium": "中（10K Tokens）",
+    "effortHigh": "高（128K Tokens）",
+    "tokenBudget": "Token 預算",
+    "tokens": "Token",
+    "baseEffortLevel": "基本努力水平",
+    "adaptiveHint": "自適應模式根據訊息計數、工具使用情況和提示長度從此基本級別進行擴充套件。",
+    "requireLogin": "需要登入",
+    "requireLoginDesc": "當開啟時，儀表板需要密碼。當關閉時，無需登入即可訪問。",
+    "currentPassword": "當前密碼",
+    "enterCurrentPassword": "輸入當前密碼",
+    "newPassword": "新密碼",
+    "enterNewPassword": "輸入新密碼",
+    "confirmPassword": "確認新密碼",
+    "confirmPasswordPlaceholder": "確認新密碼",
+    "passwordsNoMatch": "密碼不匹配",
+    "passwordUpdated": "密碼更新成功",
+    "failedUpdatePassword": "更新密碼失敗",
+    "errorOccurred": "發生錯誤",
+    "updatePassword": "更新密碼",
+    "setPassword": "設定密碼",
+    "apiEndpointProtection": "API 端點保護",
+    "requireAuthModels": "/models 需要 API 金鑰",
+    "requireAuthModelsDesc": "開啟後，`/v1/models` 對未認證請求返回 404，從而阻止未授權使用者發現模型。",
+    "authModelHeading": "當前授權模型",
+    "authModelClient": "客戶端 API 端點（/v1/*、/chat/*、/responses/*、/codex/*、/messages/*）需要 Bearer API 金鑰。",
+    "authModelManagement": "管理端點（/dashboard、/api/*）需要儀表盤會話或管理憑據。",
+    "authModelPublic": "只有登入、健康檢查和引導路由是公開的。",
+    "bruteForceProtection": "登入暴力破解保護",
+    "bruteForceProtectionDesc": "在同一 IP 多次失敗後，對 /api/auth/login 進行限流和鎖定。",
+    "corsAllowedOrigins": "CORS 允許的源",
+    "corsAllowedOriginsDesc": "允許呼叫此伺服器的瀏覽器來源列表，以逗號分隔。空列表 = 不允許瀏覽器 CORS 訪問（伺服器到伺服器仍可用）。僅在開發環境使用 CORS_ALLOW_ALL=true 環境變數。",
+    "blockedProviders": "被阻止的提供商",
+    "blockedProvidersDesc": "在 `/v1/models` 響應中隱藏指定提供商。被隱藏的提供商不會出現在模型列表中。",
+    "providersBlocked": "{count} 個提供商/模型已遮蔽",
+    "blockProviderTitle": "遮蔽 {provider}",
+    "unblockProviderTitle": "取消遮蔽 {provider}",
+    "cliFingerprint": "CLI 指紋匹配",
+    "cliFingerprintDesc": "在代理請求時模擬原生 CLI 二進位制的請求特徵。會重新排列請求頭和請求體欄位，使其與官方 CLI 工具更一致，同時保留你的代理 IP。",
+    "cliFingerprintEnabled": "已有 {count} 個提供商啟用了 CLI 指紋",
+    "enableFingerprintTitle": "為 {provider} 啟用指紋",
+    "disableFingerprintTitle": "為 {provider} 停用指紋",
+    "systemTransforms": "系統塊轉換管道",
+    "systemTransformsDesc": "在轉發之前，每個提供者訂購的轉換管道應用於請求正文。支援任何提供商 ID。",
+    "systemTransformsAddProvider": "新增提供商",
+    "systemTransformsAddProviderPlaceholder": "選擇提供商...",
+    "systemTransformsAddProviderAllConfigured": "所有提供商均已配置",
+    "systemTransformsRemoveProvider": "刪除提供商",
+    "systemTransformsNoProviders": "沒有配置提供者。新增提供商即可開始。",
+    "systemTransformsOpMoveUp": "向上移動",
+    "systemTransformsOpMoveDown": "下移",
+    "systemTransformsOpDelete": "刪除操作",
+    "routingStrategy": "路由策略",
+    "routingAdvancedGuideTitle": "高階路由指南",
+    "routingAdvancedGuideHint1": "需要可預測優先順序時使用 Fill First，需要公平分配時使用 Round Robin，需要延遲彈性時使用 P2C。",
+    "routingAdvancedGuideHint2": "如果各提供商在質量或成本上差異明顯，後臺任務可優先考慮“成本最佳化”，需要均衡消耗時可從“最少使用”開始。",
+    "fillFirst": "優先填滿",
+    "fillFirstDesc": "按優先順序順序使用帳戶",
+    "roundRobin": "輪詢",
+    "roundRobinDesc": "在所有帳戶之間輪流分配",
+    "p2c": "P2C",
+    "p2cDesc": "隨機選2個，使用更健康的一個",
+    "random": "隨機",
+    "randomDesc": "每次請求隨機選擇帳戶",
+    "leastUsed": "最少使用",
+    "leastUsedDesc": "優先選擇最近使用最少的帳戶",
+    "costOpt": "成本最佳化",
+    "costOptDesc": "優先選擇成本最低的可用帳戶",
+    "resetAware": "復位感知RR",
+    "resetAwareDesc": "優先選擇剩餘配額正常且重置時間較近的帳戶",
+    "strictRandom": "嚴格隨機",
+    "strictRandomDesc": "洗牌池模式：每個帳戶使用一次後再重新洗牌",
+    "stickyLimit": "粘性限制",
+    "stickyLimitDesc": "切換前每個帳戶連續處理的請求次數",
+    "modelAliases": "模型別名",
+    "modelAliasesTitle": "模型別名",
+    "modelAliasesDesc": "使用精確匹配或萬用字元模式重對映模型名稱。",
+    "addCustomAlias": "新增自定義別名",
+    "deprecatedModelId": "已棄用的模型 ID",
+    "newModelId": "新模型 ID",
+    "customAliases": "自定義別名",
+    "builtInAliases": "內建別名",
+    "backgroundDegradationTitle": "後臺任務降級",
+    "backgroundDegradationDesc": "自動檢測後臺任務（標題、摘要）並路由到更便宜的模型",
+    "enableDegradation": "啟用後臺任務降級",
+    "enableDegradationHint": "啟用後，標題生成和摘要等後臺任務會自動路由到更便宜的模型",
+    "tasksDetected": "檢測到的任務",
+    "degradationMap": "模型降級對映",
+    "premiumModel": "高階模型",
+    "cheapModel": "低成本模型",
+    "detectionPatterns": "檢測模式",
+    "newPattern": "例如：\"生成標題\"",
+    "aliasPatternPlaceholder": "claude-sonnet-*",
+    "aliasTargetPlaceholder": "claude-sonnet-4-20250514",
+    "pattern": "圖案",
+    "targetModel": "目標模型",
+    "add": "+ 新增",
+    "session": "會話",
+    "sessionDetailsAria": "會話詳情",
+    "status": "狀態",
+    "authenticated": "已認證",
+    "guest": "嘉賓",
+    "loginTime": "登入時間",
+    "sessionAge": "會話年齡",
+    "browser": "瀏覽器",
+    "clearLocalData": "清除本地資料",
+    "logout": "退出",
+    "clearLocalDataConfirm": "清除所有本地資料？這將重置您的首選項。",
+    "unknown": "未知",
+    "systemActor": "系統",
+    "ipAccessControl": "IP訪問控制",
+    "ipAccessControlDesc": "阻止或允許特定 IP 地址",
+    "ipModeDisabled": "已停用",
+    "ipModeBlacklist": "黑名單",
+    "ipModeWhitelist": "白名單",
+    "ipModeWhitelistPriority": "WL優先順序",
+    "addIpAddress": "新增IP地址",
+    "ipAddressPlaceholder": "192.168.1.0/24 或 10.0.*.*",
+    "block": "+ 遮蔽",
+    "allow": "+ 允許",
+    "blocked": "已被阻止 ({count})",
+    "allowed": "允許 ({count})",
+    "temporaryBans": "臨時禁令 ({count})",
+    "minLeft": "還剩 {min}m",
+    "auditLog": "稽核日誌",
+    "searchAuditLogs": "搜尋稽核日誌...",
+    "failedLoadAuditLog": "無法載入稽核日誌",
+    "noAuditEvents": "未找到稽核事件",
+    "action": "操作",
+    "actor": "操作人",
+    "details": "詳情",
+    "time": "時間",
+    "fallbackChainsTitle": "後備鏈",
+    "fallbackChainsDesc": "定義每個模型的提供商後備順序",
+    "addChain": "+ 新增鏈",
+    "modelName": "模型名稱",
+    "modelNamePlaceholder": "claude-sonnet-4-20250514",
+    "providersCommaSeparated": "提供商（用逗號分隔，按優先順序排序）",
+    "providersCommaSeparatedPlaceholder": "anthropic, openai, gemini",
+    "createChain": "建立鏈",
+    "noFallbackChains": "無後備鏈",
+    "noFallbackChainsDesc": "建立一條鏈路，用於定義某個模型的提供商回退順序。",
+    "loadingFallbackChains": "正在載入後備鏈...",
+    "deleteChainConfirm": "刪除“{model}”的後備鏈？",
+    "chainCreated": "為 {model} 建立的鏈",
+    "chainDeleted": "已刪除 {model} 鏈",
+    "failedCreateChain": "建立鏈失敗",
+    "failedDeleteChain": "刪除鏈失敗",
+    "deleteChain": "刪除鏈",
+    "fillModelAndProviders": "請填寫模型名稱和提供商",
+    "addAtLeastOneProvider": "新增至少一個提供商",
+    "comboDefaultsTitle": "組合預設值",
+    "comboDefaultsGuideTitle": "如何調整組合預設值",
+    "comboDefaultsGuideHint1": "在低延遲流中保持較低的重試次數；僅增加長生成任務的超時。",
+    "comboDefaultsGuideHint2": "當一個提供程式需要與全域性預設值不同的超時/重試行為時，請使用提供程式覆蓋。",
+    "globalComboConfig": "全域性組合配置",
+    "defaultStrategy": "預設策略",
+    "defaultStrategyDesc": "應用於沒有明確策略的新組合",
+    "comboStrategyAria": "組合策略",
+    "priority": "優先順序",
+    "weighted": "加權",
+    "contextRelay": "上下文接力",
+    "contextRelayDesc": "在帳戶輪換髮生時，採用優先順序風格路由並自動執行上下文交接",
+    "maxRetriesLabel": "最大重試次數",
+    "retryDelayLabel": "重試延遲（毫秒）",
+    "timeoutLabel": "超時（毫秒）",
+    "healthCheck": "健康檢查",
+    "healthCheckDesc": "預先檢查提供商的可用性",
+    "trackMetrics": "跟蹤指標",
+    "trackMetricsDesc": "記錄每個組合請求指標",
+    "providerOverrides": "提供商覆蓋",
+    "providerOverridesDesc": "覆蓋每個提供商的超時和重試。提供商設定會覆蓋全域性預設設定。",
+    "providerMaxRetriesAria": "{provider} 最大重試次數",
+    "providerTimeoutAria": "{provider} 超時毫秒",
+    "removeProviderOverrideAria": "刪除 {provider} 覆蓋",
+    "selectProviderPlaceholder": "__MISSING__:Select provider...",
+    "searchProviderPlaceholder": "__MISSING__:Search providers...",
+    "searchProviderAria": "__MISSING__:Search providers",
+    "newProviderNamePlaceholder": "例如 google、openai...",
+    "newProviderNameAria": "新的提供商名稱",
+    "retries": "重試",
+    "ms": "毫秒",
+    "saveComboDefaults": "儲存組合預設值",
+    "maxNestingDepth": "最大巢狀深度",
+    "concurrencyPerModel": "併發/模型",
+    "queueTimeout": "佇列超時（毫秒）",
+    "queueDepth": "__MISSING__:Queue Depth",
+    "contextRelayHandoffThreshold": "交接閾值",
+    "contextRelayMaxMessages": "摘要最大訊息數",
+    "contextRelaySummaryModel": "摘要模型",
+    "contextRelayProviderNote": "Context Relay 當前會為 Codex 帳戶生成交接摘要，並將這些值作為新的或未配置 combo 的全域性預設值。",
+    "providerProfiles": "提供商策略配置",
+    "providerProfilesDesc": "為 OAuth（基於會話）和 API Key（計費型）提供商分別設定彈性策略。由於速率限制更低，OAuth 提供商通常採用更嚴格的閾值。",
+    "oauthProviders": "OAuth 提供商",
+    "apiKeyProviders": "API 金鑰提供商",
+    "transientCooldown": "瞬時故障冷卻",
+    "rateLimitCooldown": "限流冷卻",
+    "maxBackoffLevel": "最大退避級別",
+    "cbThreshold": "熔斷閾值",
+    "cbResetTime": "熔斷重置時間",
+    "rateLimiting": "速率限制",
+    "rateLimitingDesc": "API 金鑰提供商會自動受到安全預設值的速率限制。限制是從響應標頭中學習的，並隨著時間的推移進行調整。",
+    "defaultSafetyNet": "預設安全網",
+    "rpm": "RPM",
+    "minGap": "最小間隔",
+    "maxConcurrent": "最大併發數",
+    "activeLimiters": "活動限流器",
+    "noActiveLimiters": "尚無活動的速率限制器。",
+    "reservoir": "令牌池",
+    "running": "執行中",
+    "queued": "排隊中",
+    "circuitBreakers": "斷路器",
+    "breakerStateClosed": "閉合",
+    "breakerStateOpen": "斷開",
+    "breakerStateHalfOpen": "半開",
+    "tripped": "{count} 已觸發",
+    "healthy": "{count} 健康",
+    "resetAll": "全部重置",
+    "noCircuitBreakers": "尚未啟用斷路器。當請求流經組合管道時，它們會自動建立。",
+    "failures": "{count} 失敗",
+    "policiesLocked": "策略和鎖定識別符號",
+    "allOperational": "所有系統均可執行——無停工或斷路器跳閘",
+    "loadingPolicies": "正在載入策略...",
+    "lockedIdentifiers": "鎖定識別符號",
+    "unlockedIdentifier": "解鎖：{identifier}",
+    "sinceDate": "自 {date} 起",
+    "forceUnlock": "強制解鎖",
+    "unlocking": "解鎖...",
+    "failedUnlock": "解鎖失敗",
+    "failedLoadWithStatus": "載入失敗：{status}",
+    "failedLoadResilience": "無法載入彈性狀態",
+    "saveFailed": "儲存失敗",
+    "resetFailed": "重置失敗",
+    "loadingResilience": "正在載入彈性狀態...",
+    "retry": "重試",
+    "systemStorage": "系統與儲存",
+    "allDataLocal": "所有資料都儲存在本地計算機上",
+    "databasePath": "資料庫路徑",
+    "export": "匯出",
+    "exportDatabase": "匯出資料庫",
+    "exportAll": "全部匯出 (.tar.gz)",
+    "importDatabase": "匯入資料庫",
+    "confirmDbImport": "確認資料庫匯入",
+    "confirmDbImportDesc": "這會將所有當前資料替換為 {file} 中的內容。匯入前將自動建立備份。",
+    "yesImport": "是的，匯入",
+    "lastBackup": "上次備份",
+    "noBackupYet": "還沒有備份",
+    "backupNow": "立即備份",
+    "backupRestore": "備份與恢復",
+    "viewBackups": "檢視備份",
+    "hide": "隱藏",
+    "backupRetentionDesc": "資料庫快照會在還原之前自動建立，並且在資料更改時每 15 分鐘自動建立一次。保留：24 小時 + 30 每日備份，智慧輪換。",
+    "loadingBackups": "正在載入備份...",
+    "noBackupsYet": "尚無可用的備份。當資料發生變化時，將自動建立備份。",
+    "backupsAvailable": "{count} 可用備份",
+    "refresh": "重新整理",
+    "confirm": "確認？",
+    "yes": "是的",
+    "no": "否",
+    "restore": "恢復",
+    "invalidFileType": "檔案型別無效，僅接受 `.sqlite` 檔案。",
+    "exportFailed": "匯出失敗",
+    "exportFailedWithError": "匯出失敗：{error}",
+    "fullExportFailedWithError": "完全匯出失敗：{error}",
+    "backupCreated": "建立備份：{file}",
+    "restoreSuccess": "恢復完成！共恢復 {connections} 個連線、{nodes} 個節點、{combos} 個組合、{apiKeys} 個 API 金鑰。",
+    "importSuccess": "資料庫匯入完成！共匯入 {connections} 個連線、{nodes} 個節點、{combos} 個組合、{apiKeys} 個 API 金鑰。",
+    "minutesAgo": "{count} 分鐘前",
+    "hoursAgo": "{count} 小時前",
+    "daysAgo": "{count} 天前",
+    "backupReasonManual": "手動",
+    "backupReasonPreRestore": "預恢復",
+    "connectionsCount": "{count, plural, one {# 個連線} other {# 個連線}}",
+    "noChangesSinceBackup": "自上次備份以來沒有任何變化",
+    "backupFailed": "備份失敗",
+    "restoreFailed": "恢復失敗",
+    "importFailed": "匯入失敗",
+    "errorDuringRestore": "恢復期間發生錯誤",
+    "errorDuringImport": "匯入時發生錯誤",
+    "modelPricing": "模型定價",
+    "modelPricingDesc": "配置每個模型的成本費率 • 所有費率均以美元/100 萬 Tokens 為單位",
+    "registry": "登記處",
+    "priced": "定價",
+    "searchProvidersModels": "搜尋提供商或模型...",
+    "showAll": "顯示全部",
+    "noProvidersMatch": "沒有與您的搜尋匹配的提供商。",
+    "howPricingWorks": "定價如何運作",
+    "cacheWrite": "快取寫入",
+    "unsaved": "未儲存",
+    "resetDefaults": "重置預設值",
+    "saveProvider": "儲存提供商",
+    "model": "模型",
+    "models": "模型",
+    "moreProviders": "{count} 更多提供商",
+    "withPricing": "已配置定價",
+    "policiesCircuitBreakers": "策略與斷路器",
+    "activeIssuesDetected": "檢測到活躍問題",
+    "off": "關閉",
+    "resetPricingConfirm": "將 {provider} 的所有定價重置為預設值？",
+    "pricingDescInput": "輸入：傳送到模型的令牌",
+    "pricingDescOutput": "輸出：生成的 Tokens",
+    "pricingDescCached": "快取：重用輸入（約輸入率的 50%）",
+    "pricingDescReasoning": "推理：思考 Tokens（預設回退到輸出費率）",
+    "pricingDescCacheWrite": "快取寫入：建立快取條目（回退到輸入）",
+    "pricingDescFormula": "成本 = (輸入 × 輸入率) + (輸出 × 輸出率) + (快取 × 快取率) 每百萬 Tokens。",
+    "pricingSettingsTitle": "定價設定",
+    "totalModels": "模型總數",
+    "active": "活躍",
+    "costCalculation": "成本計算",
+    "costCalculationDesc": "成本是根據為每個模型配置的令牌使用情況和定價費率計算的。",
+    "pricingFormat": "定價格式",
+    "pricingFormatDesc": "所有費率均以美元/100 萬 Tokens 為單位（每百萬 Tokens 美元）。",
+    "tokenTypes": "Token 型別",
+    "inputTokenDesc": "標準提示 Tokens",
+    "outputTokenDesc": "補全 / 響應 Tokens",
+    "cachedTokenDesc": "快取輸入 Tokens（通常按輸入費率的 50% 計）",
+    "reasoningTokenDesc": "特殊推理 / 思考 Tokens（回退到輸出費率）",
+    "cacheCreationTokenDesc": "用於建立快取條目的 Tokens（回退到輸入費率）",
+    "customPricingNote": "你可以覆蓋特定模型的預設定價。自定義覆蓋會優先於自動檢測到的定價。",
+    "editPricing": "編輯定價",
+    "viewFullDetails": "檢視完整詳情",
+    "themeCoral": "珊瑚色",
+    "adaptiveVolumeRouting": "自適應流量路由",
+    "adaptiveVolumeRoutingDesc": "根據即時負載量和吞吐壓力，動態調整各提供商連線承載的流量。",
+    "lkgpToggleTitle": "最後已知良好提供商（LKGP）",
+    "lkgpToggleDesc": "啟用後，路由器會記住上一次成功返回響應的提供商，並在後續請求中優先嚐試它。",
+    "echoRequestedModelTitle": "__MISSING__:Echo requested model name in responses",
+    "echoRequestedModelDesc": "__MISSING__:When enabled, the response `model` field echoes the alias or combo name the client requested instead of the upstream model name. Fixes strict clients (e.g. Claude Desktop) that reject a response whose model does not match the request.",
+    "webSearchRouteTitle": "__MISSING__:Web search routing",
+    "webSearchRouteDesc": "__MISSING__:When a request includes a native web_search tool, route the whole request to this model instead of the default — useful for providers that don't implement Anthropic's web_search server tool. Leave blank to disable.",
+    "webSearchRoutePlaceholder": "__MISSING__:e.g. openrouter,anthropic/claude-3.5-sonnet",
+    "clearLkgpCache": "清除 LKGP 快取",
+    "lkgpCacheCleared": "LKGP 快取已成功清除",
+    "lkgpCacheClearFailed": "清除 LKGP 快取失敗",
+    "days": "天",
+    "lkgp": "LKGP 模式",
+    "lkgpDesc": "最後已知良好提供商（可預測的彈性）",
+    "maintenance": "維護",
+    "purgeExpiredLogs": "清理過期日誌",
+    "purgeLogsFailed": "清理日誌失敗",
+    "logsDeleted": "__MISSING__:{count, plural, =0 {No expired logs purged} one {Purged # expired log} other {Purged # expired logs}}",
+    "resetUsageData": "__MISSING__:Reset Usage Data",
+    "resetUsageDataDesc": "__MISSING__:Select how far back you want to delete usage data. This action cannot be undone.",
+    "resetUsagePeriod_5m": "__MISSING__:5 minutes",
+    "resetUsagePeriod_1h": "__MISSING__:1 hour",
+    "resetUsagePeriod_3h": "__MISSING__:3 hours",
+    "resetUsagePeriod_6h": "__MISSING__:6 hours",
+    "resetUsagePeriod_12h": "__MISSING__:12 hours",
+    "resetUsagePeriod_1d": "__MISSING__:1 day",
+    "resetUsagePeriod_7d": "__MISSING__:7 days",
+    "resetUsagePeriod_30d": "__MISSING__:30 days",
+    "resetUsagePeriod_all": "__MISSING__:All time",
+    "resetUsageSuccess": "__MISSING__:{count, plural, =0 {No usage data rows deleted} one {Reset usage data (# row deleted)} other {Reset usage data (# rows deleted)}}",
+    "resetUsageFailed": "__MISSING__:Failed to reset usage data",
+    "reset": "__MISSING__:Reset",
+    "resetting": "__MISSING__:Resetting...",
+    "contextOpt": "上下文最佳化",
+    "contextOptDesc": "根據上下文視窗需求和對話長度進行路由",
+    "priorityDesc": "順序回退——先嚐試提供商 1，再嘗試提供商 2，依此類推",
+    "weightedDesc": "按百分比權重在各提供商之間分配流量",
+    "modelRoutingTitle": "模型路由規則",
+    "modelRoutingDesc": "使用 glob 模式自動將模型路由到指定組合",
+    "addRule": "新增規則",
+    "routeToCombo": "路由到組合",
+    "selectCombo": "選擇組合...",
+    "priorityHint": "數值越高越優先檢查。具體模式建議使用 10+。",
+    "patternHint": "使用 * 匹配任意字元，? 匹配單個字元。不區分大小寫。",
+    "noRoutingRules": "未配置路由規則。請求預設使用全域性組合。",
+    "routingRuleHint": "新增類似 claude-opus* -> frontier-combo 的規則，以自動路由請求。",
+    "deleteRoutingRule": "刪除此模型路由規則？",
+    "exactMatchMode": "精確匹配",
+    "wildcardPatternMode": "萬用字元模式",
+    "exactMatchModeDesc": "對已棄用或已重新命名的模型 ID 使用精確別名。",
+    "wildcardPatternModeDesc": "當一組模型應對映到同一目標時，使用帶 * 和 ? 的萬用字元別名。",
+    "noExactAliasesConfigured": "未配置精確匹配別名。",
+    "wildcardRulesTitle": "萬用字元規則",
+    "noWildcardAliasesConfigured": "未配置萬用字元別名。",
+    "overview": "概覽",
+    "unknownError": "未知錯誤",
+    "pricingSourceLiteLLM": "LiteLLM 定價來源",
+    "clearSyncedPricingConfirm": "確定要清除已同步的定價嗎？",
+    "clearSyncedPricingFailed": "清除已同步定價失敗",
+    "pricingSourceUser": "使用者定價來源",
+    "pageDescription": "頁面描述",
+    "pricingSyncStatus": "定價同步狀態",
+    "whitelist": "白名單",
+    "syncDisabled": "同步已停用",
+    "pricingLoadFailed": "載入定價失敗",
+    "pricingSyncDescription": "從 models.dev 同步模型定價和能力資料。",
+    "clearSyncedPricingSuccess": "已清除同步定價",
+    "clearSyncedPricingFailedWithReason": "清除價格失敗：{reason}",
+    "pricingSourceDefault": "預設定價來源",
+    "pricingSyncSuccess": "定價同步成功",
+    "enableSyncError": "啟用同步失敗",
+    "syncEnabled": "同步已啟用",
+    "blacklist": "黑名單",
+    "pricingSourceModelsDev": "models.dev 定價來源",
+    "syncedModels": "已同步模型",
+    "budget": "預算",
+    "pricingSyncTitle": "定價同步",
+    "pricingResetFailedWithReason": "重置價格失敗：{reason}",
+    "tab": "選項卡",
+    "pricingSavedProvider": "已儲存 {provider} 的價格",
+    "pricingSyncFailed": "定價同步失敗",
+    "pricingSaveFailedWithReason": "儲存價格失敗：{reason}",
+    "pricingResetProvider": "已重置 {provider} 的價格",
+    "nextSync": "下次同步",
+    "pricingSyncFailedWithReason": "價格同步失敗：{reason}",
+    "clearSyncedPricing": "清除同步定價",
+    "compressionTitle": "提示詞壓縮",
+    "compressionDesc": "在傳送給提供商之前壓縮提示詞，以減少 token 使用量",
+    "tokenSaverTitle": "Token Saver",
+    "tokenSaverSubtitle": "讓每次請求消耗更少 token。",
+    "tokenSaverToolOutput": "工具輸出",
+    "tokenSaverToolOutputDesc": "在傳送給提供商前清理 git、grep、ls、tree 和日誌輸出。",
+    "tokenSaverLlmOutput": "LLM 輸出",
+    "tokenSaverLlmOutputDesc": "注入簡潔回覆指令，不改寫提供商輸出。",
+    "tokenSaverInputCompression": "輸入壓縮",
+    "tokenSaverInputCompressionDesc": "在保留程式碼、URL 和意圖的前提下改寫可壓縮的對話歷史。",
+    "tokenSaverFineTunePrefix": "可在以下頁面微調各引擎：",
+    "tokenSaverFineTuneSuffix": "或按請求組合引擎：",
+    "compressionMode": "壓縮模式",
+    "compressionModeOff": "關閉",
+    "compressionModeOffDesc": "不應用壓縮",
+    "compressionModeLite": "精簡",
+    "compressionModeLiteDesc": "減少空白字元和空行",
+    "compressionModeStandard": "標準（Caveman）",
+    "compressionModeStandardDesc": "基於規則的壓縮，包含 30+ 個模式，並保留程式碼塊和 URL",
+    "compressionModeAggressive": "激進",
+    "compressionModeAggressiveDesc": "摘要 + 工具結果壓縮 + 漸進老化，以實現最大節省",
+    "compressionModeUltra": "極速",
+    "compressionModeUltraDesc": "使用包括語義去重在內的全部技術進行最大壓縮",
+    "compressionAggressiveConfig": "Aggressive 引擎配置",
+    "compressionAggressiveConfigDesc": "微調摘要、工具壓縮和老化閾值",
+    "compressionUltraConfig": "Ultra 引擎配置",
+    "compressionUltraConfigDesc": "微調啟發式剪枝、SLM 後備和每條訊息閾值",
+    "compressionUltraRate": "保留比例",
+    "compressionUltraMinScore": "最低分數閾值",
+    "compressionUltraSlmFallback": "回退到 Aggressive",
+    "compressionUltraModelPath": "SLM 模型路徑",
+    "compressionUltraEngine": "__MISSING__:Ultra tier",
+    "compressionUltraEngineHeuristic": "__MISSING__:Heuristic (Tier-A, default)",
+    "compressionUltraEngineSlm": "__MISSING__:SLM (LLMLingua-2, opt-in)",
+    "compressionUltraSlmHint": "__MISSING__:SLM downloads a small ONNX model on first use (cold-start) and transparently falls back to the heuristic on timeout or if unavailable.",
+    "compressionUltraSlmPrewarm": "__MISSING__:Pre-warm SLM model on enable",
+    "compressionSummarizerEnabled": "啟用摘要器",
+    "compressionMaxTokensPerMessage": "每條訊息最大 Token 數",
+    "compressionMinSavings": "最低節省閾值",
+    "compressionAgingThresholds": "老化閾值",
+    "compressionAgingThresholdsDesc": "每個老化層級保留的最近訊息數量（越高表示保留越多）",
+    "compressionToolStrategies": "工具結果策略",
+    "compressionToolStrategiesDesc": "為不同工具結果型別切換壓縮策略",
+    "compressionGeneral": "通用設定",
+    "compressionAutoTrigger": "自動觸發閾值",
+    "compressionCacheTTL": "快取 TTL",
+    "compressionPreserveSystem": "保留系統提示",
+    "compressionPreserveSystemAlways": "__MISSING__:Always",
+    "compressionPreserveSystemWhenNoCache": "__MISSING__:When no cache",
+    "compressionPreserveSystemNever": "__MISSING__:Never",
+    "compressionCavemanConfig": "Caveman 引擎配置",
+    "compressionCavemanConfigDesc": "微調基於規則的壓縮引擎",
+    "compressionCavemanPanelHint": "__MISSING__:Its on/off and level are set in the panel:",
+    "compressionRoles": "壓縮訊息角色",
+    "compressionRoleUser": "使用者",
+    "compressionRoleAssistant": "助手",
+    "compressionRoleSystem": "系統",
+    "compressionMinLength": "最小訊息長度",
+    "compressionSkipRules": "跳過壓縮規則",
+    "compressionSkipRulesDesc": "點選規則以在壓縮時跳過它們",
+    "compressionPreservePatterns": "保留模式",
+    "compressionPreservePatternsDesc": "永不壓縮的正規表示式模式（每行一個）",
+    "compressionLogTitle": "壓縮日誌",
+    "compressionLogEmpty": "尚無壓縮請求。啟用壓縮後處理請求時，壓縮統計會顯示在這裡。",
+    "minutes": "分鐘",
+    "compressionModeRtk": "RTK",
+    "compressionModeRtkDesc": "感知命令的工具輸出過濾",
+    "compressionModeStacked": "堆疊",
+    "compressionModeStackedDesc": "先進行 RTK 工具輸出過濾，再進行 Caveman 訊息壓縮",
+    "qdrantTitle": "Qdrant（向量記憶體）",
+    "qdrantDesc": "可選。在外部向量資料庫中索引語義記憶以加快檢索速度。",
+    "qdrantStatusActive": "活躍",
+    "qdrantStatusError": "錯誤",
+    "qdrantStatusDisabled": "殘疾人",
+    "qdrantEnable": "啟用 Qdrant",
+    "qdrantEnableDesc": "啟用後，語義/混合策略可以使用 Qdrant 來檢索記憶。",
+    "qdrantTesting": "測試...",
+    "qdrantTestConnection": "測試連線",
+    "qdrantSaved": "配置已儲存",
+    "qdrantSaveError": "儲存配置失敗",
+    "qdrantHostHint": "沒有埠。示例：127.0.0.1 或 http://qdrant",
+    "qdrantPort": "港口",
+    "qdrantPortHint": "Qdrant 預設值：6333",
+    "qdrantCollectionHint": "儲存點的位置。",
+    "qdrantEmbeddingModel": "嵌入模型",
+    "qdrantHelpTitle": "快速設定幫助",
+    "qdrantHelpQuickTitle": "快速設定（Qdrant + OpenRouter）",
+    "qdrantHelpStep1": "1. 主機：Qdrant IP/URL，埠：6333，集合：omniroute_memory。",
+    "qdrantHelpStep2": "2. 如果使用 nvidia/llama-nemotron-embed-vl-1b-v2:free，請使用集合維度 2048。",
+    "qdrantHelpStep3": "3. 模型欄位：openrouter/nvidia/llama-nemotron-embed-vl-1b-v2:free。",
+    "qdrantHelpStep4": "4. 儲存，測試連線，然後測試搜尋。",
+    "qdrantEmbeddingQuickSelect": "從發現的模型中快速選擇...",
+    "qdrantEmbeddingInputPlaceholder": "openai/text-embedding-3-small",
+    "qdrantEmbeddingHint": "格式：提供商/模型。必須配置提供者憑證。",
+    "qdrantApiKeyPlaceholderKeep": "（留空以保留當前金鑰）",
+    "qdrantApiKeyPlaceholderOptional": "（如不用則留空）",
+    "qdrantSaveHint": "提示：編輯主機/埠/集合/模型，然後單擊“儲存”。 API 金鑰是可選的。",
+    "qdrantSearchTestTitle": "搜尋測試",
+    "qdrantSearchTestDesc": "在 Qdrant 中生成嵌入和搜尋。",
+    "qdrantSearchPlaceholder": "示例：使用者偏好、歷史記錄等",
+    "qdrantNoResults": "無結果（或未配置 Qdrant）。",
+    "qdrantCleanupTitle": "保留和清理",
+    "qdrantCleanupDesc": "根據以下內容刪除過期和舊的積分",
+    "searching": "正在尋找...",
+    "cleaning": "清潔...",
+    "cleanNow": "立即清潔",
+    "optional": "可選",
+    "current": "當前",
+    "remove": "刪除",
+    "search": "搜尋",
+    "oneproxyTitle": "1proxy 免費代理市場",
+    "oneproxyTotalProxies": "代理總數",
+    "oneproxyAvgQuality": "平均質量",
+    "resilienceScope": "範圍：",
+    "resilienceTrigger": "觸發：",
+    "resilienceEffect": "效果：",
+    "resilienceRequestQueueTitle": "請求佇列與速率",
+    "resilienceAutoEnableApiKeyProviders": "為 API 金鑰提供商自動啟用",
+    "resilienceRequestsPerMinute": "每分鐘請求數",
+    "resilienceMinTimeBetweenRequests": "請求之間的最小時間",
+    "resilienceConcurrentRequests": "併發請求數",
+    "resilienceMaxQueueWaitTime": "最大佇列等待時間",
+    "resilienceBaseCooldown": "基礎冷卻時間",
+    "resilienceUseUpstreamRetryHints": "使用上游重試提示",
+    "resilienceDefaultPerProvider": "預設（按提供商）",
+    "resilienceAlwaysOn": "始終開啟",
+    "resilienceAlwaysOff": "始終關閉",
+    "routingRemoveEntry": "刪除條目",
+    "routingNeedlesSubstrings": "Needles（要匹配的子字串）",
+    "routingCaseSensitive": "區分大小寫",
+    "routingPrefixes": "字首",
+    "routingMatch": "比賽",
+    "routingReplacement": "更換",
+    "routingReplaceAllOccurrences": "替換所有出現的地方",
+    "routingPatternRegex": "模式（正規表示式）",
+    "routingFlags": "旗幟",
+    "routingNeedles": "針",
+    "routingBlockText": "塊文本",
+    "routingIdempotencyKey": "冪等性金鑰",
+    "routingEntrypoint": "入口點",
+    "routingVersionFormat": "版本格式",
+    "routingCchAlgorithm": "CCH演算法",
+    "routingWordsToObfuscate": "要混淆的單詞（在第一個字元後插入 ZWJ）",
+    "logsSettingsTitle": "日誌設定",
+    "detailedLogsLabel": "啟用詳細日誌",
+    "detailedLogsDesc": "啟用詳細的請求/響應日誌記錄",
+    "callLogPipelineLabel": "呼叫日誌管道",
+    "callLogPipelineDesc": "啟用通話記錄處理管道",
+    "maxDetailSizeLabel": "最大細節大小 (KB)",
+    "maxDetailSizeDesc": "詳細日誌條目的最大大小",
+    "ringBufferSizeLabel": "環形緩衝區大小",
+    "ringBufferSizeDesc": "日誌環形緩衝區的大小",
+    "semanticCacheEnabledLabel": "語義快取啟用",
+    "semanticCacheMaxSizeLabel": "語義快取最大大小",
+    "semanticCacheMaxSizeDesc": "語義快取條目的最大數量",
+    "semanticCacheTTLLabel": "語義快取 TTL",
+    "promptCacheEnabledLabel": "提示快取已啟用",
+    "promptCacheEnabledDesc": "啟用提示快取",
+    "promptCacheStrategyLabel": "提示快取策略",
+    "promptCacheStrategyDesc": "即時快取策略",
+    "alwaysPreserveClientCacheLabel": "始終保留客戶端快取",
+    "alwaysPreserveClientCacheDesc": "客戶端快取儲存策略",
+    "logRetentionPolicyTitle": "日誌保留策略",
+    "resilienceUseUpstream429HintsForBreaker": "使用上游 429 提示（斷路器）",
+    "appearanceLogoPreviewAlt": "標誌預覽",
+    "appearanceFaviconPreviewAlt": "圖示預覽",
+    "oneproxyLastSync": "上次同步",
+    "oneproxyAllProtocols": "所有協議",
+    "oneproxyCountryCodePlaceholder": "國家/地區程式碼（例如美國）",
+    "oneproxyMinQualityPlaceholder": "最低質量",
+    "oneproxyLoadingProxies": "正在載入代理...",
+    "oneproxyLastSyncLabel": "上次同步：",
+    "oneproxyProxiesFetched": "獲取的代理：",
+    "oneproxyConsecutiveFailures": "連續失敗：",
+    "oneproxyErrorLabel": "錯誤：",
+    "oneproxyNever": "從來沒有",
+    "oneproxySyncStatusTitle": "同步狀態",
+    "oneproxySuccess": "成功",
+    "oneproxyFailed": "失敗",
+    "routingAntigravitySignatureTitle": "反重力簽名快取模式",
+    "routingAntigravitySignatureDesc": "控制 OmniRoute 在 Antigravity 相容的工具呼叫流程中是僅複用已儲存的 Gemini thought 簽名,還是接受經校驗的客戶端提交簽名。",
+    "routingAntigravitySignatureEnabledLabel": "啟用",
+    "routingAntigravitySignatureEnabledDesc": "當前行為。忽略客戶端提交的簽名,繼續使用 OmniRoute 已儲存的流程。",
+    "routingAntigravitySignatureBypassLabel": "繞過",
+    "routingAntigravitySignatureBypassDesc": "經過輕量校驗後接受客戶端提交的簽名,無效時回退到已儲存的簽名。",
+    "routingAntigravitySignatureBypassStrictLabel": "嚴格繞過",
+    "routingAntigravitySignatureBypassStrictDesc": "在接受客戶端提交的簽名前要求完整的 protobuf 校驗。",
+    "routingHeaderFingerprintTitle": "標頭指紋（每個提供商）",
+    "routingServerRejectedSave": "⚠ 伺服器拒絕儲存：",
+    "routingAddTransformOp": "新增變換操作",
+    "routingClientCacheControlTitle": "客戶端快取控制",
+    "routingClientCacheControlDesc": "配置 OmniRoute 是否保留客戶端提交的 cache_control 標記",
+    "routingClientCacheControlAutoDesc": "對於確定性的 Claude 相容流程,按原樣保留客戶端提交的 cache_control。如果請求未攜帶 cache_control,OmniRoute 不會注入任何由橋接器擁有的標記,以相容 CC 相容的第三方代理。",
+    "routingClientCacheControlAlwaysLabel": "始終保留",
+    "routingClientCacheControlAlwaysDesc": "始終按原樣將客戶端提交的 cache_control 請求頭轉發給上游提供商。",
+    "routingClientCacheControlNeverLabel": "從不保留",
+    "routingClientCacheControlNeverDesc": "始終移除客戶端的 cache_control 請求頭,在原生提供商流程支援時由 OmniRoute 管理快取。",
+    "routingZeroConfigTitle": "零配置自動路由",
+    "routingZeroConfigDesc": "啟用使用 auto/ 字首的自動提供商選擇。啟用後,發往 auto、auto/coding、auto/fast 等的請求將在所有已連線提供商之間動態路由。",
+    "routingDefaultAutoVariant": "預設自動變體",
+    "visionBridge": "願景橋",
+    "visionBridgeDesc": "在將影像請求路由到純文本模型之前,自動執行一次視覺到文本的回退。",
+    "visionBridgeEnabledLabel": "啟用",
+    "visionBridgeEnabledDesc": "切換預呼叫橋接,將影像內容替換為提取出的文本。",
+    "visionBridgeModel": "橋樑模型",
+    "visionBridgeModelPlaceholder": "openai/gpt-4o-mini",
+    "visionBridgeModelHint": "可使用任何支援視覺的 OmniRoute 模型 ID。",
+    "visionBridgePrompt": "橋接提示",
+    "visionBridgePromptPlaceholder": "簡要描述一下這張圖片。",
+    "visionBridgePromptHint": "在將提取出的描述注入回原始請求前,先發送給視覺模型。",
+    "visionBridgeTimeoutMs": "超時（毫秒）",
+    "visionBridgeMaxImagesPerRequest": "每個請求的最大影像數",
+    "resilienceMaxBackoffSteps": "最大退避步數",
+    "resilienceProviderBreakerTitle": "按提供商的斷路器",
+    "resilienceFailureThreshold": "失敗閾值",
+    "resilienceDegradationThreshold": "Degradation threshold",
+    "resilienceResetTimeout": "重置超時",
+    "resilienceFailureThresholdLabel": "失敗閾值",
+    "resilienceResetTimeoutLabel": "重置超時",
+    "resilienceConnectionCooldownTitle": "連線冷卻",
+    "resilienceUseUpstreamRetryHintsLabel": "使用上游重試提示",
+    "resilienceUseUpstream429BreakerLabel": "使用上游 429 提示（斷路器）",
+    "resilienceMaxBackoffStepsLabel": "最大退避步數",
+    "resilienceYes": "是的",
+    "resilienceNo": "否",
+    "resilienceDefault": "預設",
+    "storageDatabaseBackupRetention": "資料庫備份保留",
+    "storageDatabaseBackups": "__MISSING__:Database backups",
+    "storagePurgeData": "清除資料",
+    "storagePurgeDataDesc": "__MISSING__:Immediately delete all records without applying retention checks. Use with caution.",
+    "storageRetentionCleanup": "__MISSING__:Retention Settings",
+    "storageRetentionCleanupDesc": "__MISSING__:Configure operational record retention and database backup cleanup.",
+    "retentionCallDays": "__MISSING__:Call {count}d",
+    "retentionAppDays": "__MISSING__:App {count}d",
+    "retentionRows": "__MISSING__:{count} rows",
+    "retentionQuotaSnapshots": "配額快照（天）",
+    "retentionCompressionAnalytics": "__MISSING__:Compression Analytics (days)",
+    "retentionMcpAudit": "MCP 稽核（天）",
+    "retentionA2aEvents": "A2A 活動（天）",
+    "retentionCallLogs": "通話記錄（天）",
+    "retentionUsageHistory": "使用歷史（天）",
+    "retentionMemoryEntries": "記憶體條目（天）",
+    "saveRetentionSettings": "__MISSING__:Save retention settings",
+    "storageAutoVacuumMode": "自動真空模式",
+    "storageScheduledVacuum": "預定真空",
+    "storageVacuumHour": "真空時間（0-23）",
+    "storagePageSize": "頁面大小（位元組）",
+    "storageDatabaseSize": "資料庫大小",
+    "storagePageCount": "頁數",
+    "storageFreelistCount": "空閒列表計數",
+    "storageLastVacuum": "最後一次真空",
+    "storageLastOptimization": "最後最佳化",
+    "storageIntegrityCheck": "完整性檢查",
+    "storageIntegrityOk": "✓ 確定",
+    "storageIntegrityError": "✗ 錯誤",
+    "storageUsageTokenBuffer": "使用令牌緩衝區",
+    "storageUsageTokenBufferDesc": "__MISSING__:Extra tokens added to reported usage to account for system prompt overhead.",
+    "storageUsageTokenBufferHint": "__MISSING__:Set to 0 to report raw provider token counts. Default: 2000.",
+    "storageUsageTokenBufferCurrent": "__MISSING__:Current: {value}",
+    "redisLauncherTitle": "__MISSING__:Local Redis",
+    "redisLauncherDesc": "__MISSING__:One-click launch a Redis 7 container (Podman or Docker) for response cache, quota tracking, and rate limiting.",
+    "redisLauncherRefresh": "__MISSING__:Refresh",
+    "redisLauncherStop": "__MISSING__:Stop",
+    "redisLauncherLaunching": "__MISSING__:Launching...",
+    "redisLauncherLaunch": "__MISSING__:Launch Redis",
+    "redisLauncherContainer": "__MISSING__:Container",
+    "redisLauncherRunning": "__MISSING__:Running",
+    "redisLauncherReachable": "__MISSING__:Reachable",
+    "redisLauncherError": "__MISSING__:Error: {message}",
+    "redisLauncherHint": "__MISSING__:Equivalent to running `omniroute redis up`. The container is named `omniroute-redis` and listens on 127.0.0.1:6379.",
+    "compressionSettingsAutoTriggerMode": "自動觸發模式",
+    "compressionSettingsMcpDescriptionCompression": "MCP描述壓縮",
+    "mcpAccessibilityTitle": "__MISSING__:MCP accessibility output",
+    "compressionSettingsCavemanIntensity": "穴居人強度",
+    "compressionSettingsCavemanOutputMode": "穴居人輸出模式",
+    "compressionSettingsOutputStyles": "__MISSING__:Output styles",
+    "compressionStylesTileTitle": "__MISSING__:Output styles",
+    "compressionSettingsOutputIntensity": "輸出強度",
+    "compressionSettingsAutoClarityBypass": "自動清晰度旁路",
+    "resilienceWaitForCooldown": "等待冷卻",
+    "resilienceEnableServerSideWait": "啟用伺服器端等待",
+    "resilienceMaximumRetries": "最大重試次數",
+    "resilienceMaximumWaitPerRetry": "每次重試的最長等待時間",
+    "memorySkillsSkillsmpMarketplace": "SkillsMP 市場",
+    "memorySkillsFailedToSave": "儲存失敗",
+    "memorySkillsApiKey": "API金鑰",
+    "memorySkillsActiveSkillsProvider": "主動技能提供者",
+    "cliproxyapiFallback": "CLIProxyAPI 後備",
+    "cliproxyapiEnableFallback": "啟用 CLIProxyAPI 回退",
+    "cliproxyapiUrl": "CLIProxyAPI URL",
+    "cliproxyapiStatus": "CLIProxyAPI 狀態",
+    "cliproxyapiNotDetected": "未檢測到",
+    "cliproxyapiImportAuthTitle": "__MISSING__:Import accounts from CLIProxyAPI",
+    "cliproxyapiImportAuthDesc": "__MISSING__:Import the OAuth accounts CLIProxyAPI already saved in ~/.cli-proxy-api/ as OmniRoute connections, so you don't have to log in to each account again. Supported account types (Gemini, Codex, Claude, Antigravity, Qwen, Kimi) are imported; others are skipped.",
+    "cliproxyapiImportAuthButton": "__MISSING__:Import accounts",
+    "payloadRulesTitle": "負載規則",
+    "payloadRulesDesc": "按模型與協議配置請求 payload 的變更。修改會持久化到設定中,並在儲存後立即熱載入到執行時。",
+    "payloadRuleDefaultTitle": "default",
+    "payloadRuleDefaultDesc": "僅在外發 payload 缺少目標路徑時應用引數。",
+    "payloadRuleOverrideTitle": "override",
+    "payloadRuleOverrideDesc": "強制將值寫入 payload,替換該路徑上已存在的任何內容。",
+    "payloadRuleFilterTitle": "filter",
+    "payloadRuleFilterDesc": "在向上遊發起請求前,從 payload 中移除被遮蔽的引數。",
+    "payloadRuleDefaultRawTitle": "defaultRaw",
+    "payloadRuleDefaultRawDesc": "與 default 類似,但會先嚐試將字串值解析為 JSON。儲存時也接受舊的輸入別名 default-raw。",
+    "payloadEditorTitle": "編輯器",
+    "payloadEditorDesc": "請使用執行時的 schema 形態:default、override、filter、defaultRaw。API 也接受舊的輸入鍵名 default-raw。",
+    "payloadEditorReady": "就緒",
+    "payloadResetInfo": "編輯器已重置為中性模板,儲存後生效。",
+    "payloadSaveSuccess": "Payload 規則已儲存並熱載入。",
+    "payloadJsonParseError": "JSON 解析錯誤:{error}",
+    "payloadMustBeObject": "Payload 規則必須是 JSON 物件。",
+    "payloadInvalidJson": "無效的 JSON payload。",
+    "payloadValidJsonRequired": "儲存前 Payload 規則必須是合法 JSON。",
+    "savePayloadRules": "儲存 Payload 規則",
+    "requestLimitsTitle": "請求限制",
+    "requestLimitsDesc": "配置全域性請求限制與併發保護。",
+    "maxRequestSizeLabel": "最大請求大小(MB)",
+    "maxRequestSizeDesc": "傳入 API 請求允許的最大大小。",
+    "maxResponseSizeLabel": "最大響應大小(MB)",
+    "maxResponseSizeDesc": "傳出 API 響應允許的最大大小。",
+    "maxRequestTokensLabel": "最大請求 Token 數",
+    "maxRequestTokensDesc": "單次請求允許的總 Token 上限。",
+    "maxResponseTokensLabel": "最大響應 Token 數",
+    "maxResponseTokensDesc": "單次響應允許的總 Token 上限。",
+    "modelCooldownsTitle": "處於冷卻狀態的模型",
+    "modelCooldownsEmpty": "目前沒有模型處於冷卻狀態。",
+    "responsesStateTitle": "響應狀態",
+    "responsesStateDesc": "控制 OmniRoute 如何處理 previous_response_id。",
+    "responsesStateModeLabel": "previous_response_id 處理",
+    "responsesStateModeAuto": "自動",
+    "responsesStateModeStrip": "剝離",
+    "responsesStateModePreserve": "保留",
+    "responsesStateHint": "自動模式會剝離 previous_response_id，除非連線明確啟用 OpenAI 響應儲存。對於無狀態客戶端（如 VS Code 自定義端點），剝離模式最安全；上下文取決於客戶端傳送完整歷史記錄。",
+    "responsesStateSaveError": "更新響應狀態設定失敗",
+    "codexFastTierTitle": "Codex 快速層",
+    "codexFastTierDesc": "為 OpenAI Codex 請求全域性注入 service_tier=priority。",
+    "codexFastTierHint": "啟用後，OmniRoute 會將 service_tier=priority 新增到尚未指定層的連線的出站 Codex 請求中。優先順序需要 OpenAI Enterprise API 金鑰或 ChatGPT-auth Codex 路徑；其他金鑰型別將從 OpenAI 收到與層相關的錯誤。 Codex 提供程式頁面上的每個連線設定優先。",
+    "codexFastTierSaveError": "無法更新 Codex Fast Tier 設定",
+    "codexFastTierTierLabel": "服務層級",
+    "codexFastTierTierPriority": "優先順序",
+    "codexFastTierTierFlex": "彈性",
+    "codexFastTierTierDefault": "預設",
+    "codexFastTierModelsLabel": "快速層模型",
+    "codexFastTierModelsHint": "啟用快速層後,只有勾選的模型會附帶 service_tier。",
+    "codexFastTierModelCheckbox": "為 {model} 啟用快速層",
+    "claudeFastModeTitle": "克勞德快速模式",
+    "claudeFastModeDesc": "選擇選定的克勞德請求進入人擇快速模式（速度：“快速”）。",
+    "claudeFastModeHint": "Anthropic 並未正式支援 SDK 樣式客戶端的快速模式。啟用後，OmniRoute 會轉發 X-CPA-Force-Fast-Mode 標頭，以便配對的 CLIProxyAPI 構建可以選擇欺騙入口點。只有列出的 Opus 模型才會受到 Anthropic 客戶端檢查的控制。訂閱層、最大計劃和快速模式信用餘額仍然在伺服器端強制執行 - 即使開啟切換，Anthropic 也可能返回 out_of_credits。",
+    "claudeFastModeModelsLabel": "應用於模型 ({count})",
+    "claudeFastModeModelCheckbox": "為 {model} 啟用快速模式",
+    "claudeFastModeSaveError": "無法更新克勞德快速模式設定",
+    "authz": {
+      "cors": {
+        "wildcard": {
+          "title": "__MISSING__:CORS is open to every origin (CORS_ALLOW_ALL=true)",
+          "desc": "__MISSING__:Any website can call this server's API from a visitor's browser. Use only on trusted networks — set explicit origins in ALLOWED_ORIGINS and disable CORS_ALLOW_ALL in production."
+        }
+      },
+      "title": "授權清單",
+      "description": "5 級路由分類與即時繞過策略。讀取展示完整分類;變更操作需重新輸入管理密碼。",
+      "loading": "正在載入清單…",
+      "loadError": "載入授權清單失敗",
+      "tier": {
+        "LOCAL_ONLY": "僅本地",
+        "ALWAYS_PROTECTED": "始終受保護",
+        "MANAGEMENT": "管理",
+        "CLIENT_API": "客戶端 API",
+        "PUBLIC": "公開"
+      },
+      "bypass": {
+        "section": "管理範圍繞過",
+        "kill_switch": {
+          "label": "繞過總開關",
+          "desc": "總開關。關閉時,無論按字首的列表如何,任何 LOCAL_ONLY 字首都無法從非環回地址訪問。"
+        },
+        "prefix": {
+          "label": "可繞過的字首",
+          "desc": "管理範圍的 API 金鑰(或儀表盤會話)可從非環回地址訪問的 LOCAL_ONLY 字首。",
+          "add": "新增字首",
+          "placeholder": "/api/mcp/v2/",
+          "empty": "未配置任何字首,繞過實際處於關閉狀態。"
+        },
+        "cli_tools_runtime_note": "可建立子程序的字首。編譯期已停用,無法設為可繞過。僅供檢視。"
+      },
+      "password": {
+        "prompt": {
+          "label": "當前密碼",
+          "desc": "重新確認以應用涉及安全的變更。"
+        },
+        "placeholder": "當前管理密碼",
+        "cancel": "取消",
+        "submit": "應用"
+      },
+      "save": "儲存更改",
+      "saved": "授權設定已更新",
+      "pending": "存在未儲存的更改",
+      "badge": {
+        "bypassable": "可通過管理範圍繞過",
+        "strict": "嚴格環回",
+        "auth_required": "需要鑑權",
+        "public": "公開",
+        "always_protected": "始終受保護",
+        "spawn_capable": "可建立子程序"
+      },
+      "error": {
+        "PASSWORD_REQUIRED": "需要輸入當前密碼才能應用這些更改。",
+        "PASSWORD_MISMATCH": "當前密碼不正確。",
+        "INSUFFICIENT_SCOPE": "API 金鑰缺少 manage 範圍。",
+        "BYPASS_PREFIX_NOT_ALLOWED": "其中一個或多個字首指向可建立子程序的路由,無法被繞過。",
+        "GENERIC": "更新授權設定失敗。"
+      }
+    },
+    "resilienceBaseCooldownLabel": "基礎冷卻時間",
+    "scopeLabel": "適用範圍",
+    "triggerLabel": "觸發",
+    "effectLabel": "效果",
+    "statusEnabled": "啟用",
+    "statusDisabled": "殘疾人",
+    "resilienceRequestQueueScope": "每個請求佇列",
+    "resilienceRequestQueueTrigger": "傳送到上游之前",
+    "resilienceRequestQueueEffect": "對請求進行排隊、限制併發並間隔呼叫",
+    "resilienceRequestQueueDesc": "該層僅控制排隊和節奏。它不儲存冷卻時間或開啟斷路器。",
+    "resilienceAutoEnableApiKeyProvidersDesc": "預設情況下為活動 API 金鑰連線啟用佇列保護。",
+    "resilienceMaxQueueWait": "最大佇列等待時間",
+    "resilienceConnectionCooldownScope": "單獨連線",
+    "resilienceConnectionCooldownTrigger": "當連線返回暫時性上游故障時",
+    "resilienceConnectionCooldownEffect": "暫時跳過該連線並增加重複失敗的退避時間",
+    "resilienceConnectionCooldownDesc": "基礎冷卻時間涵蓋短暫的連線故障。當啟用上游重試提示時，提供程式的顯式視窗將覆蓋本地冷卻時間。",
+    "resilienceUseUpstreamRetryHintsDesc": "使用來自上游提供商的重試/重置值（如果可用）。",
+    "resilienceUseUpstream429BreakerHints": "使用上游 429 提示進行斷路器冷卻",
+    "resilienceUseUpstream429BreakerHintsShort": "使用上游 429 提示",
+    "resilienceUseUpstream429BreakerHintsDesc": "將 429 響應中的重試/配額耗盡訊號應用於斷路器冷卻持續時間。預設使用每個提供商的策略：直接雲提供商預設開啟；反向代理、自託管和 CLI 支援的提供商預設關閉。獨立於“使用上游重試提示”。",
+    "resilienceProviderBreakerScope": "整個提供商",
+    "resilienceProviderBreakerTrigger": "連接回退耗盡後最終傳輸/伺服器失敗",
+    "resilienceProviderBreakerEffect": "暫時阻止該提供商，直到重置時間到期",
+    "resilienceProviderBreakerDesc": "即時斷路器狀態僅顯示在執行狀況頁面上。連線範圍的 429 速率限制保留在連線冷卻中，並且不會觸發提供商斷路器。",
+    "resilienceResetTime": "復位時間",
+    "resilienceWaitForCooldownTitle": "等待冷卻",
+    "resilienceWaitForCooldownScope": "當前客戶請求",
+    "resilienceWaitForCooldownTrigger": "當所有候選連線已經冷卻時",
+    "resilienceWaitForCooldownEffect": "等待伺服器並在第一個冷卻時間到期時重試",
+    "resilienceWaitForCooldownDesc": "這僅影響當前請求。它不儲存連線或提供者狀態。",
+    "resilienceEnableServerWait": "啟用伺服器端等待",
+    "resilienceEnableServerWaitDesc": "啟用後，OmniRoute 會等待第一次冷卻時間到期並自動重試。",
+    "resilienceMaxAttempts": "最大嘗試次數",
+    "resilienceMaxWaitPerAttempt": "每次嘗試的最長等待時間",
+    "resilienceComboCooldownWaitTitle": "__MISSING__:Quota-share combo cooldown wait",
+    "resilienceComboCooldownWaitDesc": "__MISSING__:For quota-share combos only: wait out a short transient cooldown and re-dispatch instead of returning a 429 immediately. Never waits on quota_exhausted.",
+    "resilienceComboCooldownWaitToggleDesc": "__MISSING__:Quota-share combos only; never waits on quota_exhausted.",
+    "resilienceComboCooldownMaxWaitMs": "__MISSING__:Maximum wait per attempt",
+    "resilienceComboCooldownBudgetMs": "__MISSING__:Total wait budget",
+    "resilienceQuotaShareConcurrencyTitle": "__MISSING__:Quota-share per-connection concurrency",
+    "resilienceQuotaShareConcurrencyDesc": "__MISSING__:For quota-share combos only: when a connection sets a Max Concurrent cap, serialize concurrent requests to that subscription account so it is never flooded past its ceiling. Excess requests wait in the queue instead of getting a 429. The cap comes from each connection's Max Concurrent field; this switch only enables or disables honoring it.",
+    "resilienceQuotaShareConcurrencyToggleDesc": "__MISSING__:Quota-share combos only; honors each connection's Max Concurrent cap.",
+    "resilienceProviderCooldownTitle": "__MISSING__:Provider Cooldown",
+    "resilienceProviderCooldownScope": "__MISSING__:All combo requests",
+    "resilienceProviderCooldownTrigger": "__MISSING__:When a provider/connection fails",
+    "resilienceProviderCooldownEffect": "__MISSING__:Skips the failed provider for a cooldown period before retrying",
+    "resilienceProviderCooldownDesc": "__MISSING__:Prevents subsequent requests from re-walking the same failing providers. Cooldown scales exponentially with consecutive failures.",
+    "resilienceProviderCooldownEnabled": "__MISSING__:Enable global provider cooldown",
+    "resilienceProviderCooldownEnabledDesc": "__MISSING__:When enabled, failed providers are tracked globally and skipped for a cooldown period.",
+    "resilienceProviderCooldownMin": "__MISSING__:Minimum cooldown",
+    "resilienceProviderCooldownMax": "__MISSING__:Maximum cooldown",
+    "forcedFingerprintTitle": "{provider} 始終啟用 — OAuth 帳戶安全所必需；無法關閉。",
+    "forcedFingerprintBadge": "必需",
+    "codexSessionAffinityTitle": "法典會話關聯性",
+    "codexSessionAffinityDesc": "將同一帳戶上的一個 Codex 對話保留這麼多秒。 0 停用它。",
+    "codexSessionAffinityTtl": "關聯性 TTL（秒）",
+    "resetAwareQuotaCacheTitle": "重置感知配額快取",
+    "resetAwareQuotaCacheDesc": "僅快取重置感知排序的配額遙測。配額預檢仍然保護請求。 0/0 保持即時獲取。",
+    "resetAwareQuotaCacheTtl": "新鮮 TTL（秒）",
+    "resetAwareQuotaCacheMaxStale": "最大陳舊時間（秒）",
+    "qdrantCleanupSuccess": "好的：刪除 {count} 點（保留：{days} 天）",
+    "qdrantCleanupFailed": "清理失敗",
+    "qdrantCleanupError": "錯誤：{error}",
+    "vercelRelaySuccess": "Vercel Relay 部署成功",
+    "vercelRelayButton": "部署 Vercel Relay",
+    "vercelRelayModalTitle": "部署 Vercel Relay",
+    "vercelRelayWarning": "警告：需要 Vercel 部署令牌。此令牌僅用於建立無伺服器中繼，OmniRoute 不會儲存該令牌。",
+    "vercelRelayTokenLabel": "Vercel 訪問令牌",
+    "vercelRelayProjectNameLabel": "Vercel 專案名稱",
+    "vercelRelayFreeTierNote": "中繼是在 Vercel 免費層上部署的輕量級代理端點，用於繞過本地網路/區域限制。",
+    "vercelRelayDeploying": "正在部署...",
+    "vercelRelayDeploy": "部署",
+    "deployRelayButton": "__MISSING__:Deploy Relay",
+    "denoRelayButton": "__MISSING__:Deploy Deno Relay",
+    "denoRelayModalTitle": "__MISSING__:Deploy Deno Relay",
+    "denoRelayWarning": "__MISSING__:Warning: A Deno Deploy organization token is required. This token will only be used to create the relay app and will never be stored by OmniRoute.",
+    "denoRelayTokenLabel": "__MISSING__:Deno Deploy Organization Token",
+    "denoRelayOrgDomainLabel": "__MISSING__:Organization Domain",
+    "denoRelayProjectNameLabel": "__MISSING__:Deno App Name",
+    "denoRelayFreeTierNote": "__MISSING__:Deno Deploy v2 runs on a global edge network. Free tier: 1M requests & 100GiB outbound traffic per month, no per-request CPU limits, up to 20 active apps & 50 custom domains.",
+    "denoRelayDeploying": "__MISSING__:Deploying...",
+    "denoRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelaySuccess": "__MISSING__:Cloudflare Relay deployed successfully",
+    "cloudflareRelayButton": "__MISSING__:Deploy Cloudflare Relay",
+    "cloudflareRelayModalTitle": "__MISSING__:Deploy Cloudflare Worker Relay",
+    "cloudflareRelayWarning": "__MISSING__:Deploys a Cloudflare Worker that proxies LLM requests through Cloudflare's edge network — masking the host IP behind dynamic Cloudflare addresses. The Worker enforces a one-time auth secret so the public workers.dev URL cannot be reused as an open relay.",
+    "cloudflareRelayTokenHowto": "__MISSING__:Create the API token under My Profile -> API Tokens -> Create Token -> Custom Token -> Account / Workers Scripts / Edit.",
+    "cloudflareRelayAccountIdLabel": "__MISSING__:Cloudflare Account ID",
+    "cloudflareRelayAccountIdHint": "__MISSING__:Found on the right side of the Cloudflare dashboard overview page.",
+    "cloudflareRelayApiTokenLabel": "__MISSING__:Cloudflare API Token",
+    "cloudflareRelayApiTokenHint": "__MISSING__:Requires 'Workers Scripts: Edit' permission. The token is used only at deploy time and is never stored.",
+    "cloudflareRelayProjectNameLabel": "__MISSING__:Worker Name",
+    "cloudflareRelayFreeTierNote": "__MISSING__:Free tier: 100,000 requests/day per Cloudflare account.",
+    "cloudflareRelayDeploying": "__MISSING__:Deploying...",
+    "cloudflareRelayDeploy": "__MISSING__:Deploy",
+    "cloudflareRelayCredsRequired": "__MISSING__:Account ID and API Token are required",
+    "cloudflareRelayDeployFailed": "__MISSING__:Deploy failed",
+    "modelLockout": "__MISSING__:Model Lockout",
+    "modelLockoutPageDescription": "__MISSING__:Configure which HTTP error codes trigger per-model lockout and control the cooldown behavior.",
+    "modelLockoutEnabled": "__MISSING__:Enable Model Lockout",
+    "modelLockoutEnabledDescription": "__MISSING__:When enabled, models that fail with configured error codes are temporarily locked to prevent retry loops.",
+    "modelLockoutErrorCodes": "__MISSING__:Error Codes",
+    "modelLockoutErrorCodesDescription": "__MISSING__:HTTP status codes that trigger model lockout. Type a code and click Add, or select from suggestions.",
+    "modelLockoutBaseCooldown": "__MISSING__:Base Cooldown (ms)",
+    "modelLockoutBaseCooldownDescription": "__MISSING__:Initial cooldown duration in milliseconds before a model can be retried.",
+    "modelLockoutMaxCooldown": "__MISSING__:Max Cooldown (ms)",
+    "modelLockoutMaxCooldownDescription": "__MISSING__:Maximum cooldown duration in milliseconds. Prevents excessively long lockouts.",
+    "modelLockoutExponentialBackoff": "__MISSING__:Exponential Backoff",
+    "modelLockoutExponentialBackoffDescription": "__MISSING__:When enabled, each consecutive failure increases the cooldown duration exponentially.",
+    "modelLockoutMaxBackoffSteps": "__MISSING__:Max Backoff Steps",
+    "modelLockoutMaxBackoffStepsDescription": "__MISSING__:Maximum number of backoff steps before the cooldown stops growing. The Max Cooldown cap is reached first in most configurations, making this a safety ceiling for when Max Cooldown is raised.",
+    "disableSessionStickiness": "__MISSING__:Disable session stickiness",
+    "disableSessionStickinessDesc": "__MISSING__:Round-robin and random combos rotate to a different connection on every request instead of pinning a whole conversation to one connection by the first-message hash. Leave off to preserve prompt-cache hits for multi-turn chats. Per-combo overrides take precedence."
+  },
+  "contextRtk": {
+    "title": "RTK 引擎",
+    "description": "面向工具輸出、終端日誌和構建結果的命令感知壓縮。",
+    "enabled": "已啟用",
+    "intensity": "強度",
+    "intensityMinimal": "最小",
+    "intensityStandard": "標準",
+    "intensityAggressive": "激進",
+    "toolResults": "工具結果",
+    "assistantMessages": "助手訊息",
+    "codeBlocks": "程式碼塊",
+    "filterCatalog": "過濾器目錄",
+    "filterCatalogDesc": "可用的輸出過濾器（按類別）",
+    "guidedConfig": "配置",
+    "guidedConfigDesc": "調整 RTK 過濾終端輸出的方式",
+    "maxLines": "最大行數",
+    "maxChars": "最大字元數",
+    "deduplicateThreshold": "去重閾值",
+    "customFilters": "自定義過濾器",
+    "detectedType": "檢測型別",
+    "confidence": "信心",
+    "beforeAfter": "之前/之後",
+    "trustProjectFilters": "信任專案過濾器",
+    "rawOutputRetention": "原始輸出保留",
+    "rawOutputNever": "從不",
+    "rawOutputFailures": "失敗時",
+    "rawOutputAlways": "始終",
+    "rawOutputMaxBytes": "原始輸出最大位元組數",
+    "filterTesting": "過濾測試",
+    "pasteOutput": "貼上工具輸出以測試過濾...",
+    "presetHigh": "好鬥的",
+    "presetLow": "光",
+    "presetMaxChars": "最大輸出字元數",
+    "presetMaxLines": "最大輸出線數",
+    "presetMedium": "標準型",
+    "run": "執行",
+    "result": "結果",
+    "previewEmpty": "執行示例以預覽 RTK 輸出。",
+    "detected": "已檢測",
+    "masterSwitchOffAlert": "Token Saver 總開關已關閉 — 在壓縮設定中開啟它之前，這些設定不會影響請求。",
+    "tokensFiltered": "已過濾 token",
+    "filtersActive": "活動過濾器",
+    "requests": "請求數",
+    "avgSavings": "平均節省",
+    "simpleMode": "簡單",
+    "advancedMode": "高階",
+    "searchFilters": "搜尋過濾器...",
+    "tooltipDedup": "刪除重複行的積極程度。",
+    "tooltipMaxChars": "每個輸出塊的最大字元數。",
+    "tooltipMaxLines": "命令輸出中保留的最大行數。多餘的部分被截斷。",
+    "learnDiscoverTitle": "__MISSING__:Learn & Discover filters",
+    "learnDiscoverDesc": "__MISSING__:Mine your captured command output (Raw Output retention must be on) to suggest new RTK filters. Suggestions only — you review and save them.",
+    "discoverHeading": "__MISSING__:Discover repeated noise",
+    "discoverButton": "__MISSING__:Scan samples",
+    "discoverScanning": "__MISSING__:Scanning…",
+    "discoverEmpty": "__MISSING__:No repeated noise found. Enable Raw Output retention and run a few commands first.",
+    "discoverSamples": "__MISSING__:{count} sample(s) scanned",
+    "discoverHits": "__MISSING__:{hits}× across samples",
+    "learnHeading": "__MISSING__:Learn a filter for a command",
+    "learnCommandPlaceholder": "__MISSING__:e.g. npm install",
+    "learnButton": "__MISSING__:Suggest filter",
+    "learnEmpty": "__MISSING__:No suggestion yet. Type a command you have run and scan.",
+    "learnSamplesUsed": "__MISSING__:Learned from {count} matching sample(s)",
+    "suggestionError": "__MISSING__:Could not load suggestions. Check management auth and try again."
+  },
+  "contextCombos": {
+    "title": "壓縮組合",
+    "description": "定義不同路由場景中引擎的組合方式。",
+    "createCombo": "建立壓縮組合",
+    "editCombo": "編輯",
+    "deleteCombo": "刪除",
+    "deleteConfirm": "刪除此壓縮組合？",
+    "pipeline": "流水線",
+    "addStep": "新增步驟",
+    "removeStep": "移除",
+    "name": "名稱",
+    "descriptionField": "描述",
+    "languagePacks": "語言包",
+    "outputMode": "輸出模式",
+    "assignToRouting": "分配到路由組合",
+    "noAssignments": "沒有可用的路由組合",
+    "default": "預設",
+    "setAsDefault": "設為預設",
+    "save": "儲存",
+    "cancel": "取消",
+    "enabled": "已啟用"
+  },
+  "contextCaveman": {
+    "title": "Caveman 引擎",
+    "description": "基於規則的訊息壓縮，包含語言包、分析和輸出模式控制。",
+    "advancedConfig": "高階配置",
+    "advancedConfigDesc": "微調壓縮行為",
+    "aggressiveSettings": "激進的設定",
+    "aggressiveSettingsDesc": "最大壓縮與潛在的質量權衡",
+    "requests": "請求數",
+    "tokensSaved": "已節省 token",
+    "savingsPercent": "節省比例",
+    "avgLatency": "平均延遲",
+    "languagePacks": "語言包",
+    "languagePacksDesc": "為特定語言啟用壓縮規則。",
+    "labelAutoTrigger": "當上下文超出時自動壓縮",
+    "labelCompressionRate": "抗壓強度",
+    "labelMaxTokens": "每條訊息的目標令牌",
+    "labelMinLength": "最小訊息長度",
+    "labelMinSavings": "儲存的最低代幣數量",
+    "enabled": "已啟用",
+    "autoDetect": "自動檢測語言",
+    "rulesCount": "{count} 條規則",
+    "inputCompressionTitle": "輸入壓縮",
+    "inputCompressionDesc": "用更短的措辭重寫聊天曆史,可減少約 50% 的輸入 Token。",
+    "analyticsTitle": "壓縮分析",
+    "noAnalytics": "尚無壓縮分析。",
+    "outputMode": "輸出方式",
+    "outputModeDesc": "指示 LLM 以簡潔、緊湊的格式回覆。",
+    "outputModeTitle": "輸出模式",
+    "quickSettings": "快速設定",
+    "quickSettingsDesc": "開始使用的基本壓縮設定",
+    "autoClarity": "自動清晰度繞過",
+    "bypassConditions": "繞過條件",
+    "bypassConditionsList": "安全、不可逆、需澄清、順序敏感",
+    "simpleMode": "簡單",
+    "advancedMode": "高階",
+    "tooltipAutoTrigger": "當上下文超過此大小時自動壓縮。",
+    "tooltipCompressionRate": "0.0 = 無，1.0 = 最大值。 0.5 = 平衡。",
+    "tooltipMaxTokens": "壓縮後的目標令牌計數。更低=更具攻擊性。",
+    "tooltipMinLength": "比這短的訊息不會被壓縮。更低=更多壓縮。",
+    "tooltipMinSavings": "僅當至少儲存這麼多令牌時才進行壓縮。",
+    "ultraSettings": "超級設定",
+    "ultraSettingsDesc": "SLM 支援的語義壓縮",
+    "preview": {
+      "lite": "回覆要簡潔。保留技術術語、程式碼、錯誤、URL 和識別符號。",
+      "full": "回覆要簡短緊湊。保留所有技術實質。",
+      "ultra": "用常見技術縮寫進行極簡回覆。保留精確符號。"
+    }
+  },
+  "translator": {
+    "title": "翻譯器",
+    "metaTitle": "翻譯器遊樂場 | OmniRoute",
+    "metaDescription": "除錯、測試和視覺化提供商之間的 API 格式轉換",
+    "playgroundTitle": "翻譯器遊樂場",
+    "playground": "遊樂場",
+    "realtime": "即時翻譯活動",
+    "chatTester": "聊天測試儀",
+    "testBench": "測試臺",
+    "liveMonitor": "即時監控",
+    "modeDescriptionPlayground": "貼上任意 API 請求體，檢視 OmniRoute 如何在不同提供商格式之間進行轉換（OpenAI ↔ Claude ↔ Gemini ↔ Responses API）。",
+    "modeDescriptionChatTester": "通過 OmniRoute 傳送真實聊天請求，並檢查完整往返流程：輸入、轉換後的請求、提供商響應以及轉換後的輸出。",
+    "modeDescriptionTestBench": "執行預定義的場景並比較提供商和模型之間的相容性。",
+    "modeDescriptionLiveMonitor": "即時檢視請求流經 OmniRoute 時產生的翻譯事件。",
+    "modeDescriptionFallback": "除錯、測試並可視化 OmniRoute 如何在提供商之間轉換 API 請求。",
+    "recentTranslations": "最近的翻譯",
+    "noTranslations": "還沒有翻譯",
+    "source": "來源",
+    "target": "目標",
+    "time": "時間",
+    "model": "模型",
+    "status": "狀態",
+    "latency": "延遲",
+    "totalTranslations": "總翻譯數",
+    "successful": "成功",
+    "errors": "錯誤",
+    "avgLatency": "平均延遲",
+    "millisecondsShort": "{value} 毫秒",
+    "notAvailableSymbol": "—",
+    "liveAutoRefreshing": "直播 — 自動重新整理",
+    "paused": "已暫停",
+    "eventsAppearHint": "請求流經 OmniRoute 時，翻譯事件會顯示在這裡。你可以通過下面任一方式生成事件：",
+    "chatTesterTab": "聊天測試選項卡",
+    "testBenchTab": "測試臺選項卡",
+    "externalApiCalls": "外部API呼叫",
+    "ideCliIntegrations": "IDE/CLI 整合",
+    "inMemoryNote": "注意：事件儲存在記憶體中，並在伺服器重新啟動時重置。",
+    "ok": "好的",
+    "errorShort": "錯誤率",
+    "formatConverter": "格式轉換器",
+    "formatConverterDescription": "貼上或輸入 JSON 請求體。翻譯器會自動識別源格式並將其轉換為目標格式。你可以藉此除錯 OmniRoute 在各種格式之間的轉換行為（OpenAI ↔ Claude ↔ Gemini ↔ Responses API）。",
+    "translationPathHubSpoke": "{source} → OpenAI（中間格式）→ {target}",
+    "translationPathDirect": "{source} → {target}（直接轉換器）",
+    "translationPathPassthrough": "格式相同 — 無需轉換",
+    "openaiIntermediatePanel": "OpenAI 中間格式",
+    "autoFeaturesTitle": "OmniRoute 自動處理的內容",
+    "autoFeaturesCount": "8 項功能",
+    "featureReasoningCache": "推理快取",
+    "featureReasoningCacheDesc": "當客戶端在對話歷史中省略 thinking-mode 模型（DeepSeek V4、Kimi K2、Qwen）的快取 reasoning_content 時，會重新注入。",
+    "featureSchemaCoercion": "Schema 校正",
+    "featureSchemaCoercionDesc": "修復損壞的工具 schema：新增缺失的 additionalProperties、清理過長描述、規範化巢狀物件。",
+    "featureRoleNormalization": "角色規範化",
+    "featureRoleNormalizationDesc": "針對非 OpenAI 目標將 developer→system。針對不支援 system 角色的模型將 system→user。",
+    "featureToolCallIds": "工具呼叫 ID 規範化",
+    "featureToolCallIdsDesc": "在缺失時生成唯一的 tool_call ID。針對 Mistral 等提供商規範化為 9 字元格式。",
+    "featureMissingToolResponse": "工具響應注入",
+    "featureMissingToolResponseDesc": "當客戶端傳送 tool_calls 但沒有對應響應時，注入空的 tool_result 訊息。",
+    "featureThinkingBudget": "思考預算",
+    "featureThinkingBudgetDesc": "自動管理 thinking 配置。當最後一條訊息不是使用者訊息時移除 thinking 引數。",
+    "featureDirectPaths": "直接轉換路徑",
+    "featureDirectPathsDesc": "某些格式組合（Claude→Gemini）有繞過 OpenAI 中樞的直接轉換器，可產生更準確的輸出。",
+    "featureImageMapping": "影像尺寸對映",
+    "featureImageMappingDesc": "在 API 格式之間轉換影像尺寸約定（例如 OpenAI detail 等級 → Gemini 尺寸）。",
+    "input": "輸入",
+    "output": "輸出",
+    "auto": "汽車",
+    "swapFormats": "交換格式",
+    "translateAction": "翻譯",
+    "clear": "清除",
+    "inputPlaceholder": "在此處貼上請求正文或選擇下面的模板...",
+    "exampleTemplates": "示例模板",
+    "exampleTemplatesHint": "— 點選載入",
+    "templateLoadHint": "模板以 {format} 格式載入請求。更改源格式以以不同的格式載入。",
+    "compatibilityTester": "相容性測試儀",
+    "compatibilityReport": "相容性報告",
+    "testBenchDescription": "執行預定義的場景（簡單聊天、工具呼叫等）以驗證翻譯和提供商相容性。選擇源格式和目標提供商，然後執行所有測試以檢視相容性百分比。使用它來查詢哪些功能可以跨提供商使用。",
+    "targetProvider": "目標提供商",
+    "runAllTests": "執行所有測試",
+    "runTest": "執行測試",
+    "reRun": "重新執行",
+    "running": "執行...",
+    "passed": "通過了",
+    "failed": "失敗了",
+    "passedIconLabel": "✅ 通過",
+    "chunks": "塊",
+    "scenarioSimpleChat": "簡單聊天",
+    "scenarioToolCalling": "工具呼叫",
+    "scenarioMultiTurn": "多圈",
+    "scenarioThinking": "思考",
+    "scenarioSystemPrompt": "系統提示",
+    "scenarioStreaming": "流媒體",
+    "templateNames": {
+      "simple-chat": "簡單聊天",
+      "tool-calling": "工具呼叫",
+      "multi-turn": "多圈",
+      "thinking": "思考",
+      "system-prompt": "系統提示",
+      "streaming": "流媒體",
+      "vision": "願景",
+      "schema-coercion": "模式強制"
+    },
+    "templateDescriptions": {
+      "simple-chat": "基本簡訊",
+      "tool-calling": "函式/工具呼叫",
+      "multi-turn": "與歷史對話",
+      "thinking": "擴充套件思維/推理",
+      "system-prompt": "複雜系統指令",
+      "streaming": "SSE 流請求",
+      "vision": "帶影像輸入的多模式請求",
+      "schema-coercion": "結構化輸出/JSON 模式實施"
+    },
+    "templatePayloads": {
+      "simpleChat": {
+        "system": "你是一個有用的助手。",
+        "userGreeting": "你好！你今天怎麼樣？"
+      },
+      "toolCalling": {
+        "userWeather": "聖保羅 的天氣怎麼樣？",
+        "toolDescription": "獲取某個位置的當前天氣",
+        "cityNameDescription": "城市名稱"
+      },
+      "multiTurn": {
+        "system": "你是一名編碼助理。",
+        "userInitial": "請用 Python 寫一個對陣列進行排序的函式。",
+        "assistantExample": "這是一個簡單的排序函式： ```python\ndef sort_array(arr): return sorted(arr)\n```",
+        "userFollowUp": "現在將其按降序排序。"
+      },
+      "thinking": {
+        "question": "前 100 個質數之和是多少？"
+      },
+      "systemPrompt": {
+        "systemInstruction": "你是一名專注於分散式系統的高階軟體工程師。請使用行業最佳實踐簡潔作答，並在合適時提供程式碼示例。回覆請使用 Markdown 格式。",
+        "question": "如何實現斷路器模式？"
+      },
+      "streaming": {
+        "prompt": "給我講一個關於機器人學習繪畫的小故事。"
+      },
+      "vision": {
+        "system": "你是一個精確描述影像的助手。",
+        "userPrompt": "這張圖片顯示了什麼？",
+        "imageUrl": "https://upload.wikimedia.org/wikipedia/commons/thumb/4/47/PNG_transparency_demonstration_1.png/600px-PNG_transparency_demonstration_1.png"
+      },
+      "schemaCoercion": {
+        "userPrompt": "使用公制單位查詢東京的天氣幷包括每小時的細分。",
+        "toolDescription": "通過結構化選項獲取城市的天氣。",
+        "cityDescription": "要查詢的城市，例如“東京”或“紐約”。"
+      }
+    },
+    "openaiCompatibleLabel": "OpenAI 相容",
+    "anthropicCompatibleLabel": "Anthropic 相容",
+    "noTemplateForFormat": "沒有此格式的模板",
+    "translationFailed": "翻譯失敗：{error}",
+    "pipelineDebugger": "管道偵錯程式",
+    "translationPipeline": "翻譯管道",
+    "pipelineVisualization": "管道視覺化",
+    "pipelineVisualizationHint": "傳送訊息以檢視您的請求如何經過檢測 → 翻譯 → 提供商呼叫。",
+    "chatTesterDescription": "以特定客戶端格式傳送訊息並檢查翻譯管道的每個步驟。",
+    "chatTesterFlow": "客戶端請求 → 格式檢測 → OpenAI 中間格式 → 提供商格式 → 響應",
+    "clickStepToInspect": "單擊任意步驟即可檢查該階段的資料。",
+    "clientFormat": "客戶端格式",
+    "provider": "提供商",
+    "modelPlaceholder": "選擇或輸入模型名稱...",
+    "sendMessageToSeePipeline": "傳送訊息檢視翻譯管道",
+    "chatMessageHintPrefix": "您的訊息將被格式化為",
+    "chatMessageHintSuffix": "請求，通過管道進行翻譯，然後傳送給選定的提供商。",
+    "youWithFormat": "您 ({format})",
+    "assistant": "助理",
+    "typeMessage": "輸入訊息...",
+    "send": "傳送",
+    "clientRequest": "客戶端請求",
+    "clientRequestDescription": "您的客戶端傳送的請求正文",
+    "formatDetected": "檢測到格式",
+    "formatDetectedDescription": "OmniRoute 會根據請求結構自動識別 API 格式",
+    "openaiIntermediate": "OpenAI 中間格式",
+    "openaiIntermediateDescription": "所有格式都會先歸一化為 OpenAI 格式（通用橋接層）",
+    "providerFormat": "提供商格式",
+    "providerFormatDescription": "隨後再把 OpenAI 格式轉換為提供商原生格式",
+    "providerResponse": "提供商回應",
+    "providerResponseRawDescription": "來自提供商 API 的原始響應",
+    "providerResponseSseDescription": "來自提供商 API 的原始 SSE 流",
+    "unexpectedError": "發生意外錯誤",
+    "error": "錯誤",
+    "errorMessage": "錯誤：{message}",
+    "requestFailed": "請求失敗",
+    "noTextExtracted": "（未提取文字）",
+    "liveMonitorMemoryNote": "事件儲存在記憶體中，重啟後會丟失。",
+    "liveMonitorMemoryCapNote": "最多保留 200 個事件。",
+    "eventSourcesLabel": "事件來源：",
+    "eventSourceTranslatorPage": "• Translator 頁面（Chat Tester、Test Bench）",
+    "eventSourceMainPipeline": "• 主請求流水線（CLI/IDE/API 流量）",
+    "liveMonitorDescriptionPrefix": "這裡會顯示 API 呼叫流經 OmniRoute 時產生的翻譯事件。事件來自記憶體緩衝區（重啟後會重置）。使用",
+    "liveMonitorDescriptionSuffix": "，或外部 API 呼叫來生成事件。",
+    "streamTransformer": "流轉換器",
+    "modeDescriptionStreamTransformer": "通過響應轉換器執行聊天完成 SSE 流。",
+    "streamTransformerTitle": "響應流轉換器",
+    "streamTransformerDescription": "貼上聊天完成 SSE 流，通過 OmniRoute 的響應轉換器執行它，並在連線客戶端之前檢查發出的響應。* 事件。",
+    "loadTextSample": "載入文本樣本",
+    "loadToolSample": "載入工具呼叫示例",
+    "transformToResponses": "轉換為響應",
+    "rawChatSseInput": "原始聊天完成 SSE",
+    "transformedResponsesSse": "轉換後的響應 API SSE",
+    "noResultsYet": "還沒有結果",
+    "transformedEvents": "轉化事件",
+    "uniqueEventTypes": "獨特的事件型別",
+    "inputLines": "輸入線",
+    "outputLines": "輸出線",
+    "transformedEventTimeline": "轉變的事件時間線",
+    "transformerTimelineHint": "執行變壓器以按順序檢查發出的 response.output_* 事件。",
+    "eventType": "事件型別",
+    "eventPreview": "預覽",
+    "comboRouted": "組合路由",
+    "uniqueEndpoints": "獨特的端點",
+    "routeDetails": "路線詳情",
+    "comboBadge": "組合",
+    "routeEndpointLabel": "端點",
+    "routeConnectionLabel": "連線方式",
+    "scenarioVision": "視覺（影像理解）",
+    "scenarioSchemaCoercion": "模式強制（結構化輸出）",
+    "techniques": "技巧：",
+    "friendlyTitle": "翻譯器",
+    "friendlySubtitle": "使用您現有的應用程式與任何提供商 — 無需重寫程式碼。",
+    "conceptHeadline": "您的應用程式使用一個 API 的“語言”。翻譯器將其轉換為使用另一個提供者。",
+    "conceptDiagramAppLabel": "您的應用程式",
+    "conceptDiagramSourceLabel": "源格式",
+    "conceptDiagramHubLabel": "OpenAI (中心)",
+    "conceptDiagramTargetLabel": "目標提供者",
+    "conceptDiagramExampleApp": "例如 Anthropic SDK",
+    "conceptDiagramExampleSource": "Claude",
+    "conceptDiagramExampleTarget": "雙子座",
+    "conceptHowItWorksToggle": "它是如何工作的",
+    "conceptHowItWorksBody": "您的應用以其自己的格式傳送請求。翻譯器檢測該格式，通過 OpenAI 作為中介中心進行轉換（或在可用的情況下直接進行轉換），將其傳送到所選提供商，並將響應轉換回您應用的格式。",
+    "tabTranslate": "翻譯",
+    "tabMonitor": "監視器",
+    "tabTranslateAriaLabel": "前往翻譯選項卡",
+    "tabMonitorAriaLabel": "轉到監視器選項卡",
+    "simpleAppUsesLabel": "我的應用程式使用",
+    "simpleAppUsesHint": "您的應用程式使用的 API 格式（例如，Anthropic SDK = claude）。",
+    "simpleSendToLabel": "傳送到",
+    "simpleSendToHint": "實際將請求傳送到哪裡（在 OmniRoute 中連線的提供者）。",
+    "simpleStartWithLabel": "開始於",
+    "simpleStartWithExamplePlaceholder": "選擇一個現成的示例",
+    "simpleStartWithCustomOption": "貼上您的請求（高階）",
+    "simpleModeLabel": "模式",
+    "simpleModePreview": "僅預覽翻譯",
+    "simpleModeSend": "傳送並檢視響應",
+    "simpleAdvancedToggle": "高階",
+    "simpleInputPanelTitle": "輸入",
+    "simpleInputPanelHint": "自由文本訊息或現成示例",
+    "simpleResultPanelTitle": "翻譯 + 回覆",
+    "narratedDetected": "✓ 檢測到: {format}",
+    "narratedTranslating": "正在翻譯到 {target}...",
+    "narratedSending": "正在傳送到 {target}...",
+    "narratedSuccess": "→ 翻譯為 {target} · 響應時間 {latency}ms",
+    "narratedError": "失敗：{reason}",
+    "narratedSeeTranslatedJson": "檢視翻譯後的 JSON",
+    "narratedSeePipeline": "檢視管道",
+    "advancedSectionTitle": "高階",
+    "advancedSectionSubtitle": "原始 JSON、管道和技術工具。這裡的一切與舊標籤相同——只是重新組織了一下。",
+    "advancedRawJsonTitle": "原始 JSON（自動檢測 + Monaco）",
+    "advancedRawJsonSubtitle": "貼上一個 JSON 請求；格式會自動檢測。",
+    "advancedPipelineTitle": "OpenAI 中間管道",
+    "advancedPipelineSubtitle": "視覺化每個翻譯步驟（中心輻射模型）。",
+    "advancedStreamTransformTitle": "流轉換器 (聊天 → 響應 SSE)",
+    "advancedStreamTransformSubtitle": "將聊天完成 SSE 轉換為響應 API。",
+    "advancedTestBenchTitle": "測試平臺 (8 個場景)",
+    "advancedTestBenchSubtitle": "執行所有場景並報告通過/失敗 + 相容性 %。",
+    "advancedCompressionTitle": "壓縮預覽",
+    "advancedCompressionSubtitle": "估算不同壓縮模式下的令牌節省。",
+    "monitorOriginHint": "由 Translate 或主管道生成的事件會即時顯示在這裡。",
+    "monitorEmptyCta": "轉到翻譯選項卡併發送請求 — 它將出現在這裡。",
+    "monitorOpenTranslateButton": "前往翻譯",
+    "pipelineStepClientRequest": "客戶端請求",
+    "pipelineStepClientRequestDesc": "以客戶端格式接收到請求",
+    "pipelineStepFormatDetected": "檢測到的格式",
+    "pipelineStepFormatDetectedDesc": "自動檢測到的源格式",
+    "pipelineStepOpenAIIntermediate": "OpenAI 中級",
+    "pipelineStepOpenAIIntermediateDesc": "翻譯為 OpenAI hub 格式",
+    "pipelineStepProviderFormat": "提供者格式",
+    "pipelineStepProviderFormatDesc": "翻譯為提供者目標格式",
+    "pipelineStepProviderResponse": "提供者響應",
+    "pipelineStepProviderResponseDesc": "來自提供者的流式響應",
+    "conceptDiagramArrow1": "說話",
+    "conceptDiagramArrow2": "翻譯",
+    "conceptDiagramArrow3": "轉換",
+    "conceptDiagramExampleHub": "OpenAI",
+    "conceptDiagramHubTooltip": "翻譯器用於在沒有直接對映的格式之間轉換的中間樞紐。",
+    "conceptDiagramSourceTooltip": "您的應用程式使用的 API 格式（例如，Anthropic SDK = claude）。",
+    "conceptDiagramTargetTooltip": "請求將實際傳送到的提供者。",
+    "compressionEmptyHint": "__MISSING__:Fill in the input field on the Translate tab (Simple Controls or Raw JSON) to enable the preview.",
+    "compressionModeLabel": "__MISSING__:Compression mode",
+    "compressionPreviewButton": "__MISSING__:Preview Compression",
+    "compressionPreviewing": "__MISSING__:Previewing…"
+  },
+  "usage": {
+    "title": "用量",
+    "loggerTab": "記錄器",
+    "proxyTab": "代理",
+    "budgetManagement": "預算管理",
+    "budgetSaved": "已儲存預算限制",
+    "budgetSaveFailed": "未能節省預算",
+    "loadingBudgetData": "正在載入預算資料...",
+    "noApiKeysTitle": "沒有 API 金鑰",
+    "noApiKeysDescription": "首先新增 API 金鑰以設定預算限制。",
+    "apiKey": "API key",
+    "todaysSpend": "今天的花費",
+    "thisMonth": "本月",
+    "setLimits": "設定限制",
+    "dailyLimitUsd": "每日限額（美元）",
+    "monthlyLimitUsd": "每月限額（美元）",
+    "warningThresholdPercent": "警告閾值 (%)",
+    "dailyLimitPlaceholder": "例如5.00",
+    "monthlyLimitPlaceholder": "例如50.00",
+    "warningThresholdPlaceholder": "80",
+    "saveLimits": "儲存限制",
+    "budgetOk": "預算正常 — 剩餘 {remaining}",
+    "budgetExceeded": "超出預算 - 請求可能被阻止",
+    "totalRequests": "請求總數",
+    "noDataYet": "還沒有資料",
+    "latency": "延遲",
+    "latencyP50": "p50",
+    "latencyP95": "p95",
+    "latencyP99": "p99",
+    "promptCache": "提示快取",
+    "systemHealth": "系統健康狀況",
+    "entries": "條目",
+    "activeCount": "{count} 活躍",
+    "openCircuitBreakersDetected": "檢測到斷路器開路",
+    "hitRate": "命中率",
+    "hitsMisses": "命中/未命中",
+    "circuitBreakers": "斷路器",
+    "lockedIPs": "鎖定IP",
+    "lockoutsAutoRefreshHint": "每個模型速率限制鎖定 • 自動重新整理 10 秒",
+    "lockedCount": "{count, plural, one {# 個鎖定項} other {# 個鎖定項}}",
+    "timeLeft": "剩餘 {time}",
+    "howItWorks": "工作原理",
+    "howItWorksSubtitle": "瞭解評估如何驗證您的 LLM 回答",
+    "define": "定義",
+    "defineStepDescription": "使用包含、正規表示式或完全匹配等策略建立帶有輸入提示和預期輸出標準的測試用例。",
+    "run": "執行",
+    "runStepDescription": "通過 OmniRoute 對你的 LLM 端點執行測試用例。每個案例都會作為真實 API 請求傳送。",
+    "evaluate": "評估",
+    "evaluateStepDescription": "將響應與預期標準進行比較。檢視每種情況的通過/失敗情況以及延遲指標和詳細反饋。",
+    "evalsStrategyContainsLabel": "包含",
+    "evalsStrategyExactLabel": "精確匹配",
+    "evalsStrategyRegexLabel": "正則",
+    "evalsStrategyCustomLabel": "自定義邏輯",
+    "evalsStrategyContainsDescription": "檢查 LLM 輸出是否包含期望的子串。",
+    "evalsStrategyExactDescription": "檢查 LLM 輸出是否與期望值完全一致。",
+    "evalsStrategyRegexDescription": "通過正規表示式校驗 LLM 輸出。",
+    "evalsStrategyCustomDescription": "自定義評估邏輯(通過 JSON 配置)。",
+    "historyColumnSuiteName": "套件名稱",
+    "historyColumnTarget": "目標",
+    "historyColumnPassRate": "通過率",
+    "historyColumnAvgLatencyMs": "平均延遲",
+    "historyColumnCreatedAt": "執行時間",
+    "evalSuites": "評估套件",
+    "evalSuitesHint": "點選套件可檢視測試用例，然後執行以評估你的 LLM 端點",
+    "evalsLoading": "正在載入評估套件...",
+    "noEvalSuitesFound": "未找到評估套件",
+    "noEvalSuitesDescription": "評測套件可以通過 API 或程式碼定義。它們會使用包含、正規表示式、精確匹配和自定義函式等策略，根據預期結果驗證模型輸出。",
+    "columnCase": "案例",
+    "columnStatus": "狀態",
+    "columnLatency": "延遲",
+    "columnDetails": "詳情",
+    "columnModel": "模型",
+    "columnStrategy": "策略",
+    "columnExpected": "預期",
+    "statsSuites": "套件",
+    "statsTestCases": "測試用例",
+    "statsModels": "模型",
+    "statsCoverage": "覆蓋範圍",
+    "statsStrategiesCount": "{count} 策略",
+    "evaluationStrategies": "評估策略",
+    "modelsUnderTest": "測試中的模型",
+    "searchSuitesPlaceholder": "搜尋套件...",
+    "passSuffix": "通過",
+    "casesCount": "{count, plural, one {# 個案例} other {# 個案例}}",
+    "runEval": "執行評估",
+    "runAllSuites": "全部執行",
+    "runAllRunning": "正在全部執行...",
+    "runAllProgress": "正在執行 {current}/{total}：{name}",
+    "runAllFailedSuites": "{count, plural, one {# 個套件失敗} other {# 個套件失敗}}",
+    "runAllCompleted": "已執行 {suites} 個套件 — {passed} 個通過，{failed} 個失敗",
+    "runAllCompletedWithFailures": "已執行 {completed} 個套件；{failedSuites} 個執行失敗",
+    "runningProgress": "正在執行 {current}/{total}...",
+    "passRate": "通過率",
+    "summaryBreakdown": "{passed} 通過 · {failed} 失敗 · {total} 總計",
+    "passedIconLabel": "✅ 通過",
+    "failedIconLabel": "❌ 失敗",
+    "resultPassed": "已通過",
+    "resultFailed": "失敗",
+    "expandResult": "展開結果詳情",
+    "collapseResult": "摺疊結果詳情",
+    "detailsContains": "包含：“{term}”",
+    "detailsRegex": "正規表示式：{pattern}",
+    "detailsExpected": "預期：“{expected}”",
+    "expectedOutputLabel": "預期輸出",
+    "noResultsYet": "還沒有結果",
+    "testCasesCount": "測試用例 ({count})",
+    "noTestCasesDefined": "沒有定義測試用例",
+    "runEvalHint": "點選“執行評測”即可對你的 LLM 端點執行所有案例。每次測試都會通過 OmniRoute 傳送真實請求。",
+    "notifyNoTestCases": "沒有為此套件定義測試用例",
+    "notifyAllCasesPassed": "所有 {total} 案例均已通過 ✅",
+    "notifySomeCasesFailed": "{passed}/{total} 通過，{failed} 失敗",
+    "notifyEvalRunFailed": "評估執行失敗",
+    "notifyEvalTitle": "評估：{name}",
+    "modelEvals": "模型評估",
+    "evalsHeroDescription": "通過執行預定義評測套件來測試和驗證你的 LLM 端點。每個套件都包含多個測試用例，會經由 OmniRoute 傳送真實提示，並將響應與預期標準進行比較，幫助你發現迴歸、比較模型，並確保跨提供商的響應質量。",
+    "qualityValidation": "質量驗證",
+    "modelComparison": "模型對比",
+    "regressionDetection": "迴歸檢測",
+    "latencyBenchmarks": "延遲基準",
+    "modelLockouts": "模型鎖定",
+    "noLockouts": "當前沒有被鎖定的模型",
+    "activeSessions": "活躍會話",
+    "noSessions": "沒有活動會話",
+    "sessionsHint": "會話顯示為請求流經代理",
+    "sessionsTrackedHint": "通過請求指紋跟蹤 • 自動重新整理 5 秒",
+    "session": "會話",
+    "age": "年齡",
+    "requests": "請求",
+    "connection": "連線方式",
+    "durationMillisecondsShort": "{value} 毫秒",
+    "durationSecondsShort": "{value} 秒",
+    "durationMinutesShort": "{value} 分",
+    "durationHoursShort": "{value} 時",
+    "reasonSeparator": "-",
+    "notAvailableSymbol": "-",
+    "providerLimits": "提供商限制",
+    "noProviders": "沒有連線提供商",
+    "connectProvidersForQuota": "通過 OAuth 連線提供商，以跟蹤 API 配額限制和使用情況。",
+    "accountsCount": "{count, plural, one {# 個帳戶} other {# 個帳戶}}",
+    "filteredFromCount": "（從 {count} 過濾）",
+    "autoRefresh": "自動重新整理",
+    "refreshAll": "全部重新整理",
+    "loadingQuotas": "正在載入...",
+    "showMoreQuotas": "__MISSING__:Show {count} more",
+    "showLessQuotas": "__MISSING__:Show less",
+    "account": "帳戶",
+    "modelQuotas": "模型配額",
+    "lastUsed": "最近重新整理",
+    "actions": "操作",
+    "refreshQuota": "重新整理配額",
+    "today": "今天",
+    "tomorrow": "明天",
+    "dayTimeFormat": "{day}、{time}",
+    "inDuration": "在 {duration} 中",
+    "notApplicable": "不適用",
+    "rawPlanWithValue": "原始計劃：{plan}",
+    "noPlanFromProvider": "提供商沒有計劃",
+    "tokenExpiresIn": "令牌在 {time} 後過期",
+    "tokenExpired": "令牌已過期",
+    "noQuotaData": "無配額資料",
+    "cardExpand": "展開",
+    "cardCollapse": "收起",
+    "moreQuotas": "還有 {count} 項",
+    "ungrouped": "未分組",
+    "viewFlat": "平鋪檢視",
+    "viewByEnvironment": "按環境分組",
+    "noQuotaDataAvailable": "無可用配額資料",
+    "noAccountsForTierFilter": "未找到適用於層過濾器的帳戶",
+    "tierAll": "全部",
+    "tierEnterprise": "企業",
+    "tierTeam": "團隊",
+    "tierBusiness": "商務",
+    "tierUltra": "超",
+    "tierPro": "專業版",
+    "tierPlus": "加號",
+    "tierFree": "免費",
+    "tierLite": "輕量",
+    "tierUnknown": "未知",
+    "statTotal": "總計",
+    "statCritical": "嚴重",
+    "statAlert": "警報",
+    "statHealthy": "健康",
+    "filterPurchaseTypeLabel": "型別",
+    "filterTierLabel": "層級",
+    "purchaseAll": "全部",
+    "purchaseOauthSub": "訂閱",
+    "purchaseOauthFree": "OAuth 免費",
+    "purchaseApiKey": "API 金鑰",
+    "creditsLabel": "額度",
+    "creditBalanceHint": "剩餘額度",
+    "unlimitedLabel": "無限",
+    "refreshing": "重新整理中",
+    "resetsIn": "重置倒計時",
+    "editCutoffs": "編輯截止值",
+    "forceRefresh": "立即重新整理",
+    "suiteBuilderSaveFailed": "儲存套件失敗",
+    "clone": "克隆",
+    "exportSuite": "匯出",
+    "importSuite": "匯入",
+    "suiteExported": "套件已匯出",
+    "suiteExportFailed": "匯出套件失敗",
+    "suiteImportReady": "套件匯入已載入，等待檢查",
+    "suiteImportFailed": "匯入套件失敗",
+    "suiteImportInvalid": "無效的 eval 套件 JSON",
+    "suiteBuilderCloneSuffix": "副本",
+    "suiteBuilderImportedSuite": "已匯入套件",
+    "scorecardTitle": "記分卡",
+    "evalApiKey": "API key",
+    "scorecardPassRate": "通過率",
+    "targetTypeModel": "模型",
+    "actualOutputLabel": "實際輸出",
+    "evalTargetHint": "選擇要評估的模型或組合。",
+    "suiteBuilderDeleted": "Suite 刪除成功",
+    "suiteBuilderCaseCardHint": "定義輸入提示和預期輸出標準。",
+    "nextResetUtc": "下次重置（UTC）",
+    "scorecardHint": "彙總所有 Evaluation Suite 的通過率。",
+    "suiteLatestRunsHint": "此套件最近的評估執行。",
+    "saving": "正在儲存",
+    "suiteBuilderCaseModelLabel": "模型（可選）",
+    "evalControlsTitle": "Evaluation 控制項",
+    "suiteBuilderEditTitle": "編輯 Evaluation Suite",
+    "suiteBuilderCaseStrategyLabel": "驗證策略",
+    "notifySelectDifferentCompareTarget": "請選擇不同的比較目標",
+    "recentRunsHint": "正在顯示最近的評估執行。點選某次執行可檢視詳細結果。",
+    "evalCompareHint": "可選擇與第二個目標比較結果。",
+    "suiteBuilderCaseInvalid": "此 Case 存在驗證錯誤，請先修復再儲存。",
+    "historyEmpty": "暫無 Evaluation 歷史",
+    "suiteBuilderUpdated": "Suite 更新成功",
+    "resetInterval": "重置間隔",
+    "suiteBuilderCreateTitle": "建立評估套件",
+    "activePeriodSpend": "當前週期支出",
+    "evalApiKeyHint": "選擇用於評估請求的 API 金鑰。",
+    "evalCompareOptional": "對比（可選）",
+    "suiteBuilderDeleteFailed": "刪除套件失敗",
+    "suiteBuilderCaseSystemPromptPlaceholder": "可選系統指令...",
+    "scorecardCases": "Case",
+    "runCompletedWithScore": "Evaluation 已完成 — 通過率 {score}%",
+    "suiteBuilderCustomBadge": "自定義",
+    "targetSuiteDefaults": "Suite 預設值",
+    "suiteBuilderDeleteConfirm": "確定要刪除此套件嗎？此操作無法撤銷。",
+    "suiteBuilderNameLabel": "Suite 名稱",
+    "scorecardSuites": "套件",
+    "evalCompareTarget": "對比目標",
+    "suiteBuilderCaseModelPlaceholder": "例如 gpt-4o-mini",
+    "evalControlsHint": "配置評估目標和 API 金鑰，然後執行套件以驗證模型質量。",
+    "recentRunsTitle": "最近執行",
+    "suiteBuilderCaseSystemPromptLabel": "系統提示",
+    "suiteBuilderCaseExpectedPlaceholder": "例如 def fibonacci",
+    "suiteBuilderCaseExpectedPlaceholderContains": "例如 def fibonacci",
+    "suiteBuilderCaseExpectedPlaceholderExact": "貼上精確的預期響應",
+    "suiteBuilderCaseExpectedPlaceholderRegex": "例如 ^\\s*\\{.*\\}\\s*$",
+    "suiteBuilderCaseExpectedHintRegex": "使用不帶包裹斜槓的 JavaScript 正規表示式。",
+    "suiteBuilderNamePlaceholder": "例如 Coding Quality Suite",
+    "suiteBuilderAddCase": "新增 Case",
+    "cancel": "取消",
+    "evalTarget": "目標",
+    "suiteBuilderCaseNameLabel": "Case 名稱",
+    "weeklyLimitUsd": "每週限額（USD）",
+    "suiteBuilderCaseUserPromptPlaceholder": "例如用 Python 寫一個 fibonacci 函式",
+    "suiteBuilderNameRequired": "Suite 名稱為必填項",
+    "suiteBuilderCaseUserPromptLabel": "使用者 Prompt",
+    "daily": "每日",
+    "resultErrorLabel": "錯誤",
+    "suiteBuilderBuiltInBadge": "內建",
+    "suiteBuilderCaseCardTitle": "測試用例",
+    "suiteBuilderDuplicateCase": "複製",
+    "weeklyLimitPlaceholder": "例如 50.00",
+    "suiteBuilderCaseTagsHint": "用於組織測試用例的逗號分隔標籤。",
+    "notifyEvalRunFailedWithReason": "評估失敗：{reason}",
+    "weekly": "每週",
+    "runEvalRunning": "正在執行 Evaluation...",
+    "delete": "刪除",
+    "resetTimeUtc": "重置時間（UTC）",
+    "evalApiKeyAuto": "自動（使用預設值）",
+    "suiteBuilderDescriptionPlaceholder": "可選：描述此套件測試的內容...",
+    "targetComparisonTitle": "目標對比",
+    "save": "儲存",
+    "suiteBuilderCreated": "Suite 建立成功",
+    "suiteLatestRuns": "最新執行",
+    "suiteBuilderCaseExpectedLabel": "期望值",
+    "historyLatency": "延遲",
+    "suiteBuilderCaseTagsPlaceholder": "例如 coding, python",
+    "targetTypeCombo": "組合",
+    "scorecardPassed": "已通過",
+    "suiteBuilderCaseTagsLabel": "標籤",
+    "suiteBuilderNewSuite": "新建 Suite",
+    "notifyEvalLoadFailed": "載入評估資料失敗",
+    "notConfigured": "未配置",
+    "suiteBuilderCaseNamePlaceholder": "例如 Python 斐波那契測試",
+    "intervalLabel": "間隔",
+    "suiteBuilderCreateAction": "建立套件",
+    "suiteBuilderCasesHint": "每個用例都會發送一個提示並驗證響應。",
+    "suiteBuilderUpdatedAt": "更新時間",
+    "errorBadge": "錯誤",
+    "suiteBuilderCasesTitle": "測試用例",
+    "edit": "編輯",
+    "monthly": "每月",
+    "suiteBuilderCasesRequired": "至少需要一個測試用例",
+    "weeklyLimitSummary": "每週預算限額摘要",
+    "suiteBuilderDescriptionLabel": "描述",
+    "targetComparisonHint": "在目標之間並排比較評估結果。",
+    "compareCompletedWithScore": "對比已完成 — 通過率 {score}%",
+    "staleQuotaTooltip": "上次重新整理失敗 — 顯示快取資料",
+    "quotaThresholdLabel": "最小剩餘時間",
+    "quotaCutoffsColumnHelp": "當剩餘配額降至此百分比或以下時停止請求。",
+    "quotaCutoffsButtonDefault": "預設",
+    "quotaCutoffsButtonHelp": "編輯此帳戶的最小剩餘配額截止值。",
+    "quotaCutoffsButtonDisabled": "此帳戶尚無可用的配額視窗。",
+    "deactivateAccount": "__MISSING__:Deactivate account (stop routing)",
+    "activateAccount": "__MISSING__:Activate account (resume routing)",
+    "accountActivated": "__MISSING__:Account activated",
+    "accountDeactivated": "__MISSING__:Account deactivated",
+    "toggleActiveFailed": "__MISSING__:Failed to update account status",
+    "quotaCutoffsTitle": "{name} ({provider}) 的配額截止",
+    "quotaCutoffsExplainer": "覆蓋停止為每個配額視窗選擇此帳戶的最小剩餘配額百分比。留空以繼承提供程式預設值。",
+    "quotaCutoffsDefaultHint": "預設最小剩餘量：{default}%",
+    "quotaCutoffsResetAll": "全部重置",
+    "quotaCutoffsNoWindows": "此帳戶尚無可用的配額視窗。",
+    "quotaThresholdInvalid": "輸入 0 到 100 之間的整數。",
+    "budgetKpiToday": "今天",
+    "budgetKpiThisMonth": "這個月",
+    "budgetKpiProjEom": "專案結束",
+    "budgetKpiBlocked": "被阻止",
+    "budgetKpiAtRisk": "有風險",
+    "budgetKpiActiveKeys": "活動鍵",
+    "budgetSearchKeysPlaceholder": "搜尋鍵...",
+    "budgetSortPctUsed": "排序：使用百分比 ↓",
+    "budgetSortTodayDollar": "排序：今日$ ↓",
+    "budgetSortMonthDollar": "排序: 月 $ ↓",
+    "budgetSortNameAZ": "排序： 名稱 (A–Z)",
+    "budgetColDailyLim": "每日限制",
+    "budgetColMonthlyLim": "每月限制",
+    "budgetColUsedPct": "使用百分比",
+    "percentUsed": "已使用 {pct}%",
+    "budgetLoading": "載入中...",
+    "budgetNoKeysMatch": "沒有鍵匹配過濾器",
+    "budgetLinearExtrapolation": "線性外推法",
+    "budgetThisMonthSoFar": "這個月到目前為止",
+    "budgetProjectedEndOfMonth": "預計月底",
+    "budgetByProvider": "按提供商",
+    "budgetDailyDollar": "每日 $",
+    "budgetWeeklyDollar": "每週 $",
+    "budgetMonthlyDollar": "每月 $",
+    "budgetWarnAtPct": "警告%",
+    "quotaAlerts": "配額提醒",
+    "quotaTableRefreshing": "⟳ 清爽...",
+    "noSpendLast30Days": "過去 30 天內沒有消費",
+    "updatedShort": "更新於",
+    "lastRefreshed": "上次重新整理",
+    "providerQuota": "提供商配額",
+    "providerQuotaHomeHint": "已連線帳戶的即時狀態"
+  },
+  "modals": {
+    "waitingAuth": "等待授權",
+    "verificationUrl": "驗證網址",
+    "yourCode": "你的程式碼",
+    "remoteAccess": "遠端訪問：",
+    "connectedSuccess": "連線成功！",
+    "connectionFailed": "連線失敗",
+    "chooseAuthMethod": "選擇您的身份驗證方法：",
+    "awsBuilderId": "AWS 構建器 ID",
+    "awsIamIdentity": "AWS IAM 身份中心",
+    "googleAccount": "Google 帳戶",
+    "githubAccount": "GitHub 帳戶",
+    "importToken": "匯入令牌",
+    "pasteToken": "從 Kiro IDE 貼上重新整理令牌。",
+    "awsRegion": "AWS 區域",
+    "autoDetecting": "自動檢測令牌...",
+    "readingFromCache": "從 AWS SSO 快取中讀取",
+    "readingFromCursor": "從 Cursor IDE 資料庫讀取",
+    "initializing": "正在初始化...",
+    "pricingConfig": "定價配置",
+    "loadingPricing": "正在載入定價資料...",
+    "pricingRatesFormat": "定價格式",
+    "noPricingData": "無可用定價資料",
+    "noModelsFound": "沒有找到模型"
+  },
+  "loggers": {
+    "allProviders": "所有提供商",
+    "allModels": "所有模型",
+    "allAccounts": "所有帳戶",
+    "allApiKeys": "所有 API 金鑰",
+    "allTypes": "所有型別",
+    "allLevels": "所有級別",
+    "modelAZ": "模型 A-Z",
+    "modelZA": "Z-A型",
+    "loadingLogs": "正在載入日誌...",
+    "loadingProxyLogs": "正在載入代理日誌...",
+    "noLogEntries": "未找到日誌條目",
+    "noPayloadData": "此日誌條目沒有可用的有效負載資料。",
+    "proxyEvent": "代理事件",
+    "proxy": "代理",
+    "level": "等級",
+    "directNative": "直接（本地）",
+    "combo": "組合",
+    "inputTokens": "我：",
+    "outputTokens": "哦："
+  },
+  "stats": {
+    "usageOverview": "使用概述",
+    "outputTokens": "輸出 Tokens",
+    "totalCost": "總成本",
+    "usageByModel": "按模型使用",
+    "usageByAccount": "按帳戶使用情況",
+    "failedToLoad": "無法載入使用情況統計資訊。",
+    "tokenHealth": "令牌健康",
+    "totalOAuth": "總 OAuth",
+    "healthy": "健康",
+    "warning": "警告",
+    "errored": "出錯了",
+    "lastCheck": "最後檢查",
+    "noData": "無資料",
+    "share": "分享",
+    "unableToLoad": "無法載入系統指標",
+    "product": "產品",
+    "resources": "資源",
+    "company": "公司"
+  },
+  "auth": {
+    "welcome": "歡迎",
+    "signIn": "登入",
+    "enterPassword": "輸入您的密碼以繼續",
+    "password": "密碼",
+    "unifiedProxy": "統一 AI API 代理",
+    "unifiedAiApiProxy": "統一 AI API 代理",
+    "unifiedAiApiProxyDesc": "通過單個端點將請求路由到多個 AI 提供商。內建負載均衡、故障轉移和使用情況跟蹤。",
+    "passwordNotEnabled": "未啟用密碼保護",
+    "loading": "正在載入...",
+    "invalidPassword": "密碼無效",
+    "errorOccurredRetry": "發生錯誤。請再試一次。",
+    "configureInstance": "開始配置你的 OmniRoute 例項",
+    "runOnboardingWizard": "執行入門嚮導來設定您的密碼並連線您的第一個 AI 提供商。",
+    "startOnboarding": "開始引導",
+    "secureYourInstance": "保護您的例項",
+    "setPasswordDescription": "設定密碼以保護您的儀表板並保護您的 API 端點免遭未經授權的訪問。",
+    "configurePassword": "配置密碼",
+    "continue": "繼續",
+    "windowWillClose": "該視窗將自動關閉...",
+    "closeTabNow": "您現在可以關閉此選項卡。",
+    "copyUrlManual": "請複製位址列中的 URL 並將其貼上到應用程式中。",
+    "accessDeniedDescription": "您無權訪問此資源。檢查您的 API 金鑰或聯絡管理員。",
+    "goToDashboard": "轉到儀表板",
+    "featureMultiProviderTitle": "多提供商",
+    "featureMultiProviderDesc": "OpenAI、Anthropic、Google 等",
+    "featureLoadBalancingTitle": "負載均衡",
+    "featureLoadBalancingDesc": "智慧分配請求",
+    "featureUsageTrackingTitle": "使用情況追蹤",
+    "featureUsageTrackingDesc": "監控成本和 Tokens",
+    "resetPassword": "重置密碼",
+    "resetDescription": "選擇一種方法來恢復對儀表板的訪問許可權",
+    "stopServer": "停止 OmniRoute 伺服器",
+    "processing": "處理中...",
+    "pleaseWait": "我們正在完成授權，請稍候。",
+    "authSuccess": "授權成功！",
+    "copyUrl": "複製此網址",
+    "accessDenied": "訪問被拒絕",
+    "methodCliTitle": "方法 1：CLI 重置",
+    "methodCliDescription": "在執行 OmniRoute 的伺服器上執行以下命令：",
+    "methodCliHint": "這將提示您設定新密碼。必須首先停止伺服器。",
+    "methodManualTitle": "方法 2：手動重置",
+    "methodManualDescription": "從資料庫中刪除密碼並在啟動時設定新密碼：",
+    "setPasswordInYour": "在以下位置設定新密碼：",
+    "fileLabelSuffix": "檔案：",
+    "newPasswordPlaceholder": "your_new_password",
+    "deleteSettingsFile": "刪除",
+    "orRemovePasswordHashField": "或刪除 passwordHash 欄位",
+    "restartServerWithNewPassword": "重啟伺服器，系統會使用新密碼",
+    "backToLogin": "返回登入",
+    "forgotPassword": "忘記密碼？",
+    "defaultPasswordHint": "預設密碼：CHANGEME（除非已設定 INITIAL_PASSWORD）",
+    "Authorization": "Authorization",
+    "Content-Disposition": "Content-Disposition",
+    "waitingForAuthorization": "正在等待授權...",
+    "waitingForGoogleAuthorization": "正在等待 Google 授權...",
+    "waitingForOpenAIAuthorization": "正在等待 OpenAI 授權...",
+    "waitingForAntigravityAuthorization": "正在等待 Antigravity 授權...",
+    "waitingForQoderAuthorization": "正在等待 Qoder 授權...",
+    "exchangingCodeForTokens": "正在用授權碼換取 Tokens...",
+    "nodeIncompatibleTitle": "不相容的 Node.js 版本",
+    "nodeIncompatibleDesc": "你當前執行的是 Node.js {version}，它不在 OmniRoute 支援的安全執行時策略內。請使用已打補丁的 Node.js 20.x 或 22.x LTS 版本。",
+    "nodeIncompatibleFixLabel": "修復：安裝已打補丁的 Node.js 22 LTS 版本",
+    "nodeIncompatibleHint": "OmniRoute 要求 Node.js 22.22.2+（22.x LTS）或 24.0.0+（24.x LTS）。為保證穩定性，建議使用 Node 24 LTS。"
+  },
+  "landing": {
+    "brandName": "OmniRoute",
+    "navigateHome": "導航至主頁",
+    "toggleMenu": "切換選單",
+    "featuresLink": "特點",
+    "docsLink": "文件",
+    "github": "GitHub",
+    "versionLive": "v1.0 現已上線",
+    "oneEndpoint": "一個端點",
+    "allProviders": "所有 AI 提供商",
+    "heroDescription": "帶 Web 儀表板的 AI 端點代理，是 CLIProxyAPI 的 JavaScript 版本。可與 Claude Code、OpenAI Codex、Cline、RooCode 等 CLI 工具無縫配合。",
+    "getStarted": "開始使用",
+    "viewOnGithub": "在 GitHub 上檢視",
+    "powerfulFeatures": "強大的功能",
+    "featuresSubtitle": "在一個地方管理 AI 基礎設施所需的一切，專為規模化而構建。",
+    "featureUnifiedEndpointTitle": "統一端點",
+    "featureUnifiedEndpointDesc": "通過單一標準 API URL 訪問所有提供商。",
+    "featureEasySetupTitle": "輕鬆設定",
+    "featureEasySetupDesc": "使用 npx 命令在幾分鐘內啟動並執行。",
+    "featureModelFallbackTitle": "模型回退",
+    "featureModelFallbackDesc": "發生故障或高延遲時自動切換提供商。",
+    "featureUsageTrackingTitle": "使用情況追蹤",
+    "featureUsageTrackingDesc": "所有模型的詳細分析和成本監控。",
+    "featureOAuthApiKeysTitle": "OAuth 與 API 金鑰",
+    "featureOAuthApiKeysDesc": "在一個保管庫中安全地管理憑據。",
+    "featureCloudSyncTitle": "雲同步",
+    "featureCloudSyncDesc": "立即跨裝置同步您的配置。",
+    "featureCliSupportTitle": "CLI 支援",
+    "featureCliSupportDesc": "適用於 Claude Code、Codex、Cline、Cursor 等工具。",
+    "featureDashboardTitle": "儀表板",
+    "featureDashboardDesc": "用於即時流量分析的視覺化儀表板。",
+    "howItWorks": "OmniRoute 工作原理",
+    "howItWorksDescription": "資料從您的應用程式通過我們的智慧路由層無縫流向最適合該工作的提供商。",
+    "howItWorksStep1Title": "1. CLI 和 SDK",
+    "howItWorksStep1Description": "您的請求從您最喜歡的工具或我們的統一 SDK 開始。只需更改基本 URL 即可。",
+    "howItWorksStep2Title": "2. OmniRoute 中樞",
+    "howItWorksStep2Description": "我們的引擎分析提示、檢查提供商的執行狀況以及最低延遲或成本的路線。",
+    "howItWorksStep3Title": "3. AI 提供商",
+    "howItWorksStep3Description": "請求會被立即轉發給 OpenAI、Anthropic、Gemini 或其他提供商完成處理。",
+    "getStartedIn30Seconds": "30 秒內開始",
+    "getStartedDescription": "安裝 OmniRoute，通過 Web 儀表板配置你的提供商，然後開始路由 AI 請求。",
+    "installOmniRoute": "安裝 OmniRoute",
+    "installStepDescription": "執行 npx 命令立即啟動伺服器",
+    "openDashboard": "開啟儀表板",
+    "openDashboardStepDescription": "通過 Web 介面配置提供商和 API 金鑰",
+    "routeRequests": "路由請求",
+    "routeRequestsStepDescription": "將您的 CLI 工具指向 {endpoint}",
+    "terminal": "終端",
+    "copy": "複製",
+    "copied": "✓ 已複製",
+    "startingOmniRoute": "正在啟動 OmniRoute...",
+    "serverRunningOnLabel": "伺服器運行於",
+    "dashboardLabel": "儀表板",
+    "readyToRoute": "已準備好開始路由！ ✓",
+    "configureProvidersNote": "📝 在儀表板中配置提供商或使用環境變數",
+    "dataLocation": "資料位置：",
+    "dataLocationMacLinux": "macOS/Linux：",
+    "dataLocationWindows": "Windows：",
+    "product": "產品",
+    "dashboardLink": "儀表板",
+    "changelog": "變更日誌",
+    "resources": "資源",
+    "documentation": "文件",
+    "npm": "npm",
+    "legal": "法律",
+    "mitLicense": "MIT 許可證",
+    "footerTagline": "AI 生成的統一端點。輕鬆連線、路由和管理您的 AI 提供商。",
+    "copyright": "© {year} OmniRoute。保留所有權利。",
+    "flowToolClaudeCode": "Claude Code",
+    "flowToolOpenAICodex": "OpenAI Codex",
+    "flowToolCline": "Cline",
+    "flowToolCursor": "Cursor",
+    "flowProviderOpenAI": "OpenAI",
+    "flowProviderAnthropic": "Anthropic",
+    "flowProviderGemini": "Gemini",
+    "flowProviderGithubCopilot": "GitHub Copilot",
+    "interactiveDiagram": "可互動流程圖",
+    "ctaTitle": "準備好簡化你的 AI 基礎設施了嗎？",
+    "ctaDescription": "加入更多開發者，一起用 OmniRoute 簡化 AI 整合流程。開源且可免費開始使用。",
+    "startFree": "免費開始",
+    "readDocumentation": "閱讀文件"
+  },
+  "docs": {
+    "title": "文件",
+    "quickStart": "快速入門",
+    "deploymentGuides": "部署指南",
+    "features": "特點",
+    "supportedProviders": "支援的提供商",
+    "supportedProvidersToc": "提供商",
+    "commonUseCases": "常見用例",
+    "clientCompatibility": "客戶端相容性",
+    "protocolsToc": "協議",
+    "apiReference": "API參考",
+    "managementApiReference": "管理 API 參考",
+    "managementApiDescription": "用於代理登錄檔、作用域繫結以及舊版代理遷移的自動化介面。",
+    "method": "方法",
+    "path": "路徑",
+    "notes": "註釋",
+    "modelPrefixes": "模型字首",
+    "prefix": "字首",
+    "troubleshooting": "故障排除",
+    "supportsChat": "支援聊天和響應端點。",
+    "oauthAutoRefresh": "支援自動重新整理 Token 的 OAuth 連線。",
+    "fullStreaming": "所有模型都支援完整流式輸出。",
+    "docsLabel": "文件",
+    "docsHeroDescription": "面向多提供商 LLM 的 AI 閘道器。一個端點即可統一接入 OpenAI、Anthropic、Gemini、GitHub Copilot、Claude Code、Cursor 等 20+ 提供商。",
+    "openDashboard": "開啟儀表板",
+    "endpointPage": "端點頁面",
+    "github": "GitHub",
+    "reportIssue": "報告問題",
+    "onThisPage": "在此頁面上",
+    "documentationVersion": "文件 - v{version}",
+    "quickStartStep1Title": "1.安裝並執行",
+    "quickStartStep1Prefix": "執行",
+    "quickStartStep1Middle": "或者從 GitHub 克隆並執行",
+    "quickStartStep2Title": "2. 建立API金鑰",
+    "quickStartStep2Text": "轉至端點 -> 註冊金鑰。每個環境生成一個金鑰。",
+    "quickStartStep3Title": "3. 連線提供商",
+    "quickStartStep3Text": "通過 OAuth 登入、API 金鑰或免費套餐自動接入來新增提供商帳戶。",
+    "quickStartStep4Title": "4. 設定客戶端基本 URL",
+    "quickStartStep4Prefix": "將您的 IDE 或 API 客戶端指向",
+    "quickStartStep4Suffix": "例如使用提供商字首",
+    "deploySetupTitle": "設定指南",
+    "deploySetupText": "OmniRoute 的分步安裝、環境配置和首次執行演練。",
+    "deployElectronTitle": "電子桌面",
+    "deployElectronText": "在 Windows、macOS 和 Linux 上將 OmniRoute 作為本機桌面應用程式執行。",
+    "deployDockerTitle": "碼頭工人",
+    "deployDockerText": "使用 Docker Compose 進行容器化部署；為生產堆疊和 Kubernetes 做好準備。",
+    "deployVmTitle": "虛擬機器",
+    "deployVmText": "在任何 Linux VM 上自託管。包括 systemd 單元、日誌輪換和備份工具。",
+    "deployFlyTitle": "飛行大作戰",
+    "deployFlyText": "使用一個 Fly.toml 和一個部署命令部署到 Fly.io 邊緣執行時。",
+    "deployPwaTitle": "漸進式網頁應用",
+    "deployPwaText": "在 Android、iOS 和桌面瀏覽器上將 OmniRoute 作為漸進式 Web 應用程式安裝。",
+    "deployTermuxTitle": "Termux（Android）",
+    "deployTermuxText": "通過 Termux 在 Android 上以無介面模式執行 OmniRoute，並從移動瀏覽器訪問儀表盤。",
+    "featureRoutingTitle": "多提供商路由",
+    "featureRoutingText": "通過單一 OpenAI 相容端點將請求路由到 30+ AI 提供商，支援聊天、Responses、音訊和影像 API。",
+    "featureCombosTitle": "組合和平衡",
+    "featureCombosText": "使用後備鏈和平衡策略建立模型組合：迴圈、優先順序、隨機、最少使用和成本最佳化。",
+    "featureUsageTitle": "使用情況和成本跟蹤",
+    "featureUsageText": "即時令牌計數、每個提供商/模型的成本計算以及按 API 金鑰和帳戶劃分的詳細使用情況細分。",
+    "featureAnalyticsTitle": "分析儀表板",
+    "featureAnalyticsText": "視覺化分析，包含隨時間變化的請求、令牌、錯誤、延遲、成本和模型受歡迎程度的圖表。",
+    "featureHealthTitle": "健康監測",
+    "featureHealthText": "即時健康檢查、提供商狀態、斷路器狀態以及具有指數退避功能的自動速率限制檢測。",
+    "featureCliTitle": "CLI工具",
+    "featureCliText": "可在儀表板中管理 IDE 配置、匯出/匯入備份、發現 Codex 配置檔案並修改設定。",
+    "featureSecurityTitle": "安全與策略",
+    "featureSecurityText": "API 金鑰身份驗證、IP 過濾、提示注入防護、域策略、會話管理和稽核日誌記錄。",
+    "featureCloudSyncTitle": "雲同步",
+    "featureCloudSyncText": "將配置同步到 Cloudflare Workers，以便通過加密憑據和自動故障轉移實現遠端訪問。",
+    "providersAcrossConnectionTypes": "跨三種連線型別的 {count} 提供商。",
+    "manageProviders": "管理提供商",
+    "providersCount": "{count} 提供商",
+    "providerTypeFree": "免費套餐",
+    "providerTypeOAuth": "OAuth",
+    "providerTypeApiKey": "API金鑰",
+    "useCaseSingleEndpointTitle": "許多提供商的單一端點",
+    "useCaseSingleEndpointText": "將客戶端統一指向一個 Base URL，再通過模型字首進行路由（例如：gh/、cc/、kr/、openai/）。",
+    "useCaseFallbackTitle": "使用組合進行回退和模型切換",
+    "useCaseFallbackText": "在儀表板中建立組合模型，並在提供商內部輪換時保持客戶端配置穩定。",
+    "useCaseUsageVisibilityTitle": "使用情況、成本和除錯可見性",
+    "useCaseUsageVisibilityText": "在“使用情況”和“分析”選項卡中按提供商、帳戶和 API 金鑰跟蹤令牌和成本。",
+    "clientCherryStudioTitle": "櫻桃工作室",
+    "baseUrlLabel": "基礎 URL",
+    "chatEndpointLabel": "聊天端點",
+    "modelRecommendationLabel": "模型建議：顯式字首",
+    "clientCodexTitle": "Codex / GitHub Copilot 模型",
+    "clientCodexBullet1": "使用模型 ID",
+    "clientCodexBullet2": "Codex 系列模型會自動路由到",
+    "clientCodexBullet3": "非法典模型繼續",
+    "clientCursorTitle": "Cursor IDE",
+    "clientCursorBullet1": "使用",
+    "clientCursorBullet1Suffix": "Cursor 模型字首。",
+    "clientCursorBullet2": "OAuth 連線方式：在 Providers 頁面中登入。",
+    "clientClaudeTitle": "Claude Code / Antigravity",
+    "clientClaudeBullet1Prefix": "使用",
+    "clientClaudeBullet1Middle": "（Claude）或",
+    "clientClaudeBullet1Suffix": "（Antigravity）字首。",
+    "clientWindsurfTitle": "Windsurf",
+    "clientWindsurfBullet1": "將 OmniRoute 用作 OpenAI 相容的 base URL，並保留顯式提供商字首，以實現確定性路由。",
+    "clientWindsurfBullet2": "常規流量將模型指向 `/v1/chat/completions`，併為 Codex 風格流程保留 `/v1/responses`。",
+    "clientWindsurfBullet3": "使用儀表盤 -> CLI 工具獲取現成的 Windsurf 配置指南。",
+    "clientClineTitle": "Cline",
+    "clientClineBullet1": "Cline 最適合使用顯式的提供商/模型字首，這樣路由器無需猜測後端。",
+    "clientClineBullet2": "常規模型使用 `/v1/chat/completions`，並在不同帳戶間複用同一個 OmniRoute base URL。",
+    "clientClineBullet3": "除錯 Cline 執行時問題前，請使用提供商儀表盤驗證 OAuth/API 金鑰。",
+    "clientKimiTitle": "Kimi Coding",
+    "clientKimiBullet1": "輪換底層帳戶或提供商組合時，將 OmniRoute 用作穩定的 base URL。",
+    "clientKimiBullet2": "在編碼流程中優先使用帶字首的模型，讓回退和審計軌跡保持明確。",
+    "clientKimiBullet3": "當你希望為使用工具的客戶端啟用原生 Responses 風格路由時，請使用 `/v1/responses`。",
+    "protocolsTitle": "協議：MCP 與 A2A",
+    "protocolsDescription": "除了 OpenAI 相容 API 之外，OmniRoute 還提供兩類操作協議：用於工具執行的 MCP，以及用於智慧體協作工作流的 A2A。",
+    "protocolMcpTitle": "MCP（Model Context Protocol）",
+    "protocolMcpDesc": "通過 stdio 使用 MCP，讓客戶端發現並呼叫 OmniRoute 工具，同時具備審計可見性。",
+    "protocolMcpStep1": "使用 `omniroute --mcp` 啟動 MCP 傳輸。",
+    "protocolMcpStep2": "將你的 MCP 客戶端指向 stdio 傳輸。",
+    "protocolMcpStep3": "呼叫 `omniroute_get_health` 和 `omniroute_list_combos` 驗證連通性。",
+    "protocolA2aTitle": "A2A（Agent2Agent）",
+    "protocolA2aDesc": "使用 A2A JSON-RPC 以同步方式或通過 SSE 流式方式提交任務。",
+    "protocolA2aStep1": "讀取 `/.well-known/agent.json` 進行智慧體發現。",
+    "protocolA2aStep2": "向 `POST /a2a` 傳送 `message/send` 或 `message/stream` 請求。",
+    "protocolA2aStep3": "通過 `tasks/get` 和 `tasks/cancel` 管理任務生命週期。",
+    "protocolTroubleshootingTitle": "協議故障排查",
+    "protocolTroubleshooting1": "如果 MCP 狀態為離線，請確認 stdio 程序正在執行，且心跳檔案持續更新。",
+    "protocolTroubleshooting2": "如果 A2A 任務長時間停留在 `working`，請檢查 `/api/a2a/tasks/:id` 和流事件中是否出現終態。",
+    "protocolTroubleshooting3": "可使用 `/dashboard/mcp` 和 `/dashboard/a2a` 進行執行控制並檢視審計資訊。",
+    "endpointChatNote": "OpenAI 相容聊天端點（預設）。",
+    "endpointResponsesNote": "Responses API 端點（Codex、o 系列）。",
+    "endpointModelsNote": "所有連線的提供商的模型目錄。",
+    "endpointAudioNote": "音訊轉錄（Deepgram、AssemblyAI）。",
+    "endpointSpeechNote": "語音生成（ElevenLabs、OpenAI TTS）。",
+    "endpointEmbeddingsNote": "文本嵌入生成（OpenAI、Cohere、Voyage）。",
+    "endpointImagesNote": "影像生成（NanoBanana）。",
+    "endpointRewriteChatNote": "為沒有 /v1 的客戶端重寫幫助程式。",
+    "endpointRewriteResponsesNote": "重寫不帶 /v1 的響應幫助程式。",
+    "endpointRewriteModelsNote": "重寫模型發現助手，無需 /v1。",
+    "mgmtProxiesListNote": "列出已儲存的代理註冊項（支援分頁）。",
+    "mgmtProxiesCreateNote": "在登錄檔中建立可複用的代理項。",
+    "mgmtProxiesHealthNote": "基於代理日誌獲取每個已儲存代理的 24 小時 / 滾動健康指標。",
+    "mgmtProxiesBulkAssignNote": "一次請求即可為多個 scope ID 統一分配或清除同一個代理。",
+    "mgmtAssignmentsListNote": "按 scope、scope_id 或 proxy_id 列出代理繫結關係。",
+    "mgmtAssignmentsUpdateNote": "為 global/provider/account/combo 作用域分配或清除代理。",
+    "mgmtLegacyMigrationNote": "將舊版 proxyConfig 對映匯入為登錄檔繫結關係。",
+    "modelPrefixesDescriptionStart": "在模型名稱之前使用提供商字首可路由到特定提供商。示例：",
+    "modelPrefixesDescriptionEnd": "會被路由到 GitHub Copilot。",
+    "provider": "提供商",
+    "type": "型別",
+    "troubleshootingModelRouting": "如果客戶端在模型路由上失敗，請使用顯式 provider/model（例如：gh/gpt-5.1-codex）。",
+    "troubleshootingAmbiguousModels": "如果您收到不明確的模型錯誤，請選擇提供商字首而不是裸模型 ID。",
+    "troubleshootingCodexFamily": "對於 GitHub Codex 系列模型，請保持模型名為 `gh/codex-model`；路由器會自動選擇 `/responses`。",
+    "troubleshootingTestConnection": "在從 IDE 或外部客戶端進行測試之前，請使用儀表板 > 提供商 > 測試連線。",
+    "troubleshootingCircuitBreaker": "如果提供商顯示斷路器已開啟，請等待冷卻或檢視執行狀況頁面以瞭解詳細資訊。",
+    "troubleshootingOAuth": "對於 OAuth 提供商，如果 Token 過期，請重新認證，並檢查提供商卡片上的狀態指示器。",
+    "endpointCompletionsNote": "用於文本生成的舊版 completions 端點。",
+    "endpointModerationsNote": "內容稽核和安全分類。",
+    "endpointRerankNote": "用於檢索增強生成的文件重排序（Cohere、Jina）。",
+    "endpointSearchNote": "通過 5 個提供商進行網頁搜尋（Serper、Brave、Exa、Tavily、Perplexity）。",
+    "endpointSearchAnalyticsNote": "搜尋請求的分析和指標。",
+    "endpointVideoNote": "影片生成（ComfyUI、SD WebUI 工作流）。",
+    "endpointMusicNote": "通過 ComfyUI 工作流生成音樂。",
+    "endpointMessagesNote": "Anthropic 原生 messages 端點。",
+    "endpointCountTokensNote": "統計給定訊息載荷的 token 數。",
+    "endpointFilesNote": "用於多模態輸入的檔案上傳。",
+    "endpointBatchesNote": "用於批次 API 請求的 Batch 處理。",
+    "endpointWsNote": "用於即時流式傳輸的 WebSocket 端點。",
+    "mgmtProvidersListNote": "列出所有已註冊的提供商連線。",
+    "mgmtProvidersCreateNote": "建立新的提供商連線。",
+    "mgmtProvidersUpdateNote": "更新現有提供商連線。",
+    "mgmtProvidersDeleteNote": "刪除提供商連線。",
+    "mgmtProvidersTestNote": "測試提供商的連線和認證。",
+    "mgmtProvidersModelsNote": "列出特定提供商的可用模型。",
+    "mgmtSettingsGetNote": "獲取當前應用設定。",
+    "mgmtSettingsUpdateNote": "更新應用設定。",
+    "mgmtPayloadRulesGetNote": "獲取載荷轉換規則。",
+    "mgmtPayloadRulesUpdateNote": "更新載荷轉換規則。",
+    "mcpToolsTitle": "MCP 工具",
+    "mcpToolsDescription": "OmniRoute 通過 Model Context Protocol 暴露 {count} 個工具，用於 Agent 編排。",
+    "mcpToolsCount": "{count} 個工具",
+    "mcpToolsToc": "MCP 工具",
+    "mcpToolsRoutingTitle": "路由與發現",
+    "mcpToolsRoutingDesc": "健康檢查、組合管理、配額監控、成本報告和模型目錄訪問。",
+    "mcpToolsOperationsTitle": "運維與策略",
+    "mcpToolsOperationsDesc": "路由模擬、預算保護、策略切換、韌性配置和提供商指標。",
+    "mcpToolsCacheTitle": "快取管理",
+    "mcpToolsCacheDesc": "檢視快取統計，並清空語義快取或簽名快取。",
+    "mcpToolsCompressionTitle": "壓縮發動機",
+    "mcpToolsCompressionDesc": "配置 RTK/Brotli 壓縮、交換引擎並按組合檢查壓縮分析。",
+    "mcpToolsOneProxyTitle": "1代理/隧道",
+    "mcpToolsOneProxyDesc": "管理出站代理、輪換住宅 IP 並檢查代理執行狀況。",
+    "mcpToolsMemoryTitle": "記憶",
+    "mcpToolsMemoryDesc": "搜尋、新增和清除持久化對話記憶條目。",
+    "mcpToolsSkillsTitle": "技能",
+    "mcpToolsSkillsDesc": "列出、啟用、執行和監控自定義技能執行。",
+    "featureAutoComboTitle": "Auto-Combo",
+    "featureAutoComboText": "根據你連線的提供商、使用模式和模型能力，自動建立最佳化組合。",
+    "featureSearchTitle": "網頁搜尋",
+    "featureSearchText": "整合 5 個提供商的網頁搜尋（Serper、Brave、Exa、Tavily、Perplexity），幷包含分析和成本跟蹤。",
+    "featureMemoryTitle": "記憶系統",
+    "featureMemoryText": "跨會話提供提取、注入、檢索和摘要能力的持久化對話記憶。",
+    "featureSkillsTitle": "技能框架",
+    "featureSkillsText": "可擴充套件技能系統，支援內建和自定義技能、沙箱執行、請求攔截和上下文注入。",
+    "featureAcpTitle": "Agent 通訊",
+    "featureAcpText": "Agent Communication Protocol (ACP) 登錄檔，用於管理 Agent 間工作流和工具編排。",
+    "protocolAcpTitle": "ACP（Agent 通訊）",
+    "protocolAcpDesc": "通過 ACP 登錄檔註冊和管理 Agent，用於 Agent 間通訊和工具共享。",
+    "protocolAcpStep1": "前往儀表盤 → Agents 檢視已註冊的 ACP Agent。",
+    "protocolAcpStep2": "使用能力和端點配置註冊新的 Agent。",
+    "protocolAcpStep3": "使用 CLI 工具配置 Agent 通訊通道。"
+  },
+  "legal": {
+    "privacyPolicy": "隱私政策",
+    "termsOfService": "服務條款",
+    "providerConfigurations": "提供商配置",
+    "apiKeys": "API 金鑰",
+    "usageLogs": "使用日誌",
+    "applicationSettings": "應用程式設定",
+    "viewExportAnalytics": "檢視和匯出使用情況分析",
+    "clearHistory": "隨時清除使用記錄",
+    "configureRetention": "配置日誌保留策略",
+    "backupRestore": "備份和恢復您的資料庫",
+    "privacyMetadataTitle": "隱私政策 | OmniRoute",
+    "privacyMetadataDescription": "OmniRoute AI API 代理路由器的隱私政策。",
+    "termsMetadataTitle": "服務條款 | OmniRoute",
+    "termsMetadataDescription": "OmniRoute AI API 代理路由器的服務條款。",
+    "backToHome": "返回首頁",
+    "lastUpdated": "最後更新：{date}",
+    "policyLastUpdatedDate": "2026 年 2 月 13 日",
+    "listSeparator": "-",
+    "questionsVisit": "有問題嗎？訪問我們的",
+    "githubRepository": "GitHub 倉庫",
+    "privacySection1Title": "1. 本地優先架構",
+    "privacySection1Text": "OmniRoute 是一款本地優先的應用。所有資料處理和儲存都只發生在你的裝置上，不存在集中式伺服器收集你的資訊。",
+    "privacySection2Title": "2. 我們儲存的資料",
+    "privacyDataStoredIn": "以下資料儲存在本地",
+    "privacyDataProviderConfigurationsDesc": "連線 URL、提供商型別和優先順序設定",
+    "privacyDataApiKeysDesc": "已加密並存儲在本地，用於與 AI 提供商進行身份驗證",
+    "privacyDataUsageLogsDesc": "請求計數、令牌使用情況、模型名稱、時間戳和響應時間",
+    "privacyDataApplicationSettingsDesc": "主題偏好、路由策略和組合配置",
+    "privacySection3Title": "3. 無遙測",
+    "privacySection3Text": "OmniRoute 不收集遙測、分析或崩潰報告。不會向我們或任何第三方傳送資料。你的使用模式、API 呼叫和配置都會保持私密。",
+    "privacySection4Title": "4. 第三方 AI 提供商",
+    "privacySection4Text": "當你通過 OmniRoute 發起 API 呼叫時，請求會被轉發到你配置的 AI 提供商（例如：OpenAI、Anthropic、Google）。這些提供商有各自的隱私政策，請查閱：",
+    "privacyOpenAiPolicy": "OpenAI 隱私政策",
+    "privacyAnthropicPolicy": "Anthropic 隱私政策",
+    "privacyGooglePolicy": "Google 隱私政策",
+    "privacySection5Title": "5. 雲同步（可選）",
+    "privacySection5Text": "如果您啟用可選的雲同步功能，提供商配置和 API 金鑰可能會傳輸到配置的雲端點。此功能預設處於停用狀態，需要明確選擇加入。",
+    "privacySection6Title": "6. 日誌記錄",
+    "privacyLoggingIntro": "可以通過儀表板設定配置請求日誌。您可以：",
+    "privacySection7Title": "7. 您的權利",
+    "privacySection7TextStart": "由於所有資料都儲存在本地，因此您擁有完全的控制權。您可以隨時刪除您的資料，方法是刪除",
+    "privacySection7TextEnd": "目錄或使用儀表板中的資料庫備份和恢復功能。",
+    "termsSection1Title": "1. 概述",
+    "termsSection1Text": "OmniRoute 是一款本地優先的 AI API 代理路由器，完全執行在你的裝置上。它通過負載均衡、故障回退和用量跟蹤，將請求路由到多個 AI 提供商。",
+    "termsSection2Title": "2. 使用者的責任",
+    "termsResponsibilityApiKeys": "你需要自行負責管理自己的 API 金鑰，以及第三方 AI 提供商（OpenAI、Anthropic、Google 等）的憑證。",
+    "termsResponsibilityCompliance": "你必須遵守通過 OmniRoute 訪問的每個 AI 提供商的服務條款。",
+    "termsResponsibilitySecurity": "你需要負責本地 OmniRoute 安裝的安全，包括設定密碼和限制網路訪問。",
+    "termsSection3Title": "3. 工作原理",
+    "termsSection3Text": "OmniRoute 充當中間代理。傳送到 OmniRoute 的 API 呼叫會被轉換後轉發到你配置的 AI 提供商。除必要的協議轉換外，OmniRoute 不會修改你的請求或響應內容。",
+    "termsSection4Title": "4. 資料處理",
+    "termsDataStoredLocally": "所有資料都儲存在你本機上的 SQLite 資料庫中。",
+    "termsNoTransmission": "除非你明確啟用雲同步功能，否則 OmniRoute 不會將任何資料傳輸到外部伺服器。",
+    "termsDataLocationText": "使用日誌、API 金鑰和配置儲存在",
+    "termsSection5Title": "5. 免責宣告",
+    "termsSection5Text": "OmniRoute 按“原樣”提供，不附帶任何形式的保證。我們不對 API 使用成本、服務中斷或資料丟失造成的任何損失負責。請始終為配置做好備份。",
+    "termsSection6Title": "6. 開源",
+    "termsSection6Text": "OmniRoute 是開源軟體。您可以根據其許可條款自由檢查、修改和分發它。"
+  },
+  "agents": {
+    "title": "CLI 智慧體",
+    "description": "發現系統中已安裝的 CLI 智慧體，並支援新增自定義智慧體以便自動檢測。",
+    "refresh": "重新整理",
+    "installed": "已安裝",
+    "notFound": "未找到",
+    "builtIn": "內建",
+    "custom": "自定義",
+    "remove": "移除",
+    "addCustomAgent": "新增自定義智慧體",
+    "addCustomAgentDesc": "註冊任意 CLI 工具用於檢測，重新整理時會自動掃描。",
+    "agentName": "智慧體名稱",
+    "binaryName": "執行檔名",
+    "versionCommand": "版本命令",
+    "spawnArgs": "啟動引數",
+    "addAgent": "新增智慧體",
+    "scanning": "正在掃描系統中的 CLI 智慧體...",
+    "opencodeIntegration": "OpenCode 整合",
+    "opencodeDetected": "已檢測到 opencode {version}",
+    "opencodeDesc": "生成可直接使用的 {configFile}，其中會填入你的 OmniRoute Base URL 和全部可用模型。將它放到專案根目錄後執行 {command} 即可。",
+    "downloadConfig": "下載 {file}",
+    "downloaded": "已下載！",
+    "setupGuideTitle": "設定指南",
+    "openCliTools": "開啟 CLI Tools",
+    "setupGuideDetectCliTitle": "檢測已安裝的 CLI",
+    "setupGuideDetectCliDesc": "安裝或更新 CLI 後點擊“重新整理”，讓 OmniRoute 重新掃描執行檔和版本資訊。",
+    "setupGuideCustomAgentTitle": "註冊自定義執行檔",
+    "setupGuideCustomAgentDesc": "如果你的 CLI 不在內建列表中，請使用“新增自定義智慧體”，並填寫執行檔名與版本命令。",
+    "setupGuideCommandMissingTitle": "修復“command not found”",
+    "setupGuideCommandMissingDesc": "請確認 CLI 命令已存在於 PATH 中，重新開啟一個終端會話後再次點選“重新整理”。",
+    "cliToolsRedirectTitle": "CLI 工具已移至專用頁面",
+    "cliToolsRedirectDesc": "在 CLI Tools 頁面管理 Agent CLI 整合與重定向。",
+    "spawnArgsPlaceholder": "啟動引數佔位符",
+    "binaryNamePlaceholder": "二進位制名稱佔位符",
+    "versionCommandPlaceholder": "版本命令佔位符",
+    "architectureTitle": "架構",
+    "flowLocalBinary": "本地二進位制",
+    "flowOmniRoute": "OmniRoute",
+    "agentNamePlaceholder": "Agent 名稱佔位符",
+    "architectureDescription": "瞭解 OmniRoute 如何在客戶端、路由器和 Agent 目標之間轉發請求。",
+    "flowExecute": "執行",
+    "flowSpawn": "啟動",
+    "cliToolsRedirectCta": "開啟 CLI Tools",
+    "comparisonTitle": "CLI 工具與 Agent 目標有什麼區別？",
+    "comparisonCliToolsLabel": "CLI 工具頁面",
+    "comparisonCliToolsTitle": "你的 IDE 通過 OmniRoute 傳送請求",
+    "comparisonCliToolsDesc": "配置 Claude Code、Codex、Cursor 和其他 IDE，將 OmniRoute 用作它們的 API base URL。OmniRoute 作為代理，將請求路由到你配置的提供商。",
+    "comparisonAgentsLabel": "當前頁面（Agent 目標）",
+    "comparisonAgentsTitle": "OmniRoute 將請求傳送到本地 CLI 工具",
+    "comparisonAgentsDesc": "OmniRoute 可以啟動本地 CLI 二進位制檔案（claude、codex、goose）作為執行後端。CLI 工具使用自己的認證處理請求並返回結果。",
+    "comparisonSummary": "簡而言之：CLI 工具 = 你配置工具指向 OmniRoute。Agent 目標 = OmniRoute 將工具用作端點。",
+    "agentUseCaseHint": "可通過 ACP 協議用作執行目標",
+    "flowDiagramClient": "客戶端應用",
+    "flowDiagramClientDesc": "SDK、API 或上游服務",
+    "flowDiagramOmniRoute": "OmniRoute",
+    "flowDiagramOmniRouteDesc": "接收請求並選擇目標",
+    "flowDiagramSpawn": "啟動程序",
+    "flowDiagramSpawnDesc": "通過 stdio 啟動 CLI 二進位制檔案",
+    "flowDiagramCli": "CLI 代理",
+    "flowDiagramCliDesc": "使用自身認證/模型處理",
+    "fingerprintSettingsHint": "CLI 指紋匹配（偽裝成特定 CLI 工具的請求）可在以下位置配置：",
+    "settingsRoutingLink": "設定/路由",
+    "openSettings": "設定",
+    "copyRawUrlTitle": "將原始 URL 複製到剪貼簿",
+    "copied": "複製了！",
+    "copyUrl": "複製網址",
+    "startHere": "從這裡開始",
+    "badgeNew": "新",
+    "viewOnGithub": "在 GitHub 上檢視",
+    "howToUse": "如何使用",
+    "browseAllSkillsOnGithub": "瀏覽 GitHub 上的所有技能",
+    "apiSkills": "API技能",
+    "cliSkills": "CLI 技能",
+    "apiSkillsSubtitle": "{count} 個技能 — 通過 REST / HTTP 控制 OmniRoute",
+    "cliSkillsSubtitle": "{count} 個技能 — 通過 omniroute 終端執行檔控制 OmniRoute",
+    "howToUseStep1": "在你想讓代理瞭解的技能上點選 <bold>{copyUrl}</bold>。",
+    "howToUseStep2": "在你的 AI 代理(Claude、Cursor、Cline…)中輸入:",
+    "howToUseStep2Code": "在 [pasted-url] 處使用該技能",
+    "howToUseStep3": "代理會獲取 SKILL.md 並學習 OmniRoute 的 API 或 CLI — 無需手動文件。"
+  },
+  "cloudAgents": {
+    "title": "雲代理",
+    "description": "管理自主編碼代理（Jules、Devin、Codex Cloud）",
+    "loading": "正在載入任務...",
+    "aboutTitle": "關於雲代理",
+    "aboutDescription": "雲代理是遠端人工智慧編碼助手，可以自主執行任務。它們的工作方式與本地 CLI 代理不同 - 您可以通過 OmniRoute 的 API 與它們互動。",
+    "howItWorksTitle": "工作原理：",
+    "howItWorksDesc": "建立任務 → 代理分析並提出計劃 → 您批准 → 代理執行 → 結果返回",
+    "newTaskTitle": "建立新任務",
+    "newTaskDescription": "使用雲代理啟動新任務",
+    "selectAgent": "選擇代理",
+    "taskDescription": "任務描述",
+    "taskDescriptionPlaceholder": "描述您希望代理做什麼...",
+    "startTask": "啟動任務",
+    "tasks": "任務",
+    "taskDetail": "任務詳情",
+    "noTasks": "還沒有任務。建立一個以開始使用。",
+    "noTasksTitle": "暫無任務",
+    "noTasksDesc": "建立你的第一個任務以開始使用。",
+    "tasksTab": "任務",
+    "agentsTab": "代理",
+    "settingsTab": "設定",
+    "agentsEnabled": "已啟用",
+    "agentsDisabled": "已停用",
+    "filterAllProviders": "所有提供商",
+    "filterAll": "全部",
+    "autoRefreshing": "自動重新整理中",
+    "viewPR": "檢視 Pull Request",
+    "connected": "已連線",
+    "notConnected": "未連線",
+    "configure": "配置",
+    "settingsTitle": "雲代理設定",
+    "settingsDesc": "為雲代理配置本地偏好。",
+    "settingEnableAgents": "啟用雲代理",
+    "settingEnableAgentsDesc": "允許 OmniRoute 編排自主編碼代理。",
+    "settingAutoPR": "自動建立 PR",
+    "settingAutoPRDesc": "任務完成後自動建立包含變更的 Pull Request。",
+    "settingRequireApproval": "需要方案審批",
+    "settingRequireApprovalDesc": "代理執行所提方案前始終等待手動批准。",
+    "untitledTask": "無標題任務",
+    "created": "已建立",
+    "conversation": "對話",
+    "result": "結果",
+    "error": "錯誤",
+    "planReady": "計劃已準備好等待批准",
+    "approvePlan": "批准計劃",
+    "rejectPlan": "拒絕並取消",
+    "sendMessagePlaceholder": "給代理發訊息...",
+    "cancel": "取消",
+    "delete": "刪除",
+    "selectTaskPrompt": "選擇任務檢視詳細資訊",
+    "statusPending": "待定",
+    "statusRunning": "跑步",
+    "statusWaitingApproval": "等待批准",
+    "statusCompleted": "已完成",
+    "statusFailed": "失敗",
+    "statusCancelled": "取消",
+    "repositoryName": "儲存庫名稱",
+    "repositoryUrl": "儲存庫網址",
+    "branch": "分公司"
+  },
+  "templateNames": {
+    "simple-chat": "簡單對話",
+    "streaming": "流式響應",
+    "system-prompt": "系統提示詞",
+    "thinking": "思考模式",
+    "tool-calling": "工具呼叫",
+    "multi-turn": "多輪對話",
+    "vision": "願景",
+    "schema-coercion": "模式強制"
+  },
+  "templateDescriptions": {
+    "simple-chat": "帶系統訊息的基礎對話模板",
+    "streaming": "用於流式響應的模板",
+    "system-prompt": "帶自定義系統提示詞的模板",
+    "thinking": "帶推理/思考預算的模板",
+    "tool-calling": "用於工具/函式呼叫的模板",
+    "multi-turn": "用於多輪對話的模板",
+    "vision": "具有影像輸入的多模態模板",
+    "schema-coercion": "結構化輸出/JSON 模式實施"
+  },
+  "templatePayloads": {
+    "simpleChat": {
+      "system": "你是一名樂於助人的 AI 助手。",
+      "userGreeting": "你好！今天我可以幫你做些什麼？"
+    },
+    "streaming": {
+      "prompt": "寫一個關於"
+    },
+    "systemPrompt": {
+      "question": "生命的意義是什麼？",
+      "systemInstruction": "請給出一個深思熟慮、帶有哲學意味的回答。"
+    },
+    "thinking": {
+      "question": "請解釋量子計算"
+    },
+    "toolCalling": {
+      "cityNameDescription": "需要查詢天氣的城市名稱",
+      "toolDescription": "獲取某個地點的當前天氣",
+      "userWeather": "東京現在天氣怎麼樣？"
+    },
+    "multiTurn": {
+      "system": "你是一名樂於助人的助手。",
+      "assistantExample": "我很樂意幫助你處理這件事。",
+      "userInitial": "我需要幫助來處理",
+      "userFollowUp": "你可以再詳細說明一下嗎？"
+    }
+  },
+  "cache": {
+    "title": "快取管理",
+    "description": "監控提供商側 Prompt Cache 的效率，以及本地 Semantic Cache 的響應複用情況。",
+    "refresh": "重新整理",
+    "clearAll": "清空語義快取",
+    "memoryEntries": "記憶體條目",
+    "memoryEntriesSub": "記憶體 LRU",
+    "dbEntries": "資料庫條目",
+    "dbEntriesSub": "已持久化（SQLite）",
+    "cacheHits": "快取命中數",
+    "cacheHitsSub": "共 {total} 次",
+    "tokensSaved": "節省的 Tokens",
+    "tokensSavedSub": "根據命中次數估算",
+    "hitRate": "命中率",
+    "performance": "快取效能",
+    "autoRefresh": "每 {seconds} 秒自動重新整理",
+    "hits": "命中次數",
+    "misses": "未命中次數",
+    "total": "總計",
+    "behavior": "快取行為",
+    "behaviorDeterministic": "僅快取 temperature=0 的非流式請求。",
+    "behaviorBypass": "通過請求頭 {header} 繞過快取。",
+    "behaviorTwoTier": "雙層儲存：記憶體 LRU（快速）+ SQLite（重啟後持久化）。",
+    "behaviorTtl": "預設 TTL：30 分鐘。可通過 {envVar} 配置。",
+    "idempotency": "冪等層",
+    "activeDedupKeys": "活躍去重鍵",
+    "dedupWindow": "去重視窗",
+    "clearSuccess": "語義快取已清空，已刪除 {count} 條記錄。",
+    "clearError": "清除快取失敗。",
+    "unavailable": "快取不可用",
+    "unavailableDesc": "無法獲取快取統計資訊。請確保伺服器正在執行。",
+    "loadingCacheAria": "正在載入快取",
+    "promptCache": "Prompt 快取（提供商側）",
+    "semanticCache": "語義快取",
+    "promptCacheSectionDesc": "基於 usage history 展示提供商側 prompt cache 的活躍度，讓你區分哪些請求真的啟用了 cache control，以及實際複用了多少輸入。",
+    "promptTrendDesc": "按小時展示最近 24 小時的請求量、快取覆蓋率，以及 cache read token 的變化。",
+    "cachedRequests": "快取請求數",
+    "cachedRequests24h": "24 小時快取請求數",
+    "cacheHitRate": "快取命中率",
+    "cacheRate": "快取率",
+    "cacheRateDesc": "佔總請求數",
+    "cachedTokens": "快取讀取 Token",
+    "cacheCreationTokens": "快取寫入 Token",
+    "cacheMetrics": "Prompt 快取指標",
+    "withCacheControl": "含快取控制",
+    "cachedTokensRead": "從快取讀取",
+    "cacheCreationWrite": "寫入快取",
+    "cacheReuseRatio": "快取複用率",
+    "cacheReuseRatioDesc": "快取讀取 token / 輸入 token 總量",
+    "estCostSaved": "預估節省費用",
+    "lastUpdated": "上次更新",
+    "hoursTracked": "個小時",
+    "busiestHour": "最繁忙時段",
+    "peakCacheRate": "最高快取率",
+    "trendHour": "小時",
+    "activityVolume": "活動量",
+    "requestsShort": "請求",
+    "inputShort": "輸入",
+    "cachedShort": "已快取",
+    "writeShort": "寫入",
+    "resetting": "正在重置...",
+    "resetMetrics": "重置指標",
+    "byProvider": "按提供商分類",
+    "providerCacheRateDesc": "每個提供商都會直接展示總輸入 token、cache read token 和 cache write token，方便你對照原始資料判斷比率是否可靠。",
+    "provider": "提供商",
+    "requests": "請求數",
+    "inputTokens": "輸入 Tokens 總計",
+    "cachedTokensCol": "快取讀取",
+    "cacheCreation": "快取寫入",
+    "trend24h": "快取趨勢（24 小時）",
+    "peakCached": "峰值快取量",
+    "cached": "已快取",
+    "overview": "概覽",
+    "tableProvider": "提供商",
+    "tableModel": "模型",
+    "performanceTitle": "效能",
+    "semanticCacheSectionDesc": "OmniRoute 自己維護的確定性響應快取。開啟後，重複的非流式、temperature=0 請求可以直接在本地命中，不再訪問上游 provider。",
+    "semanticCacheDisabledDesc": "Semantic Cache 當前已停用。重新在設定中開啟之前，OmniRoute 不會再做本地響應複用。",
+    "semanticEntriesDesc": "這裡展示的是儲存在 SQLite 裡的 semantic cache 記錄，不包含 provider-side prompt cache 的活動。",
+    "searchEntries": "搜尋條目...",
+    "search": "搜尋",
+    "loading": "載入中...",
+    "entriesLoadError": "載入語義快取條目失敗。",
+    "noEntries": "未找到快取條目",
+    "noPromptCacheData": "暫時還沒有記錄到提供商側 prompt cache 活動。",
+    "noTrendData": "最近 24 小時還沒有記錄到 prompt cache 活動。",
+    "signature": "簽名",
+    "model": "模型",
+    "created": "建立時間",
+    "expires": "到期時間",
+    "actions": "操作",
+    "deduplicatedRequests": "去重請求數",
+    "savedCalls": "節省的 API 呼叫次數",
+    "totalProcessed": "已處理請求總數",
+    "disabled": "已停用",
+    "totalRequests": "總請求數",
+    "reasoningCache": "推理回放",
+    "reasoningCacheDesc": "為多輪工具呼叫流程保留模型思考內容",
+    "reasoningEntries": "活動條目",
+    "reasoningReplayRate": "回放率",
+    "reasoningReplays": "總回放次數",
+    "reasoningCharsCached": "已快取字元數",
+    "reasoningMisses": "快取未命中",
+    "reasoningByProvider": "按提供商",
+    "reasoningByModel": "按模型",
+    "reasoningRecentEntries": "最近條目",
+    "reasoningToolCallId": "工具呼叫 ID",
+    "reasoningChars": "字元數",
+    "reasoningAge": "時間",
+    "reasoningView": "檢視",
+    "reasoningDetail": "推理內容",
+    "reasoningBehavior": "行為",
+    "reasoningBehaviorCapture": "從流式響應中捕獲 reasoning_content",
+    "reasoningBehaviorReplay": "當客戶端省略時，在下一輪重新注入",
+    "reasoningBehaviorFallback": "記憶體優先，並使用 SQLite 作為崩潰恢復後備",
+    "reasoningBehaviorTtl": "TTL：2 小時 | 最大條目：2,000（記憶體）",
+    "reasoningBehaviorModels": "支援：DeepSeek、Kimi、Qwen-Thinking、GLM",
+    "reasoningClearAll": "清空推理快取",
+    "reasoningClearSuccess": "已清除 {count} 個推理快取條目",
+    "reasoningClearError": "清除推理快取失敗",
+    "reasoningNoData": "尚未快取推理條目。思考模型使用工具呼叫時會顯示條目。",
+    "cachePerformanceRetry": "重試",
+    "cachePerformanceHitRate": "命中率",
+    "cachePerformanceAvgLatency": "平均延遲（毫秒）",
+    "cachePerformanceP95Latency": "p95 延遲（毫秒）",
+    "retry": "重試",
+    "reasoningAvgChars": "平均字元數",
+    "tableShare": "佔比",
+    "justNow": "剛剛",
+    "minutesAgo": "{minutes} 分鐘前",
+    "hoursAgo": "{hours} 小時前",
+    "daysAgo": "{days} 天前",
+    "entries": "條目"
+  },
+  "proxyConfigModal": {
+    "levelGlobal": "全域性",
+    "levelProvider": "供應商",
+    "levelCombo": "組合",
+    "levelKey": "金鑰",
+    "levelDirect": "直接（無代理）",
+    "titleGlobal": "全域性代理配置",
+    "titleLevel": "{level} 代理 — {label}",
+    "loading": "正在載入代理配置...",
+    "inheritingFrom": "繼承自",
+    "source": "來源",
+    "savedProxy": "已儲存代理",
+    "custom": "自定義",
+    "selectSavedProxyPlaceholder": "選擇已儲存的代理...",
+    "proxyType": "代理型別",
+    "host": "主機",
+    "hostPlaceholder": "1.2.3.4 或 proxy.example.com",
+    "port": "埠",
+    "authOptional": "認證（可選）",
+    "username": "使用者名稱",
+    "usernamePlaceholder": "使用者名稱",
+    "password": "密碼",
+    "passwordPlaceholder": "密碼",
+    "connected": "已連線",
+    "ip": "IP：",
+    "connectionFailed": "連線失敗",
+    "testConnection": "測試連線",
+    "clear": "清除",
+    "cancel": "取消",
+    "save": "儲存",
+    "errorSelectSavedProxy": "請先選擇已儲存的代理。",
+    "errorSelectProxyFirst": "請先選擇代理。",
+    "errorProxyNotFound": "所選代理未找到。",
+    "errorClearSavedProxy": "清除已儲存代理失敗",
+    "errorSaveProxy": "儲存代理配置失敗",
+    "errorClearProxy": "清除代理配置失敗",
+    "errorSocks5Hidden": "SOCKS5 已配置但已隱藏，因為 NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=false。"
+  },
+  "oauthModal": {
+    "title": "連線 {providerName}",
+    "waiting": "等待授權",
+    "completeAuthInPopup": "在彈出視窗中完成授權。",
+    "popupClosedHint": "如果彈出視窗關閉而沒有重定向回來（例如 Qoder），此對話方塊將自動切換到手動 URL 輸入模式。",
+    "popupBlocked": "彈出視窗被阻止？手動輸入 URL",
+    "deviceCodeVisitUrl": "訪問下面的 URL 並輸入程式碼：",
+    "deviceCodeVerificationUrl": "驗證 URL",
+    "deviceCodeYourCode": "您的程式碼",
+    "deviceCodeWaiting": "等待授權...",
+    "googleOAuthWarning": "遠端訪問 + Google OAuth：預設憑據僅接受重定向到 <code>localhost</code>。授權後，您的瀏覽器將嘗試開啟 <code>localhost</code> — 複製該完整 URL 並貼上到下方。要完全遠端使用而無需此手動步驟，<a>配置您自己的 OAuth 憑據</a>。",
+    "remoteAccessInfo": "遠端訪問：由於您是遠端訪問 OmniRoute，授權後您會看到一個錯誤頁面（localhost 未找到）。這是正常的 — 只需從瀏覽器位址列複製完整 URL 並貼上到下方。",
+    "step1OpenUrl": "步驟 1：在瀏覽器中開啟此 URL",
+    "copy": "複製",
+    "step2PasteCallback": "步驟 2：在此處貼上回撥 URL 或授權程式碼",
+    "step2Hint": "授權後，貼上完整的回撥 URL。對於 Claude Code 和 Cline，您也可以直接貼上身份驗證程式碼，例如 <code>code#state</code>。",
+    "connect": "連線",
+    "cancel": "取消",
+    "success": "連線成功！",
+    "successMessage": "您的 {providerName} 帳戶已連線。",
+    "done": "完成",
+    "error": "連線失敗",
+    "tryAgain": "重試"
+  },
+  "cursorAuthModal": {
+    "title": "連線 Cursor IDE",
+    "autoDetecting": "自動檢測令牌中...",
+    "readingFromCursor": "正在從 Cursor IDE 或 cursor-agent 讀取",
+    "tokensAutoDetected": "已成功從 Cursor IDE 自動檢測到令牌！",
+    "cursorNotDetected": "未檢測到 Cursor IDE。請手動貼上您的令牌。",
+    "accessToken": "訪問令牌",
+    "required": "*",
+    "accessTokenPlaceholder": "訪問令牌將自動填充...",
+    "machineId": "機器 ID",
+    "optional": "（可選）",
+    "machineIdPlaceholder": "機器 ID 將自動填充...",
+    "importing": "正在匯入...",
+    "importToken": "匯入令牌",
+    "cancel": "取消",
+    "errorAutoDetect": "無法自動檢測令牌",
+    "errorAutoDetectFailed": "自動檢測令牌失敗",
+    "errorEnterToken": "請輸入訪問令牌",
+    "errorImportFailed": "匯入失敗"
+  },
+  "pricingModal": {
+    "title": "定價配置",
+    "loading": "正在載入定價資料...",
+    "pricingRatesFormat": "定價費率格式",
+    "ratesDescription": "所有費率均為 <strong>每百萬令牌美元</strong>（$/1M 令牌）。示例：輸入費率為 2.50 表示每 1,000,000 個輸入令牌收費 2.50 美元。",
+    "model": "模型",
+    "input": "輸入",
+    "output": "輸出",
+    "cached": "快取",
+    "reasoning": "推理",
+    "cacheCreation": "快取建立",
+    "noPricingData": "無定價資料可用",
+    "resetToDefaults": "重置為預設值",
+    "cancel": "取消",
+    "saving": "正在儲存...",
+    "saveChanges": "儲存更改",
+    "resetConfirm": "將所有定價重置為預設值？此操作無法撤銷。",
+    "errorSaveFailed": "儲存定價失敗",
+    "errorResetFailed": "重置定價失敗"
+  },
+  "proxyRegistry": {
+    "title": "代理登錄檔",
+    "description": "儲存可重用的代理並跟蹤分配。",
+    "importLegacy": "匯入舊版",
+    "bulkAssign": "批次分配",
+    "addProxy": "新增代理",
+    "loading": "正在載入代理...",
+    "noProxies": "暫無儲存的代理。",
+    "tableName": "名稱",
+    "tableEndpoint": "端點",
+    "tableStatus": "狀態",
+    "tableHealth": "健康狀態（24小時）",
+    "tableUsage": "使用情況",
+    "tableActions": "操作",
+    "test": "測試",
+    "edit": "編輯",
+    "delete": "刪除",
+    "modalCreateTitle": "建立代理",
+    "modalEditTitle": "編輯代理",
+    "labelName": "名稱",
+    "labelType": "型別",
+    "labelFamily": "__MISSING__:IP family",
+    "familyAuto": "__MISSING__:Auto (dual-stack)",
+    "familyIpv4": "__MISSING__:IPv4 only",
+    "familyIpv6": "__MISSING__:IPv6 only",
+    "familyHint": "__MISSING__:Egress address family. Auto keeps dual-stack; IPv4/IPv6 pin this proxy to that family (prevents a v4 leak under an IPv6-only proxy).",
+    "labelHost": "主機",
+    "labelPort": "埠",
+    "labelUsername": "使用者名稱",
+    "labelPassword": "密碼",
+    "labelRegion": "區域",
+    "labelStatus": "狀態",
+    "labelNotes": "備註",
+    "usernamePlaceholderEdit": "留空以保留當前使用者名稱",
+    "passwordPlaceholderEdit": "留空以保留當前密碼",
+    "statusActive": "活躍",
+    "statusInactive": "非活躍",
+    "cancel": "取消",
+    "save": "儲存",
+    "bulkModalTitle": "批次代理分配",
+    "bulkLabelScope": "範圍",
+    "bulkLabelProxy": "代理",
+    "bulkClearAssignment": "（清除分配）",
+    "bulkLabelScopeIds": "範圍 ID（逗號或換行符分隔）",
+    "bulkScopeIdsPlaceholder": "provider-openai,provider-anthropic",
+    "bulkApply": "應用",
+    "labelScope": "作用域",
+    "labelProxy": "代理",
+    "scopeGlobal": "全域性",
+    "scopeProvider": "按提供商",
+    "scopeAccount": "按帳號",
+    "scopeCombo": "按組合",
+    "bulkImportErrorMissingName": "缺少 NAME",
+    "bulkImportErrorMissingHost": "缺少 HOST",
+    "bulkImportErrorInvalidPort": "PORT 無效（必須為 1-65535）",
+    "bulkImportErrorInvalidType": "TYPE 無效（使用 http、https 或 socks5）",
+    "bulkImportErrorInvalidStatus": "STATUS 無效（使用 active 或 inactive）",
+    "errorLoadFailed": "載入代理登錄檔失敗",
+    "errorNameHostRequired": "名稱和主機為必填項",
+    "errorSaveFailed": "儲存代理失敗",
+    "errorDeleteFailed": "刪除代理失敗",
+    "errorForceDeleteConfirm": "此代理仍在分配中。強制刪除並移除所有分配？",
+    "errorMigrateFailed": "遷移舊版代理配置失敗",
+    "errorBulkFailed": "執行批次分配失敗",
+    "success": "✓",
+    "failure": "✗",
+    "failed": "失敗",
+    "successRate": "{rate}% 成功",
+    "avgLatency": "{latency} 毫秒平均",
+    "assignmentsCount": "{count} 個分配",
+    "noData": "—",
+    "testSuccess": "✓ {ip}",
+    "testLatency": "{latency}毫秒",
+    "testFailure": "✗ {error}",
+    "bulkImport": "批次匯入",
+    "bulkImportTitle": "批次匯入代理",
+    "bulkImportDescription": "使用管道符分隔格式貼上代理配置。每行一個代理。已有代理（相同 host + port）將被更新。",
+    "bulkImportParse": "解析",
+    "bulkImportImport": "匯入 {count} 個代理",
+    "bulkImportImporting": "正在匯入...",
+    "bulkImportParsed": "已解析 {count} 個代理",
+    "bulkImportSkipped": "已跳過 {count} 行",
+    "bulkImportParseErrors": "{count} 個錯誤",
+    "bulkImportNoValidEntries": "未找到有效條目。請檢查格式後重試。",
+    "bulkImportSuccess": "匯入完成：已建立 {created} 個，已更新 {updated} 個，失敗 {failed} 個",
+    "bulkImportErrorLine": "第 {line} 行：{reason}",
+    "bulkImportMaxExceeded": "每次最多匯入 100 個代理",
+    "bulkImportPreview": "預覽",
+    "clearAssignment": "（明確分配）",
+    "bulkProxyAssignment": "批次代理分配",
+    "testAll": "__MISSING__:Test All",
+    "errorTestFailed": "__MISSING__:Failed to test proxies",
+    "batchSelectedCount": "__MISSING__:{count} selected",
+    "batchDeleteSelected": "__MISSING__:Delete {count} selected",
+    "batchActivateSelected": "__MISSING__:Enable {count} selected",
+    "testPassed": "__MISSING__:✓ OK"
+  },
+  "playground": {
+    "title": "模型演練場",
+    "description": "直接從儀表板測試任何模型。選擇提供商、模型和端點型別，然後傳送請求以檢視原始響應。",
+    "endpoint": "端點",
+    "provider": "提供商",
+    "model": "模型",
+    "accountKey": "帳戶 / 金鑰",
+    "autoAccounts": "自動（{count} 個帳戶）",
+    "noAccounts": "無帳戶",
+    "send": "傳送",
+    "cancel": "取消",
+    "audioFile": "音訊檔案",
+    "attachImages": "附加圖片（視覺）",
+    "multipartFormData": "multipart/form-data",
+    "upToImages": "最多 4 張圖片",
+    "selectAudioFile": "選擇音訊檔案進行轉錄（mp3、wav、m4a、ogg、flac…）",
+    "clearAll": "清除全部",
+    "request": "請求",
+    "response": "響應",
+    "transcription": "轉錄",
+    "copy": "複製",
+    "resetToDefault": "重置為預設",
+    "downloadAudio": "下載音訊",
+    "copyText": "複製文本",
+    "transcriptionHint": "轉錄使用 multipart/form-data。上傳上面的音訊檔案 — 下面的 JSON 控制額外引數（模型、語言）。",
+    "imagesGenerated": "生成了 {count} 張圖片",
+    "generatedImage": "生成圖片 {index}",
+    "save": "儲存",
+    "endpointOptions": {
+      "chat": "聊天補全",
+      "responses": "響應",
+      "images": "圖片生成",
+      "embeddings": "Embeddings",
+      "speech": "文本轉語音",
+      "transcription": "音訊轉錄",
+      "video": "影片生成",
+      "music": "音樂生成",
+      "rerank": "Rerank",
+      "search": "網頁搜尋"
+    },
+    "conversationalChat": "對話式聊天",
+    "clearChat": "清除聊天內容",
+    "typeMessagePlaceholder": "輸入訊息...（Shift+Enter 換行）",
+    "tabChat": "聊天",
+    "tabCompare": "比較",
+    "tabApi": "API",
+    "tabBuild": "構建",
+    "configPane": "配置",
+    "systemPrompt": "系統提示",
+    "systemPromptPlaceholder": "你是一個樂於助人的助手。",
+    "modelPlaceholder": "例如 openai/gpt-4o",
+    "endpointLabel": "端點",
+    "parametersLabel": "引數",
+    "collapseConfig": "摺疊配置面板",
+    "expandConfig": "展開配置面板",
+    "temperature": "溫度",
+    "maxTokens": "最大令牌數",
+    "topP": "Top-p",
+    "presencePenalty": "存在懲罰",
+    "frequencyPenalty": "頻率懲罰",
+    "seedPlaceholder": "隨機（留空）",
+    "presetsLabel": "預設",
+    "loadPreset": "載入預設",
+    "savePreset": "儲存預設",
+    "noPresets": "無預設",
+    "presetNamePlaceholder": "預設名稱",
+    "savingPreset": "儲存中…",
+    "nameRequired": "名稱是必填項",
+    "failedToSavePreset": "儲存預設失敗",
+    "improvePrompt": "最佳化提示",
+    "improvingPrompt": "最佳化中…",
+    "improvePromptTitle": "使用 AI 最佳化提示",
+    "setModelFirst": "請先設定模型",
+    "improveQuotaWarning": "這將消耗配置中模型配額的用量。",
+    "improveConfirm": "最佳化",
+    "exportCode": "匯出程式碼",
+    "exportCodeTitle": "匯出程式碼",
+    "exportShort": "匯出",
+    "noStateToExport": "沒有可匯出的 Playground 狀態。",
+    "closeExportModal": "關閉匯出模態框",
+    "close": "關閉",
+    "exportRealKeyWarning": "安全警告：匯出被阻止 — 輸出中檢測到真實的 API 金鑰。請重置您的 API 金鑰並重試。",
+    "placeholderHintPrefix": "替換",
+    "placeholderHintSuffix": "使用您的實際 API 金鑰，或將其設定為環境變數。",
+    "copyLangCode": "複製 {language} 程式碼",
+    "loadingPresets": "載入中…",
+    "loadPresetPlaceholder": "載入預設…",
+    "copyCode": "複製",
+    "copiedCode": "已複製！",
+    "addModel": "+ 新增模型",
+    "runAll": "執行全部",
+    "cancelAll": "取消全部",
+    "maxColumnsReached": "最大 {max} 列",
+    "modelPlaceholderCompare": "模型（Cmd+K）…",
+    "ttft": "TTFT",
+    "tps": "TPS",
+    "metricsDisclaimer": "客戶端估算",
+    "tokensLabel": "令牌",
+    "costLabel": "成本",
+    "costEstimated": "（估算）",
+    "toolsLabel": "工具",
+    "addTool": "新增工具",
+    "toolNamePlaceholder": "函式名稱",
+    "toolDescPlaceholder": "描述（可選）",
+    "toolParamsInvalid": "引數必須為有效 JSON",
+    "structuredOutputLabel": "結構化輸出",
+    "enableJsonMode": "啟用 JSON 模式",
+    "disableJsonMode": "停用 JSON 模式",
+    "invalidJson": "無效 JSON",
+    "running": "執行中…",
+    "runLabel": "執行",
+    "enterToolResult": "輸入工具結果…",
+    "build": {
+      "step1Label": "測試什麼？",
+      "step2Label": "配置",
+      "step3Label": "執行",
+      "step1Title": "你想測試什麼？",
+      "step1Subtitle": "選擇您想在本次會議中探索的功能。",
+      "step2Title": "配置",
+      "step2Subtitle": "設定請求中將使用的工具或 JSON 架構。",
+      "step3Title": "執行",
+      "modeToolsTitle": "工具",
+      "modeToolsDesc": "測試函式呼叫 — 定義工具並檢視模型如何呼叫它們。",
+      "modeJsonTitle": "JSON",
+      "modeJsonDesc": "測試結構化輸出 — 將響應限制為 JSON 架構。",
+      "modeBothTitle": "工具 + JSON",
+      "modeBothDesc": "在單個請求中結合函式呼叫和結構化輸出。",
+      "backButton": "返回",
+      "nextButton": "下一步",
+      "runButton": "執行",
+      "promptPlaceholder": "輸入您的訊息…（按 Enter 傳送，Shift+Enter 換行）"
+    }
+  },
+  "miniPlayground": {
+    "endpoint": "端點",
+    "apiKey": "API 金鑰",
+    "model": "模型",
+    "voice": "聲音",
+    "speed": "語速",
+    "input": "輸入",
+    "url": "URL",
+    "format": "格式",
+    "depth": "深度",
+    "copyCurl": "複製 cURL",
+    "copied": "已複製!",
+    "run": "執行",
+    "running": "執行中...",
+    "response": "響應",
+    "tunnel": "隧道",
+    "send": "傳送",
+    "selectKey": "選擇金鑰",
+    "testLabel": "測試",
+    "expandTest": "展開測試",
+    "collapseTest": "收起測試",
+    "revealKey": "顯示金鑰",
+    "hideKey": "隱藏金鑰",
+    "download": "下載",
+    "play": "播放",
+    "query": "查詢",
+    "numResults": "最大結果數",
+    "prompt": "提示詞",
+    "size": "尺寸",
+    "duration": "時長",
+    "question": "問題",
+    "audioFile": "音訊檔案",
+    "noKeysFound": "未找到 API 金鑰。請到 Keys 區域新增一個。",
+    "exampleLabel": "示例",
+    "latency": "{ms} 毫秒",
+    "statsLine": "{ms}ms · {tokensIn} 輸入 / {tokensOut} 輸出 tokens"
+  },
+  "requestLogger": {
+    "recording": "正在錄製",
+    "paused": "已暫停",
+    "pipelineLogsOn": "管道日誌開啟",
+    "pipelineLogsOff": "管道日誌關閉",
+    "updatingPipelineLogs": "正在更新管道日誌...",
+    "updatePipelineFailed": "更新流水線日誌失敗",
+    "capturePipeline": "為新請求捕獲流水線載荷",
+    "searchPlaceholder": "搜尋模型、提供商、帳戶、API金鑰、組合...",
+    "allProviders": "所有提供商",
+    "allModels": "所有模型",
+    "allAccounts": "所有帳戶",
+    "allApiKeys": "所有API金鑰",
+    "total": "總計",
+    "ok": "成功",
+    "err": "錯誤",
+    "combo": "組合",
+    "keys": "金鑰",
+    "shown": "顯示",
+    "sortNewest": "最新",
+    "sortOldest": "最早",
+    "sortTokensDesc": "令牌 ↓",
+    "sortTokensAsc": "令牌 ↑",
+    "sortDurationDesc": "時長 ↓",
+    "sortDurationAsc": "時長 ↑",
+    "sortStatusDesc": "狀態 ↓",
+    "sortStatusAsc": "狀態 ↑",
+    "sortModelAsc": "模型 A-Z",
+    "sortModelDesc": "模型 Z-A",
+    "sortLogs": "日誌排序",
+    "refresh": "重新整理",
+    "columnsLabel": "列",
+    "cacheSem": "語義",
+    "cacheUp": "線上",
+    "semantic": "Semantic Cache",
+    "upstream": "上游",
+    "semanticCacheHit": "語義快取命中（由 OmniRoute 提供）",
+    "upstreamResponse": "上游提供商響應",
+    "noApiKey": "無 API key",
+    "requestedRoutedTitle": "請求 {requested}，路由為 {routed}",
+    "statusFilters": {
+      "all": "全部",
+      "error": "錯誤",
+      "success": "成功",
+      "combo": "組合"
+    },
+    "columns": {
+      "status": "狀態",
+      "cacheSource": "快取來源",
+      "model": "模型",
+      "requested": "請求",
+      "provider": "提供商",
+      "protocol": "請求協議",
+      "account": "帳戶",
+      "apiKey": "API金鑰",
+      "combo": "組合",
+      "tokens": "Tokens",
+      "compressed": "壓縮",
+      "tps": "TPS",
+      "duration": "時長",
+      "time": "時間"
+    },
+    "loadingLogs": "正在載入日誌...",
+    "noLogs": "暫無日誌記錄。進行一些API呼叫以在此處檢視它們。",
+    "noMatchingLogs": "沒有匹配當前篩選器的日誌。",
+    "callLogsInfo": "呼叫日誌也儲存為JSON檔案到{dataDir}，並根據{retentionDays}和{maxEntries}進行輪換。",
+    "loadMore": "__MISSING__:Load More",
+    "loadingMore": "__MISSING__:Loading more..."
+  },
+  "proxyLogger": {
+    "filterAll": "全部",
+    "filterErrors": "錯誤",
+    "filterSuccess": "成功",
+    "filterTimeout": "超時",
+    "colStatus": "狀態",
+    "colProxy": "代理",
+    "colTls": "TLS",
+    "colType": "型別",
+    "colLevel": "級別",
+    "colProvider": "提供商",
+    "colTarget": "目標",
+    "colLatency": "延遲",
+    "colClientIp": "客戶端 IP",
+    "colTime": "時間",
+    "recording": "記錄中",
+    "paused": "已暫停",
+    "searchPlaceholder": "搜尋主機、提供商、目標或 IP...",
+    "allTypes": "全部型別",
+    "allLevels": "全部級別",
+    "allProviders": "全部 Provider",
+    "total": "總計",
+    "ok": "正常",
+    "err": "錯誤",
+    "timeoutShort": "超時",
+    "direct": "直連",
+    "newest": "最新",
+    "oldest": "最舊",
+    "latencyDesc": "延遲 ↓",
+    "latencyAsc": "延遲 ↑",
+    "refresh": "重新整理",
+    "columns": "列",
+    "loadingProxyLogs": "正在載入代理日誌...",
+    "noProxyLogs": "尚無代理日誌。配置代理併發起 API 呼叫後會顯示在這裡。",
+    "noMatchingLogs": "沒有日誌匹配當前篩選條件。",
+    "tlsFingerprint": "Chrome 124 TLS 指紋",
+    "colPublicIp": "公共IP"
+  },
+  "endpointOptions": {
+    "speech": "語音",
+    "search": "搜尋",
+    "images": "影像",
+    "chat": "聊天",
+    "music": "音樂",
+    "responses": "響應",
+    "rerank": "重新排序",
+    "video": "影片",
+    "embeddings": "嵌入",
+    "transcription": "轉寫"
+  },
+  "toolDescriptions": {
+    "cline": "Cline",
+    "openclaw": "Openclaw",
+    "droid": "Droid",
+    "codex": "Codex",
+    "claude": "Claude",
+    "kilo": "Kilo"
+  },
+  "runtime": {
+    "title": "執行時",
+    "description": "即時可觀測性 — 3 層彈性 + 會話 + 配額告警",
+    "pause": "暫停",
+    "resume": "恢復",
+    "refreshNow": "立即重新整理",
+    "kpiSessions": "會話",
+    "kpiCircuits": "斷路器",
+    "kpiCooldowns": "冷卻",
+    "kpiLockouts": "鎖定",
+    "hintStickyBound": "{count} 個粘性繫結",
+    "hintRecovering": "{count} 個恢復中",
+    "hintAllHealthy": "全部健康",
+    "hintOpen": "開啟",
+    "hintConnsCooling": "連線冷卻中",
+    "hintModelsBlocked": "模型已阻止",
+    "resilienceTitle": "3 層彈性",
+    "resilienceSubtitle": "反映記錄的彈性模型",
+    "providersHealthy": "{percent}% 提供商健康",
+    "layer": "第 {n} 層",
+    "layer1Title": "提供商斷路器",
+    "layer1Desc": "阻止到上游級失敗的提供商的流量",
+    "layer2Title": "連線冷卻",
+    "layer2Desc": "跳過一個壞帳戶/金鑰；其他連線繼續服務",
+    "layer3Title": "模型鎖定",
+    "layer3Desc": "按模型速率限制鎖定；同一連線仍可服務其他模型",
+    "badgeAffectedOf": "{affected}/{total} 受影響",
+    "badgeCooling": "{count} 冷卻中",
+    "badgeLocked": "{count} 已鎖定",
+    "emptyCircuits": "尚無活動斷路器",
+    "emptyCooldowns": "尚無連線冷卻",
+    "emptyLockouts": "無模型鎖定",
+    "moreCooldowns": "+{count} 更多冷卻",
+    "moreLockouts": "+{count} 更多鎖定",
+    "feedTitle": "即時動態",
+    "feedSubtitle": "最近 {count} 個事件",
+    "feedFilterAll": "全部",
+    "feedFilterCircuits": "斷路器",
+    "feedFilterCooldowns": "冷卻",
+    "feedFilterLockouts": "鎖定",
+    "feedFilterSessions": "會話",
+    "feedFilterQuotas": "配額",
+    "feedClear": "清除",
+    "feedEmptyWaiting": "等待事件…（每 5 秒輪詢一次）",
+    "feedEmptyFiltered": "沒有匹配此篩選條件的事件",
+    "sessionsTitle": "活動會話",
+    "sessionsSubtitle": "粘性繫結請求指紋（即時）",
+    "sessionsActive": "{count} 個活動",
+    "sessionsEmptyTitle": "無活動會話",
+    "sessionsEmptyHint": "請求流經代理時會出現會話",
+    "tblSession": "會話",
+    "tblAge": "時長",
+    "tblIdle": "空閒",
+    "tblReqs": "請求數",
+    "tblBoundTo": "繫結到",
+    "topApiKeys": "熱門 API 金鑰",
+    "quotaMonitorsTitle": "配額監視器",
+    "quotaMonitorsSubtitle": "每個帳戶視窗的即時配額狀態",
+    "openQuota": "開放配額",
+    "allQuotasHealthy": "所有配額健康",
+    "statusExhausted": "已耗盡",
+    "statusAlerting": "告警中",
+    "statusError": "錯誤",
+    "moreSuffix": "+{count} 更多"
+  },
+  "quotaShare": {
+    "title": "配額共享",
+    "description": "通過百分比限制跨 API 金鑰共享提供商配額",
+    "newPool": "新建池",
+    "betaTitle": "Beta — UI preview.",
+    "betaDescription": "配置儲存在 localStorage 中（尚未持久化到伺服器）。每次請求的上限執行將在未來更新中實現。",
+    "kpiActivePools": "活躍池",
+    "kpiKeysAllocated": "已分配金鑰",
+    "kpiAvgUnallocated": "平均未分配",
+    "kpiProvidersWithQuota": "有配額的提供商",
+    "emptyTitle": "未配置池",
+    "emptyDescription": "建立池以分配 API 金鑰，通過百分比分配共享提供商的配額視窗。",
+    "loading": "載入中…",
+    "removePool": "移除池",
+    "removeConfirm": "移除此池？",
+    "pool": "池",
+    "used": "已使用",
+    "allocationsCount": "分配（{count}）",
+    "allocatedFree": "已分配 {allocated}% · 空閒 {free}%",
+    "noAllocations": "尚未分配金鑰",
+    "capLabel": "上限 {value}",
+    "notTrackedYet": "（尚未跟蹤）",
+    "policy": "策略",
+    "policyHard": "硬性",
+    "policySoft": "軟性",
+    "policyBurst": "突發",
+    "policyHardHint": "金鑰耗盡分配時阻止",
+    "policySoftHint": "允許溢位，僅告警",
+    "policyBurstHint": "允許突發進入空閒池",
+    "editAllocations": "編輯分配",
+    "newPoolTitle": "新建配額池",
+    "providerConnection": "提供商連線（帳戶）",
+    "selectConnection": "選擇連線…",
+    "noEligibleConnections": "沒有帶配額資料的連線。首先從 /dashboard/quota 重新整理。",
+    "quotaWindow": "配額視窗",
+    "selectWindow": "選擇視窗…",
+    "alreadyUsedSuffix": "（已使用）",
+    "windowReset": "重置",
+    "duplicatePoolError": "此連線 + 視窗的池已存在",
+    "cancel": "取消",
+    "createPool": "建立池",
+    "editTitle": "編輯分配",
+    "noKeysAdded": "未分配金鑰。請在下方新增。",
+    "totalLabel": "總計：{percent}%",
+    "totalExceeded": "⚠ 超過 100%",
+    "addKey": "+ 新增金鑰…",
+    "equalSplit": "平均分配",
+    "save": "儲存分配",
+    "betaPreviewLabel": "Beta — UI 預覽。",
+    "betaConfigSavedPrefix": "配置儲存在",
+    "betaConfigSavedSuffix": "（尚未保留在伺服器上）。每個請求上限的強制執行尚未連線到代理管道中。此螢幕可讓您設計和視覺化配額分配；真正的執行將在未來的迭代中通過資料庫永續性和上游呼叫攔截來實現。",
+    "policyLabel": "政策：",
+    "resetIn": "重置於",
+    "quotaTotal": "總計",
+    "kpiAvgUtilization": "平均利用率",
+    "kpiBorrowingNow": "現在借款",
+    "conceptTitle": "配額分成是如何工作的",
+    "conceptIntro": "配額共享通過節約型公平分享將提供者的配額分配給多個 API 金鑰：每個金鑰獲得一個按比例分配的份額，但可以在不超過全球上限的情況下從自由余額中借用。",
+    "conceptFairShare": "公平共享：每個鍵接收與其配置權重成比例的配額",
+    "conceptBorrowing": "借用：金鑰可以在不違反上限的情況下消耗他人的自由余額",
+    "conceptGlobalCap": "硬性全球上限：提供者的絕對限制永遠不會被超越",
+    "conceptWindows": "Windows: 5小時，按小時、按日、按周、按月 — 每個獨立跟蹤",
+    "conceptKeyHowTitle": "為配額啟用金鑰",
+    "conceptKeyHowDesc": "在 API 管理器中正常建立金鑰 — 它會自動出現在嚮導的金鑰步驟中。在那裡勾選獨佔以使其僅限配額。沒有單獨的啟用步驟。",
+    "conceptExclusiveTitle": "“Exclusive” 的作用是什麼",
+    "conceptExclusiveDesc": "獨佔金鑰僅檢視/使用池的 quotaShared-* 模型 — 其他所有模型在其 /v1/models 中被隱藏並被阻止。",
+    "burnRateTitle": "燒錢率",
+    "burnRateExhaustsIn": "排氣在",
+    "dimensionResetIn": "重置於",
+    "realConsumedColumn": "已消耗",
+    "deficitColumn": "赤字",
+    "borrowingIndicator": "借款",
+    "migratedFromLocalStorageNotice": "池成功從 localStorage 遷移。",
+    "policyCapAbsoluteLabel": "絕對上限",
+    "policyCapAbsolutePlaceholder": "數字限制（可選）",
+    "multiDimensionLabel": "多維",
+    "stackedBarTitle": "按 API 金鑰切片",
+    "usedSuffix": "已使用 {percent}%",
+    "wizardTitle": "新配額池",
+    "editPoolTitle": "編輯池",
+    "saveChanges": "儲存更改",
+    "wizardStep1Label": "帳戶",
+    "wizardStep2Label": "限制",
+    "wizardStep3Label": "金鑰",
+    "wizardStep1Title": "選擇提供商連線",
+    "wizardStep1Subtitle": "選擇此池將共享配額的提供者帳戶，設定名稱和預設策略。",
+    "wizardStep2Title": "配置配額維度",
+    "wizardStep2Subtitle": "為所選連線定義配額計劃維度（單位、視窗、限制）。保持不變以保持當前設定。",
+    "wizardStep3Title": "分配 API 金鑰",
+    "wizardStep3Subtitle": "將 API 金鑰分配給該池，設定權重 % 分配和可選上限。",
+    "wizardPoolNameLabel": "池名稱",
+    "wizardPoolNamePlaceholder": "我的配額池",
+    "wizardNext": "下一個",
+    "wizardBack": "返回",
+    "wizardCreatePool": "建立池",
+    "wizardDimensionsEditedNotice": "已編輯的尺寸 - 在建立泳池時將作為手動覆蓋儲存。",
+    "wizardExclusiveLabel": "獨佔配額",
+    "wizardExclusiveHint": "啟用後，這些 API 金鑰將僅允許使用此池的虛擬模型（在儲存時應用 allowedQuotas 對帳）。",
+    "wizardPreviewLabel": "虛擬模型名稱預覽",
+    "wizardConnectionsLabel": "提供者連線",
+    "wizardPrimaryBadge": "主要",
+    "wizardAdditionalConnectionsNote": "附加連線使用其目錄預設限制（稍後可編輯）。",
+    "wizardSingleProviderNote": "一個池使用單一提供者",
+    "wizardPreviewMoreModels": "+{count} 更多",
+    "accountQuotaTitle": "帳戶配額",
+    "accountQuotaNone": "—",
+    "logTitle": "使用日誌",
+    "logEmpty": "尚未使用",
+    "groupLabel": "組",
+    "newGroup": "新建組",
+    "renameGroup": "重新命名組",
+    "groupSelectHint": "按組過濾池",
+    "groupAllocationNote": "分配適用於此組中的所有池，通過共享配額層。",
+    "groupNamePrompt": "輸入組名",
+    "wizardGroupLabel": "組",
+    "allGroups": "所有組",
+    "endpointsTitle": "可用的端點",
+    "endpointsHint": "使用任何分配的金鑰呼叫這些虛擬模型 — 路由 + 配額按組處理。",
+    "previewForKey": "金鑰預覽",
+    "previewKeyNone": "(所有端點)",
+    "endpointsBaseUrl": "基礎 URL",
+    "endpointsCollapse": "摺疊",
+    "endpointsExpand": "展開",
+    "endpointsAnthropicNote": "Anthropic 原生",
+    "endpointsResponsesNote": "OpenAI 響應 — codex/github",
+    "endpointsWsNote": "WebSocket — 僅限 codex",
+    "betaText": "配額共享功能正常，但預計會有錯誤。發現一個了嗎？請報告。",
+    "betaReportLink": "報告問題",
+    "deleteGroup": "刪除組",
+    "deleteGroupConfirm": "要刪除此組嗎？必須先重新分配或移除其池。",
+    "deleteGroupHasPools": "該組仍然有池 — 請先重新分配或刪除它們。",
+    "ungroupedTitle": "未分組",
+    "ungroupedHint": "這些池未分配給已知組。編輯一個池以將其移動到真實組中。"
+  },
+  "plugins": {
+    "title": "外掛",
+    "description": "安裝和管理外掛以擴充套件 OmniRoute 功能",
+    "loading": "載入外掛中…",
+    "scanning": "掃描中…",
+    "scanForPlugins": "掃描外掛",
+    "noPlugins": "未安裝外掛",
+    "noPluginsDescription": "將外掛目錄放入 ~/.omniroute/plugins/ 並點選掃描。",
+    "activate": "啟用",
+    "deactivate": "停用",
+    "uninstall": "解除安裝",
+    "uninstallConfirm": "解除安裝外掛 \"{name}\"？",
+    "pluginScanComplete": "外掛掃描完成",
+    "pluginScanFailed": "外掛掃描失敗",
+    "activated": "{name} 已啟用",
+    "deactivated": "{name} 已停用",
+    "activateFailed": "啟用 {name} 失敗",
+    "deactivateFailed": "停用 {name} 失敗",
+    "uninstalled": "{name} 已解除安裝",
+    "uninstallFailed": "解除安裝 {name} 失敗",
+    "configure": "配置：{name}",
+    "configurePlugin": "配置",
+    "noConfigSettings": "此外掛無可配置的設定。",
+    "saving": "儲存中…",
+    "saveConfiguration": "儲存配置",
+    "configurationSaved": "配置已儲存",
+    "saveConfigurationFailed": "儲存配置失敗",
+    "pluginNotFound": "未找到外掛",
+    "version": "版本",
+    "author": "作者",
+    "description_label": "描述",
+    "status": "狀態",
+    "enabled": "已啟用",
+    "disabled": "已停用",
+    "installedTab": "__MISSING__:Installed",
+    "marketplaceTab": "__MISSING__:Marketplace",
+    "marketplaceUrlLabel": "__MISSING__:Custom Marketplace URL",
+    "marketplaceUrlPlaceholder": "__MISSING__:Leave empty for official Omniroute registry",
+    "saveMarketplaceUrl": "__MISSING__:Save & Reload",
+    "marketplaceUrlSaved": "__MISSING__:Marketplace URL updated",
+    "marketplaceEmpty": "__MISSING__:No plugins found in marketplace.",
+    "marketplaceInstallComingSoon": "__MISSING__:Marketplace installs are coming soon.",
+    "verified": "__MISSING__:Verified",
+    "install": "__MISSING__:Install",
+    "installedFromMarketplace": "__MISSING__:Plugin {name} installed!",
+    "hooks": "鉤子"
+  },
+  "quotaPlans": {
+    "title": "計劃與配額",
+    "description": "為每個提供商配置配額計劃 — 維度（%、請求、令牌、$）和時間視窗",
+    "providerLabel": "提供者 / 連線",
+    "detectedPlanLabel": "檢測到的計劃",
+    "manualPlanLabel": "手動覆蓋",
+    "unconfiguredLabel": "未配置 — 需要手動設定",
+    "dimensionLabel": "尺寸",
+    "addDimension": "新增維度",
+    "removeDimension": "移除",
+    "limitLabel": "限制",
+    "unitOptions": {
+      "percent": "%",
+      "requests": "請求",
+      "tokens": "令牌",
+      "usd": "美元 ($)"
+    },
+    "windowOptions": {
+      "5h": "5 小時",
+      "hourly": "每小時",
+      "daily": "每日",
+      "weekly": "每週",
+      "monthly": "每月"
+    },
+    "useCatalogButton": "使用目錄",
+    "saveOverrideButton": "儲存覆蓋",
+    "revertToCatalogButton": "恢復到目錄",
+    "unknownProviderNotice": "在左側選擇一個提供商以配置其配額計劃。",
+    "catalogTitle": "已知目錄",
+    "catalogDescription": "自動檢測到以下提供商的計劃："
+  },
+  "activity": {
+    "title": "活動",
+    "description": "最近事件動態",
+    "emptyTitle": "尚無活動",
+    "emptyDescription": "當您新增提供者、建立組合或旋轉金鑰時，事件將出現在這裡。",
+    "todayHeader": "今天",
+    "yesterdayHeader": "昨天",
+    "filterAll": "全部",
+    "filterProviders": "提供者",
+    "filterCombos": "組合",
+    "filterApiKeys": "API 金鑰",
+    "filterSettings": "設定",
+    "filterQuota": "配額",
+    "filterAuth": "認證",
+    "filterSystem": "系統",
+    "relative": {
+      "justNow": "剛剛",
+      "minutesAgo": "{n}分鐘前",
+      "hoursAgo": "{n} 小時前",
+      "yesterday": "昨天",
+      "daysAgo": "{n} 天前"
+    },
+    "eventVerb": {
+      "providerAdded": "{actor} 添加了提供者 {target}",
+      "providerRemoved": "{actor} 移除了提供者 {target}",
+      "providerTested": "{actor} 測試了提供者 {target}",
+      "comboCreated": "{actor} 建立了組合 {target}",
+      "comboUpdated": "{actor} 更新了組合 {target}",
+      "comboDeleted": "{actor} 移除了組合 {target}",
+      "apiKeyCreated": "{actor} 建立了 API 金鑰 {target}",
+      "apiKeyRevoked": "{actor} 撤銷了 API 金鑰 {target}",
+      "apiKeyRotated": "{actor} 旋轉了 API 金鑰 {target}",
+      "budgetThreshold": "已達到 {target} 的預算閾值",
+      "settingUpdated": "{actor} 更新了設定 {target}",
+      "authLogin": "{actor} 已登入",
+      "authLogout": "{actor} 已登出",
+      "cloudAgentSession": "為 {target} 啟動了雲代理會話",
+      "mcpToolRegistered": "MCP 工具 {target} 已註冊",
+      "webhookCreated": "{actor} 建立了 webhook {target}",
+      "webhookDeleted": "{actor} 移除了 webhook {target}",
+      "quotaPoolCreated": "{actor} 建立了配額池 {target}",
+      "quotaPoolUpdated": "{actor} 更新了配額池 {target}",
+      "quotaPoolDeleted": "{actor} 移除了配額池 {target}",
+      "quotaPlanUpdated": "{actor} 更新了配額計劃 {target}",
+      "quotaStoreDriverChanged": "QuotaStore 驅動已更改",
+      "updateApplied": "已應用更新 {target}",
+      "deployCompleted": "部署完成",
+      "skillInstalled": "{actor} 安裝了技能 {target}",
+      "skillRemoved": "{actor} 移除了技能 {target}",
+      "providerCredentialsCreated": "{actor} 為 {target} 建立了憑據",
+      "providerCredentialsApplied": "已應用 {target} 的憑據",
+      "providerCredentialsUpdated": "{actor} 更新了 {target} 的憑據",
+      "providerCredentialsRevoked": "{actor} 撤銷了 {target} 的憑據",
+      "providerCredentialsBatchRevoked": "{actor} 批次撤銷憑證",
+      "providerCredentialsBatchUpdated": "{actor} 批次更新了憑據",
+      "providerCredentialsBulkCreated": "{actor} 批次建立了憑據",
+      "providerCredentialsBulkImported": "{actor} 批次匯入了憑據",
+      "providerCredentialsImported": "{actor} 匯入的憑據",
+      "providerSsrfBlocked": "已阻止對 {target} 的 SSRF 嘗試",
+      "authLoginSuccess": "{actor} 已登入",
+      "authLoginError": "{actor} 的登入錯誤",
+      "authLoginFailed": "{name} 登入失敗",
+      "authLoginLocked": "{actor} 在嘗試次數過多後被鎖定",
+      "authLoginMisconfigured": "身份驗證配置無效",
+      "authLoginSetupRequired": "需要進行身份驗證設定",
+      "authLogoutSuccess": "{actor} 已登出",
+      "syncTokenCreated": "{actor} 建立了同步令牌",
+      "syncTokenRevoked": "{actor} 撤銷了同步令牌",
+      "settingsUpdate": "{actor} 更新了設定",
+      "settingsUpdateFailed": "設定更新失敗",
+      "serviceRevealApiKey": "{actor} 揭露了 {target} 的 API 金鑰",
+      "genericEvent": "{actor} {target}"
+    }
+  },
+  "agentBridge": {
+    "title": "AgentBridge",
+    "subtitle": "使用 IDE 代理與 OmniRoute 模型 — 無需配置",
+    "riskBannerTitle": "自行承擔風險",
+    "riskBannerBody": "AgentBridge 攔截來自 IDE 代理的 HTTPS 流量。通過啟用它，您接受遵守每個代理服務條款的責任。切勿在禁止 TLS 檢查的裝置或網路上使用。",
+    "riskBannerDismiss": "關閉",
+    "serverCardTitle": "AgentBridge 伺服器",
+    "statusRunning": "執行中",
+    "statusStopped": "已停止",
+    "statusActive": "活動",
+    "statusDnsOff": "DNS 關閉",
+    "statusSetupRequired": "需要設定",
+    "statusInvestigating": "調查中",
+    "serverPort": "埠",
+    "serverConns": "連線",
+    "serverIntercepted": "攔截成功",
+    "serverLastStarted": "最後啟動時間",
+    "startServer": "開始",
+    "stopServer": "停止",
+    "restartServer": "重啟",
+    "trustCert": "信任證書",
+    "downloadCert": "下載證書",
+    "certManualTitle": "__MISSING__:Certificate couldn't be installed automatically (e.g. inside a container). The bridge can still run — trust the CA manually:",
+    "regenerateCert": "重新生成證書",
+    "starting": "正在啟動…",
+    "stopping": "停止中…",
+    "restarting": "正在重啟…",
+    "trusting": "信任中……",
+    "regenerating": "重新生成中…",
+    "upstreamCaLabel": "上游 CA 證書（企業）",
+    "upstreamCaPlaceholder": "/etc/ssl/certs/corp-ca.pem",
+    "upstreamCaTest": "測試 TLS",
+    "upstreamCaTestOk": "TLS 測試通過",
+    "upstreamCaTestError": "TLS 測試失敗 — 檢查路徑和 CA 檔案",
+    "bypassSectionTitle": "繞過列表",
+    "bypassSectionDesc": "匹配這些模式的主機將直接隧道（不進行 TLS 解密）。預設包括銀行、.gov 和企業 SSO。",
+    "bypassDefaultsLabel": "預設繞過模式（只讀）",
+    "bypassUserLabel": "自定義繞過模式（每行一個，glob 或正規表示式）",
+    "saveBypassList": "儲存繞過列表",
+    "agentListTitle": "IDE 代理",
+    "filterAll": "全部",
+    "filterActive": "活躍",
+    "filterSetupRequired": "需要設定",
+    "filterInvestigating": "調查中",
+    "searchAgents": "搜尋代理…",
+    "noAgentsMatch": "沒有代理與當前篩選條件匹配",
+    "agentHosts": "攔截的主機",
+    "certTrusted": "證書已信任",
+    "certNotTrusted": "證書不受信任",
+    "investigatingNotice": "該代理正在接受調查。主機和 API 介面仍在確認中。一旦上游 API 文件完成，設定將可用。",
+    "modelMappingsLabel": "模型對映",
+    "sourceModel": "源模型（代理原生）",
+    "targetModel": "目標模型 (OmniRoute)",
+    "noMappings": "未配置模型對映。執行設定嚮導以自動檢測模型。",
+    "selectModel": "選擇…",
+    "saveMappings": "儲存對映",
+    "setupWizard": "設定嚮導",
+    "startDns": "啟動 DNS",
+    "stopDns": "停止 DNS",
+    "toggling": "切換中…",
+    "viewTraffic": "檢視流量",
+    "emptyNoProvidersTitle": "尚未配置提供程式",
+    "emptyNoProvidersBody": "要使用 AgentBridge，首先連線至少一個提供者。它將是 IDE 請求路由的目標。",
+    "emptyGoToProviders": "前往提供者",
+    "wizardTitle": "設定嚮導",
+    "wizardSubtitle": "3步設定",
+    "wizardStep1Label": "驗證",
+    "wizardStep2Label": "DNS",
+    "wizardStep3Label": "對映",
+    "wizardStep1Desc": "確認伺服器正在執行並且證書已安裝。",
+    "wizardStep2Desc": "以下條目將被新增到 /etc/hosts 以通過 AgentBridge 重定向流量：",
+    "wizardStep3Desc": "您現在可以在代理卡中配置模型對映。重啟 IDE 以應用更改。",
+    "wizardStep3Success": "代理已配置！",
+    "wizardServerCheck": "AgentBridge 伺服器",
+    "wizardRunning": "執行中",
+    "wizardNotRunning": "未執行",
+    "wizardCertCheck": "證書",
+    "wizardTrusted": "可信的",
+    "wizardNotTrusted": "尚未信任 — 使用信任證書按鈕",
+    "wizardTutorialTitle": "設定說明：",
+    "wizardEnableDns": "新增 /etc/hosts 條目",
+    "wizardDnsAlreadyEnabled": "此代理已啟用 DNS",
+    "enablingDns": "啟用中…",
+    "modelSelectorTitle": "選擇目標模型",
+    "modelSelectorSearch": "搜尋模型…",
+    "noModelsFound": "未找到模型",
+    "quickLinks": "快速連結",
+    "quickLinkProviders": "配置提供程式",
+    "quickLinkInspector": "在流量檢查器中檢視流量",
+    "maintenanceTitle": "__MISSING__:Maintenance & Diagnostics",
+    "maintenanceSubtitle": "__MISSING__:Self-test the capture pipeline, undo leftover system state, and move your setup between machines.",
+    "orphanedStateWarning": "__MISSING__:A previous session left system state behind (DNS spoof, CA, or system proxy). Run Repair to clean it up.",
+    "diagnose": "__MISSING__:Diagnose",
+    "diagnosing": "__MISSING__:Diagnosing…",
+    "diagnoseHealthy": "__MISSING__:Capture pipeline is healthy.",
+    "diagnoseUnhealthy": "__MISSING__:Capture pipeline has problems:",
+    "repair": "__MISSING__:Repair",
+    "repairing": "__MISSING__:Repairing…",
+    "repairDone": "__MISSING__:Repaired: {items}",
+    "repairNothing": "__MISSING__:Nothing to repair — system state is clean.",
+    "removeCa": "__MISSING__:Remove CA",
+    "removeCaConfirm": "__MISSING__:Remove CA?",
+    "removeCaDone": "__MISSING__:MITM root CA removed from the OS trust store.",
+    "removing": "__MISSING__:Removing…",
+    "confirm": "__MISSING__:Confirm",
+    "exportConfig": "__MISSING__:Export config",
+    "exporting": "__MISSING__:Exporting…",
+    "importConfig": "__MISSING__:Import config",
+    "importing": "__MISSING__:Importing…",
+    "importInvalidJson": "__MISSING__:The selected file is not valid JSON.",
+    "importDone": "__MISSING__:Imported {bypass} bypass · {hosts} hosts · {agents} agents",
+    "save": "儲存",
+    "saving": "儲存中…",
+    "cancel": "取消",
+    "back": "返回",
+    "next": "下一個",
+    "done": "完成",
+    "loading": "載入中…",
+    "riskNoticeTitle": "風險確認",
+    "riskNoticeBody": "AgentBridge 將通過 DNS 重定向其 API 主機來攔截來自此代理的 HTTPS 流量。僅在您接受遵守代理的服務條款和任何適用的網路政策的責任時啟用。",
+    "pageMoved": {
+      "goNow": "現在去",
+      "message": "MITM Proxy 現在歸 AgentBridge 所有。",
+      "title": "此頁面已移動"
+    }
+  },
+  "trafficInspector": {
+    "title": "流量檢查員",
+    "subtitle": "監控 LLM 呼叫並除錯任何應用程式的 HTTPS 流量",
+    "captureModesTitle": "捕獲模式",
+    "agentBridgeMode": "AgentBridge",
+    "agentBridgeModeDesc": "捕獲來自所有連線的 IDE 代理的流量",
+    "customHostsMode": "自定義主機",
+    "customHostsModeDesc": "新增特定主機以進行攔截",
+    "httpProxyMode": "HTTP 代理",
+    "httpProxyModeDesc": "使用 HTTP_PROXY 環境變數",
+    "systemWideMode": "系統範圍內",
+    "systemWideModeDesc": "攔截所有系統流量（高階）",
+    "tproxyMode": "__MISSING__:TPROXY Decrypt",
+    "tproxyModeUnavailable": "__MISSING__:TPROXY decrypt requires Linux + root + the native addon",
+    "filterBarTitle": "過濾器",
+    "profileLlmOnly": "僅限 LLM",
+    "profileCustom": "自定義",
+    "profileAll": "全部",
+    "filterHost": "過濾主機…",
+    "filterAgent": "代理人",
+    "filterStatus": "狀態",
+    "pauseBtn": "暫停",
+    "resumeBtn": "簡歷",
+    "clearBtn": "清除",
+    "exportHar": "匯出 .har",
+    "recordSession": "記錄",
+    "stopSession": "停止",
+    "liveBadge": "直播",
+    "offlineBadge": "離線",
+    "noRequests": "尚未捕獲任何請求。",
+    "noRequestsDesc": "確保 AgentBridge 正在執行或啟用其他捕獲模式。",
+    "selectRequest": "選擇一個請求以進行檢查。",
+    "tabConversation": "對話",
+    "tabHeaders": "標題",
+    "tabRequest": "請求",
+    "tabResponse": "響應",
+    "tabTiming": "計時",
+    "tabLlm": "LLM",
+    "tabStats": "統計資訊",
+    "requestHeaders": "請求頭部",
+    "responseHeaders": "響應頭部",
+    "rawEvents": "原始事件",
+    "mergedView": "合併檢視",
+    "noBody": "沒有主體。",
+    "streaming": "流媒體…",
+    "manageHosts": "管理主機",
+    "copySnippet": "複製代理程式碼片段",
+    "addHost": "新增",
+    "hostPlaceholder": "api.openai.com",
+    "noHostsYet": "尚未新增自定義主機。",
+    "noSessionsYet": "還沒有會話",
+    "allTraffic": "所有流量（無會話）",
+    "sessionsDropdown": "會話",
+    "annotationPlaceholder": "新增備註…",
+    "contextFingerprint": "上下文指紋",
+    "llmProvider": "檢測到的提供者",
+    "llmApiKind": "API 型別",
+    "llmModel": "模型",
+    "llmMessages": "訊息",
+    "llmStream": "流媒體",
+    "llmMappedTo": "對映到",
+    "llmCostEstimate": "成本估算",
+    "systemProxyExitWarning": "系統範圍的代理仍然處於活動狀態 — 仍然離開頁面嗎？",
+    "customHostsTitle": "自定義主機",
+    "loading": "載入中…",
+    "copied": "已複製！",
+    "copy": "複製",
+    "httpProxyTitle": "HTTP 代理程式碼片段 — 埠 {port}",
+    "notRecording": "未錄製",
+    "anyStatus": "任何狀態",
+    "liveOnly": "__MISSING__:Live",
+    "viewingRecordedSession": "檢視錄製的會話",
+    "backToLive": "返回直播",
+    "untitledSession": "未命名會話",
+    "contextHistory": "上下文歷史",
+    "modelResponse": "模型響應",
+    "conversationNoMessages": "在此請求中未找到訊息。",
+    "conversationNotAvailable": "對話資料不可用。這可能不是 LLM 請求，或者主體無法解析。",
+    "loadingCharts": "載入圖表…",
+    "statsErrors": "錯誤",
+    "statsLatency": "延遲（最近 50 個請求）",
+    "statsNoData": "尚未有請求。開始會話錄製以捕獲統計資料。",
+    "statsStatusDistribution": "狀態分佈",
+    "statsSuccessful": "成功",
+    "statsTotalRequests": "總請求數",
+    "timingProxyOverhead": "代理開銷",
+    "timingUpstreamResponse": "上游響應",
+    "timingNoData": "沒有可用的時間資料。",
+    "timingTotalLatency": "總延遲",
+    "timingTimestamp": "時間戳",
+    "timingMethod": "方法",
+    "timingStatus": "狀態",
+    "timingRequestSize": "請求大小",
+    "timingResponseSize": "響應大小",
+    "pausedNewBadge": "{count} 新的",
+    "clearContextFilter": "清除"
+  },
+  "cliCommon": {
+    "concept": {
+      "code": {
+        "title": "CLI 程式碼的",
+        "phrase": "指向 OmniRoute 的程式碼工具",
+        "flow": "你 → CLI 程式碼 → OmniRoute → 提供者",
+        "seeOther": "檢視 →"
+      },
+      "agent": {
+        "title": "CLI 代理",
+        "phrase": "通用自主CLI代理，您可以指向OmniRoute",
+        "flow": "您 → CLI 代理 → OmniRoute → 提供者",
+        "seeOther": "檢視 →"
+      },
+      "acp": {
+        "title": "ACP 代理",
+        "phrase": "OmniRoute 作為執行後端（反向流）生成的 CLI",
+        "flow": "客戶端 → OmniRoute → 生成 CLI (stdio/ACP) → 響應",
+        "seeOther": "檢視 →"
+      }
+    },
+    "comparison": {
+      "title": "瞭解 OmniRoute 中的 3 種 CLI 型別",
+      "thisPage": "[此頁面 ✓]",
+      "open": "__MISSING__:Open →",
+      "code": {
+        "title": "程式碼工具",
+        "desc": "指向 Omni",
+        "flow": "你 → CLI → Omni → 提供者",
+        "examples": "例如：claude，codex"
+      },
+      "agent": {
+        "title": "廣泛自主代理",
+        "desc": "指向 Omni",
+        "flow": "你 → 代理 → Omni",
+        "examples": "例如：hermes，goose"
+      },
+      "acp": {
+        "title": "Omni 使用的後端 CLI",
+        "desc": "反向執行",
+        "flow": "Omni → spawn CLI → resp",
+        "examples": "例如：claude，codex (ACP)"
+      }
+    },
+    "card": {
+      "detected": "檢測到",
+      "notDetected": "未檢測到",
+      "configured": "已配置",
+      "notConfigured": "未配置",
+      "configure": "配置 →",
+      "howToInstall": "如何安裝 →",
+      "manualConfig": "手動配置",
+      "installGuide": "安裝指南",
+      "endpointLabel": "端點",
+      "baseUrlFull": "__MISSING__:Full Base URL",
+      "baseUrlPartial": "部分基礎 URL",
+      "refreshDetection": "重新整理檢測",
+      "alsoAcp": "也 ACP",
+      "connectProviderHint": "__MISSING__:Connect a provider in Providers"
+    },
+    "detail": {
+      "back": "返回",
+      "apply": "儲存",
+      "reset": "清除",
+      "manualConfig": "手動配置",
+      "vendor": "供應商",
+      "category": "型別",
+      "detectionStatus": "檢測",
+      "configStatus": "配置",
+      "baseUrlLabel": "基礎 URL",
+      "apiKeyLabel": "API 金鑰",
+      "modelMappingLabel": "模型對映",
+      "noActiveProviders": "沒有活動的提供者。",
+      "noActiveProvidersDesc": "請前往 Providers 連線至少 1 個提供者，然後再配置 CLI。",
+      "openProviders": "開啟提供者 →"
+    }
+  },
+  "cliCode": {
+    "pageTitle": "CLI 程式碼的",
+    "pageSubtitle": "指向 OmniRoute 的程式碼工具",
+    "searchPlaceholder": "搜尋 CLI…",
+    "filterDetectionLabel": "檢測",
+    "filterBaseUrlLabel": "基礎 URL",
+    "detectionAll": "所有",
+    "detectionInstalled": "已安裝",
+    "detectionNotFound": "未找到",
+    "baseUrlAll": "所有",
+    "baseUrlFull": "完整",
+    "baseUrlPartial": "部分"
+  },
+  "cliAgents": {
+    "pageTitle": "CLI 代理",
+    "pageSubtitle": "通用自主CLI代理",
+    "refreshDetection": "重新整理檢測",
+    "searchPlaceholder": "搜尋代理…",
+    "detectionFilterLabel": "檢測",
+    "detectionAll": "全部",
+    "detectionInstalled": "已安裝",
+    "detectionNotInstalled": "未安裝",
+    "visibleCount": "{count} 可見",
+    "emptyState": "未找到符合當前篩選條件的 CLI 代理。"
+  },
+  "acpAgents": {
+    "pageTitle": "ACP 代理",
+    "pageSubtitle": "OmniRoute 作為執行後端生成的 CLI",
+    "scanning": "正在檢測代理…",
+    "refresh": "重新整理",
+    "setupGuideTitle": "設定指南",
+    "setupGuideDetectCliTitle": "檢測 CLI",
+    "setupGuideDetectCliDesc": "代理通過在 PATH 中執行 --version 命令來識別。",
+    "setupGuideCustomAgentTitle": "新增自定義代理",
+    "setupGuideCustomAgentDesc": "填寫下面的表格以註冊自定義 CLI 代理。",
+    "setupGuideCommandMissingTitle": "找不到命令",
+    "setupGuideCommandMissingDesc": "檢查二進位制檔案是否在 PATH 中。",
+    "fingerprintSettingsHint": "在中配置路由和指紋",
+    "settingsRoutingLink": "設定 → 路由",
+    "installed": "已安裝",
+    "notFound": "未找到",
+    "builtIn": "內建",
+    "custom": "自定義",
+    "agentUseCaseHint": "通過 ACP 可用以生成。",
+    "remove": "移除",
+    "addCustomAgent": "新增自定義代理",
+    "addCustomAgentDesc": "通過 ACP 註冊一個自定義 CLI 代理。",
+    "addAgent": "新增代理",
+    "agentName": "名稱",
+    "agentNamePlaceholder": "我的代理",
+    "binaryName": "二進位制",
+    "binaryNamePlaceholder": "例如：myagent",
+    "versionCommand": "版本命令",
+    "versionCommandPlaceholder": "例如：myagent --version",
+    "spawnArgs": "生成引數",
+    "spawnArgsPlaceholder": "例如：--quiet，--json",
+    "cliCodeRedirectCta": "開啟 CLI 程式碼的"
+  },
+  "agentSkills": {
+    "pageTitle": "特工技能",
+    "pageSubtitle": "教你的代理操作 OmniRoute — 22 個 API 區域 + 20 個 CLI 家族",
+    "conceptCard": {
+      "agent": {
+        "title": "代理技能 — 外呼",
+        "description": "代理技能是機器可讀的 SKILL.md 文件，外部 AI 代理（Claude Code、Cursor、Copilot 等）從 GitHub 獲取這些文件，以瞭解如何通過 REST 或 CLI 操作 OmniRoute。它們由代理讀取，而不是由 OmniRoute 執行。",
+        "crossLinkLabel": "瞭解區別 →"
+      },
+      "omni": {
+        "title": "全能技能 — 入站",
+        "description": "Omni Skills 是 OmniRoute 在每個請求中注入到模型上下文中的沙盒工具。它們由 OmniRoute 執行，而不是由代理讀取。",
+        "crossLinkLabel": "瞭解差異 →"
+      },
+      "comparison": {
+        "colAgent": "特工技能",
+        "colOmni": "全能技能",
+        "whatIs": {
+          "label": "它是什麼",
+          "agent": "機器可讀的 SKILL.md，教外部代理如何操作 OmniRoute",
+          "omni": "OmniRoute 注入到 LLM 請求中的可執行工具"
+        },
+        "direction": {
+          "label": "方向",
+          "agent": "外部 — 外部代理學習控制 OmniRoute",
+          "omni": "入站 — OmniRoute 為經過它的模型提供工具"
+        },
+        "executor": {
+          "label": "執行者",
+          "agent": "外部代理（讀取 markdown → 通過 API/CLI 執行）",
+          "omni": "OmniRoute 本身（攔截 tool_calls，Docker 沙箱）"
+        },
+        "storage": {
+          "label": "儲存",
+          "agent": "動態目錄 (/api/agent-skills) → GitHub 上的 SKILL.md",
+          "omni": "SQLite (SkillsMP / skills.sh / local)"
+        },
+        "tagline": {
+          "label": "標語",
+          "agent": "教你的代理使用 OmniRoute",
+          "omni": "為 OmniRoute 模型提供可執行工具"
+        }
+      }
+    },
+    "filters": {
+      "category": "類別",
+      "area": "區域",
+      "searchPlaceholder": "搜尋技能…"
+    },
+    "categoryApi": "API",
+    "categoryCli": "命令列介面",
+    "categoryConfig": "配置",
+    "filterAll": "所有",
+    "coverageLabel": "覆蓋率",
+    "mcpUrl": "MCP URL",
+    "a2aLink": "A2A",
+    "copyUrl": "複製 URL",
+    "viewOnGithub": "在 GitHub 上檢視",
+    "previewLoading": "載入技能文件…",
+    "previewError": "載入技能文件失敗。",
+    "previewEmpty": "選擇一個技能以預覽其文件。",
+    "generateButton": "生成缺失的技能",
+    "coverageBar": {
+      "complete": "完成",
+      "partial": "部分"
+    },
+    "noSkillsFound": "未找到與您的篩選條件匹配的技能。",
+    "regenerateConfirm": "這將重新生成所有缺失的 SKILL.md 檔案。繼續嗎？",
+    "regenerateRunning": "正在重新生成技能…",
+    "regenerateSuccess": "技能成功重生。",
+    "regenerateError": "無法重新生成技能。"
+  },
+  "freeProviderRankingsPage": {
+    "title": "__MISSING__:Free Provider Rankings",
+    "subtitle": "__MISSING__:Best free providers ranked by model ELO scores from Arena AI leaderboards",
+    "loading": "__MISSING__:Loading rankings...",
+    "errorLoading": "__MISSING__:Failed to load rankings",
+    "emptyState": "__MISSING__:No rankings available yet. Arena ELO data syncs on startup (daily) — check back shortly, or trigger a manual sync. Disable Arena ELO Sync in Feature Flags or set ARENA_ELO_SYNC_ENABLED=false to opt out.",
+    "bestModel": "__MISSING__:Best",
+    "allCategories": "__MISSING__:All Categories",
+    "categoryDefault": "__MISSING__:Default",
+    "categoryCoding": "__MISSING__:Coding",
+    "categoryReview": "__MISSING__:Review",
+    "categoryDocumentation": "__MISSING__:Documentation",
+    "categoryDebugging": "__MISSING__:Debugging",
+    "colRank": "__MISSING__:Rank",
+    "colProvider": "__MISSING__:Provider",
+    "colTopModel": "__MISSING__:Top Model",
+    "colScore": "__MISSING__:Score",
+    "colAvgScore": "__MISSING__:Avg Score",
+    "colModels": "__MISSING__:Models",
+    "colType": "__MISSING__:Type",
+    "filterConfiguredOnly": "__MISSING__:Configured only",
+    "filterAvailableOnly": "__MISSING__:Available only",
+    "filterAvailableOnlyHelp": "__MISSING__:Hide providers whose connections are all rate-limited or out of quota.",
+    "configuredOnly": "__MISSING__:Configured Only",
+    "configuredOnlyHint": "__MISSING__:Show only providers with active connections",
+    "noConfiguredProviders": "__MISSING__:No configured providers found. Add a provider connection first.",
+    "colConfigured": "__MISSING__:Status"
+  },
+  "discovery": {
+    "title": "__MISSING__:Provider Discovery",
+    "subtitle": "__MISSING__:Scan providers for free/unlimited access methods and review findings. Opt-in, local-only.",
+    "scanLabel": "__MISSING__:Provider to scan",
+    "scanPlaceholder": "__MISSING__:e.g. huggingchat",
+    "scan": "__MISSING__:Scan",
+    "scanning": "__MISSING__:Scanning…",
+    "scanQueued": "__MISSING__:Scan complete for {provider}.",
+    "scanFailed": "__MISSING__:Scan failed.",
+    "loadFailed": "__MISSING__:Failed to load discovery results.",
+    "localOnlyNote": "__MISSING__:This tool is local-only (loopback). Scans run from this machine and are never reachable remotely.",
+    "verify": "__MISSING__:Verify",
+    "verifyFailed": "__MISSING__:Failed to verify finding.",
+    "delete": "__MISSING__:Delete",
+    "deleteFailed": "__MISSING__:Failed to delete finding.",
+    "deleteTitle": "__MISSING__:Delete discovery result",
+    "deleteConfirm": "__MISSING__:Delete the discovery finding for {provider}? This cannot be undone.",
+    "emptyTitle": "__MISSING__:No discovery results yet",
+    "emptyDescription": "__MISSING__:Run a scan above to look for free access methods on a provider.",
+    "risk": "__MISSING__:Risk",
+    "method": "__MISSING__:Method",
+    "auth": "__MISSING__:Auth",
+    "feasibility": "__MISSING__:Feasibility",
+    "models": "__MISSING__:Models"
+  }
+}
diff --git a/src/instrumentation-node.ts b/src/instrumentation-node.ts
index ad132b51f8..4cc92e1d7f 100755
--- a/src/instrumentation-node.ts
+++ b/src/instrumentation-node.ts
@@ -35,6 +35,67 @@ export function renameProcessTitle(currentTitle: string): string {
   return `omniroute${currentTitle.slice("next-server".length)}`;
 }
 
+/**
+ * Normalize any thrown/rejected value into a real `Error` instance.
+ *
+ * Next.js's own `registerInstrumentation()` wrapper (see
+ * `node_modules/next/dist/server/lib/router-utils/instrumentation-globals.external.js`)
+ * unconditionally does `err.message = \`...${err.message}\`` on whatever our
+ * `register()` export rejects with, assuming it is always an `Error`. If a raw
+ * non-Error primitive bubbles up instead (e.g. sql.js's WASM adapter throws the
+ * bare string `"Database closed"` — see `./lib/db/adapters/sqljsAdapter.ts`),
+ * that assignment throws `TypeError: Cannot create property 'message' on
+ * string '...'` in strict mode, masking the original error and crashing the
+ * whole server on every boot (#6560). Normalizing before it leaves our code
+ * guarantees Next always receives something `.message`-assignable.
+ */
+export function normalizeBootError(err: unknown): Error {
+  return err instanceof Error ? err : new Error(String(err));
+}
+
+// Matches sql.js's raw `throw "Database closed"` (and similarly-worded
+// variants) thrown when a query runs against an already-closed WASM handle —
+// typically a stale globalThis-cached adapter left over by a prior
+// close/reload racing with this boot (#6560).
+const TRANSIENT_DB_CLOSED_RE = /database\s*(connection\s*)?(is\s*)?closed/i;
+
+/**
+ * Initialize the SQLite singleton for boot, tolerating one transient
+ * "database closed" failure (#6560) by retrying once — the driverFactory
+ * cache-eviction fix (`preInitSqlJs`) makes the retry create a fresh adapter
+ * instead of reusing the dead one. Any other failure (or a second consecutive
+ * "database closed") is re-thrown as a real `Error` via `normalizeBootError`
+ * so it can never crash instrumentation with a masking TypeError — the caller
+ * (`registerNodejs`) still surfaces it as a real boot failure.
+ *
+ * `ensureDbInitializedFn` is only for tests to inject a fake without
+ * module-mocking (`node:test` does not support `mock.module` reliably here).
+ */
+export async function ensureDbReadyForBoot(
+  ensureDbInitializedFn?: () => Promise<void>
+): Promise<void> {
+  const ensureDbInitialized =
+    ensureDbInitializedFn ?? (await import("@/lib/db/core")).ensureDbInitialized;
+
+  try {
+    await ensureDbInitialized();
+  } catch (err: unknown) {
+    const normalized = normalizeBootError(err);
+    if (!TRANSIENT_DB_CLOSED_RE.test(normalized.message)) {
+      throw normalized;
+    }
+    console.warn(
+      "[STARTUP] Database was closed by a prior reload/shutdown — retrying with a fresh connection (#6560):",
+      normalized.message
+    );
+    try {
+      await ensureDbInitialized();
+    } catch (retryErr: unknown) {
+      throw normalizeBootError(retryErr);
+    }
+  }
+}
+
 function isBackgroundServicesDisabled(): boolean {
   const raw = process.env.OMNIROUTE_DISABLE_BACKGROUND_SERVICES;
   if (!raw) return false;
@@ -215,9 +276,8 @@ export async function registerNodejs(): Promise<void> {
     // without this the dashboard mode (auto/custom/adaptive) silently reverts to
     // the passthrough default on every restart. Previously this was only wired into
     // the unused `server-init.ts`, so it never ran in production.
-    const { hydrateThinkingBudgetConfig } = await import(
-      "@omniroute/open-sse/services/thinkingBudget.ts"
-    );
+    const { hydrateThinkingBudgetConfig } =
+      await import("@omniroute/open-sse/services/thinkingBudget.ts");
     if (hydrateThinkingBudgetConfig(settings)) {
       console.log("[STARTUP] Thinking-Budget config restored from settings");
     }
@@ -271,7 +331,7 @@ export async function registerNodejs(): Promise<void> {
     console.warn("[COMPLIANCE] Could not initialize audit log:", msg);
   }
 
-  await import("@/lib/db/core").then(({ ensureDbInitialized }) => ensureDbInitialized());
+  await ensureDbReadyForBoot();
 
   // Storage-configured scheduled VACUUM (#4437): registers the timer from
   // Settings > System & Storage and persists lastVacuumAt for the UI.
@@ -380,7 +440,7 @@ export async function registerNodejs(): Promise<void> {
       console.warn("[STARTUP] memory decay sweep failed to start (non-fatal):", msg);
     }
 
-    // Real-time dashboard WebSocket daemon (port 20129): powers Combo Studio Live,
+    // Real-time dashboard WebSocket daemon (port 20132): powers Combo Studio Live,
     // the Home live-pulse, and Live Compression. liveServer.ts auto-starts the
     // daemon on import (gated by OMNIROUTE_ENABLE_LIVE_WS, default ON) — but NOTHING
     // imported it in the packaged standalone/PM2 runtime. Only the unused
diff --git a/src/lib/api/modelTestRunner.ts b/src/lib/api/modelTestRunner.ts
index 175a46b167..87a512fa30 100644
--- a/src/lib/api/modelTestRunner.ts
+++ b/src/lib/api/modelTestRunner.ts
@@ -113,7 +113,7 @@ async function findCustomModelMetadata(providerId: string, modelId: string) {
   }
 }
 
-function buildInternalChatRequest(testBody: Record<string, unknown>, signal: AbortSignal) {
+export function buildInternalChatRequest(testBody: Record<string, unknown>, signal: AbortSignal) {
   return new Request(`${INTERNAL_ORIGIN}/v1/chat/completions`, {
     method: "POST",
     headers: {
@@ -121,6 +121,9 @@ function buildInternalChatRequest(testBody: Record<string, unknown>, signal: Abo
       // Reuse the existing strict-mode internal bypass for live health checks.
       "X-Internal-Test": "combo-health-check",
       "X-OmniRoute-No-Cache": "true",
+      // #6240: a connection test must be clean — never let the operator's globally-enabled
+      // Output Styles (e.g. "Ultra terse") leak a system prompt into a test-model call.
+      "X-OmniRoute-Compression": "off",
       "X-Request-Id": `model-test-${randomUUID()}`,
     },
     body: JSON.stringify(testBody),
@@ -128,13 +131,14 @@ function buildInternalChatRequest(testBody: Record<string, unknown>, signal: Abo
   });
 }
 
-function buildInternalRerankRequest(testBody: Record<string, unknown>, signal: AbortSignal) {
+export function buildInternalRerankRequest(testBody: Record<string, unknown>, signal: AbortSignal) {
   return new Request(`${INTERNAL_ORIGIN}/v1/rerank`, {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
       "X-Internal-Test": "combo-health-check",
       "X-OmniRoute-No-Cache": "true",
+      "X-OmniRoute-Compression": "off",
       "X-Request-Id": `model-test-${randomUUID()}`,
     },
     body: JSON.stringify(testBody),
diff --git a/src/lib/api/proxyRegistryRouteHandlers.ts b/src/lib/api/proxyRegistryRouteHandlers.ts
index dc93873956..b5b2e9bf4e 100644
--- a/src/lib/api/proxyRegistryRouteHandlers.ts
+++ b/src/lib/api/proxyRegistryRouteHandlers.ts
@@ -94,7 +94,13 @@ export async function handleProxyUpdate(request: Request) {
       });
     }
 
-    const { id, assignment, ...changes } = validation.data;
+    const { id, assignment, ...rawChanges } = validation.data;
+    // Strip keys the client didn't send — .partial() resolves absent fields to
+    // undefined, which would silently overwrite DB values via the spread merge
+    // in updateProxyRow. Only include keys the client explicitly provided.
+    const changes = Object.fromEntries(
+      Object.entries(rawChanges).filter(([_, v]) => v !== undefined)
+    );
     if (assignment) {
       const result = await updateProxyAndAssign(id, changes, assignment);
       if (!result?.proxy) {
diff --git a/src/lib/chaos/chaosConfig.ts b/src/lib/chaos/chaosConfig.ts
new file mode 100644
index 0000000000..a132c9015f
--- /dev/null
+++ b/src/lib/chaos/chaosConfig.ts
@@ -0,0 +1,119 @@
+/**
+ * lib/chaos/chaosConfig.ts
+ *
+ * Chaos Mode configuration — persisted per-instance settings for:
+ * - Which providers/models participate
+ * - Default mode (parallel vs collaborative)
+ * - System prompt overrides
+ * - Max timeout per model call
+ */
+
+import { z } from "zod";
+import { getSettings, updateSettings } from "@/lib/db/settings";
+
+// ── Schema ───────────────────────────────────────────────────────────────────
+
+export const chaosConfigSchema = z.object({
+  enabled: z.boolean().default(false),
+  defaultMode: z.enum(["parallel", "collaborative"]).default("parallel"),
+  providerOverrides: z
+    .array(
+      z.object({
+        providerId: z.string().min(1),
+        modelId: z.string().optional(),
+        enabled: z.boolean().default(true),
+      })
+    )
+    .max(200)
+    .default([]),
+  systemPrompt: z.string().max(10_000).optional(),
+  timeoutMs: z.number().int().min(5_000).max(600_000).default(120_000),
+  maxTokens: z.number().int().min(256).max(128_000).default(4096),
+});
+
+export type ChaosConfig = z.infer<typeof chaosConfigSchema>;
+
+export const DEFAULT_CHAOS_CONFIG: ChaosConfig = {
+  enabled: false,
+  defaultMode: "parallel",
+  providerOverrides: [],
+  systemPrompt: undefined,
+  timeoutMs: 120_000,
+  maxTokens: 4096,
+};
+
+// ── Persistence ──────────────────────────────────────────────────────────────
+//
+// Persisted via the shared settings store (src/lib/db/settings.ts::getSettings/
+// updateSettings — the `key_value` table, namespace 'settings') rather than
+// hand-rolled SQL against a nonexistent `settings` table (the original PR queried
+// a table that was never created — every read silently fell back to defaults and
+// every write/reset threw). Follows the repo convention of routing all settings
+// reads/writes through src/lib/db/settings.ts (see CLAUDE.md → Database).
+
+const CONFIG_KEY = "chaosModeConfig";
+
+let _configCache: ChaosConfig | null = null;
+
+/**
+ * Get the current Chaos Mode configuration.
+ */
+export async function getChaosConfig(): Promise<ChaosConfig> {
+  if (_configCache) return _configCache;
+
+  try {
+    const settings = await getSettings();
+    const raw = settings[CONFIG_KEY];
+
+    if (raw === undefined || raw === null) {
+      _configCache = DEFAULT_CHAOS_CONFIG;
+      return _configCache;
+    }
+
+    const result = chaosConfigSchema.safeParse(raw);
+    if (result.success) {
+      _configCache = result.data;
+      return result.data;
+    }
+
+    // Fall back to default if stored config is invalid
+    _configCache = DEFAULT_CHAOS_CONFIG;
+    return _configCache;
+  } catch {
+    _configCache = DEFAULT_CHAOS_CONFIG;
+    return _configCache;
+  }
+}
+
+/**
+ * Update the Chaos Mode configuration.
+ */
+export async function setChaosConfig(config: ChaosConfig): Promise<ChaosConfig> {
+  const validated = chaosConfigSchema.parse(config);
+
+  await updateSettings({ [CONFIG_KEY]: validated });
+
+  // Invalidate cache
+  _configCache = null;
+
+  return validated;
+}
+
+/**
+ * Reset chaos config to defaults.
+ */
+export async function resetChaosConfig(): Promise<ChaosConfig> {
+  await updateSettings({ [CONFIG_KEY]: null });
+  _configCache = null;
+  return DEFAULT_CHAOS_CONFIG;
+}
+
+/**
+ * Invalidate the in-memory config cache without touching persisted settings.
+ * Needed whenever the underlying DB/settings store is reset out-of-band (e.g.
+ * test teardown calling resetDbInstance()) — otherwise getChaosConfig() keeps
+ * serving a stale in-memory value after the store it was read from is gone.
+ */
+export function invalidateChaosConfigCache(): void {
+  _configCache = null;
+}
diff --git a/src/lib/chaos/chaosExecutor.ts b/src/lib/chaos/chaosExecutor.ts
new file mode 100644
index 0000000000..6029460cd3
--- /dev/null
+++ b/src/lib/chaos/chaosExecutor.ts
@@ -0,0 +1,439 @@
+/**
+ * lib/chaos/chaosExecutor.ts
+ *
+ * Shared Chaos Mode execution engine — used by BOTH:
+ *   - POST /api/chaos/run       (dashboard, management-session auth)
+ *   - POST /api/skills/collect/chaos  (external, Bearer-token auth)
+ *
+ * Eliminates the ~150 lines of duplicate dispatch logic that previously existed
+ * in both route files.
+ */
+import { getProviderConnections } from "@/models";
+import { getChaosConfig, type ChaosConfig } from "@/lib/chaos/chaosConfig";
+import { POST as postChatCompletion } from "@/app/api/v1/chat/completions/route";
+
+// Wrapped in an object (rather than called as a bare imported function) so unit
+// tests can swap it out via `mock.method(chatDispatch, "postChatCompletion", ...)`
+// without hitting real upstream providers — the same pattern src/lib/batches/
+// dispatch.ts uses for its `dispatch` export (ES module named bindings are
+// read-only and cannot be mocked directly).
+export const chatDispatch = {
+  postChatCompletion,
+};
+
+// ── Exported types ───────────────────────────────────────────────────────────
+
+export interface ProviderInfo {
+  id: string;
+  name: string;
+  provider: string;
+  defaultModel: string | null;
+}
+
+export interface ModelResult {
+  providerId: string;
+  providerName: string;
+  modelId: string;
+  status: "success" | "error" | "skipped";
+  content: string | null;
+  error?: string;
+  durationMs: number;
+}
+
+export type ChaosMode = "parallel" | "collaborative";
+
+export interface ChaosRunInput {
+  task: string;
+  providers?: string[];
+  mode?: ChaosMode;
+  systemPrompt?: string;
+  /** Override the global timeout for this single run */
+  timeoutMs?: number;
+  /** Override max_tokens sent to each model (default 4096) */
+  maxTokens?: number;
+  /**
+   * API key to attribute the in-process dispatch calls to (usage accounting,
+   * per-key policy). Optional — omitted for dashboard-initiated runs, which fall
+   * back to the same "local mode" (no Authorization header) path used by
+   * src/lib/evals/runtime.ts and src/lib/batches/dispatch.ts.
+   */
+  apiKey?: string | null;
+}
+
+export interface ChaosRunResult {
+  task: string;
+  mode: ChaosMode;
+  startedAt: string;
+  totalProviders: number;
+  totalResults: number;
+  models: ModelResult[];
+  summary?: string;
+}
+
+interface EffectiveRunParams {
+  mode: ChaosMode;
+  timeoutMs: number;
+  maxTokens: number;
+  effectiveSystemPrompt: string;
+}
+
+// ── Constants ─────────────────────────────────────────────────────────────────
+
+export const DEFAULT_SYSTEM_PROMPT = `You are one of several AI models working in CHAOS MODE.
+
+Your job:
+1. Analyze the user's task thoroughly
+2. Produce the best possible response using your unique strengths
+3. Be concise but complete — your output will be combined with other models' outputs
+4. Do NOT refer to "other models" or "CHAOS MODE" in your response — just answer the task directly`;
+
+export const COLLABORATIVE_SYSTEM_PROMPT = `You are one of several AI models working in CHAOS MODE (collaborative).
+
+Your job:
+1. You will see the task AND the previous model's output
+2. Build upon, refine, critique, or extend the previous work
+3. Add new insights, fix issues, or provide an alternative perspective
+4. Do NOT refer to "CHAOS MODE" or other models explicitly — just contribute your part naturally`;
+
+const DEFAULT_MAX_TOKENS = 4096;
+/** Maximum concurrent fetch requests in parallel mode */
+const MAX_CONCURRENCY = 10;
+
+// ── Internal helpers — config/param resolution ──────────────────────────────
+
+function resolveEffectiveRunParams(
+  input: ChaosRunInput,
+  globalConfig: ChaosConfig
+): EffectiveRunParams {
+  const mode: ChaosMode = input.mode || globalConfig.defaultMode || "parallel";
+  const timeoutMs = input.timeoutMs || globalConfig.timeoutMs || 120_000;
+  const maxTokens = input.maxTokens || globalConfig.maxTokens || DEFAULT_MAX_TOKENS;
+  const effectiveSystemPrompt =
+    input.systemPrompt ||
+    globalConfig.systemPrompt ||
+    (mode === "collaborative" ? COLLABORATIVE_SYSTEM_PROMPT : DEFAULT_SYSTEM_PROMPT);
+
+  return { mode, timeoutMs, maxTokens, effectiveSystemPrompt };
+}
+
+/**
+ * Resolve the best model ID for a provider connection.
+ * Applies provider overrides from global chaos config if present.
+ */
+function resolveModelId(
+  conn: { provider?: string; id?: string; defaultModel?: string | null },
+  overrides: ChaosConfig["providerOverrides"]
+): string {
+  const override = overrides.find(
+    (o) =>
+      o.enabled &&
+      (o.providerId.toLowerCase() === (conn.provider || "").toLowerCase() ||
+        o.providerId.toLowerCase() === (conn.id || "").toLowerCase())
+  );
+  if (override?.modelId) return override.modelId;
+  return conn.defaultModel || conn.provider || conn.id || "unknown";
+}
+
+// ── Internal helpers — provider selection ───────────────────────────────────
+
+/** Narrow `active` connections down to the caller-requested `providers` filter. */
+function filterByRequestedProviders(active: any[], requested: string[]): any[] {
+  const filterSet = new Set(requested.map((p: string) => p.toLowerCase()));
+  const selected = active.filter((c: any) => filterSet.has((c.provider ?? "").toLowerCase()));
+  if (selected.length === 0) {
+    throw new Error(`None of the specified providers are active: ${requested.join(", ")}`);
+  }
+  return selected;
+}
+
+/** Narrow `active` connections down to the enabled global-config overrides (soft filter). */
+function filterByEnabledOverrides(
+  active: any[],
+  enabledOverrides: ChaosConfig["providerOverrides"]
+): any[] {
+  const overrideIds = new Set(enabledOverrides.map((o) => o.providerId.toLowerCase()));
+  const selected = active.filter(
+    (c: any) =>
+      overrideIds.has((c.provider ?? "").toLowerCase()) || overrideIds.has((c.id ?? "").toLowerCase())
+  );
+  return selected.length > 0 ? selected : active; // fallback to all active
+}
+
+function toProviderInfoList(selected: any[]): ProviderInfo[] {
+  const providerMap = new Map<string, ProviderInfo>();
+  for (const conn of selected) {
+    const providerKey = conn.provider || conn.id;
+    if (!providerMap.has(providerKey)) {
+      providerMap.set(providerKey, {
+        id: conn.id,
+        name: conn.name || conn.provider || providerKey,
+        provider: conn.provider || providerKey,
+        defaultModel: conn.defaultModel || null,
+      });
+    }
+  }
+  return Array.from(providerMap.values());
+}
+
+/**
+ * Fetch active provider connections and narrow them down to the requested
+ * (explicit `providers` filter, else enabled global-config overrides, else all
+ * active) set, deduplicated by provider id.
+ */
+async function selectChaosProviders(
+  input: ChaosRunInput,
+  globalConfig: ChaosConfig
+): Promise<{ providers: ProviderInfo[]; enabledOverrides: ChaosConfig["providerOverrides"] }> {
+  const allConnections = await getProviderConnections().catch(() => [] as any[]);
+  const active = (Array.isArray(allConnections) ? allConnections : []).filter(
+    (c: any) => c.isActive !== false
+  );
+
+  if (active.length === 0) {
+    throw new Error("No active provider connections found");
+  }
+
+  const enabledOverrides = globalConfig.providerOverrides.filter((o) => o.enabled);
+
+  let selected = active;
+  if (input.providers && input.providers.length > 0) {
+    selected = filterByRequestedProviders(active, input.providers);
+  } else if (enabledOverrides.length > 0) {
+    selected = filterByEnabledOverrides(active, enabledOverrides);
+  }
+
+  return { providers: toProviderInfoList(selected), enabledOverrides };
+}
+
+// ── Internal helpers — single-model dispatch ────────────────────────────────
+
+function buildDispatchRequest(
+  model: string,
+  messages: { role: string; content: string }[],
+  maxTokens: number,
+  timeoutMs: number,
+  apiKey?: string | null
+): Request {
+  const headers = new Headers({ "Content-Type": "application/json" });
+  if (apiKey) {
+    headers.set("Authorization", `Bearer ${apiKey}`);
+  }
+  return new Request("http://localhost/api/v1/chat/completions", {
+    method: "POST",
+    headers,
+    body: JSON.stringify({ model, messages, stream: false, max_tokens: maxTokens }),
+    signal: AbortSignal.timeout(timeoutMs),
+  });
+}
+
+async function parseDispatchResponse(
+  res: Response,
+  ctx: { providerId: string; providerName: string; modelId: string },
+  start: number
+): Promise<ModelResult> {
+  if (!res.ok) {
+    const errText = await res.text().catch(() => "unknown error");
+    return {
+      ...ctx,
+      status: "error",
+      content: null,
+      error: `API ${res.status}: ${errText.slice(0, 500)}`,
+      durationMs: Math.round(performance.now() - start),
+    };
+  }
+
+  const data = await res.json();
+  const content =
+    data.choices?.[0]?.message?.content ?? data.choices?.[0]?.text ?? JSON.stringify(data);
+
+  return {
+    ...ctx,
+    status: "success",
+    content,
+    durationMs: Math.round(performance.now() - start),
+  };
+}
+
+function buildDispatchErrorResult(
+  err: unknown,
+  ctx: { providerId: string; providerName: string; modelId: string },
+  start: number,
+  timeoutMs: number
+): ModelResult {
+  const errObj = err as { name?: string; type?: string; message?: string };
+  const isAbort = errObj?.name === "AbortError" || errObj?.type === "aborted";
+  return {
+    ...ctx,
+    status: "error",
+    content: null,
+    error: isAbort ? `timeout (${timeoutMs}ms)` : (errObj?.message ?? String(err)),
+    durationMs: Math.round(performance.now() - start),
+  };
+}
+
+/**
+ * Dispatch to OmniRoute's own /v1/chat/completions handler for a given
+ * provider+model — in-process, via a synthetic Request handed directly to the
+ * route's POST handler. No network hop, no port dependency. Mirrors the
+ * established pattern in src/lib/batches/dispatch.ts and src/lib/evals/runtime.ts
+ * (which the codebase's outbound-self-call convention requires — see #6679 review).
+ */
+async function dispatchToModel(
+  providerId: string,
+  providerName: string,
+  modelId: string,
+  messages: { role: string; content: string }[],
+  timeoutMs: number,
+  maxTokens: number,
+  apiKey?: string | null
+): Promise<ModelResult> {
+  const start = performance.now();
+  const ctx = { providerId, providerName, modelId };
+
+  try {
+    const model = modelId || providerId;
+    const request = buildDispatchRequest(model, messages, maxTokens, timeoutMs, apiKey);
+    const res = await chatDispatch.postChatCompletion(request);
+    return await parseDispatchResponse(res, ctx, start);
+  } catch (err: unknown) {
+    return buildDispatchErrorResult(err, ctx, start, timeoutMs);
+  }
+}
+
+/**
+ * Run an array of async functions with a concurrency limit.
+ * Uses a simple pooling approach: start up to `limit` tasks at once,
+ * and as each completes, start the next one.
+ */
+async function runWithConcurrencyLimit<T>(tasks: (() => Promise<T>)[], limit: number): Promise<T[]> {
+  const results: T[] = new Array(tasks.length);
+  let nextIndex = 0;
+
+  async function worker(): Promise<void> {
+    while (nextIndex < tasks.length) {
+      const idx = nextIndex++;
+      results[idx] = await tasks[idx]();
+    }
+  }
+
+  const workers = Array.from({ length: Math.min(limit, tasks.length) }, () => worker());
+  await Promise.all(workers);
+  return results;
+}
+
+// ── Internal helpers — mode dispatch ────────────────────────────────────────
+
+function buildMessages(
+  systemPrompt: string,
+  userContent: string
+): { role: "system" | "user"; content: string }[] {
+  return [
+    { role: "system", content: systemPrompt },
+    { role: "user", content: userContent },
+  ];
+}
+
+async function dispatchParallel(
+  providers: ProviderInfo[],
+  input: ChaosRunInput,
+  overrides: ChaosConfig["providerOverrides"],
+  params: EffectiveRunParams
+): Promise<ModelResult[]> {
+  const tasks = providers.map((p) => () => {
+    const modelId = resolveModelId(p, overrides);
+    const messages = buildMessages(params.effectiveSystemPrompt, input.task);
+    return dispatchToModel(
+      p.id,
+      p.name,
+      modelId,
+      messages,
+      params.timeoutMs,
+      params.maxTokens,
+      input.apiKey
+    );
+  });
+
+  const results = await runWithConcurrencyLimit(tasks, MAX_CONCURRENCY);
+
+  // Sort: successes first, then errors, then by duration
+  results.sort((a, b) => {
+    if (a.status === "success" && b.status !== "success") return -1;
+    if (a.status !== "success" && b.status === "success") return 1;
+    return a.durationMs - b.durationMs;
+  });
+
+  return results;
+}
+
+async function dispatchCollaborative(
+  providers: ProviderInfo[],
+  input: ChaosRunInput,
+  overrides: ChaosConfig["providerOverrides"],
+  params: EffectiveRunParams
+): Promise<ModelResult[]> {
+  const results: ModelResult[] = [];
+  let context = input.task;
+
+  for (const p of providers) {
+    const modelId = resolveModelId(p, overrides);
+    const messages = buildMessages(params.effectiveSystemPrompt, context);
+
+    const result = await dispatchToModel(
+      p.id,
+      p.name,
+      modelId,
+      messages,
+      params.timeoutMs,
+      params.maxTokens,
+      input.apiKey
+    );
+    results.push(result);
+
+    if (result.status === "success" && result.content) {
+      context = `Task: ${input.task}\n\nPrevious model's output:\n${result.content}\n\n---\n\nPlease refine, extend, critique, or provide an alternative perspective on the above.`;
+    }
+  }
+
+  return results;
+}
+
+function buildCollaborativeSummary(mode: ChaosMode, results: ModelResult[]): string | undefined {
+  if (mode !== "collaborative") return undefined;
+  return (
+    results
+      .filter((r) => r.status === "success" && r.content)
+      .map((r) => r.content!)
+      .join("\n\n---\n\n") || undefined
+  );
+}
+
+// ── Main execution function ──────────────────────────────────────────────────
+
+/**
+ * Execute a Chaos Mode run.
+ *
+ * This is the single shared implementation used by both API routes.
+ */
+export async function executeChaosRun(input: ChaosRunInput): Promise<ChaosRunResult> {
+  const globalConfig = await getChaosConfig();
+  const params = resolveEffectiveRunParams(input, globalConfig);
+  const { providers, enabledOverrides } = await selectChaosProviders(input, globalConfig);
+
+  const startedAt = new Date().toISOString();
+  const results =
+    params.mode === "parallel"
+      ? await dispatchParallel(providers, input, enabledOverrides, params)
+      : await dispatchCollaborative(providers, input, enabledOverrides, params);
+
+  const summary = buildCollaborativeSummary(params.mode, results);
+
+  return {
+    task: input.task,
+    mode: params.mode,
+    startedAt,
+    totalProviders: providers.length,
+    totalResults: results.length,
+    models: results,
+    ...(summary ? { summary } : {}),
+  };
+}
diff --git a/src/lib/cli-helper/claudeProfileAutoSync.ts b/src/lib/cli-helper/claudeProfileAutoSync.ts
index 431f0a1013..a6c910b65b 100644
--- a/src/lib/cli-helper/claudeProfileAutoSync.ts
+++ b/src/lib/cli-helper/claudeProfileAutoSync.ts
@@ -1,6 +1,9 @@
 import path from "node:path";
 import { ensureCliConfigWriteAllowed, getCliConfigPaths } from "../../shared/services/cliRuntime";
-import { getModelSyncInternalBaseUrl } from "../../shared/services/modelSyncScheduler";
+import {
+  fetchModelSyncInternal,
+  getModelSyncInternalBaseUrl,
+} from "../../shared/services/modelSyncScheduler";
 import { isFeatureFlagEnabled } from "../../shared/utils/featureFlags";
 
 type SyncResult =
@@ -47,8 +50,9 @@ export async function autoSyncClaudeProfilesFromLiveCatalog(
   }
 
   const internalBase = getModelSyncInternalBaseUrl().replace(/\/$/, "");
-  const res = await fetch(`${internalBase}/v1/models`, {
+  const res = await fetchModelSyncInternal(`${internalBase}/v1/models`, {
     headers: forwardAuthHeaders(request),
+    redirect: "error",
     signal: AbortSignal.timeout(10_000),
   });
 
diff --git a/src/lib/cli-helper/codexProfileAutoSync.ts b/src/lib/cli-helper/codexProfileAutoSync.ts
index 023da5d899..6ae66ec59f 100644
--- a/src/lib/cli-helper/codexProfileAutoSync.ts
+++ b/src/lib/cli-helper/codexProfileAutoSync.ts
@@ -1,6 +1,9 @@
 import path from "node:path";
 import { ensureCliConfigWriteAllowed, getCliConfigPaths } from "../../shared/services/cliRuntime";
-import { getModelSyncInternalBaseUrl } from "../../shared/services/modelSyncScheduler";
+import {
+  fetchModelSyncInternal,
+  getModelSyncInternalBaseUrl,
+} from "../../shared/services/modelSyncScheduler";
 import { isFeatureFlagEnabled } from "../../shared/utils/featureFlags";
 
 type SyncResult =
@@ -47,8 +50,9 @@ export async function autoSyncCodexProfilesFromLiveCatalog(
   }
 
   const baseUrl = getModelSyncInternalBaseUrl().replace(/\/$/, "");
-  const res = await fetch(`${baseUrl}/v1/models`, {
+  const res = await fetchModelSyncInternal(`${baseUrl}/v1/models`, {
     headers: forwardAuthHeaders(request),
+    redirect: "error",
     signal: AbortSignal.timeout(10_000),
   });
 
diff --git a/src/lib/cloudAgent/api.ts b/src/lib/cloudAgent/api.ts
index 90dbcb1690..331d8cc1c9 100644
--- a/src/lib/cloudAgent/api.ts
+++ b/src/lib/cloudAgent/api.ts
@@ -1,18 +1,39 @@
 import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 import { getProviderConnections } from "@/lib/db/providers";
+import { resolveAllowedOrigin, getCorsStatus } from "@/server/cors/origins";
 import type { AgentCredentials } from "./baseAgent.ts";
 import type { CloudAgentTaskRow } from "./db.ts";
 
 type JsonRecord = Record<string, unknown>;
 
-export function getCloudAgentCorsHeaders(request?: Request) {
-  const origin = request?.headers.get("origin");
-  return {
-    "Access-Control-Allow-Origin": origin || "*",
+/**
+ * CORS headers for the cloud-agent surface. These routes are MANAGEMENT
+ * (cookie/session) authed (`requireCloudAgentManagementAuth`), so their CORS
+ * must be fail-closed: the previous `origin || "*"` reflected ANY caller's
+ * origin AND paired it with `Allow-Credentials: true`, which lets any website
+ * make credentialed (cookie-bearing) requests against the management API — a
+ * classic CSRF/exfil hole. We now defer to the central allowlist
+ * (`resolveAllowedOrigin`): only an allowlisted origin is echoed, and
+ * `Allow-Credentials` is emitted ONLY for an EXPLICITLY allowlisted origin —
+ * never for a `CORS_ALLOW_ALL` wildcard echo. Same-origin dashboard calls need
+ * no ACAO at all. See docs/security/CORS.md.
+ */
+export function getCloudAgentCorsHeaders(request?: Request): Record<string, string> {
+  const requestOrigin = request?.headers.get("origin") ?? null;
+  const headers: Record<string, string> = {
     "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
     "Access-Control-Allow-Headers": "Content-Type, Authorization",
-    "Access-Control-Allow-Credentials": "true",
   };
+  const allowed = resolveAllowedOrigin(requestOrigin);
+  if (allowed) {
+    headers["Access-Control-Allow-Origin"] = allowed;
+    headers["Vary"] = "Origin";
+    const normalized = requestOrigin?.toLowerCase().replace(/\/+$/, "") ?? "";
+    if (normalized && getCorsStatus().allowedOrigins.includes(normalized)) {
+      headers["Access-Control-Allow-Credentials"] = "true";
+    }
+  }
+  return headers;
 }
 
 export function withCloudAgentCors(response: Response, request?: Request): Response {
diff --git a/src/lib/combos/builderOptions.ts b/src/lib/combos/builderOptions.ts
index 4ce26daa93..5b2ac572ac 100644
--- a/src/lib/combos/builderOptions.ts
+++ b/src/lib/combos/builderOptions.ts
@@ -155,11 +155,6 @@ function toStringArray(value: unknown): string[] | undefined {
   return normalized.length > 0 ? normalized : undefined;
 }
 
-function isChatCapable(supportedEndpoints: string[] | undefined): boolean {
-  if (!supportedEndpoints || supportedEndpoints.length === 0) return true;
-  return supportedEndpoints.includes("chat");
-}
-
 function getSourcePriority(source: BuilderModelSource): number {
   switch (source) {
     case "imported":
@@ -305,7 +300,6 @@ function addModelOption(
   const modelId = toStringOrNull(input.id);
   if (!modelId) return;
   if (getModelIsHidden(providerId, modelId)) return;
-  if (!isChatCapable(input.supportedEndpoints)) return;
 
   const nextSourcePriority = getSourcePriority(input.source);
   const existing = modelMap.get(modelId);
@@ -449,9 +443,36 @@ function buildModelOptions(
     }
   }
 
+  disambiguateCollidingModelNames(modelMap);
   return modelMap;
 }
 
+/**
+ * #6957: some providers' own catalogs assign the identical display `name` to
+ * several distinct model ids (e.g. Mistral's "codestral-latest" alias renders
+ * under the same upstream name as its base "codestral-2508" model). Since the
+ * builder picker renders `model.name` as the visible option text, two colliding
+ * names make genuinely different models look like duplicates and hide aliases.
+ * Run this after all merge loops have populated `modelMap`: for any name shared
+ * by 2+ distinct ids, fall back every entry in that group to its own `id` as the
+ * display name (display-only — `id`/`qualifiedModel` used for routing untouched).
+ */
+function disambiguateCollidingModelNames(modelMap: Map<string, ComboBuilderModelOption>): void {
+  const idsByName = new Map<string, string[]>();
+  for (const option of modelMap.values()) {
+    const bucket = idsByName.get(option.name) || [];
+    bucket.push(option.id);
+    idsByName.set(option.name, bucket);
+  }
+  for (const [name, ids] of idsByName) {
+    if (ids.length < 2) continue;
+    for (const id of ids) {
+      const option = modelMap.get(id);
+      if (option && option.name === name) option.name = option.id;
+    }
+  }
+}
+
 function compareConnections(
   left: ComboBuilderConnectionOption,
   right: ComboBuilderConnectionOption
diff --git a/src/lib/db/adapters/driverFactory.ts b/src/lib/db/adapters/driverFactory.ts
index 4975714e02..574abfc0f4 100644
--- a/src/lib/db/adapters/driverFactory.ts
+++ b/src/lib/db/adapters/driverFactory.ts
@@ -10,6 +10,7 @@ const _require = createRequire(import.meta.url);
 
 declare global {
   var __omnirouteSqlJsAdapters: Map<string, SqliteAdapter> | undefined;
+  var __omnirouteSqlJsInitPromises: Map<string, Promise<SqliteAdapter>> | undefined;
 }
 
 function getSqlJsCache(): Map<string, SqliteAdapter> {
@@ -19,6 +20,20 @@ function getSqlJsCache(): Map<string, SqliteAdapter> {
   return globalThis.__omnirouteSqlJsAdapters;
 }
 
+/**
+ * Cache das Promises de inicialização EM VOO (não resolvidas ainda), por filePath.
+ * Separado de getSqlJsCache() (que só guarda o adapter já resolvido) para que
+ * chamadores concorrentes (BATCH/STARTUP/HealthCheck/ProviderLimitsSync no boot)
+ * compartilhem UMA única leitura+decode do arquivo em vez de cada um chamar
+ * fs.readFileSync + WASM decode independentemente (#6628 — thundering herd).
+ */
+function getSqlJsPendingCache(): Map<string, Promise<SqliteAdapter>> {
+  if (!globalThis.__omnirouteSqlJsInitPromises) {
+    globalThis.__omnirouteSqlJsInitPromises = new Map();
+  }
+  return globalThis.__omnirouteSqlJsInitPromises;
+}
+
 /** Tenta abrir com better-sqlite3 e node:sqlite sincronamente. Retorna null se ambos falharem. */
 export function tryOpenSync(
   filePath: string,
@@ -64,12 +79,37 @@ export function tryOpenSync(
 export async function preInitSqlJs(filePath: string): Promise<SqliteAdapter> {
   const cache = getSqlJsCache();
   const existing = cache.get(filePath);
-  if (existing) return existing;
+  if (existing) {
+    if (existing.open) return existing;
+    // Stale handle left over by a prior close/reload (e.g. gracefulShutdown or
+    // resetDbInstance closed the underlying WASM db but this globalThis-backed
+    // cache — deliberately shared across re-invocations for idempotency — still
+    // holds the reference). Reusing it would make every subsequent query throw
+    // the raw string "Database closed" straight from sql.js (#6560). Evict and
+    // recreate instead of returning a dead connection.
+    cache.delete(filePath);
+  }
 
-  const { createSqlJsAdapter } = await import("./sqljsAdapter");
-  const adapter = await createSqlJsAdapter(filePath);
-  cache.set(filePath, adapter);
-  return adapter;
+  // Share one in-flight load across concurrent callers for the same filePath
+  // (#6628): without this, each of BATCH/STARTUP/HealthCheck/ProviderLimitsSync
+  // independently fs.readFileSync + WASM-decode the same (possibly 300+MB) file
+  // at boot, multiplying peak memory pressure by the number of racing callers.
+  const pending = getSqlJsPendingCache();
+  const inflight = pending.get(filePath);
+  if (inflight) return inflight;
+
+  const initPromise = (async () => {
+    const { createSqlJsAdapter } = await import("./sqljsAdapter");
+    const adapter = await createSqlJsAdapter(filePath);
+    cache.set(filePath, adapter);
+    return adapter;
+  })();
+  pending.set(filePath, initPromise);
+  try {
+    return await initPromise;
+  } finally {
+    pending.delete(filePath);
+  }
 }
 
 /** Retorna adapter sql.js pré-inicializado ou null se ainda não inicializado. */
diff --git a/src/lib/db/adapters/sqljsAdapter.ts b/src/lib/db/adapters/sqljsAdapter.ts
index 0d2ea317db..181481ab1a 100644
--- a/src/lib/db/adapters/sqljsAdapter.ts
+++ b/src/lib/db/adapters/sqljsAdapter.ts
@@ -31,6 +31,57 @@ function resolveSqlJsWasmPath(): string {
   return candidatePaths[0];
 }
 
+/**
+ * better-sqlite3's named-parameter convention lets callers bind with the bare
+ * property name (e.g. `{ isActive: 1 }` for a SQL placeholder written as
+ * `@isActive`, `:isActive`, or `$isActive` — better-sqlite3 strips the sigil
+ * internally). sql.js's own named-bind path (`sqlite3_bind_parameter_index`)
+ * requires the FULL name INCLUDING the sigil, and silently no-ops (does not
+ * throw) for a key it can't resolve. Expand each bare key to all three
+ * sigil-prefixed variants so sql.js matches whichever sigil the SQL actually
+ * used, while passing through any key the caller already prefixed unchanged.
+ */
+function withNamedParamPrefixes(obj: Record<string, unknown>): Record<string, unknown> {
+  const expanded: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(obj)) {
+    if (/^[:@$]/.test(key)) {
+      expanded[key] = value;
+      continue;
+    }
+    expanded[`@${key}`] = value;
+    expanded[`:${key}`] = value;
+    expanded[`$${key}`] = value;
+  }
+  return expanded;
+}
+
+/**
+ * sql.js's own `stmt.bind()` dispatches on shape: an Array means positional
+ * bind (each element -> bind index N), a plain object means named-parameter
+ * bind. Callers here always pass their rest-args as an array, so a caller
+ * doing `.all({ isActive: 1 })` for a named placeholder (mirrors
+ * better-sqlite3's spread-args named-bind convention, see
+ * betterSqliteAdapter.ts) ends up handing sql.js `[{isActive:1}]` — an ARRAY
+ * containing the object — which sql.js treats as a single positional value
+ * and rejects with "Wrong API use : tried to bind a value of an unknown
+ * type (...)." (#6802). Unwrap a lone plain-object param back to the object
+ * itself (sigil-expanded) so sql.js takes its named-bind path instead.
+ */
+function toBindValue(params: unknown[]): unknown[] | Record<string, unknown> | undefined {
+  if (!params.length) return undefined;
+  const [first] = params;
+  const isLoneNamedParamsObject =
+    params.length === 1 &&
+    first !== null &&
+    typeof first === "object" &&
+    !Array.isArray(first) &&
+    !Buffer.isBuffer(first) &&
+    !(first instanceof Uint8Array);
+  return isLoneNamedParamsObject
+    ? withNamedParamPrefixes(first as Record<string, unknown>)
+    : params;
+}
+
 async function loadSqlJs(): Promise<typeof _sqlJsLib> {
   if (_sqlJsLib) return _sqlJsLib;
   const initSqlJs = ((await import("sql.js")) as { default: (typeof import("sql.js"))["default"] })
@@ -103,7 +154,8 @@ export async function createSqlJsAdapter(filePath: string): Promise<SqliteAdapte
       run(...params: unknown[]): RunResult {
         const stmt = db.prepare(sql);
         try {
-          if (params.length) stmt.bind(params as unknown[]);
+          const bindValue = toBindValue(params);
+          if (bindValue !== undefined) stmt.bind(bindValue);
           stmt.step();
           const changes = db.getRowsModified();
           const lastRows = db.exec("SELECT last_insert_rowid() as id");
@@ -117,7 +169,8 @@ export async function createSqlJsAdapter(filePath: string): Promise<SqliteAdapte
       get(...params: unknown[]): unknown {
         const stmt = db.prepare(sql);
         try {
-          if (params.length) stmt.bind(params as unknown[]);
+          const bindValue = toBindValue(params);
+          if (bindValue !== undefined) stmt.bind(bindValue);
           if (stmt.step()) return stmt.getAsObject();
           return undefined;
         } finally {
@@ -127,7 +180,8 @@ export async function createSqlJsAdapter(filePath: string): Promise<SqliteAdapte
       all(...params: unknown[]): unknown[] {
         const stmt = db.prepare(sql);
         try {
-          if (params.length) stmt.bind(params as unknown[]);
+          const bindValue = toBindValue(params);
+          if (bindValue !== undefined) stmt.bind(bindValue);
           const rows: unknown[] = [];
           while (stmt.step()) rows.push(stmt.getAsObject());
           return rows;
diff --git a/src/lib/db/apiKeyColumnFallbacks.ts b/src/lib/db/apiKeyColumnFallbacks.ts
index 398672c5fc..ff0618cd03 100644
--- a/src/lib/db/apiKeyColumnFallbacks.ts
+++ b/src/lib/db/apiKeyColumnFallbacks.ts
@@ -44,4 +44,8 @@ export const API_KEY_COLUMN_FALLBACKS = [
     name: "weekly_usage_limit_usd",
     definition: "weekly_usage_limit_usd REAL",
   },
+  {
+    name: "chaos_mode_enabled",
+    definition: "chaos_mode_enabled INTEGER NOT NULL DEFAULT 0",
+  },
 ] as const;
diff --git a/src/lib/db/apiKeys.ts b/src/lib/db/apiKeys.ts
index 874bae3f1b..6cb167d26b 100644
--- a/src/lib/db/apiKeys.ts
+++ b/src/lib/db/apiKeys.ts
@@ -43,6 +43,7 @@ import {
   parseNullableTimestamp,
   parseIsBanned,
   parseStreamDefaultMode,
+  parseChaosModeEnabled,
 } from "./apiKeys/rowParsers";
 import type { AccessSchedule, RateLimitRule } from "./apiKeys/types";
 
@@ -95,6 +96,7 @@ interface ApiKeyMetadata {
   usageLimitEnabled: boolean;
   dailyUsageLimitUsd: number | null;
   weeklyUsageLimitUsd: number | null;
+  chaosModeEnabled: boolean;
 }
 
 interface ApiKeyRow extends JsonRecord {
@@ -134,6 +136,8 @@ interface ApiKeyRow extends JsonRecord {
   dailyUsageLimitUsd?: unknown;
   weekly_usage_limit_usd?: unknown;
   weeklyUsageLimitUsd?: unknown;
+  chaos_mode_enabled?: unknown;
+  chaosModeEnabled?: unknown;
 }
 
 interface StatementLike<TRow = unknown> {
@@ -180,6 +184,7 @@ interface ApiKeyView extends JsonRecord {
   usageLimitEnabled?: boolean;
   dailyUsageLimitUsd?: number | null;
   weeklyUsageLimitUsd?: number | null;
+  chaosModeEnabled?: boolean;
 }
 
 // LRU cache for API key validation (valid keys only)
@@ -237,7 +242,7 @@ async function deleteRedisAuthCacheEntry(keyHash: unknown): Promise<void> {
   try {
     const { getRedisClient, isRedisConfigured } = await import("@/shared/utils/rateLimiter");
     if (!isRedisConfigured()) return;
-    const redis = getRedisClient();
+    const redis = await getRedisClient();
     await redis.del(`auth:api_key:${keyHash}`);
   } catch {
     // Redis is an optimization for auth caching; SQLite remains authoritative.
@@ -393,7 +398,7 @@ function getPreparedStatements(db: ApiKeysDbLike): ApiKeysStatements {
       "SELECT id, expires_at, revoked_at, is_active, is_banned FROM api_keys WHERE key = ? OR key_hash = ?"
     );
     _stmtGetKeyMetadata = db.prepare<ApiKeyRow>(
-      "SELECT id, name, machine_id, allowed_models, blocked_models, allowed_combos, allowed_connections, allowed_quotas, no_log, auto_resolve, is_active, access_schedule, max_requests_per_day, max_requests_per_minute, throttle_delay_ms, max_sessions, revoked_at, expires_at, ip_allowlist, scopes, rate_limits, is_banned, key_hash, allowed_endpoints, stream_default_mode, disable_non_public_models, allow_usage_command, usage_limit_enabled, daily_usage_limit_usd, weekly_usage_limit_usd, proxy_id FROM api_keys WHERE key = ? OR key_hash = ?"
+      "SELECT id, name, machine_id, allowed_models, blocked_models, allowed_combos, allowed_connections, allowed_quotas, no_log, auto_resolve, is_active, access_schedule, max_requests_per_day, max_requests_per_minute, throttle_delay_ms, max_sessions, revoked_at, expires_at, ip_allowlist, scopes, rate_limits, is_banned, key_hash, allowed_endpoints, stream_default_mode, disable_non_public_models, allow_usage_command, usage_limit_enabled, daily_usage_limit_usd, weekly_usage_limit_usd, chaos_mode_enabled, proxy_id FROM api_keys WHERE key = ? OR key_hash = ?"
     );
     _stmtInsertKey = db.prepare(
       "INSERT INTO api_keys (id, name, key, machine_id, allowed_models, no_log, created_at, key_prefix, key_hash, scopes) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"
@@ -446,6 +451,7 @@ export async function getApiKeys() {
       (camelRow as JsonRecord).disableNonPublicModels
     );
     camelRow.allowUsageCommand = parseAllowUsageCommand((camelRow as JsonRecord).allowUsageCommand);
+    camelRow.chaosModeEnabled = parseChaosModeEnabled((camelRow as JsonRecord).chaosModeEnabled);
     Object.assign(camelRow, parseApiKeyUsageLimitFields(camelRow));
     if (typeof camelRow.id === "string" && camelRow.id.length > 0) {
       setNoLog(camelRow.id, camelRow.noLog === true);
@@ -558,6 +564,7 @@ export async function getApiKeyById(id: string) {
     (camelRow as JsonRecord).disableNonPublicModels
   );
   camelRow.allowUsageCommand = parseAllowUsageCommand((camelRow as JsonRecord).allowUsageCommand);
+  camelRow.chaosModeEnabled = parseChaosModeEnabled((camelRow as JsonRecord).chaosModeEnabled);
   Object.assign(camelRow, parseApiKeyUsageLimitFields(camelRow));
   if (typeof camelRow.id === "string" && camelRow.id.length > 0) {
     setNoLog(camelRow.id, camelRow.noLog === true);
@@ -684,6 +691,7 @@ export async function updateApiKeyPermissions(
         usageLimitEnabled?: boolean;
         dailyUsageLimitUsd?: number | null;
         weeklyUsageLimitUsd?: number | null;
+        chaosModeEnabled?: boolean;
       }
 ) {
   const db = getDbInstance() as ApiKeysDbLike;
@@ -722,6 +730,7 @@ export async function updateApiKeyPermissions(
           dailyUsageLimitUsd: (update as { dailyUsageLimitUsd?: number | null }).dailyUsageLimitUsd,
           weeklyUsageLimitUsd: (update as { weeklyUsageLimitUsd?: number | null })
             .weeklyUsageLimitUsd,
+          chaosModeEnabled: (update as { chaosModeEnabled?: boolean }).chaosModeEnabled,
         };
 
   if (
@@ -748,6 +757,7 @@ export async function updateApiKeyPermissions(
     (normalized as Record<string, unknown>).streamDefaultMode === undefined &&
     normalized.disableNonPublicModels === undefined &&
     normalized.allowUsageCommand === undefined &&
+    normalized.chaosModeEnabled === undefined &&
     !hasUsageLimitUpdate(normalized as Record<string, unknown>)
   ) {
     return false;
@@ -781,6 +791,7 @@ export async function updateApiKeyPermissions(
     usageLimitEnabled?: number;
     dailyUsageLimitUsd?: number | null;
     weeklyUsageLimitUsd?: number | null;
+    chaosModeEnabled?: number;
   } = { id };
 
   if (normalized.name !== undefined) {
@@ -884,6 +895,11 @@ export async function updateApiKeyPermissions(
     params.allowUsageCommand = normalized.allowUsageCommand ? 1 : 0;
   }
 
+  if (normalized.chaosModeEnabled !== undefined) {
+    updates.push("chaos_mode_enabled = @chaosModeEnabled");
+    params.chaosModeEnabled = normalized.chaosModeEnabled ? 1 : 0;
+  }
+
   appendUsageLimitUpdates(normalized as Record<string, unknown>, updates, params);
 
   const maxSessionsUpdate = (normalized as Record<string, unknown>).maxSessions;
@@ -1126,7 +1142,7 @@ export async function validateApiKey(key: string | null | undefined) {
     try {
       const { getRedisClient, isRedisConfigured } = await import("@/shared/utils/rateLimiter");
       if (isRedisConfigured()) {
-        const redis = getRedisClient();
+        const redis = await getRedisClient();
         const redisKey = `auth:api_key:${hashedKey}`;
         const redisData = await redis.get(redisKey);
         if (redisData) {
@@ -1179,7 +1195,7 @@ export async function validateApiKey(key: string | null | undefined) {
     try {
       const { getRedisClient, isRedisConfigured } = await import("@/shared/utils/rateLimiter");
       if (isRedisConfigured()) {
-        const redis = getRedisClient();
+        const redis = await getRedisClient();
         const redisKey = `auth:api_key:${hashedKey}`;
         await redis.set(
           redisKey,
@@ -1270,6 +1286,7 @@ export async function getApiKeyMetadata(
       usageLimitEnabled: false,
       dailyUsageLimitUsd: null,
       weeklyUsageLimitUsd: null,
+      chaosModeEnabled: false,
     };
   }
 
@@ -1343,6 +1360,9 @@ export async function getApiKeyMetadata(
     allowUsageCommand: parseAllowUsageCommand(
       (record as JsonRecord).allow_usage_command ?? (record as JsonRecord).allowUsageCommand
     ),
+    chaosModeEnabled: parseChaosModeEnabled(
+      (record as JsonRecord).chaos_mode_enabled ?? (record as JsonRecord).chaosModeEnabled
+    ),
     ...parseApiKeyUsageLimitFields(record as JsonRecord),
   };
 
diff --git a/src/lib/db/apiKeys/rowParsers.ts b/src/lib/db/apiKeys/rowParsers.ts
index d087563b7e..fcec6d2372 100644
--- a/src/lib/db/apiKeys/rowParsers.ts
+++ b/src/lib/db/apiKeys/rowParsers.ts
@@ -47,6 +47,10 @@ export function parseAllowUsageCommand(value: unknown): boolean {
   return value === true || value === 1 || value === "1";
 }
 
+export function parseChaosModeEnabled(value: unknown): boolean {
+  return value === true || value === 1 || value === "1";
+}
+
 export function parseIsActive(value: unknown): boolean {
   // DEFAULT 1 — active unless explicitly set to 0
   if (value === 0 || value === "0" || value === false) return false;
diff --git a/src/lib/db/compression.ts b/src/lib/db/compression.ts
index e2806a3406..c1e92101fe 100644
--- a/src/lib/db/compression.ts
+++ b/src/lib/db/compression.ts
@@ -43,6 +43,7 @@ const COMPRESSION_MODES = new Set<CompressionMode>([
   "ultra",
   "rtk",
   "stacked",
+  "omniglyph",
 ]);
 
 type JsonRecord = Record<string, unknown>;
@@ -259,8 +260,9 @@ function normalizeContextEditingConfig(value: unknown): ContextEditingConfig {
 }
 
 // Engines allowed in the global stackedPipeline setting. MUST stay in sync with the
-// compression-combo KNOWN_ENGINE_IDS (src/lib/db/compressionCombos.ts) — otherwise the
-// global setting silently strips engines the combo path accepts (B-PIPELINE-DIVERGENCE).
+// compression-combo KNOWN_ENGINE_IDS (src/lib/db/compressionCombos.ts) and with
+// stackedPipelineStepSchema / ENGINE_CATALOG — otherwise the global setting silently
+// strips engines the combo path accepts (B-PIPELINE-DIVERGENCE / #6747).
 const STACKED_PIPELINE_ENGINE_IDS = new Set([
   "lite",
   "caveman",
@@ -271,6 +273,8 @@ const STACKED_PIPELINE_ENGINE_IDS = new Set([
   "session-dedup",
   "ccr",
   "llmlingua",
+  "relevance",
+  "omniglyph",
 ]);
 
 export function normalizeStackedPipeline(value: unknown): CompressionPipelineStep[] {
@@ -417,6 +421,7 @@ const SINGLE_MODE_ENGINE: Partial<Record<CompressionMode, string>> = {
   aggressive: "aggressive",
   ultra: "ultra",
   rtk: "rtk",
+  omniglyph: "omniglyph",
 };
 
 function normalizeEngineToggle(value: unknown): EngineToggle | null {
@@ -654,8 +659,7 @@ export async function getCompressionSettings(): Promise<CompressionConfig> {
         storedEngines = parseStoredEnginesMap(parsed);
         break;
       case "activeComboId":
-        config.activeComboId =
-          typeof parsed === "string" && parsed.trim() ? parsed.trim() : null;
+        config.activeComboId = typeof parsed === "string" && parsed.trim() ? parsed.trim() : null;
         break;
       case "ultraEngine":
         // Phase 4 (B): SLM tier selector. Only the two known values; anything else
diff --git a/src/lib/db/compressionCombos.ts b/src/lib/db/compressionCombos.ts
index e7f3dcb888..e4333509bd 100644
--- a/src/lib/db/compressionCombos.ts
+++ b/src/lib/db/compressionCombos.ts
@@ -56,6 +56,7 @@ function parseJsonArray<T>(value: unknown, fallback: T[]): T[] {
   }
 }
 
+// Keep in sync with stackedPipelineStepSchema + ENGINE_CATALOG (#6747).
 const KNOWN_ENGINE_IDS = [
   "lite",
   "caveman",
@@ -66,6 +67,7 @@ const KNOWN_ENGINE_IDS = [
   "session-dedup",
   "ccr",
   "llmlingua",
+  "relevance",
 ];
 
 function normalizePipeline(value: unknown): CompressionPipelineStep[] {
@@ -92,8 +94,7 @@ function upgradeLegacySeededDefaultCompressionCombo(): void {
   const row = db
     .prepare("SELECT name, description, pipeline FROM compression_combos WHERE id = ?")
     .get(DEFAULT_COMPRESSION_COMBO_ID) as
-    | { name?: string; description?: string; pipeline?: string }
-    | undefined;
+    { name?: string; description?: string; pipeline?: string } | undefined;
 
   if (!row) return;
 
diff --git a/src/lib/db/core.ts b/src/lib/db/core.ts
index dd5bbec334..0fa67ac01e 100644
--- a/src/lib/db/core.ts
+++ b/src/lib/db/core.ts
@@ -462,6 +462,10 @@ const SCHEMA_SQL = `
 
 declare global {
   var __omnirouteDb: SqliteAdapter | undefined;
+  // Cycle-breaker counter for the probe-failed/restore cascade. Survives
+  // Next.js HMR re-evaluations so concurrent subsystems all see the same
+  // count and we abort with a clear error instead of looping forever.
+  var __omnirouteDbProbeRestoreCount: number | undefined;
 }
 
 function getDb(): SqliteDatabase | null {
@@ -952,6 +956,26 @@ export function getDbInstance(): SqliteDatabase {
   const jsonDbFile = JSON_DB_FILE;
   const probeFailureBackups = listProbeFailureBackups(sqliteFile);
   if (!fs.existsSync(sqliteFile) && probeFailureBackups.length > 0) {
+    // Cycle-breaker: a previous probe failure renamed the DB to
+    // `storage.sqlite.probe-failed-<ts>` and the next caller auto-restored it.
+    // When the same DB continues to fail the probe (typically an OOM on a
+    // large sql.js WASM load), the rename/restore cascade loops forever
+    // because every subsystem (BATCH, HealthCheck, ProviderLimitsSync, ...)
+    // hits the same code path during boot. Track restoration attempts on
+    // globalThis; abort with a clear recovery message after 3 attempts so
+    // the user gets a real error instead of a hung "Starting server...".
+    if (
+      (globalThis.__omnirouteDbProbeRestoreCount =
+        (globalThis.__omnirouteDbProbeRestoreCount || 0) + 1) > 3
+    ) {
+      throw new Error(
+        `[DB] Aborting startup: probe-failed/restore loop detected after 3 attempts. ` +
+          `The preserved database at ${path.dirname(sqliteFile)} is unloadable under this runtime. ` +
+          `Remove the probe-failed backups (storage.sqlite.probe-failed-*) from ${path.dirname(
+            sqliteFile
+          )} and restart, or restore the database from a known-good backup.`
+      );
+    }
     const latestBackup = probeFailureBackups[0];
     try {
       fs.renameSync(latestBackup, sqliteFile);
@@ -1047,6 +1071,19 @@ export function getDbInstance(): SqliteDatabase {
       ) {
         throw e;
       }
+      // OOM during probe = the DB is too large to load under the current
+      // V8 heap (sql.js loads the whole file into WASM memory). Throwing
+      // immediately gives the user a clear "increase --max-old-space-size"
+      // signal instead of silently renaming a perfectly good DB.
+      if (/out of memory|allocation failure|Array buffer allocation failed|allocation failed/i.test(message)) {
+        throw new Error(
+          `[DB] Out of memory while probing ${sqliteFile}. ` +
+            `The bundled sql.js driver loads the entire file into WASM memory; ` +
+            `increase the V8 heap with NODE_OPTIONS=--max-old-space-size=4096 (or higher) ` +
+            `and restart, or restore the database from a backup. ` +
+            `Original error: ${message}`
+        );
+      }
       preservedCriticalState = captureCriticalDbState(sqliteFile);
 
       // SAFETY: Never delete the database — rename to backup so data can be recovered.
diff --git a/src/lib/db/freeProxies.ts b/src/lib/db/freeProxies.ts
index c75642d491..3a63c9f7a0 100644
--- a/src/lib/db/freeProxies.ts
+++ b/src/lib/db/freeProxies.ts
@@ -28,6 +28,9 @@ export interface FreeProxyStats {
   lastSyncAt: string | null;
 }
 
+/** Source id → list of error messages from that source's last sync. */
+export type FreeProxySyncErrors = Record<string, string[]>;
+
 type DbRow = Record<string, unknown>;
 
 function mapRow(row: unknown): FreeProxyRecord {
@@ -109,6 +112,8 @@ export async function listFreeProxies(options?: {
   minQuality?: number;
   onlyInPool?: boolean;
   onlyNotInPool?: boolean;
+  search?: string;
+  sortBy?: "quality" | "latency" | "recent";
   limit?: number;
   offset?: number;
 }): Promise<FreeProxyRecord[]> {
@@ -138,8 +143,18 @@ export async function listFreeProxies(options?: {
   if (options?.onlyNotInPool) {
     sql += " AND in_pool = 0";
   }
+  if (options?.search) {
+    sql += " AND host LIKE ?";
+    params.push(`%${options.search}%`);
+  }
 
-  sql += " ORDER BY quality_score DESC, last_validated DESC";
+  const sortClause =
+    options?.sortBy === "latency"
+      ? "ORDER BY latency_ms IS NULL, latency_ms ASC"
+      : options?.sortBy === "recent"
+        ? "ORDER BY last_validated DESC"
+        : "ORDER BY quality_score DESC, last_validated DESC";
+  sql += ` ${sortClause}`;
 
   if (options?.limit) {
     sql += " LIMIT ?";
@@ -154,6 +169,51 @@ export async function listFreeProxies(options?: {
   return rows.map(mapRow);
 }
 
+export async function countFreeProxies(options?: {
+  sources?: FreeProxySourceId[];
+  protocol?: string;
+  country?: string;
+  minQuality?: number;
+  onlyInPool?: boolean;
+  onlyNotInPool?: boolean;
+  search?: string;
+}): Promise<number> {
+  const db = getDbInstance();
+  const params: unknown[] = [];
+  let sql = "SELECT COUNT(*) AS count FROM free_proxies WHERE 1=1";
+
+  if (options?.sources?.length) {
+    sql += ` AND source IN (${options.sources.map(() => "?").join(",")})`;
+    params.push(...options.sources);
+  }
+  if (options?.protocol) {
+    sql += " AND type = ?";
+    params.push(options.protocol);
+  }
+  if (options?.country) {
+    sql += " AND country_code = ?";
+    params.push(options.country.toUpperCase());
+  }
+  if (options?.minQuality != null) {
+    sql += " AND quality_score >= ?";
+    params.push(options.minQuality);
+  }
+  if (options?.onlyInPool) {
+    sql += " AND in_pool = 1";
+  }
+  if (options?.onlyNotInPool) {
+    sql += " AND in_pool = 0";
+  }
+  if (options?.search) {
+    sql += " AND host LIKE ?";
+    params.push(`%${options.search}%`);
+  }
+
+  const row = db.prepare(sql).get(...params) as DbRow | undefined;
+  const count = row?.count;
+  return typeof count === "number" ? count : Number(count ?? 0);
+}
+
 export async function listFreeProxiesBySource(
   source: FreeProxySourceId,
   filters: {
@@ -313,9 +373,11 @@ const FREE_PROXY_SYNC_KEY = "last_sync_at";
 export async function recordFreeProxySync(at?: string): Promise<string> {
   const db = getDbInstance();
   const ts = at ?? new Date().toISOString();
-  db.prepare(
-    "INSERT OR REPLACE INTO key_value (namespace, key, value) VALUES (?, ?, ?)"
-  ).run(FREE_PROXY_SYNC_NAMESPACE, FREE_PROXY_SYNC_KEY, ts);
+  db.prepare("INSERT OR REPLACE INTO key_value (namespace, key, value) VALUES (?, ?, ?)").run(
+    FREE_PROXY_SYNC_NAMESPACE,
+    FREE_PROXY_SYNC_KEY,
+    ts
+  );
   backupDbFile("pre-write");
   return ts;
 }
@@ -358,3 +420,50 @@ export async function getFreeProxyStats(): Promise<FreeProxyStats> {
     lastSyncAt: recordedSyncAt ?? derivedSyncAt,
   };
 }
+/**
+ * Persist the most recent per-source sync errors. A successful sync for a
+ * source should call clearFreeProxySyncErrors instead so the stale error
+ * stops showing.
+ */
+export async function recordFreeProxySyncErrors(
+  source: FreeProxySourceId,
+  errors: string[]
+): Promise<void> {
+  const db = getDbInstance();
+  const at = new Date().toISOString();
+  db.prepare(
+    "INSERT OR REPLACE INTO free_proxy_sync_errors (source, errors, updated_at) VALUES (?, ?, ?)"
+  ).run(source, JSON.stringify(errors), at);
+  backupDbFile("pre-write");
+}
+
+/** Clear a source's stored sync error (called on a successful sync). */
+export async function clearFreeProxySyncErrors(source: FreeProxySourceId): Promise<void> {
+  const db = getDbInstance();
+  db.prepare("DELETE FROM free_proxy_sync_errors WHERE source = ?").run(source);
+  backupDbFile("pre-write");
+}
+
+/**
+ * Read all stored per-source sync errors as a plain map. Sources with no
+ * recorded error are omitted, so an empty object means a clean (or un-synced)
+ * state.
+ */
+export async function getFreeProxySyncErrors(): Promise<FreeProxySyncErrors> {
+  const db = getDbInstance();
+  const rows = db.prepare("SELECT source, errors FROM free_proxy_sync_errors").all() as Array<{
+    source: string;
+    errors: string;
+  }>;
+  const out: FreeProxySyncErrors = {};
+  for (const row of rows) {
+    if (!row.source) continue;
+    try {
+      const parsed = JSON.parse(row.errors) as unknown;
+      out[row.source] = Array.isArray(parsed) ? parsed.map(String) : [String(row.errors)];
+    } catch {
+      out[row.source] = [String(row.errors)];
+    }
+  }
+  return out;
+}
diff --git a/src/lib/db/interceptionRules.ts b/src/lib/db/interceptionRules.ts
new file mode 100644
index 0000000000..faff5a1fc3
--- /dev/null
+++ b/src/lib/db/interceptionRules.ts
@@ -0,0 +1,203 @@
+/**
+ * db/interceptionRules.ts — Per-model web-search / web-fetch interception rules (#3384).
+ *
+ * CRUD against the key_value table under namespace "interception_rules". Follows the
+ * established key_value pattern from paramFilters.ts / databaseSettings.ts.
+ *
+ * Resolution precedence (see resolveInterceptSearch): per-model rule > provider-level
+ * rule > undefined (caller falls back to the existing native-bypass defaults).
+ */
+
+import { getDbInstance } from "./core";
+
+const NAMESPACE = "interception_rules";
+
+// ── Types ───────────────────────────────────────────────────────────────────
+
+export type FetchInterceptionBackend = "firecrawl" | "jina" | "tavily";
+
+export interface ModelInterceptionRule {
+  /** true = route through OmniRoute's /v1/search; false = force native passthrough. */
+  interceptSearch?: boolean;
+  /** true = route through OmniRoute's /v1/web/fetch; false = force native passthrough. */
+  interceptFetch?: boolean;
+  fetchBackend?: FetchInterceptionBackend;
+  fetchProxyUrl?: string;
+}
+
+export interface ProviderInterceptionRules {
+  /** Provider-level default, used when a model has no override. */
+  interceptSearch?: boolean;
+  interceptFetch?: boolean;
+  fetchBackend?: FetchInterceptionBackend;
+  fetchProxyUrl?: string;
+  /** Per-model overrides (stricter/looser than provider-level). */
+  models?: Record<string, ModelInterceptionRule>;
+}
+
+// ── Cache ───────────────────────────────────────────────────────────────────
+
+let rulesCache: Map<string, ProviderInterceptionRules> | null = null;
+
+function invalidateCache(): void {
+  rulesCache = null;
+}
+
+// ── Helpers ─────────────────────────────────────────────────────────────────
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function toNormalizedString(value: unknown): string | null {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+
+function toOptionalBool(value: unknown): boolean | undefined {
+  return typeof value === "boolean" ? value : undefined;
+}
+
+function toFetchBackend(value: unknown): FetchInterceptionBackend | undefined {
+  return value === "firecrawl" || value === "jina" || value === "tavily" ? value : undefined;
+}
+
+function parseStoredValue(raw: unknown): unknown {
+  if (typeof raw !== "string") return raw;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return raw;
+  }
+}
+
+function toModelInterceptionRule(raw: unknown): ModelInterceptionRule | null {
+  if (!isRecord(raw)) return null;
+  const rule: ModelInterceptionRule = {
+    interceptSearch: toOptionalBool(raw.interceptSearch),
+    interceptFetch: toOptionalBool(raw.interceptFetch),
+    fetchBackend: toFetchBackend(raw.fetchBackend),
+    fetchProxyUrl: toNormalizedString(raw.fetchProxyUrl) ?? undefined,
+  };
+  const hasAnyField = Object.values(rule).some((v) => v !== undefined);
+  return hasAnyField ? rule : null;
+}
+
+function toModelInterceptionRules(raw: unknown): Record<string, ModelInterceptionRule> {
+  const models: Record<string, ModelInterceptionRule> = {};
+  if (!isRecord(raw)) return models;
+  for (const [modelId, val] of Object.entries(raw)) {
+    const rule = toModelInterceptionRule(val);
+    if (rule) models[modelId] = rule;
+  }
+  return models;
+}
+
+function toProviderInterceptionRules(raw: unknown): ProviderInterceptionRules | null {
+  if (!isRecord(raw)) return null;
+  const models = toModelInterceptionRules(raw.models);
+  return {
+    interceptSearch: toOptionalBool(raw.interceptSearch),
+    interceptFetch: toOptionalBool(raw.interceptFetch),
+    fetchBackend: toFetchBackend(raw.fetchBackend),
+    fetchProxyUrl: toNormalizedString(raw.fetchProxyUrl) ?? undefined,
+    models: Object.keys(models).length > 0 ? models : undefined,
+  };
+}
+
+// ── Read ────────────────────────────────────────────────────────────────────
+
+function readNamespace(namespace: string): Record<string, unknown> {
+  const db = getDbInstance();
+  const rows = db
+    .prepare("SELECT key, value FROM key_value WHERE namespace = ?")
+    .all(namespace) as Array<{ key: string; value: string }>;
+
+  const values: Record<string, unknown> = {};
+  for (const row of rows) {
+    values[row.key] = parseStoredValue(row.value);
+  }
+  return values;
+}
+
+function loadAllRules(): Map<string, ProviderInterceptionRules> {
+  const raw = readNamespace(NAMESPACE);
+  const map = new Map<string, ProviderInterceptionRules>();
+  for (const [key, value] of Object.entries(raw)) {
+    const parsed = toProviderInterceptionRules(value);
+    if (parsed) map.set(key, parsed);
+  }
+  return map;
+}
+
+function loadRulesCached(): Map<string, ProviderInterceptionRules> {
+  if (rulesCache === null) {
+    rulesCache = loadAllRules();
+  }
+  return rulesCache;
+}
+
+// ── Public API ──────────────────────────────────────────────────────────────
+
+/** Get the interception rules for a single provider, or null if not configured. */
+export function getInterceptionRules(provider: string): ProviderInterceptionRules | null {
+  return toNormalizedString(provider) ? (loadRulesCached().get(provider) ?? null) : null;
+}
+
+/** Upsert the entire interception rule set for a provider. Invalidates the cache. */
+export function setInterceptionRules(provider: string, rules: ProviderInterceptionRules): void {
+  const normalizedProvider = toNormalizedString(provider);
+  if (!normalizedProvider) return;
+
+  const db = getDbInstance();
+  const stmt = db.prepare(
+    "INSERT OR REPLACE INTO key_value (namespace, key, value) VALUES (?, ?, ?)"
+  );
+
+  const normalized: ProviderInterceptionRules = {
+    interceptSearch: rules.interceptSearch,
+    interceptFetch: rules.interceptFetch,
+    fetchBackend: rules.fetchBackend,
+    fetchProxyUrl: rules.fetchProxyUrl,
+    models: rules.models && Object.keys(rules.models).length > 0 ? rules.models : undefined,
+  };
+
+  stmt.run(NAMESPACE, normalizedProvider, JSON.stringify(normalized));
+  invalidateCache();
+}
+
+/** Delete the interception rules for a provider. Resets that provider to default behavior. */
+export function deleteInterceptionRules(provider: string): void {
+  const normalizedProvider = toNormalizedString(provider);
+  if (!normalizedProvider) return;
+
+  const db = getDbInstance();
+  db.prepare("DELETE FROM key_value WHERE namespace = ? AND key = ?").run(
+    NAMESPACE,
+    normalizedProvider
+  );
+  invalidateCache();
+}
+
+/**
+ * Resolve the effective `interceptSearch` override for a provider/model pair.
+ *
+ * Precedence: per-model rule > provider-level rule > undefined (no override — the
+ * caller should fall back to the existing native-bypass defaults).
+ */
+export function resolveInterceptSearch(
+  provider: string | null | undefined,
+  model: string | null | undefined
+): boolean | undefined {
+  const normalizedProvider = toNormalizedString(provider);
+  if (!normalizedProvider) return undefined;
+
+  const rules = getInterceptionRules(normalizedProvider);
+  if (!rules) return undefined;
+
+  const normalizedModel = toNormalizedString(model);
+  if (normalizedModel && rules.models?.[normalizedModel]?.interceptSearch !== undefined) {
+    return rules.models[normalizedModel].interceptSearch;
+  }
+
+  return rules.interceptSearch;
+}
diff --git a/src/lib/db/migrations/118_provider_param_filters.sql b/src/lib/db/migrations/118_provider_param_filters.sql
new file mode 100644
index 0000000000..2a6d351ca6
--- /dev/null
+++ b/src/lib/db/migrations/118_provider_param_filters.sql
@@ -0,0 +1,7 @@
+-- 118_provider_param_filters.sql
+-- Documents the provider_param_filters namespace in the key_value table.
+-- No schema change — the key_value table already exists.
+-- Key = provider ID, value = JSON with shape:
+--   { block: string[], allow: string[], models?: { [modelId]: { block?: string[], allow?: string[] } }, autoLearn?: boolean }
+--
+-- See: src/lib/db/paramFilters.ts
diff --git a/src/lib/db/migrations/119_model_capability_overrides.sql b/src/lib/db/migrations/119_model_capability_overrides.sql
new file mode 100644
index 0000000000..5ab9614f85
--- /dev/null
+++ b/src/lib/db/migrations/119_model_capability_overrides.sql
@@ -0,0 +1,16 @@
+-- 119_model_capability_overrides.sql
+-- Manual model capability overrides per provider/model target. The UI stores targets
+-- in the same provider/model shape used by combos, so provider-specific model caps do
+-- not leak across providers that expose the same model id.
+
+CREATE TABLE IF NOT EXISTS model_capability_overrides (
+  provider TEXT NOT NULL,
+  model_id TEXT NOT NULL,
+  override_key TEXT NOT NULL,
+  override_value TEXT NOT NULL,
+  refreshed_at TEXT NOT NULL DEFAULT (datetime('now')),
+  PRIMARY KEY (provider, model_id, override_key)
+) WITHOUT ROWID;
+
+CREATE INDEX IF NOT EXISTS idx_model_capability_overrides_key
+  ON model_capability_overrides (override_key);
diff --git a/src/lib/db/migrations/120_interception_rules.sql b/src/lib/db/migrations/120_interception_rules.sql
new file mode 100644
index 0000000000..d042a5f035
--- /dev/null
+++ b/src/lib/db/migrations/120_interception_rules.sql
@@ -0,0 +1,16 @@
+-- 120_interception_rules.sql
+-- Documents the interception_rules namespace in the key_value table (#3384).
+-- No schema change — the key_value table already exists.
+-- Key = provider ID, value = JSON with shape:
+--   {
+--     interceptSearch?: boolean,
+--     interceptFetch?: boolean,
+--     fetchBackend?: "firecrawl"|"jina"|"tavily",
+--     fetchProxyUrl?: string,
+--     models?: { [modelId]: { interceptSearch?, interceptFetch?, fetchBackend?, fetchProxyUrl? } }
+--   }
+--
+-- Resolution precedence: per-model rule > provider-level rule > undefined (caller
+-- falls back to the existing native web-search-bypass defaults in webSearchFallback.ts).
+--
+-- See: src/lib/db/interceptionRules.ts
diff --git a/src/lib/db/migrations/122_free_proxy_sync_errors.sql b/src/lib/db/migrations/122_free_proxy_sync_errors.sql
new file mode 100644
index 0000000000..ee98c70e26
--- /dev/null
+++ b/src/lib/db/migrations/122_free_proxy_sync_errors.sql
@@ -0,0 +1,10 @@
+-- 122_free_proxy_sync_errors.sql
+-- Per-source sync errors for the free-proxy pool. Each failed source writes its
+-- last error(s) here, keyed by source id, so a "Total: 0" result is honest
+-- instead of silent. Cleared on a successful sync for that source.
+
+CREATE TABLE IF NOT EXISTS free_proxy_sync_errors (
+  source TEXT PRIMARY KEY,
+  errors TEXT NOT NULL,
+  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
diff --git a/src/lib/db/modelCapabilityOverrides.ts b/src/lib/db/modelCapabilityOverrides.ts
new file mode 100644
index 0000000000..36ad9364e8
--- /dev/null
+++ b/src/lib/db/modelCapabilityOverrides.ts
@@ -0,0 +1,133 @@
+import { getDbInstance } from "./core";
+
+export type ModelCapabilityOverrideKey = "max_token";
+
+export interface ModelCapabilityOverride {
+  provider: string;
+  modelId: string;
+  target: string;
+  key: ModelCapabilityOverrideKey;
+  value: number;
+  refreshedAt: string;
+}
+
+interface OverrideRow {
+  provider: string;
+  model_id: string;
+  override_key: string;
+  override_value: string;
+  refreshed_at: string;
+}
+
+function isSupportedKey(value: unknown): value is ModelCapabilityOverrideKey {
+  return value === "max_token";
+}
+
+function isPositiveInteger(value: unknown): value is number {
+  return typeof value === "number" && Number.isInteger(value) && value > 0;
+}
+
+export function parseModelOverrideTarget(
+  target: unknown
+): { provider: string; modelId: string } | null {
+  const raw = typeof target === "string" ? target.trim() : "";
+  const slashIndex = raw.indexOf("/");
+  if (slashIndex <= 0 || slashIndex === raw.length - 1) return null;
+
+  const provider = raw.slice(0, slashIndex).trim();
+  const modelId = raw.slice(slashIndex + 1).trim();
+  if (!provider || !modelId) return null;
+  return { provider, modelId };
+}
+
+function toOverride(row: OverrideRow): ModelCapabilityOverride | null {
+  if (!isSupportedKey(row.override_key)) return null;
+
+  let parsedValue: unknown;
+  try {
+    parsedValue = JSON.parse(row.override_value);
+  } catch {
+    return null;
+  }
+
+  if (!isPositiveInteger(parsedValue)) return null;
+
+  return {
+    provider: row.provider,
+    modelId: row.model_id,
+    target: `${row.provider}/${row.model_id}`,
+    key: row.override_key,
+    value: parsedValue,
+    refreshedAt: row.refreshed_at,
+  };
+}
+
+export function getModelCapabilityOverride(
+  provider: string | null | undefined,
+  modelId: string | null | undefined,
+  key: ModelCapabilityOverrideKey
+): number | null {
+  const target = parseModelOverrideTarget(`${provider || ""}/${modelId || ""}`);
+  if (!target || !isSupportedKey(key)) return null;
+
+  try {
+    const row = getDbInstance()
+      .prepare(
+        "SELECT provider, model_id, override_key, override_value, refreshed_at " +
+          "FROM model_capability_overrides WHERE provider = ? AND model_id = ? AND override_key = ?"
+      )
+      .get(target.provider, target.modelId, key) as OverrideRow | undefined;
+    const override = row ? toOverride(row) : null;
+    return override?.value ?? null;
+  } catch {
+    return null;
+  }
+}
+
+export function setModelCapabilityOverride(
+  target: string,
+  key: ModelCapabilityOverrideKey,
+  value: number
+): boolean {
+  const parsedTarget = parseModelOverrideTarget(target);
+  if (!parsedTarget || !isSupportedKey(key) || !isPositiveInteger(value)) return false;
+
+  getDbInstance()
+    .prepare(
+      "INSERT OR REPLACE INTO model_capability_overrides " +
+        "(provider, model_id, override_key, override_value, refreshed_at) " +
+        "VALUES (?, ?, ?, ?, datetime('now'))"
+    )
+    .run(parsedTarget.provider, parsedTarget.modelId, key, JSON.stringify(value));
+  return true;
+}
+
+export function removeModelCapabilityOverride(
+  target: string,
+  key: ModelCapabilityOverrideKey
+): boolean {
+  const parsedTarget = parseModelOverrideTarget(target);
+  if (!parsedTarget || !isSupportedKey(key)) return false;
+
+  const info = getDbInstance()
+    .prepare(
+      "DELETE FROM model_capability_overrides " +
+        "WHERE provider = ? AND model_id = ? AND override_key = ?"
+    )
+    .run(parsedTarget.provider, parsedTarget.modelId, key);
+  return info.changes > 0;
+}
+
+export function listModelCapabilityOverrides(): ModelCapabilityOverride[] {
+  try {
+    const rows = getDbInstance()
+      .prepare(
+        "SELECT provider, model_id, override_key, override_value, refreshed_at " +
+          "FROM model_capability_overrides ORDER BY refreshed_at DESC"
+      )
+      .all() as OverrideRow[];
+    return rows.map(toOverride).filter((entry): entry is ModelCapabilityOverride => entry !== null);
+  } catch {
+    return [];
+  }
+}
diff --git a/src/lib/db/omp.ts b/src/lib/db/omp.ts
new file mode 100644
index 0000000000..08f9b05aa8
--- /dev/null
+++ b/src/lib/db/omp.ts
@@ -0,0 +1,52 @@
+import os from "os";
+import path from "path";
+import Database from "better-sqlite3";
+
+const getOmpDir = () => path.join(os.homedir(), ".omp", "agent");
+const getOmpDbPath = () => path.join(getOmpDir(), "agent.db");
+
+export function getOmpCredentials(providerId: string) {
+  const dbPath = getOmpDbPath();
+  try {
+    const db = new Database(dbPath, { readonly: true });
+    const row = db
+      .prepare(
+        "SELECT data FROM auth_credentials WHERE provider = ? AND credential_type = 'api_key'"
+      )
+      .get(providerId) as { data: string } | undefined;
+    db.close();
+
+    if (row?.data) {
+      const parsed = JSON.parse(row.data);
+      return { hasOmniRoute: true, baseUrl: parsed.baseUrl || null, apiKey: parsed.apiKey || null };
+    }
+    return { hasOmniRoute: false, baseUrl: null, apiKey: null };
+  } catch {
+    return { hasOmniRoute: false, baseUrl: null, apiKey: null };
+  }
+}
+
+export function saveOmpCredentials(providerId: string, apiKey: string, baseUrl: string) {
+  const dbPath = getOmpDbPath();
+  const db = new Database(dbPath);
+
+  db.prepare("DELETE FROM auth_credentials WHERE provider = ?").run(providerId);
+  db.prepare(
+    "INSERT INTO auth_credentials (provider, credential_type, data, disabled_cause, identity_key, created_at, updated_at) VALUES (?, ?, ?, NULL, NULL, ?, ?)"
+  ).run(
+    providerId,
+    "api_key",
+    JSON.stringify({ apiKey, baseUrl }),
+    Math.floor(Date.now() / 1000),
+    Math.floor(Date.now() / 1000)
+  );
+
+  db.close();
+}
+
+export function deleteOmpCredentials(providerId: string) {
+  const dbPath = getOmpDbPath();
+  const db = new Database(dbPath);
+  db.prepare("DELETE FROM auth_credentials WHERE provider = ?").run(providerId);
+  db.close();
+}
diff --git a/src/lib/db/paramFilters.ts b/src/lib/db/paramFilters.ts
new file mode 100644
index 0000000000..3558156762
--- /dev/null
+++ b/src/lib/db/paramFilters.ts
@@ -0,0 +1,238 @@
+/**
+ * db/paramFilters.ts — Provider/Model parameter filter configuration.
+ *
+ * CRUD against the key_value table under namespace "provider_param_filters".
+ * Follows the established key_value pattern from databaseSettings.ts.
+ */
+
+import { getDbInstance } from "./core";
+
+const NAMESPACE = "provider_param_filters";
+
+// ── Types ───────────────────────────────────────────────────────────────────
+
+export interface ModelParamFilter {
+  block?: string[];
+  allow?: string[];
+}
+
+export interface ProviderParamFilter {
+  /** Provider-level params to strip from all requests to this provider. */
+  block: string[];
+  /** Provider-level params to re-add after denylist stripping. */
+  allow: string[];
+  /** Model-specific overrides (stricter than provider-level). */
+  models?: Record<string, ModelParamFilter>;
+  /** When true, upstream 400 "Unsupported parameter" errors auto-populate block. */
+  autoLearn?: boolean;
+}
+
+// ── Cache ───────────────────────────────────────────────────────────────────
+
+let filterCache: Map<string, ProviderParamFilter> | null = null;
+let cacheGeneration = 0;
+
+function bumpCacheGeneration(): void {
+  cacheGeneration++;
+  filterCache = null;
+}
+
+// ── Helpers ─────────────────────────────────────────────────────────────────
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function parseStoredValue(raw: unknown): unknown {
+  if (typeof raw !== "string") return raw;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return raw;
+  }
+}
+
+function toNormalizedString(value: unknown): string | null {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+
+function toStringArray(value: unknown): string[] {
+  return Array.isArray(value) ? value.filter((k): k is string => typeof k === "string") : [];
+}
+
+function toModelParamFilter(raw: Record<string, unknown>): ModelParamFilter | null {
+  const block = toStringArray(raw.block);
+  const allow = toStringArray(raw.allow);
+  if (block.length === 0 && allow.length === 0) return null;
+  const filter: ModelParamFilter = {};
+  if (block.length > 0) filter.block = block;
+  if (allow.length > 0) filter.allow = allow;
+  return filter;
+}
+
+function toModelParamFilters(raw: unknown): Record<string, ModelParamFilter> {
+  const models: Record<string, ModelParamFilter> = {};
+  if (!isRecord(raw)) return models;
+  for (const [modelId, val] of Object.entries(raw)) {
+    if (!isRecord(val)) continue;
+    const filter = toModelParamFilter(val);
+    if (filter) models[modelId] = filter;
+  }
+  return models;
+}
+
+function toProviderParamFilter(raw: unknown): ProviderParamFilter | null {
+  if (!isRecord(raw)) return null;
+  const block = toStringArray(raw.block);
+  const allow = toStringArray(raw.allow);
+  const models = toModelParamFilters(raw.models);
+  const autoLearn = typeof raw.autoLearn === "boolean" ? raw.autoLearn : false;
+  return { block, allow, models: Object.keys(models).length > 0 ? models : undefined, autoLearn };
+}
+
+// ── Read ────────────────────────────────────────────────────────────────────
+
+function readNamespace(namespace: string): Record<string, unknown> {
+  const db = getDbInstance();
+  const rows = db
+    .prepare("SELECT key, value FROM key_value WHERE namespace = ?")
+    .all(namespace) as Array<{ key: string; value: string }>;
+
+  const values: Record<string, unknown> = {};
+  for (const row of rows) {
+    values[row.key] = parseStoredValue(row.value);
+  }
+  return values;
+}
+
+function loadAllConfigs(): Map<string, ProviderParamFilter> {
+  const raw = readNamespace(NAMESPACE);
+  const map = new Map<string, ProviderParamFilter>();
+  for (const [key, value] of Object.entries(raw)) {
+    const parsed = toProviderParamFilter(value);
+    if (parsed) {
+      map.set(key, parsed);
+    }
+  }
+  return map;
+}
+
+// ── Public API ──────────────────────────────────────────────────────────────
+
+/**
+ * Warm the cache on module load so the first call to getParamFilterConfig
+ * does not hit the DB. Idempotent — subsequent calls return the cached map.
+ */
+export function loadParamFilterConfigs(): Map<string, ProviderParamFilter> {
+  if (filterCache === null) {
+    filterCache = loadAllConfigs();
+  }
+  return filterCache;
+}
+
+/**
+ * Get the param filter config for a single provider, or null if not configured.
+ * Uses an in-memory cache refreshed on write.
+ */
+export function getParamFilterConfig(provider: string): ProviderParamFilter | null {
+  return toNormalizedString(provider) ? (loadParamFilterConfigs().get(provider) ?? null) : null;
+}
+
+/**
+ * Upsert the entire param filter config for a provider.
+ * Invalidates the in-memory cache.
+ */
+export function setParamFilterConfig(provider: string, config: ProviderParamFilter): void {
+  if (!toNormalizedString(provider)) return;
+
+  const db = getDbInstance();
+  const stmt = db.prepare(
+    "INSERT OR REPLACE INTO key_value (namespace, key, value) VALUES (?, ?, ?)"
+  );
+
+  // Normalize the filter before persisting
+  const normalized: ProviderParamFilter = {
+    block: config.block ?? [],
+    allow: config.allow ?? [],
+    autoLearn: config.autoLearn ?? false,
+    models: config.models && Object.keys(config.models).length > 0 ? config.models : undefined,
+  };
+
+  stmt.run(NAMESPACE, provider, JSON.stringify(normalized));
+  bumpCacheGeneration();
+}
+
+/**
+ * Delete the param filter config for a provider.
+ * Resets to no filtering for that provider.
+ */
+export function deleteParamFilterConfig(provider: string): void {
+  if (!toNormalizedString(provider)) return;
+
+  const db = getDbInstance();
+  const stmt = db.prepare("DELETE FROM key_value WHERE namespace = ? AND key = ?");
+  stmt.run(NAMESPACE, provider);
+  bumpCacheGeneration();
+}
+
+// ── Global auto-learn flag ──────────────────────────────────────────────────
+
+const GLOBAL_AUTOLEARN_KEY = "__global__";
+
+/**
+ * Check whether the global auto-learn flag is enabled.
+ * When enabled, ALL providers auto-learn unsupported params from 400 errors
+ * regardless of their per-provider autoLearn setting.
+ * Only fires when this is explicitly configured, else returns false.
+ */
+export function isAutoLearnGloballyEnabled(): boolean {
+  const globalCfg = getParamFilterConfig(GLOBAL_AUTOLEARN_KEY);
+  return globalCfg?.autoLearn === true;
+}
+
+/**
+ * Enable or disable global auto-learn globally for all providers.
+ * When enabled, the per-provider autoLearn flag is still honored after
+ * the global check (either being on is sufficient to trigger auto-learn).
+ */
+export function setGlobalAutoLearnEnabled(enabled: boolean): void {
+  const existing = getParamFilterConfig(GLOBAL_AUTOLEARN_KEY);
+  setParamFilterConfig(GLOBAL_AUTOLEARN_KEY, {
+    block: existing?.block ?? [],
+    allow: existing?.allow ?? [],
+    autoLearn: enabled,
+  });
+}
+
+/**
+ * Auto-learn helper: add a single parameter to a provider's block list.
+ * If the field is already in the block list (or the config does not exist),
+ * this is a no-op. Optionally scoped to a specific model.
+ */
+export function addParamToBlocklist(provider: string, paramName: string, model?: string): void {
+  if (!toNormalizedString(provider) || !toNormalizedString(paramName)) return;
+
+  const existing = getParamFilterConfig(provider) ?? {
+    block: [],
+    allow: [],
+    autoLearn: false,
+  };
+
+  if (model) {
+    // Model-level
+    const models = existing.models ?? {};
+    const modelCfg = models[model] ?? {};
+
+    if (Array.isArray(modelCfg.block) && modelCfg.block.includes(paramName)) return;
+
+    const updatedBlock = [...(modelCfg.block ?? []), paramName];
+    models[model] = { ...modelCfg, block: updatedBlock };
+    existing.models = models;
+  } else {
+    // Provider-level
+    if (existing.block.includes(paramName)) return;
+    existing.block = [...existing.block, paramName];
+  }
+
+  setParamFilterConfig(provider, existing);
+}
diff --git a/src/lib/db/providers.ts b/src/lib/db/providers.ts
index a59e178cad..47a18fee9f 100644
--- a/src/lib/db/providers.ts
+++ b/src/lib/db/providers.ts
@@ -55,6 +55,10 @@ export async function getProviderConnections(filter: JsonRecord = {}) {
     conditions.push("is_active = @isActive");
     params.isActive = filter.isActive ? 1 : 0;
   }
+  if (filter.authType) {
+    conditions.push("auth_type = @authType");
+    params.authType = filter.authType;
+  }
 
   if (conditions.length > 0) {
     sql += " WHERE " + conditions.join(" AND ");
@@ -169,6 +173,25 @@ export async function createProviderConnection(data: JsonRecord) {
       }
       // For Codex with workspaceId, don't fall back to email-only check
       // This allows creating new connections for different workspaces
+    } else if (data.provider === "codex") {
+      // Codex without a workspaceId — do NOT fall through to the generic
+      // bare-email dedup below. Codex never sets providerSpecificData.username,
+      // so that path's disambiguation is a no-op and two distinct Codex logins
+      // sharing an email (but missing a verifiable workspace/account id) would
+      // silently collapse into one row, overwriting the first login's token
+      // pair. Require a matching chatgptUserId (a stable per-account id from
+      // the JWT) before merging; otherwise treat this as a new connection.
+      const chatgptUserId = toStringOrNull(providerSpecificData.chatgptUserId);
+      if (chatgptUserId) {
+        existing =
+          (db
+            .prepare(
+              "SELECT * FROM provider_connections WHERE provider = ? AND auth_type = 'oauth' AND json_extract(provider_specific_data, '$.chatgptUserId') = ? AND email = ?"
+            )
+            .get(data.provider, chatgptUserId, data.email) as JsonRecord | undefined) || null;
+      }
+      // No chatgptUserId on the incoming row (or no existing match) — leave
+      // `existing` null so a new connection row is inserted.
     } else {
       // For other providers (or Codex without workspaceId), match on email —
       // disambiguated by providerSpecificData.username when present on both
diff --git a/src/lib/db/proxies.ts b/src/lib/db/proxies.ts
index 220725d084..1f05128045 100755
--- a/src/lib/db/proxies.ts
+++ b/src/lib/db/proxies.ts
@@ -6,6 +6,7 @@
 import { randomUUID, randomInt } from "crypto";
 import { getDbInstance } from "./core";
 import { backupDbFile } from "./backup";
+import { pickByLatency } from "./proxyLatency";
 import type {
   JsonRecord,
   ProxyScope,
@@ -19,10 +20,7 @@ import type {
   LegacyProxyConfig,
   ProxyRotationStrategy,
 } from "./proxies/types";
-import {
-  PROXY_ROTATION_STRATEGIES,
-  DEFAULT_PROXY_ROTATION_STRATEGY,
-} from "./proxies/types";
+import { PROXY_ROTATION_STRATEGIES, DEFAULT_PROXY_ROTATION_STRATEGY } from "./proxies/types";
 import {
   mapProxyRow,
   mapAssignmentRow,
@@ -743,6 +741,8 @@ function pickFromCandidates<T>(
     return candidates[randomInt(candidates.length)];
   }
 
+  if (state.strategy === "latency") return pickByLatency(db, candidates);
+
   if (state.strategy === "sticky") {
     const windowMs = state.stickyWindowMinutes * 60_000;
     const lastRotated = state.rotatedAt ? Date.parse(state.rotatedAt) : NaN;
diff --git a/src/lib/db/proxies/mappers.ts b/src/lib/db/proxies/mappers.ts
index ac88149b1d..c475ad1b64 100644
--- a/src/lib/db/proxies/mappers.ts
+++ b/src/lib/db/proxies/mappers.ts
@@ -1,4 +1,4 @@
-import { decrypt } from "../encryption";
+import { decrypt, looksEncrypted } from "../encryption";
 import type {
   JsonRecord,
   ProxyScope,
@@ -68,12 +68,68 @@ export function extractRelayAuth(notes: unknown): string | undefined {
     if (parsed.relayAuthEnc) {
       const dec = decrypt(parsed.relayAuthEnc);
       if (dec) return dec;
+      // decrypt returned null despite a present blob — warn so operators
+      // know the key changed or went missing. The plaintext fallback below
+      // may still save us (legacy rows that never migrated).
+      if (looksEncrypted(parsed.relayAuthEnc)) {
+        console.warn(
+          `[relay] Failed to decrypt relayAuthEnc for proxy — ` +
+            `STORAGE_ENCRYPTION_KEY may have changed or been unset`
+        );
+      }
     }
     return parsed.relayAuth || undefined;
   } catch {
     return undefined;
   }
 }
+/**
+ * True when a relay-type proxy has no usable auth in `notes` — neither a
+ * plaintext `relayAuth` nor a still-decryptable `relayAuthEnc` blob. This is
+ * the state that makes proxyFetch throw `missing relayAuth` at request time.
+ * Non-relay types are never "missing" (they have no relay auth to begin with).
+ */
+export function isRelayAuthMissing(notes: unknown, type: unknown): boolean {
+  return isRelayProxyType(type) && extractRelayAuth(notes) === undefined;
+}
+
+export type RelayRepairMode = "noop" | "recovered" | "redeploy" | null;
+
+/**
+ * Classifies how a relay's missing/uncertain auth can be fixed WITHOUT a full
+ * redeploy (the deploy token is never persisted):
+ * - "noop":      plaintext relayAuth already present — nothing to do.
+ * - "recovered": relayAuthEnc blob present and decrypts — re-derive plaintext
+ *               in place (key still set, blob intact).
+ * - "redeploy":  neither recoverable — token is unrecoverable, must redeploy.
+ * - null:       not a relay type (repair is N/A).
+ */
+export function relayRepairMode(notes: unknown, type: unknown): RelayRepairMode {
+  if (!isRelayProxyType(type)) return null;
+  // Plaintext relayAuth already in place: nothing to do.
+  const parsed = safeParseNotes(notes);
+  if (typeof parsed?.relayAuth === "string" && parsed.relayAuth) return "noop";
+  // Encrypted blob present and still decryptable: re-derive plaintext in place.
+  if (
+    typeof parsed?.relayAuthEnc === "string" &&
+    parsed.relayAuthEnc &&
+    decrypt(parsed.relayAuthEnc)
+  ) {
+    return "recovered";
+  }
+  // Neither recoverable: the deploy token (never persisted) is lost → redeploy.
+  return "redeploy";
+}
+
+function safeParseNotes(notes: unknown): { relayAuth?: string; relayAuthEnc?: string } | null {
+  if (typeof notes !== "string") return null;
+  try {
+    const parsed = JSON.parse(notes) as { relayAuth?: string; relayAuthEnc?: string };
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
 
 export function toRegistryProxyResolution(row: unknown, level: ProxyScope, levelId: string | null) {
   const record = toRecord(row);
diff --git a/src/lib/db/proxies/types.ts b/src/lib/db/proxies/types.ts
index 73c91c8c01..c734f20a9d 100644
--- a/src/lib/db/proxies/types.ts
+++ b/src/lib/db/proxies/types.ts
@@ -5,11 +5,12 @@ export type ProxyScope = "global" | "provider" | "account" | "combo";
 // to `round-robin` (monotonic persisted cursor — never Math.random). `random`
 // picks uniformly from the alive set; `sticky` holds the same member for a
 // configurable window before advancing the cursor.
-export type ProxyRotationStrategy = "round-robin" | "random" | "sticky";
+export type ProxyRotationStrategy = "round-robin" | "random" | "sticky" | "latency";
 export const PROXY_ROTATION_STRATEGIES: readonly ProxyRotationStrategy[] = [
   "round-robin",
   "random",
   "sticky",
+  "latency",
 ];
 export const DEFAULT_PROXY_ROTATION_STRATEGY: ProxyRotationStrategy = "round-robin";
 
diff --git a/src/lib/db/proxyLatency.ts b/src/lib/db/proxyLatency.ts
new file mode 100644
index 0000000000..818d2f094b
--- /dev/null
+++ b/src/lib/db/proxyLatency.ts
@@ -0,0 +1,55 @@
+// Latency-based proxy rotation strategy: picks the candidate with the lowest
+// average latency observed in `proxy_logs` over a trailing window. Extracted
+// from proxies.ts to keep that frozen god-file under its line-count cap
+// (imported directly by src/lib/db/proxies.ts, anti-barrel, #6798).
+import { getDbInstance } from "./core";
+
+const PROXY_LATENCY_WINDOW_HOURS = parseInt(process.env.PROXY_LATENCY_WINDOW_HOURS ?? "3", 10);
+
+type LatencyLogRow = {
+  proxy_host: string;
+  proxy_port: number;
+  avg_latency: number | null;
+};
+
+// Builds a `"host:port" -> avg_latency_ms` map from proxy_logs rows recorded
+// within the trailing PROXY_LATENCY_WINDOW_HOURS window.
+function buildLatencyMap(db: ReturnType<typeof getDbInstance>): Map<string, number> {
+  const sinceIso = new Date(Date.now() - PROXY_LATENCY_WINDOW_HOURS * 60 * 60 * 1000).toISOString();
+
+  const latencyRows = db
+    .prepare(
+      `SELECT proxy_host, proxy_port, AVG(latency_ms) as avg_latency
+       FROM proxy_logs
+       WHERE timestamp >= ?
+       GROUP BY proxy_host, proxy_port`
+    )
+    .all(sinceIso) as LatencyLogRow[];
+
+  const latencyMap = new Map<string, number>();
+  for (const r of latencyRows) {
+    if (r.avg_latency !== null && r.avg_latency !== undefined) {
+      latencyMap.set(`${r.proxy_host}:${r.proxy_port}`, r.avg_latency);
+    }
+  }
+  return latencyMap;
+}
+
+// Picks the candidate with the lowest recorded average latency; candidates
+// with no logged latency are treated as -1 (best/first) so untested proxies
+// still get a chance to be selected and gather data.
+export function pickByLatency<T>(db: ReturnType<typeof getDbInstance>, candidates: T[]): T {
+  const latencyMap = buildLatencyMap(db);
+
+  const sorted = [...candidates].sort((a, b) => {
+    const pA = a as { host: string; port: number };
+    const pB = b as { host: string; port: number };
+    const keyA = `${pA.host}:${pA.port}`;
+    const keyB = `${pB.host}:${pB.port}`;
+    const latA = latencyMap.has(keyA) ? latencyMap.get(keyA)! : -1;
+    const latB = latencyMap.has(keyB) ? latencyMap.get(keyB)! : -1;
+    return latA - latB;
+  });
+
+  return sorted[0];
+}
diff --git a/src/lib/db/relayProbeStats.ts b/src/lib/db/relayProbeStats.ts
new file mode 100644
index 0000000000..914ac13b68
--- /dev/null
+++ b/src/lib/db/relayProbeStats.ts
@@ -0,0 +1,28 @@
+// In-process relay probe counters. We deliberately keep these in memory rather
+// than persisting to the DB: the dashboard only needs a coarse "how many relay
+// probes have we run, and how many came back alive" signal to flag a sidecar
+// backend that is drifting unhealthy. They reset on restart, which is acceptable
+// for an operational pulse.
+
+interface RelayProbeStats {
+  tested: number;
+  alive: number;
+}
+
+let stats: RelayProbeStats = { tested: 0, alive: 0 };
+
+export function recordRelayProbe(alive: boolean): void {
+  // Single-threaded JS; no lock needed. Guard against pathological values.
+  stats = {
+    tested: stats.tested + 1,
+    alive: stats.alive + (alive ? 1 : 0),
+  };
+}
+
+export function getRelayProbeStats(): RelayProbeStats {
+  return { ...stats };
+}
+
+export function resetRelayProbeStats(): void {
+  stats = { tested: 0, alive: 0 };
+}
diff --git a/src/lib/db/relayProxies.ts b/src/lib/db/relayProxies.ts
index b88c6db945..5c9ffabe37 100644
--- a/src/lib/db/relayProxies.ts
+++ b/src/lib/db/relayProxies.ts
@@ -153,8 +153,7 @@ export function getRelayTokens(): RelayToken[] {
 export function getRelayToken(id: string): RelayToken | null {
   const db = getDbInstance();
   const row = db.prepare("SELECT * FROM relay_tokens WHERE id = ?").get(id) as
-    | RelayTokenRow
-    | undefined;
+    RelayTokenRow | undefined;
   if (!row) return null;
   return { ...(rowToCamel(row) as unknown as RelayToken), enabled: row.enabled === 1 };
 }
@@ -235,16 +234,22 @@ export function toggleRelayToken(id: string, enabled: boolean): RelayToken | nul
 
 // ── Usage / Rate Limit ───────────────────────────────────────────────────────
 
-export function checkRateLimit(tokenId: string): {
+export function checkRateLimit(
+  tokenId: string,
+  existingToken?: RelayToken
+): {
   allowed: boolean;
   remaining: number;
   resetIn: number;
 } {
   const db = getDbInstance();
-  const token = db.prepare("SELECT * FROM relay_tokens WHERE id = ?").get(tokenId) as
-    | RelayTokenRow
-    | undefined;
-  if (!token) return { allowed: false, remaining: 0, resetIn: 0 };
+  let token = existingToken;
+  if (!token) {
+    const row = db.prepare("SELECT * FROM relay_tokens WHERE id = ?").get(tokenId) as
+      RelayTokenRow | undefined;
+    if (!row) return { allowed: false, remaining: 0, resetIn: 0 };
+    token = rowToCamel(row) as unknown as RelayToken;
+  }
 
   const now = Math.floor(Date.now() / 1000);
   const minuteWindow = Math.floor(now / 60) * 60;
@@ -258,7 +263,7 @@ export function checkRateLimit(tokenId: string): {
     .get(tokenId, minuteWindow) as { request_count: number; cost: number } | undefined;
 
   const minuteCount = minuteRow?.request_count || 0;
-  if (minuteCount >= token.max_requests_per_minute) {
+  if (minuteCount >= token.maxRequestsPerMinute) {
     return { allowed: false, remaining: 0, resetIn: 60 - (now % 60) };
   }
 
@@ -270,13 +275,13 @@ export function checkRateLimit(tokenId: string): {
     .get(tokenId, dayWindow) as { total: number } | undefined;
 
   const dayCount = dayRow?.total || 0;
-  if (dayCount >= token.max_requests_per_day) {
+  if (dayCount >= token.maxRequestsPerDay) {
     return { allowed: false, remaining: 0, resetIn: 86400 - (now % 86400) };
   }
 
   const remaining = Math.min(
-    token.max_requests_per_minute - minuteCount,
-    token.max_requests_per_day - dayCount
+    token.maxRequestsPerMinute - minuteCount,
+    token.maxRequestsPerDay - dayCount
   );
 
   return { allowed: true, remaining, resetIn: 60 - (now % 60) };
diff --git a/src/lib/db/settings.ts b/src/lib/db/settings.ts
index 8c8a8eb569..390551d8af 100644
--- a/src/lib/db/settings.ts
+++ b/src/lib/db/settings.ts
@@ -11,6 +11,7 @@ import { getComboModelProvider as getComboEntryProvider } from "@/lib/combos/ste
 import { requestBodyLimitMbFromEnv } from "@/shared/constants/bodySize";
 import { DEFAULT_RESPONSES_PREVIOUS_RESPONSE_ID_MODE } from "@/shared/constants/responsesPreviousResponseId";
 import { type JsonRecord, toRecord } from "./settings/shared";
+import { resolveNoAuthSharedProviderProxy } from "./settings/noAuthProxyFallback";
 
 type ProxyValue = JsonRecord | string | null;
 type ProxyResolutionResult = {
@@ -97,6 +98,9 @@ export async function getSettings() {
     tailscaleUrl: "",
     stickyRoundRobinLimit: 3,
     disableSessionStickiness: false,
+    comboStrategy: "fallback",
+    comboStickyRoundRobinLimit: null, // null = inherit stickyRoundRobinLimit (a literal default here shadows the documented batched-rotation default of 3 — #6678 regression caught by the v3.8.47 release CI)
+    providerStrategies: {},
     requestRetry: 3,
     maxRetryIntervalSec: 30,
     antigravitySignatureCacheMode: "enabled",
@@ -186,6 +190,17 @@ export async function getSettings() {
 }
 
 export async function updateSettings(updates: Record<string, unknown>) {
+  // Detect first-time setup completion before we overwrite settings.
+  let setupJustCompleted = false;
+  if (updates.setupComplete === true) {
+    try {
+      const prev = await getSettings();
+      setupJustCompleted = prev.setupComplete !== true;
+    } catch {
+      setupJustCompleted = true;
+    }
+  }
+
   const db = getDbInstance();
   const insert = db.prepare(
     "INSERT OR REPLACE INTO key_value (namespace, key, value) VALUES ('settings', ?, ?)"
@@ -217,6 +232,17 @@ export async function updateSettings(updates: Record<string, unknown>) {
     );
   }
 
+  // Onboarding / setup finished → one-shot Codex catalog revalidation (init case).
+  if (setupJustCompleted) {
+    void import("@/shared/services/codexCatalogRevalidation")
+      .then(({ scheduleCodexCatalogRevalidationAfterInit }) => {
+        scheduleCodexCatalogRevalidationAfterInit();
+      })
+      .catch(() => {
+        // non-fatal
+      });
+  }
+
   return nextSettings;
 }
 
@@ -558,6 +584,19 @@ export async function resolveProxyForConnection(connectionId: string, apiKeyId?:
     }
   }
 
+  // Step 8.5 (#6272): no-auth providers (mimocode, opencode, ...) share a single
+  // synthetic connectionId that never matches a `provider_connections` row, so
+  // `connectionRecord` above is null and Steps 5-8 (which require it) never run for
+  // them — a provider-level proxy assigned to a no-auth provider was silently
+  // ignored. Best-effort fallback: scan the known no-auth provider ids directly.
+  if (!connectionRecord) {
+    const noAuthFallback = await resolveNoAuthSharedProviderProxy(config.providers);
+    if (noAuthFallback) {
+      cacheProxyResolution(cacheKey, startGeneration, startRegistryGeneration, noAuthFallback);
+      return noAuthFallback;
+    }
+  }
+
   // Step 9: Global registry
   const registryGlobal = await resolveProxyForScopeFromRegistry("global");
   if (registryGlobal?.proxy) {
diff --git a/src/lib/db/settings/noAuthProxyFallback.ts b/src/lib/db/settings/noAuthProxyFallback.ts
new file mode 100644
index 0000000000..14fcabd1ec
--- /dev/null
+++ b/src/lib/db/settings/noAuthProxyFallback.ts
@@ -0,0 +1,65 @@
+/**
+ * db/settings/noAuthProxyFallback.ts
+ *
+ * #6272 — no-auth providers (mimocode, opencode, ...) are dispatched with a single
+ * hardcoded, provider-agnostic connectionId ("noauth" — SYNTHETIC_NOAUTH_CONNECTION_ID
+ * in src/sse/services/auth.ts). No `provider_connections` row ever has id="noauth", so
+ * `resolveProxyForConnection()` in ../settings.ts can never populate `connectionRecord`
+ * for these providers, and its provider-level proxy lookup (Steps 6/8) only runs when
+ * `connectionRecord` is present — a proxy assigned via Settings -> Providers -> mimocode
+ * (or any other no-auth provider) was therefore silently unreachable.
+ *
+ * This is a best-effort fallback invoked only when `connectionRecord` could not be
+ * found: it scans the known no-auth provider ids for a configured provider-level
+ * proxy (registry first, then legacy `proxyConfig.providers`) and returns the first
+ * match. It intentionally does not try to disambiguate which no-auth provider issued
+ * the request (the shared connectionId carries no such information) — in practice at
+ * most one no-auth provider has a provider-level proxy assigned at a time.
+ */
+import { NOAUTH_PROVIDERS } from "@/shared/constants/providers";
+import { resolveProxyForScopeFromRegistry } from "../proxies";
+import type { JsonRecord } from "./shared";
+
+type ProxyValue = JsonRecord | string | null;
+export type NoAuthProxyResolutionResult = {
+  proxy: ProxyValue;
+  level: string;
+  levelId: string | null;
+  source?: string;
+};
+type LegacyProviderProxyMap = Record<string, ProxyValue> | undefined | null;
+
+// Mirrors settings.ts's withFamilyDefault: legacy proxyConfig entries predate the
+// IPv6-only `family` directive, so default it to "auto" when missing.
+function withFamilyDefault(value: ProxyValue): ProxyValue {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    const record = value as JsonRecord;
+    if (typeof record.family === "string") return record;
+    return { ...record, family: "auto" };
+  }
+  return value;
+}
+
+async function resolveOneNoAuthProviderProxy(
+  providerId: string,
+  legacyProviders: LegacyProviderProxyMap
+): Promise<NoAuthProxyResolutionResult | null> {
+  const registryProvider = await resolveProxyForScopeFromRegistry("provider", providerId);
+  if (registryProvider?.proxy) return registryProvider as NoAuthProxyResolutionResult;
+
+  const legacyProxy = legacyProviders?.[providerId];
+  if (legacyProxy) {
+    return { proxy: withFamilyDefault(legacyProxy), level: "provider", levelId: providerId };
+  }
+  return null;
+}
+
+export async function resolveNoAuthSharedProviderProxy(
+  legacyProviders: LegacyProviderProxyMap
+): Promise<NoAuthProxyResolutionResult | null> {
+  for (const providerId of Object.keys(NOAUTH_PROVIDERS)) {
+    const resolved = await resolveOneNoAuthProviderProxy(providerId, legacyProviders);
+    if (resolved) return resolved;
+  }
+  return null;
+}
diff --git a/src/lib/db/usageAnalytics.ts b/src/lib/db/usageAnalytics.ts
index 59c627a441..e37fc5875c 100644
--- a/src/lib/db/usageAnalytics.ts
+++ b/src/lib/db/usageAnalytics.ts
@@ -693,6 +693,49 @@ export function getEndpointUsageRows(params: EndpointUsageParams = {}): Endpoint
     .all(bind) as EndpointUsageRow[];
 }
 
+// ---------------------------------------------------------------------------
+// Request count per provider, per date — #4009
+// ---------------------------------------------------------------------------
+
+export interface ProviderDailyUsageRow {
+  date: string;
+  provider: string;
+  requests: number;
+  promptTokens: number;
+  completionTokens: number;
+  totalTokens: number;
+}
+
+/**
+ * Per-day, per-provider request counts + token totals from the unified source CTE.
+ * Answers "how many requests did provider X get on date Y" (#4009) — providers that
+ * bill per-request rather than per-token need this breakdown, not just the
+ * per-provider aggregate (`getProviderUsageRows`) or the per-day aggregate
+ * (`getDailyUsage`).
+ */
+export function getProviderDailyUsageRows(
+  unifiedSource: string,
+  params: AnalyticsParams
+): ProviderDailyUsageRow[] {
+  const db = getDbInstance();
+  return db
+    .prepare(
+      `
+      SELECT
+        DATE(timestamp) as date,
+        LOWER(provider) as provider,
+        COUNT(*) as requests,
+        COALESCE(SUM(tokens_input), 0) as promptTokens,
+        COALESCE(SUM(tokens_output), 0) as completionTokens,
+        COALESCE(SUM(tokens_input + tokens_output), 0) as totalTokens
+      FROM ${unifiedSource} AS _u
+      GROUP BY DATE(timestamp), LOWER(provider)
+      ORDER BY date DESC, requests DESC
+    `
+    )
+    .all(params) as ProviderDailyUsageRow[];
+}
+
 // ---------------------------------------------------------------------------
 // Export-JSON backup — /api/settings/export-json
 // ---------------------------------------------------------------------------
diff --git a/src/lib/embeddings/service.ts b/src/lib/embeddings/service.ts
index 49b16f9db2..19c5da6fa6 100644
--- a/src/lib/embeddings/service.ts
+++ b/src/lib/embeddings/service.ts
@@ -17,6 +17,7 @@ import { runWithProxyContext } from "@omniroute/open-sse/utils/proxyFetch.ts";
 import { handleComboChat } from "@omniroute/open-sse/services/combo.ts";
 import { resolveBareModelToConnectionDefault } from "@omniroute/open-sse/services/model.ts";
 import { findEmbeddingComboDimensionConflict } from "./familyGuard";
+import { isPrivateHost, isCloudMetadataHost } from "@/shared/network/outboundUrlGuard";
 import { calculateCost } from "@/lib/usage/costCalculator";
 import { attachOmniRouteMetaHeaders } from "@/domain/omnirouteResponseMeta";
 import { generateRequestId } from "@/shared/utils/requestId";
@@ -24,6 +25,17 @@ import { generateRequestId } from "@/shared/utils/requestId";
 type ValidatedEmbeddingBody = Record<string, unknown> & { model: string };
 type ProviderCredentialsResult = Awaited<ReturnType<typeof getProviderCredentials>>;
 
+// #6925: a private/LAN host (RFC1918 10/8, 192.168/16, 172.16/12, CGNAT 100.64/10,
+// loopback, .local/.internal, ULA/link-local IPv6) is treated as a trusted no-auth
+// local embedding provider — mirrors the outbound-URL guard's private-host
+// classification instead of the old hand-rolled localhost/127.0.0.1/172.16-31-only
+// regex, which excluded common LAN ranges (10.x, 192.168.x) and forced them through
+// the apikey/bearer fallback even when no credentials exist. Cloud-metadata hosts
+// (169.254.169.254 etc.) are never treated as no-auth local providers.
+function isNoAuthLocalEmbeddingHost(hostname: string): boolean {
+  return isPrivateHost(hostname) && !isCloudMetadataHost(hostname);
+}
+
 export interface EmbeddingHandlerOptions {
   clientRawRequest?: {
     endpoint: string;
@@ -119,11 +131,7 @@ export async function createEmbeddingResponse(
         if (!validTypes.includes(n.apiType || "")) return false;
         try {
           const hostname = new URL(n.baseUrl).hostname;
-          return (
-            hostname === "localhost" ||
-            hostname === "127.0.0.1" ||
-            /^172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}$/.test(hostname)
-          );
+          return isNoAuthLocalEmbeddingHost(hostname);
         } catch {
           return false;
         }
@@ -164,11 +172,22 @@ export async function createEmbeddingResponse(
       );
       if (matchingNode) {
         const baseUrl = String(matchingNode.baseUrl).replace(/\/+$/, "");
+        // #6925: a private/LAN node reaching this fallback (e.g. a matching
+        // prefix that skipped the dynamicProviders pass above) must never be
+        // forced through bearer-auth — only a non-private host falls back to
+        // apikey/bearer credential resolution.
+        let nodeHostname = "";
+        try {
+          nodeHostname = new URL(matchingNode.baseUrl).hostname;
+        } catch {
+          nodeHostname = "";
+        }
+        const isNoAuthLocal = nodeHostname !== "" && isNoAuthLocalEmbeddingHost(nodeHostname);
         providerConfig = {
           id: matchingNode.prefix,
           baseUrl: `${baseUrl}/embeddings`,
-          authType: "apikey",
-          authHeader: "bearer",
+          authType: isNoAuthLocal ? "none" : "apikey",
+          authHeader: isNoAuthLocal ? "none" : "bearer",
           models: [],
         };
         credentialsProviderId = matchingNode.id || provider;
diff --git a/src/lib/freeProviderRankings.ts b/src/lib/freeProviderRankings.ts
index dfa58fab82..c5055332b3 100644
--- a/src/lib/freeProviderRankings.ts
+++ b/src/lib/freeProviderRankings.ts
@@ -12,6 +12,7 @@ import { NOAUTH_PROVIDERS, OAUTH_PROVIDERS, APIKEY_PROVIDERS } from "@/shared/co
 import { REGISTRY } from "@omniroute/open-sse/config/providerRegistry";
 import { listModelIntelligence } from "./db/modelIntelligence";
 import { getProviderConnections } from "./db/providers";
+import { getCustomModels } from "./db/models";
 
 export interface ProviderModelScore {
   modelId: string;
@@ -90,12 +91,51 @@ function getFreeProviders() {
   return providers;
 }
 
+/** Minimal shape shared by registry models and user-added custom models. */
+export interface RankableModel {
+  id: string;
+  name: string;
+}
+
 /**
- * Get models for a provider from the registry.
+ * Pure merge: combine a provider's static registry models with its
+ * user-added custom models, de-duplicating by `id` (registry entry wins on
+ * collision — a custom model overriding a known catalog ID keeps the
+ * catalog's richer metadata upstream, only the extra IDs are additive here).
+ *
+ * Exported so the #6368 fix ("custom models missing from Free Provider
+ * Rankings under configured/available filters") can be unit-tested without a
+ * DB: the ranking builder no longer only walks the static registry — it also
+ * folds in whatever the operator configured as a custom model for that
+ * provider, mirroring how #6150's connection-based filters already treat
+ * "configured" as DB/runtime state rather than catalog membership.
  */
-function getProviderModels(providerId: string) {
+export function mergeProviderModels(
+  registryModels: RankableModel[],
+  customModels: RankableModel[]
+): RankableModel[] {
+  if (customModels.length === 0) return registryModels;
+  const seen = new Set(registryModels.map((m) => m.id));
+  const merged = registryModels.slice();
+  for (const custom of customModels) {
+    if (!custom?.id || seen.has(custom.id)) continue;
+    seen.add(custom.id);
+    merged.push({ id: custom.id, name: custom.name || custom.id });
+  }
+  return merged;
+}
+
+/**
+ * Get models for a provider: static registry models plus any user-added
+ * custom models for that provider (#6368 — custom models were previously
+ * invisible to the ranking builder, so they never survived the
+ * configured/available filters even when actually configured+available).
+ */
+async function getProviderModels(providerId: string): Promise<RankableModel[]> {
   const entry = REGISTRY[providerId];
-  return entry?.models ?? [];
+  const registryModels = entry?.models ?? [];
+  const customModels = (await getCustomModels(providerId)) as RankableModel[];
+  return mergeProviderModels(registryModels, Array.isArray(customModels) ? customModels : []);
 }
 
 /**
@@ -282,7 +322,7 @@ export async function computeFreeProviderRankings(
   const rankings: FreeProviderRanking[] = [];
 
   for (const provider of freeProviders) {
-    const models = getProviderModels(provider.id);
+    const models = await getProviderModels(provider.id);
     if (models.length === 0) continue;
 
     const modelScores: ProviderModelScore[] = [];
diff --git a/src/lib/guardrails/visionBridge.ts b/src/lib/guardrails/visionBridge.ts
index 1c721b8cd9..4e5b45f966 100644
--- a/src/lib/guardrails/visionBridge.ts
+++ b/src/lib/guardrails/visionBridge.ts
@@ -1,7 +1,8 @@
 /**
  * Vision Bridge Guardrail.
- * Intercepts image-bearing requests to non-vision models,
- * extracts descriptions via vision model, and replaces images with text.
+ * Intercepts image-bearing requests to non-vision models.
+ * For individual non-vision models: reroutes to the fastest available vision-capable model.
+ * For combos with non-vision targets: extracts descriptions via vision model and replaces images with text.
  */
 
 import { BaseGuardrail, type GuardrailContext, type GuardrailResult } from "./base";
@@ -17,6 +18,7 @@ import {
   getVisionBridgeConfig,
   isVisionBridgeForcedModel,
 } from "@/shared/constants/visionBridgeDefaults";
+import { getBestVisionModel } from "./visionBridgeRouter";
 
 type ComboVisionBridgeDecision = "process" | "skip" | "not-combo";
 
@@ -121,6 +123,11 @@ export class VisionBridgeGuardrail extends BaseGuardrail {
       return { block: false };
     }
 
+    // 3b. Auto/ prefix → skip guardrail (auto-combo resolver handles vision-capable model selection)
+    if (model === "auto" || model.startsWith("auto/")) {
+      return { block: false };
+    }
+
     const forceVisionBridge = isVisionBridgeForcedModel(model);
 
     // 4. Check if model supports vision
@@ -176,7 +183,40 @@ export class VisionBridgeGuardrail extends BaseGuardrail {
       return { block: false };
     }
 
-    // 9. Get configuration
+    // 9. Individual non-combo model with images → REROUTE to best vision-capable model
+    // instead of describing images through an intermediate vision call.
+    // This lets a downstream vision model process the image natively.
+    if (comboVisionBridgeDecision === "not-combo" && !forceVisionBridge) {
+      // Honor an explicit operator override from the Vision Bridge settings tab
+      // (settings.visionBridgeModel) as the fixed reroute target, for consistency
+      // with the combo/describe path below (step 10) which always honors it via
+      // getVisionBridgeConfig. When unset, auto-select the fastest available
+      // vision-capable model from available providers.
+      const configuredModel =
+        typeof settings.visionBridgeModel === "string" && settings.visionBridgeModel.trim()
+          ? settings.visionBridgeModel.trim()
+          : undefined;
+      const bestModel = getBestVisionModel({ fixedModel: configuredModel });
+      if (bestModel && bestModel !== model) {
+        const modifiedBody = {
+          ...(body as Record<string, unknown>),
+          model: bestModel,
+        };
+        return {
+          block: false,
+          modifiedPayload: modifiedBody as unknown,
+          meta: {
+            rerouted: true,
+            fromModel: model,
+            toModel: bestModel,
+            imagesKept: imageParts.length,
+          },
+        };
+      }
+      // Fall through: if no vision model found, describe images as text instead
+    }
+
+    // 10. Get configuration
     const config = getVisionBridgeConfig({
       visionBridgeEnabled: settings.visionBridgeEnabled as boolean | undefined,
       visionBridgeModel: settings.visionBridgeModel as string | undefined,
@@ -185,10 +225,10 @@ export class VisionBridgeGuardrail extends BaseGuardrail {
       visionBridgeMaxImages: settings.visionBridgeMaxImages as number | undefined,
     });
 
-    // 10. Limit images
+    // 11. Limit images
     const limitedParts = imageParts.slice(0, config.maxImages);
 
-    // 11. Call vision model for each image in parallel (injectable for testing)
+    // 12. Call vision model for each image in parallel (injectable for testing)
     const callVision = this.deps.callVisionModel ?? defaultCallVisionModel;
     const logger = context.log;
     const startTime = Date.now();
@@ -215,7 +255,7 @@ export class VisionBridgeGuardrail extends BaseGuardrail {
       return null;
     });
 
-    // 12. Replace image parts with text descriptions (null → keep original image)
+    // 13. Replace image parts with text descriptions (null → keep original image)
     const modifiedBody = replaceImageParts(
       body as Parameters<typeof replaceImageParts>[0],
       descriptions
diff --git a/src/lib/localDb.ts b/src/lib/localDb.ts
index 0b9ba7000f..46f2eb67cf 100755
--- a/src/lib/localDb.ts
+++ b/src/lib/localDb.ts
@@ -559,6 +559,7 @@ export type {
 export {
   upsertFreeProxy,
   listFreeProxies,
+  countFreeProxies,
   listFreeProxiesBySource,
   getFreeProxyById,
   markFreeProxyInPool,
@@ -568,9 +569,12 @@ export {
   pruneStaleFreeProxies,
   getFreeProxyStats,
   recordFreeProxySync,
+  recordFreeProxySyncErrors,
+  clearFreeProxySyncErrors,
+  getFreeProxySyncErrors,
 } from "./db/freeProxies";
 
-export type { FreeProxyRecord, FreeProxyStats } from "./db/freeProxies";
+export type { FreeProxyRecord, FreeProxyStats, FreeProxySyncErrors } from "./db/freeProxies";
 
 export {
   listPlaygroundPresets,
@@ -589,15 +593,15 @@ export {
   markAllMemoriesNeedReindex,
   getMemoryReindexQueue,
   countMemoryReindexPending,
+  type MemoryVecMeta,
 } from "./db/memoryVec";
-
-export type { MemoryVecMeta } from "./db/memoryVec";
 // T-A-F2: AgentBridge state/mappings/bypass + Inspector custom hosts/sessions
 export * from "./db/agentBridgeState";
 export * from "./db/agentBridgeMappings";
 export * from "./db/agentBridgeBypass";
 export * from "./db/inspectorCustomHosts";
 export * from "./db/inspectorSessions";
+export * from "./db/omp";
 // Quota Sharing — Group B (planos 16+22)
 export {
   listPools,
@@ -788,10 +792,13 @@ export type {
 // proxy_logs — export query (#3500 slice 4)
 // ---------------------------------------------------------------------------
 export { exportProxyLogsSince } from "./db/proxyLogs";
-
 // ---------------------------------------------------------------------------
 // Per-connection 429 cooldown wrappers (#5957 / #5958 — Issue 1 follow-ups)
 // Logic lives in db/providers/rateLimit.ts (Hard Rule #2 — localDb is re-export
 // only); re-exported here for the historical localDb import contract.
 // ---------------------------------------------------------------------------
 export { markConnectionRateLimitedUntil, clearConnectionRateLimit } from "./db/providers";
+// Provider param filters — denylist/allowlist config per provider/model (#6625)
+export * from "./db/paramFilters";
+export * from "./db/interceptionRules"; // Per-model web-search/web-fetch interception rules (#3384)
+export * from "./db/relayProbeStats"; // Relay probe latency/health stats (#6909)
diff --git a/src/lib/modelCapabilities.ts b/src/lib/modelCapabilities.ts
index cae1173042..e3e6052f9d 100644
--- a/src/lib/modelCapabilities.ts
+++ b/src/lib/modelCapabilities.ts
@@ -12,6 +12,7 @@ import {
 } from "@/shared/constants/modelSpecs";
 import { getSyncedCapability } from "@/lib/modelsDevSync";
 import { getModelContextOverride } from "@/lib/db/modelContextOverrides";
+import { getModelCapabilityOverride } from "@/lib/db/modelCapabilityOverrides";
 import { isVisionModelId } from "@/shared/constants/visionModels";
 
 const TOOL_CALLING_UNSUPPORTED_PATTERNS: string[] = [];
@@ -340,6 +341,47 @@ function resolveVisionCapability(
   return null;
 }
 
+/**
+ * Issue #6524: an operator-set `max_token` capability override (see
+ * `src/lib/db/modelCapabilityOverrides.ts`) is the manual escape hatch for a
+ * wrong/stale synced `limit_output` value (e.g. a provider's models.dev catalog
+ * row reporting `limit_output` equal to `limit_context`). It already won over the
+ * synced value in `getResolvedModelCapabilities().maxOutputTokens` — this helper
+ * makes `getExplicitModelOutputCap()` (used by the reasoning-token-buffer clamp)
+ * consult the same override so both read paths agree.
+ */
+function getMaxTokenCapabilityOverride(resolved: {
+  provider: string | null;
+  model: string | null;
+  rawModel: string | null;
+}): number | null {
+  return (
+    getModelCapabilityOverride(resolved.provider, resolved.model, "max_token") ??
+    (resolved.rawModel && resolved.rawModel !== resolved.model
+      ? getModelCapabilityOverride(resolved.provider, resolved.rawModel, "max_token")
+      : null)
+  );
+}
+
+export function getExplicitModelOutputCap(input: CapabilityInput): number | null {
+  const resolved = resolveCapabilityInput(input);
+  const maxTokenOverride = getMaxTokenCapabilityOverride(resolved);
+  if (maxTokenOverride !== null) return maxTokenOverride;
+
+  const synced = getSyncedCapabilityForResolved(
+    resolved.provider,
+    resolved.model,
+    resolved.rawModel
+  );
+  if (synced && typeof synced.limit_output === "number") return synced.limit_output;
+
+  const registryModel = getRegistryModel(resolved.provider, resolved.model);
+  if (typeof registryModel?.maxOutputTokens === "number") return registryModel.maxOutputTokens;
+
+  const spec = getStaticSpec(resolved.model, resolved.rawModel);
+  return spec?.maxOutputTokens ?? null;
+}
+
 export function getResolvedModelCapabilities(input: CapabilityInput): ResolvedModelCapabilities {
   const resolved = resolveCapabilityInput(input);
   const spec = getStaticSpec(resolved.model, resolved.rawModel);
@@ -385,6 +427,8 @@ export function getResolvedModelCapabilities(input: CapabilityInput): ResolvedMo
     spec?.contextWindow ??
     null;
 
+  const maxTokenOverride = getMaxTokenCapabilityOverride(resolved);
+
   return {
     provider: resolved.provider,
     model: resolved.model,
@@ -412,6 +456,7 @@ export function getResolvedModelCapabilities(input: CapabilityInput): ResolvedMo
       synced?.limit_input ??
       contextWindow,
     maxOutputTokens:
+      maxTokenOverride ??
       synced?.limit_output ??
       (typeof registryModel?.maxOutputTokens === "number" ? registryModel.maxOutputTokens : null) ??
       spec?.maxOutputTokens ??
diff --git a/src/lib/modelMetadataRegistry.ts b/src/lib/modelMetadataRegistry.ts
index 37e0dfa6e3..12d9f215a6 100644
--- a/src/lib/modelMetadataRegistry.ts
+++ b/src/lib/modelMetadataRegistry.ts
@@ -12,7 +12,10 @@ import {
 import { AI_PROVIDERS } from "@/shared/constants/providers";
 import { PROVIDER_ID_TO_ALIAS, PROVIDER_MODELS } from "@/shared/constants/models";
 import { getSyncStatus, getSyncedCapability } from "@/lib/modelsDevSync";
-import { CANONICAL_EFFORT_VALUES } from "@/shared/reasoning/effortStandardization";
+import {
+  CANONICAL_EFFORT_VALUES,
+  extendCodexGpt56EffortValues,
+} from "@/shared/reasoning/effortStandardization";
 
 const MODEL_METADATA_SCHEMA_VERSION = "model-metadata-v1";
 
@@ -296,7 +299,13 @@ export function enrichCatalogModelEntry<T extends JsonRecord>(
           thinking: metadata.capabilities.supportsThinking,
           supportsThinking: metadata.capabilities.supportsThinking,
           ...(metadata.capabilities.supportsThinking
-            ? { effort_tiers: [...CANONICAL_EFFORT_VALUES] }
+            ? {
+                effort_tiers: extendCodexGpt56EffortValues(
+                  metadata.provider,
+                  metadata.model,
+                  CANONICAL_EFFORT_VALUES
+                ),
+              }
             : {}),
         }
       : {}),
diff --git a/src/lib/oauth/constants/oauth.ts b/src/lib/oauth/constants/oauth.ts
index 4ca6d3a70a..b9c36adc26 100644
--- a/src/lib/oauth/constants/oauth.ts
+++ b/src/lib/oauth/constants/oauth.ts
@@ -484,6 +484,7 @@ export const PROVIDERS = {
   CURSOR: "cursor",
   KILOCODE: "kilocode",
   CLINE: "cline",
+  CLINEPASS: "clinepass",
   WINDSURF: "windsurf",
   DEVIN_CLI: "devin-cli",
   TRAE: "trae",
diff --git a/src/lib/oauth/providers/index.ts b/src/lib/oauth/providers/index.ts
index 1be452e2c5..e2f9e10847 100644
--- a/src/lib/oauth/providers/index.ts
+++ b/src/lib/oauth/providers/index.ts
@@ -46,6 +46,10 @@ export const PROVIDERS = {
   trae,
   kilocode,
   cline,
+  // clinepass reuses the Cline WorkOS OAuth flow 1:1 (same api.cline.bot host, same token
+  // type) — it is a separate catalog entry advertising the cline-pass/* (ClinePass
+  // subscription) models. See registry/clinepass/index.ts.
+  clinepass: cline,
   windsurf,
   // devin-cli shares the same token format as windsurf (WINDSURF_API_KEY / devin auth login)
   "devin-cli": windsurf,
diff --git a/src/lib/oauth/providers/kiro.ts b/src/lib/oauth/providers/kiro.ts
index 2efb7fc609..f90bbae0f0 100644
--- a/src/lib/oauth/providers/kiro.ts
+++ b/src/lib/oauth/providers/kiro.ts
@@ -1,4 +1,5 @@
 import { KIRO_CONFIG, AWS_REGION_PATTERN, assertValidAwsRegion } from "../constants/oauth";
+import { discoverKiroProfileArnAcrossRegions } from "@omniroute/open-sse/services/kiroRegion.ts";
 
 export const kiro = {
   config: KIRO_CONFIG,
@@ -8,9 +9,7 @@ export const kiro = {
     const candidateRegion = regionMatch?.[1] || "us-east-1";
     // Region is sourced from KIRO_CONFIG.tokenUrl (trusted constant) but defensively
     // re-validate before letting it influence later fetches (GHSA-6mwv-4mrm-5p3m).
-    const resolvedRegion = AWS_REGION_PATTERN.test(candidateRegion)
-      ? candidateRegion
-      : "us-east-1";
+    const resolvedRegion = AWS_REGION_PATTERN.test(candidateRegion) ? candidateRegion : "us-east-1";
     const registerPayload: {
       clientName: string;
       clientType: string;
@@ -131,45 +130,19 @@ export const kiro = {
   },
   // Enterprise IAM Identity Center accounts require a region-bound Q Developer profileArn on every
   // CodeWhisperer call; without it AWS returns 403 "User is not authorized to make this call". The
-  // device-code flow does not return one, so discover it here via ListAvailableProfiles against the
-  // same regional endpoint the token was issued for. Best-effort: AWS Builder ID accounts have no
-  // profile and this simply yields none; failures never block login.
+  // device-code flow does not return one, so discover it here via ListAvailableProfiles.
+  //
+  // The IdC/token region (`_region`, e.g. eu-north-1) is NOT where the Q Developer profile lives —
+  // AWS only hosts the profile (and its runtime) in us-east-1 / eu-central-1. So probe those
+  // profile regions with the freshly-minted SSO token (which works cross-region against the
+  // profile's home region), NOT q.{idcRegion} which does not resolve. Best-effort: AWS Builder ID
+  // accounts have no profile and this simply yields none; failures never block login.
   postExchange: async (tokenData) => {
     const accessToken = tokenData?.access_token;
     if (!accessToken) return null;
-    const region = String(tokenData?._region || "us-east-1").toLowerCase();
-    // Defensive: tokenData._region came from upstream JSON or extraData
-    // and is interpolated into the runtime host below (GHSA-6mwv-4mrm-5p3m).
-    if (!AWS_REGION_PATTERN.test(region)) return null;
-    const runtimeHost =
-      region === "us-east-1"
-        ? "https://codewhisperer.us-east-1.amazonaws.com"
-        : `https://q.${region}.amazonaws.com`;
-    try {
-      const profRes = await fetch(`${runtimeHost}/`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-amz-json-1.0",
-          Accept: "application/json",
-          "x-amz-target": "AmazonCodeWhispererService.ListAvailableProfiles",
-          Authorization: `Bearer ${accessToken}`,
-        },
-        body: JSON.stringify({ maxResults: 10 }),
-        signal: AbortSignal.timeout(10000),
-      });
-      if (!profRes.ok) return null;
-      const profData = await profRes.json();
-      const profiles = Array.isArray(profData?.profiles) ? profData.profiles : [];
-      const matched =
-        profiles.find(
-          (p: { arn?: string }) => typeof p?.arn === "string" && p.arn.includes(`:${region}:`)
-        ) || profiles[0];
-      const arn = matched && typeof matched.arn === "string" ? matched.arn : undefined;
-      return arn ? { profileArn: arn } : null;
-    } catch {
-      // Best-effort profile discovery — never block login on it.
-      return null;
-    }
+    const storedRegion = typeof tokenData?._region === "string" ? tokenData._region : undefined;
+    const arn = await discoverKiroProfileArnAcrossRegions(accessToken, storedRegion);
+    return arn ? { profileArn: arn } : null;
   },
   mapTokens: (tokens, extra) => ({
     accessToken: tokens.access_token,
diff --git a/src/lib/oauth/services/codexImport.ts b/src/lib/oauth/services/codexImport.ts
index 955584e3c6..9f5b929d34 100644
--- a/src/lib/oauth/services/codexImport.ts
+++ b/src/lib/oauth/services/codexImport.ts
@@ -138,6 +138,36 @@ function unwrapCodexAuthJson(rec: Record<string, unknown>): Record<string, unkno
   return { ...rec, ...tokens };
 }
 
+/**
+ * Map the camelCase field names used by 9router's Codex account export
+ * (`accessToken`, `refreshToken`, `idToken`, `expiresAt`, and a nested
+ * `providerSpecificData` block) onto the snake_case keys the rest of the
+ * normalizer already understands (#6665). A snake_case key is only filled from
+ * its camelCase alias when it is absent, so a snake_case or mixed export keeps
+ * working unchanged.
+ */
+function applyCamelCaseAliases(
+  rec: Record<string, unknown>,
+): Record<string, unknown> {
+  const out: Record<string, unknown> = { ...rec };
+  const fillFrom = (snake: string, value: unknown) => {
+    if (out[snake] === undefined && typeof value === "string" && value) {
+      out[snake] = value;
+    }
+  };
+  fillFrom("access_token", rec.accessToken);
+  fillFrom("refresh_token", rec.refreshToken);
+  fillFrom("id_token", rec.idToken);
+  fillFrom("expired", rec.expiresAt);
+  const psd = rec.providerSpecificData;
+  if (psd && typeof psd === "object" && !Array.isArray(psd)) {
+    const block = psd as Record<string, unknown>;
+    fillFrom("account_id", block.chatgptAccountId);
+    fillFrom("chatgpt_plan_type", block.chatgptPlanType);
+  }
+  return out;
+}
+
 // ── Public API ────────────────────────────────────────────────────────────────
 
 /**
@@ -151,7 +181,9 @@ export function normalizeCodexImportRecord(input: unknown): NormalizeResult {
     return { ok: false, error: "Record is not an object" };
   }
 
-  const rec = unwrapCodexAuthJson(input as Record<string, unknown>);
+  const rec = applyCamelCaseAliases(
+    unwrapCodexAuthJson(input as Record<string, unknown>),
+  );
 
   // Allow type field to be missing or "codex"; reject anything else explicitly so
   // users don't accidentally import claude/gemini exports through this path.
@@ -181,7 +213,10 @@ export function normalizeCodexImportRecord(input: unknown): NormalizeResult {
     fromJwt.chatgptAccountId,
     rec.account_id as string | undefined,
   );
-  const chatgptPlanType = pickString(fromJwt.chatgptPlanType);
+  const chatgptPlanType = pickString(
+    fromJwt.chatgptPlanType,
+    rec.chatgpt_plan_type as string | undefined,
+  );
 
   const expiresAt =
     parseExpiry(rec.expired) ?? parseAccessTokenExp(accessToken);
diff --git a/src/lib/oauth/services/kiro.ts b/src/lib/oauth/services/kiro.ts
index b1357533f3..7023ddffa9 100644
--- a/src/lib/oauth/services/kiro.ts
+++ b/src/lib/oauth/services/kiro.ts
@@ -1,4 +1,8 @@
 import { KIRO_CONFIG, assertValidAwsRegion } from "../constants/oauth";
+import {
+  buildExternalIdpRefreshParams,
+  isExternalIdpAuthMethod,
+} from "@omniroute/open-sse/services/kiroExternalIdp.ts";
 
 /**
  * Kiro OAuth Service
@@ -187,6 +191,32 @@ export class KiroService {
   async refreshToken(refreshToken: string, providerSpecificData: any = {}) {
     const { authMethod, clientId, clientSecret, region } = providerSpecificData;
 
+    // Enterprise / Microsoft Entra "Your organization" (external_idp) login: refresh with a
+    // standard public-client OAuth2 refresh_token grant against the org IdP's tokenEndpoint
+    // (form-encoded client_id + refresh_token + scope, no client_secret). The AWS SSO OIDC and
+    // Kiro social endpoints cannot refresh these tokens.
+    if (isExternalIdpAuthMethod(authMethod)) {
+      const refreshRequest = buildExternalIdpRefreshParams(refreshToken, providerSpecificData);
+      const response = await fetch(refreshRequest.tokenEndpoint, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json",
+        },
+        body: refreshRequest.body,
+      });
+      if (!response.ok) {
+        const error = await response.text();
+        throw new Error(`Token refresh failed: ${error}`);
+      }
+      const data = await response.json();
+      return {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token || refreshToken,
+        expiresIn: data.expires_in || 3600,
+      };
+    }
+
     // AWS SSO OIDC refresh (Builder ID or IDC).
     // Imported social tokens (authMethod === "imported") have a registered clientId/clientSecret
     // but a Kiro-social refresh token the OIDC client can't refresh — use the social path (#2467).
@@ -418,6 +448,80 @@ export class KiroService {
     return null;
   }
 
+  /**
+   * List available CodeWhisperer profiles for an access token or long-lived API key.
+   * Some long-lived API keys can call GenerateAssistantResponse but are explicitly
+   * denied on ListAvailableProfiles, so callers must treat an AccessDenied profile
+   * lookup as an optional discovery failure rather than a hard auth failure.
+   */
+  async listAvailableProfiles(accessToken: string, region: string = "us-east-1") {
+    assertValidAwsRegion(region);
+    const endpoint =
+      region === "us-east-1"
+        ? "https://codewhisperer.us-east-1.amazonaws.com"
+        : `https://q.${region}.amazonaws.com`;
+
+    const response = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        "Content-Type": "application/x-amz-json-1.0",
+        "x-amz-target": "AmazonCodeWhispererService.ListAvailableProfiles",
+        Accept: "application/json",
+        tokentype: "API_KEY",
+      },
+      body: JSON.stringify({ maxResults: 10 }),
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Failed to list profiles: ${error}`);
+    }
+
+    const data = await response.json();
+    const profiles = Array.isArray(data?.profiles) ? data.profiles : [];
+    const arnOf = (profile: any) => profile?.arn || profile?.profileArn || null;
+    const match =
+      profiles.find((profile: any) => String(arnOf(profile) || "").includes(`:${region}:`)) ||
+      profiles[0];
+    return arnOf(match);
+  }
+
+  /**
+   * Normalize a long-lived Kiro/CodeWhisperer API key.
+   */
+  async validateApiKey(apiKey: string, regionInput?: string) {
+    // Default kept OUT of the parameter list: check-public-creds' CRED_KEY_RE matches the
+    // `apiKey:` annotation and flags any string literal in the signature (fn-param FP class).
+    const region = regionInput || "us-east-1";
+    assertValidAwsRegion(region);
+    const accessToken = apiKey.trim();
+    if (!accessToken) {
+      throw new Error("API key is required");
+    }
+
+    let profileArn: string | null = null;
+    try {
+      profileArn = await this.listAvailableProfiles(accessToken, region);
+    } catch (error: any) {
+      const message = String(error?.message || error || "");
+      const isApiKeyProfileDenied =
+        message.includes("AccessDeniedException") &&
+        message.includes("API key authentication is not supported for this operation");
+      if (!isApiKeyProfileDenied) {
+        throw error;
+      }
+    }
+
+    return {
+      accessToken,
+      refreshToken: null,
+      profileArn,
+      region,
+      authMethod: "api_key",
+    };
+  }
+
   /**
    * Fetch user email from access token (optional, for display)
    */
diff --git a/src/lib/pricingSync.ts b/src/lib/pricingSync.ts
index 4fbd1b34ef..886c387aed 100644
--- a/src/lib/pricingSync.ts
+++ b/src/lib/pricingSync.ts
@@ -285,6 +285,51 @@ export function clearSyncedPricing(): void {
   invalidateDbCache("pricing");
 }
 
+// ─── DB: Sync status namespace ───────────────────────────
+//
+// Persisted separately from `pricing_synced` because Next.js standalone
+// builds load this module from independent webpack chunks (e.g. the
+// instrumentation hook vs an API route handler) — each gets its OWN
+// top-level module state. Module-level vars (`lastSyncTime`,
+// `lastSyncModelCount`) are therefore invisible across those instances;
+// persisting them to the DB lets any instance read the real status.
+
+const SYNC_STATUS_NAMESPACE = "pricing_sync_status";
+const SYNC_STATUS_KEY = "last_sync";
+
+function readPersistedSyncStatus(): { lastSyncTime: string; lastSyncModelCount: number } | null {
+  const db = getDbInstance();
+  const row = db
+    .prepare("SELECT value FROM key_value WHERE namespace = ? AND key = ?")
+    .get(SYNC_STATUS_NAMESPACE, SYNC_STATUS_KEY);
+  const record = toRecord(row);
+  const rawValue = typeof record.value === "string" ? record.value : null;
+  if (!rawValue) return null;
+  try {
+    const parsed = JSON.parse(rawValue) as { lastSyncTime?: string; lastSyncModelCount?: number };
+    if (typeof parsed.lastSyncTime !== "string") return null;
+    return {
+      lastSyncTime: parsed.lastSyncTime,
+      lastSyncModelCount:
+        typeof parsed.lastSyncModelCount === "number" ? parsed.lastSyncModelCount : 0,
+    };
+  } catch {
+    return null;
+  }
+}
+
+function writePersistedSyncStatus(lastSync: string, modelCount: number): void {
+  const db = getDbInstance();
+  db.prepare(
+    "INSERT INTO key_value (namespace, key, value) VALUES (?, ?, ?) " +
+      "ON CONFLICT(namespace, key) DO UPDATE SET value = excluded.value"
+  ).run(
+    SYNC_STATUS_NAMESPACE,
+    SYNC_STATUS_KEY,
+    JSON.stringify({ lastSyncTime: lastSync, lastSyncModelCount: modelCount })
+  );
+}
+
 // ─── Main sync function ─────────────────────────────────
 
 /**
@@ -341,6 +386,7 @@ export async function syncPricingFromSources(opts?: {
       saveSyncedPricing(aggregated);
       lastSyncTime = new Date().toISOString();
       lastSyncModelCount = modelCount;
+      writePersistedSyncStatus(lastSyncTime, modelCount);
     }
 
     return {
@@ -429,14 +475,21 @@ export function stopPeriodicSync(): void {
  */
 export function getSyncStatus(): SyncStatus {
   const enabled = process.env.PRICING_SYNC_ENABLED === "true";
+  // `lastSyncTime`/`lastSyncModelCount` are only reliably populated on the
+  // module instance that performed the sync (see note above
+  // writePersistedSyncStatus) — fall back to the persisted DB record so
+  // status reads from a different module instance still see it.
+  const persisted = lastSyncTime === null ? readPersistedSyncStatus() : null;
+  const effectiveLastSync = lastSyncTime ?? persisted?.lastSyncTime ?? null;
+  const effectiveModelCount =
+    lastSyncTime !== null ? lastSyncModelCount : (persisted?.lastSyncModelCount ?? 0);
   return {
     enabled,
-    lastSync: lastSyncTime,
-    lastSyncModelCount,
-    nextSync:
-      syncTimer && lastSyncTime
-        ? new Date(new Date(lastSyncTime).getTime() + activeSyncIntervalMs).toISOString()
-        : null,
+    lastSync: effectiveLastSync,
+    lastSyncModelCount: effectiveModelCount,
+    nextSync: effectiveLastSync
+      ? new Date(new Date(effectiveLastSync).getTime() + activeSyncIntervalMs).toISOString()
+      : null,
     intervalMs: activeSyncIntervalMs,
     sources: SYNC_SOURCES,
   };
diff --git a/src/lib/providers/catalog.ts b/src/lib/providers/catalog.ts
index 1c9d5e4621..ec4da40838 100644
--- a/src/lib/providers/catalog.ts
+++ b/src/lib/providers/catalog.ts
@@ -195,8 +195,22 @@ export function resolveStaticProviderCatalogEntry(
   return null;
 }
 
+/**
+ * OAuth-primary providers that ALSO accept a direct BYOK API key (dual-auth),
+ * admitted through the managed-connection API-key gate independent of the OAuth
+ * catalog. These are deliberately kept OUT of `FREE_APIKEY_PROVIDER_IDS`: that
+ * set flips `providerSupportsPat` true, which turns `isOAuth` false and would
+ * make the dashboard's primary "Connect" button route to the API-key modal
+ * instead of the OAuth flow. Admitting them here lets POST /api/providers
+ * persist an `apikey` connection (the reliable BYOK path) while the provider
+ * stays OAuth-primary (isOAuth=true). clinepass is the dual-auth case: sign in
+ * with a Cline account OR paste a ClinePass API key.
+ */
+const DUAL_AUTH_APIKEY_PROVIDER_IDS = new Set<string>(["clinepass"]);
+
 export function isManagedProviderConnectionId(providerId: string): boolean {
   if (supportsApiKeyOnFreeProvider(providerId)) return true;
+  if (DUAL_AUTH_APIKEY_PROVIDER_IDS.has(providerId)) return true;
 
   const entry = resolveStaticProviderCatalogEntry(providerId);
   return !!(entry && MANAGED_PROVIDER_CONNECTION_CATEGORIES.has(entry.category));
diff --git a/src/lib/providers/codexFastTier.ts b/src/lib/providers/codexFastTier.ts
index 9fe973e467..4f8887c787 100644
--- a/src/lib/providers/codexFastTier.ts
+++ b/src/lib/providers/codexFastTier.ts
@@ -13,7 +13,12 @@ function asRecord(value: unknown): JsonRecord {
 export type CodexFastTierValue = CodexServiceTier;
 export type CodexGlobalServiceMode = "none" | CodexServiceTier;
 
-export const CODEX_FAST_TIER_DEFAULT_SUPPORTED_MODELS: readonly string[] = ["gpt-5.5", "gpt-5.4"];
+export const CODEX_FAST_TIER_DEFAULT_SUPPORTED_MODELS: readonly string[] = [
+  "gpt-5.6-sol",
+  "gpt-5.6-terra",
+  "gpt-5.6-luna",
+  "gpt-5.5",
+];
 
 export interface CodexGlobalFastServiceTierResolved {
   enabled: boolean;
@@ -30,7 +35,8 @@ export interface CodexGlobalFastServiceTierResolved {
  *
  * Defaults when fields are absent on an enabled config:
  *  - tier            = "priority"  (back-compat: PR #2440 only injected priority)
- *  - supportedModels = ["gpt-5.5", "gpt-5.4"] (OpenAI Fast-eligible per models_cache.json)
+ *  - supportedModels = CODEX_FAST_TIER_DEFAULT_SUPPORTED_MODELS
+ *    (OpenAI Fast-eligible per models_cache.json)
  */
 export function resolveCodexGlobalFastServiceTier(
   settings: unknown
diff --git a/src/lib/providers/requestDefaults.ts b/src/lib/providers/requestDefaults.ts
index 355937f199..ae6c2a5449 100644
--- a/src/lib/providers/requestDefaults.ts
+++ b/src/lib/providers/requestDefaults.ts
@@ -5,7 +5,14 @@ import { normalizeExcludedModelPatterns } from "@/domain/connectionModelRules";
 import { normalizeRoutingTags } from "@/domain/tagRouter";
 import { normalizeOpenRouterPreset } from "@/shared/constants/openRouterPreset";
 
-export const CODEX_REASONING_EFFORT_VALUES = ["none", "low", "medium", "high", "xhigh"] as const;
+export const CODEX_REASONING_EFFORT_VALUES = [
+  "none",
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+  "max",
+] as const;
 
 export type CodexReasoningEffort = (typeof CODEX_REASONING_EFFORT_VALUES)[number];
 
diff --git a/src/lib/providers/staticModels.ts b/src/lib/providers/staticModels.ts
index 86bb2f5904..88bb6d85d8 100644
--- a/src/lib/providers/staticModels.ts
+++ b/src/lib/providers/staticModels.ts
@@ -79,6 +79,12 @@ const STATIC_MODEL_PROVIDERS: Record<string, () => Array<{ id: string; name: str
     // Google Labs async coding agent — single async session, no model selection.
     { id: "jules", name: "Jules (Google Labs coding agent)" },
   ],
+  devin: () => [
+    // Cognition's Devin cloud-agent sessions don't expose per-request model
+    // selection like devin-cli's ACP models do — single non-selectable placeholder
+    // so the "Available Models" UI shows something instead of a hard failure (#6142).
+    { id: "devin", name: "Devin (Cognition cloud agent)" },
+  ],
   "linkup-search": () => [
     // Linkup web search — the "model" is the search depth (docs.linkup.so #5571).
     { id: "standard", name: "Standard (single-iteration agentic search)" },
@@ -146,24 +152,43 @@ export function getStaticModelsForProvider(provider: string): LocalCatalogModel[
     });
   }
 
+  // Image / video: only fold into the provider specialty list for *media-only*
+  // providers (no chat registry models). Chat+image providers (openai, lmarena,
+  // xai, …) keep image rows exclusively in IMAGE_PROVIDERS so the provider page
+  // chat catalog is not polluted with flux-* / dalle ids.
+  const chatRegistry = getModelsByProviderId(provider);
+  const hasChatRegistry = Array.isArray(chatRegistry) && chatRegistry.length > 0;
+
   const imageProvider = getImageProvider(provider);
-  if (imageProvider) {
-    appendModels(imageProvider.models);
+  if (imageProvider && !hasChatRegistry) {
+    appendModels(imageProvider.models, {
+      apiFormat: "images",
+      supportedEndpoints: ["images"],
+    });
   }
 
   const videoProvider = getVideoProvider(provider);
-  if (videoProvider) {
-    appendModels(videoProvider.models);
+  if (videoProvider && !hasChatRegistry) {
+    appendModels(videoProvider.models, {
+      apiFormat: "video",
+      supportedEndpoints: ["videos"],
+    });
   }
 
   const speechProvider = getSpeechProvider(provider);
   if (speechProvider) {
-    appendModels(speechProvider.models);
+    appendModels(speechProvider.models, {
+      apiFormat: "audio",
+      supportedEndpoints: ["audio"],
+    });
   }
 
   const transcriptionProvider = getTranscriptionProvider(provider);
   if (transcriptionProvider) {
-    appendModels(transcriptionProvider.models);
+    appendModels(transcriptionProvider.models, {
+      apiFormat: "audio",
+      supportedEndpoints: ["audio"],
+    });
   }
 
   return specialtyModels.length > 0 ? specialtyModels : undefined;
diff --git a/src/lib/providers/validation.ts b/src/lib/providers/validation.ts
index 867625ccb6..01a13c7339 100644
--- a/src/lib/providers/validation.ts
+++ b/src/lib/providers/validation.ts
@@ -16,6 +16,12 @@ import { resolveNvidiaValidationModel } from "@/lib/providers/nvidiaValidationMo
 import { MODAL_DEFAULT_VALIDATION_MODEL_ID } from "@/shared/constants/modal";
 import { validateQoderCliPat } from "@omniroute/open-sse/services/qoderCli.ts";
 import { validateImageProviderApiKey } from "@/lib/providers/imageValidation";
+import { KiroService } from "@/lib/oauth/services/kiro";
+import { usesCcWireImage } from "@omniroute/open-sse/services/ccWireImageBuiltins.ts";
+import {
+  buildProviderHeaders,
+  buildProviderUrl,
+} from "@omniroute/open-sse/services/provider.ts";
 
 import {
   OPENAI_LIKE_FORMATS,
@@ -44,6 +50,7 @@ import {
   validateCopilotWebProvider,
   validateT3WebProvider,
   validateJulesProvider,
+  validateDevinCloudAgentProvider,
   validateInnerAiProvider,
 } from "./validation/webProvidersB";
 import {
@@ -107,11 +114,16 @@ export { isRetryableProxyTarget, isSecurityBlockError } from "./validation/trans
 export async function validateWebCookieProvider({
   provider,
   apiKey,
-  providerSpecificData = {},
-}: any) {
+  providerSpecificData: _providerSpecificData = {},
+}: {
+  provider: string;
+  apiKey?: string;
+  providerSpecificData?: Record<string, unknown>;
+}) {
   try {
     const entry = getRegistryEntry(provider);
-    if (!entry) {
+    const cookieProvider = WEB_COOKIE_PROVIDERS[provider as keyof typeof WEB_COOKIE_PROVIDERS];
+    if (!entry && !cookieProvider) {
       return { valid: false, error: "Provider not found in registry", unsupported: true };
     }
 
@@ -121,9 +133,26 @@ export async function validateWebCookieProvider({
       return { valid: false, error: "Cookie required for web-cookie provider", unsupported: false };
     }
 
+    if (!entry) {
+      // Providers listed in WEB_COOKIE_PROVIDERS without a providerRegistry entry (e.g.
+      // lmarena, gemini-business, poe-web, venice-web, v0-vercel-web) only expose a
+      // marketing website URL, not a real API host. Probing `${website}/models`
+      // does not reliably signal session validity for these —
+      // live verification showed most return redirects or SPA 200s regardless of
+      // cookie validity, which would silently report an expired/garbage cookie as
+      // "OK" (worse than an honest "not supported"). Until each of these providers
+      // has a verified, side-effect-free auth probe against its real API host, report
+      // unsupported instead of a false positive.
+      return {
+        valid: false,
+        error: "Provider validation not supported",
+        unsupported: true,
+      };
+    }
+
     // Attempt a minimal request to check if the session is valid
     // Use /models endpoint or a minimal completion request depending on the provider
-    const baseUrl = entry.baseUrl || "";
+    const baseUrl = normalizeBaseUrl(entry.baseUrl || "");
     const testUrl = `${baseUrl}/models`;
 
     const res = await directHttpsRequest(
@@ -132,6 +161,7 @@ export async function validateWebCookieProvider({
         method: "GET",
         headers: {
           "User-Agent": STANDARD_USER_AGENT,
+          Cookie: cookie,
         },
       },
       10_000
@@ -150,7 +180,7 @@ export async function validateWebCookieProvider({
     // a 401/403 from the /models probe is the only definitive "session expired" signal
     // for web-cookie auth, so a non-auth status is treated as a valid session.
     return { valid: true, error: null, unsupported: false };
-  } catch (error: any) {
+  } catch (error: unknown) {
     return toValidationErrorResult(error);
   }
 }
@@ -187,6 +217,74 @@ export async function validateBytezProvider({ apiKey, providerSpecificData = {}
   }
 }
 
+async function validateKiroApiKeyRuntimeProbe({
+  apiKey,
+  region,
+  profileArn,
+}: {
+  apiKey: string;
+  region: string;
+  profileArn?: string | null;
+}) {
+  const endpoint =
+    region === "us-east-1"
+      ? "https://codewhisperer.us-east-1.amazonaws.com/generateAssistantResponse"
+      : `https://q.${region}.amazonaws.com/generateAssistantResponse`;
+
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 15_000);
+  try {
+    const body = {
+      ...(profileArn ? { profileArn } : {}),
+      conversationState: {
+        chatTriggerType: "MANUAL",
+        conversationId: crypto.randomUUID(),
+        currentMessage: {
+          userInputMessage: {
+            content: "ping",
+            modelId: "auto",
+            origin: "AI_EDITOR",
+          },
+        },
+        history: [],
+      },
+      inferenceConfig: {
+        maxTokens: 1,
+      },
+    };
+
+    const res = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        tokentype: "API_KEY",
+        "Content-Type": "application/x-amz-json-1.0",
+        "X-Amz-Target": "AmazonCodeWhispererStreamingService.GenerateAssistantResponse",
+        Accept: "application/vnd.amazon.eventstream",
+        "Amz-Sdk-Request": "attempt=1; max=3",
+        "Amz-Sdk-Invocation-Id": crypto.randomUUID(),
+      },
+      body: JSON.stringify(body),
+      signal: controller.signal,
+    });
+
+    await res.body?.cancel().catch(() => undefined);
+
+    if (res.ok) {
+      return { valid: true, error: null, method: "kiro_generate_assistant_response" };
+    }
+    if (res.status === 401 || res.status === 403) {
+      return { valid: false, error: "Invalid Kiro API key or AWS region" };
+    }
+    if (res.status === 400 || res.status === 422 || res.status === 429) {
+      return { valid: true, error: null, method: `kiro_generate_assistant_response_${res.status}` };
+    }
+    return { valid: false, error: `Kiro validation failed: ${res.status}` };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
 export async function validateProviderApiKey({ provider, apiKey, providerSpecificData = {} }: any) {
   const requiresApiKey = !providerAllowsOptionalApiKey(provider);
   const isLocal = isLocalProvider(provider);
@@ -298,13 +396,15 @@ export async function validateProviderApiKey({ provider, apiKey, providerSpecifi
       }
     },
     jules: validateJulesProvider,
+    // "devin" is the Cognition cloud-agent provider (distinct from the "devin-cli"
+    // LLM/ACP provider, which is already registered in providerRegistry). Wired here
+    // for parity with the "jules" cloud-agent entry above — see #6142.
+    devin: validateDevinCloudAgentProvider,
     // auggie is a fully local, credential-less CLI passthrough — there is no API
     // key to check upstream. The only meaningful validation is confirming the
     // `auggie` binary is installed and runnable on this machine.
     auggie: async () => {
-      const { checkAuggieCliVersion } = await import(
-        "@omniroute/open-sse/executors/auggie.ts"
-      );
+      const { checkAuggieCliVersion } = await import("@omniroute/open-sse/executors/auggie.ts");
       const result = await checkAuggieCliVersion();
       if (!result.ok) {
         return {
@@ -351,6 +451,26 @@ export async function validateProviderApiKey({ provider, apiKey, providerSpecifi
         return toValidationErrorResult(err);
       }
     },
+    kiro: async ({ apiKey, providerSpecificData }: any) => {
+      try {
+        const region = providerSpecificData?.region || "us-east-1";
+        const credential = await new KiroService().validateApiKey(apiKey, region);
+        if (!credential.profileArn) {
+          return await validateKiroApiKeyRuntimeProbe({
+            apiKey: credential.accessToken,
+            region: credential.region,
+            profileArn: providerSpecificData?.profileArn,
+          });
+        }
+        return {
+          valid: true,
+          error: null,
+          method: "kiro_list_available_profiles",
+        };
+      } catch (error: any) {
+        return toValidationErrorResult(error);
+      }
+    },
     "command-code": validateCommandCodeProvider,
     huggingface: validateHuggingFaceProvider,
     // #5422: auth-only probe — Bytez 404s on every chat model until the account adds it to
@@ -710,6 +830,27 @@ export async function validateProviderApiKey({ provider, apiKey, providerSpecifi
     }
 
     if (entry.format === "claude") {
+      // Built-in CC-wire-image providers (e.g. agentrouter, #6056/#6255) gate
+      // their WAF on the dynamic Claude-Code fingerprint (User-Agent,
+      // `?beta=true` chat path, anthropic-beta/x-app/X-Stainless-* headers).
+      // The real chat-request path already routes through
+      // buildProviderUrl/buildProviderHeaders for this; the validation probe
+      // must use the SAME wire image or a genuinely valid key gets 403'd as
+      // "unauthorized client detected" (#6377).
+      if (usesCcWireImage(provider)) {
+        const requestBaseUrl = buildProviderUrl(provider, modelId, true, { baseUrl });
+        const requestHeaders = buildProviderHeaders(provider, { apiKey }, true);
+
+        return await validateAnthropicLikeProvider({
+          apiKey,
+          baseUrl: requestBaseUrl,
+          modelId,
+          headers: requestHeaders,
+          providerSpecificData,
+          isLocal,
+        });
+      }
+
       const requestBaseUrl = `${baseUrl}${entry.urlSuffix || ""}`;
       const requestHeaders = {
         ...(entry.headers || {}),
diff --git a/src/lib/providers/validation/headers.ts b/src/lib/providers/validation/headers.ts
index 24116c36bd..aabc65339e 100644
--- a/src/lib/providers/validation/headers.ts
+++ b/src/lib/providers/validation/headers.ts
@@ -2,6 +2,7 @@
 // from validation.ts (god-file decomposition). Pure header construction except directHttpsRequest,
 // which delegates to safeOutboundFetch with bypassProxyPatch. Behavior is byte-identical.
 import { safeOutboundFetch } from "@/shared/network/safeOutboundFetch";
+import { getProviderValidationGuard } from "@/shared/network/outboundUrlGuard";
 
 // Standardized desktop Chrome UA for web-cookie/no-auth session probes (minimizes anti-bot detection).
 export const STANDARD_USER_AGENT =
@@ -40,6 +41,17 @@ export function withCustomUserAgent(init: RequestInit, providerSpecificData: any
  * Direct HTTPS request utility that bypasses the global patched fetch.
  * Used for provider validation where the patched fetch has compatibility issues.
  * Uses safeOutboundFetch with bypassProxyPatch to use native Node.js fetch directly.
+ *
+ * SSRF hardening: provider validation hits a caller-controllable `baseUrl`
+ * (e.g. the web-cookie `${baseUrl}/models` probe), so it MUST NOT be an open
+ * relay to cloud-metadata endpoints. We apply `getProviderValidationGuard()`
+ * (local-first default = "block-metadata": allow LAN/localhost providers but
+ * reject 169.254.169.254 / link-local IMDS; power users can opt fully out via
+ * `OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS`). `applyUrlGuard` only checks the
+ * INITIAL url, so `allowRedirect: false` is required too — otherwise a provider
+ * could 3xx-redirect the probe to metadata past the guard. Validation targets
+ * are concrete API endpoints (/models, /chat/completions, /v1/messages) that
+ * return direct JSON, so blocking redirects loses no legitimate provider.
  */
 export function directHttpsRequest(
   url: string,
@@ -52,8 +64,8 @@ export function directHttpsRequest(
     body: options.body,
     timeoutMs,
     bypassProxyPatch: true,
-    allowRedirect: true,
-    guard: "none",
+    allowRedirect: false,
+    guard: getProviderValidationGuard(),
     retry: false,
   }).then(async (response) => ({
     status: response.status,
diff --git a/src/lib/providers/validation/webProvidersA.ts b/src/lib/providers/validation/webProvidersA.ts
index ef8c1fd366..2c537ac035 100644
--- a/src/lib/providers/validation/webProvidersA.ts
+++ b/src/lib/providers/validation/webProvidersA.ts
@@ -144,7 +144,7 @@ export async function validateDeepSeekWebProvider({ apiKey }: any) {
 }
 
 // qwen-web has no `modelsUrl` in its registry entry, so the generic OpenAI-compatible
-// validator used to derive a probe URL of `https://chat.qwen.ai/api/v2/models` (via
+// validator used to derive a probe URL of `https://chat.qwen.ai/api/v2/models/` (via
 // addModelsSuffix) — a non-existent path that answers with a 307 redirect, which the
 // outbound guard blocked and the route then mislabeled as an SSRF block (#3288/#3758).
 //
diff --git a/src/lib/providers/validation/webProvidersB.ts b/src/lib/providers/validation/webProvidersB.ts
index e28e135c4c..9a1afb128b 100644
--- a/src/lib/providers/validation/webProvidersB.ts
+++ b/src/lib/providers/validation/webProvidersB.ts
@@ -1,6 +1,7 @@
 // Web-cookie provider key validators (part B): muse-spark-web, adapta-web, claude-web, gemini-web,
-// copilot-web, t3-web, jules, inner-ai. Extracted from validation.ts (god-file decomposition) —
-// top-level functions with no dispatcher-state captures; behavior is byte-identical to the inline defs.
+// copilot-web, t3-web, jules, devin (cloud-agent), inner-ai. Extracted from validation.ts (god-file
+// decomposition) — top-level functions with no dispatcher-state captures; behavior is byte-identical
+// to the inline defs.
 import { applyCustomUserAgent } from "./headers";
 import { toValidationErrorResult, validationRead, validationWrite } from "./transport";
 import { normalizeSessionCookieHeader } from "@/lib/providers/webCookieAuth";
@@ -453,6 +454,38 @@ export async function validateJulesProvider({ apiKey }: { apiKey: string }) {
   }
 }
 
+/**
+ * Devin cloud-agent (Cognition) — GET /v1/sessions with Bearer auth
+ * (see docs.devin.ai/api-reference/sessions/list-sessions). Distinct from the
+ * "devin-cli" LLM provider (ACP), which is already wired via providerRegistry.
+ */
+export async function validateDevinCloudAgentProvider({ apiKey }: { apiKey: string }) {
+  try {
+    const response = await validationWrite("https://api.devin.ai/v1/sessions?limit=1", {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+      },
+    });
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (response.ok) {
+      return { valid: true, error: null };
+    }
+
+    const errorText = await response.text().catch(() => "");
+    return {
+      valid: false,
+      error: errorText.trim() || `Devin API returned ${response.status}`,
+    };
+  } catch (error: unknown) {
+    return toValidationErrorResult(error);
+  }
+}
+
 export async function validateInnerAiProvider({ apiKey, providerSpecificData = {} }: any) {
   try {
     const raw = typeof apiKey === "string" ? apiKey.trim() : "";
diff --git a/src/lib/proxyRelay/cloudflareWorkerScript.ts b/src/lib/proxyRelay/cloudflareWorkerScript.ts
index d8a639b376..680254b264 100644
--- a/src/lib/proxyRelay/cloudflareWorkerScript.ts
+++ b/src/lib/proxyRelay/cloudflareWorkerScript.ts
@@ -13,7 +13,12 @@
  *  - Strips Host + relay control headers before forwarding upstream.
  *
  * The string template is fed to Cloudflare's PUT /accounts/{id}/workers/scripts/{name}
- * API with main_module=index.js (ESM Workers Modules format).
+ * API as a Service Worker (no ES module export). Cloudflare's multipart upload
+ * API rejects `application/javascript+module` (#5128C) and treats a plain
+ * `application/javascript` script part as a Service Worker regardless of any
+ * `main_module` metadata — `main_module` requires the script to be an actual
+ * ES module (top-level `export`), which Service Worker syntax is not. The
+ * `body_part` metadata field is the correct way to point at a non-ESM script.
  *
  * The OmniRoute variant intentionally diverges from the upstream PR:
  *  - The upstream worker had NO auth check, leaving the deployed workers.dev URL
@@ -22,6 +27,54 @@
  *    the same proxyFetch relay short-circuit work unchanged.
  *  - SSRF guard is inlined so a leaked relay URL cannot scan internal IPs.
  */
+import { randomUUID } from "crypto";
+
+/**
+ * Build the multipart/form-data request body for Cloudflare's Worker
+ * script-upload API as a raw `Buffer` with an explicit boundary, instead of
+ * relying on the WHATWG `FormData` + `fetch`-derived Content-Type (#6416).
+ *
+ * In production `globalThis.fetch` is patched (`open-sse/utils/proxyFetch.ts`)
+ * with `node_modules/undici`'s own `fetch`, whose `FormData`/`Request` classes
+ * differ from the runtime's global `FormData` (same cross-realm class
+ * mismatch already fixed for image edits in #3273 —
+ * `open-sse/handlers/imageGeneration.ts::handleOpenAIImageEdit`). Passing a
+ * native `FormData` instance through that patched fetch makes undici
+ * serialize the body as the literal string `"[object FormData]"` with
+ * `Content-Type: text/plain;charset=UTF-8` — which Cloudflare's API rejects
+ * with "Content-Type must be one of: application/javascript, text/javascript,
+ * multipart/form-data". A manually-built `Buffer` body with an explicit
+ * `multipart/form-data; boundary=…` header is accepted verbatim by any fetch
+ * implementation (patched or native).
+ */
+export function buildCloudflareWorkerUploadRequest(
+  workerScript: string,
+  metadata: Record<string, unknown>
+): { headers: Record<string, string>; body: Buffer } {
+  const boundary = `----OmniRouteCFWorker${randomUUID().replace(/-/g, "")}`;
+  const CRLF = "\r\n";
+  const parts: Buffer[] = [
+    Buffer.from(
+      `--${boundary}${CRLF}` +
+        `Content-Disposition: form-data; name="index.js"; filename="index.js"${CRLF}` +
+        `Content-Type: application/javascript${CRLF}${CRLF}`
+    ),
+    Buffer.from(workerScript, "utf8"),
+    Buffer.from(CRLF),
+    Buffer.from(
+      `--${boundary}${CRLF}` +
+        `Content-Disposition: form-data; name="metadata"; filename="metadata.json"${CRLF}` +
+        `Content-Type: application/json${CRLF}${CRLF}` +
+        `${JSON.stringify(metadata)}${CRLF}`
+    ),
+    Buffer.from(`--${boundary}--${CRLF}`),
+  ];
+  return {
+    headers: { "Content-Type": `multipart/form-data; boundary=${boundary}` },
+    body: Buffer.concat(parts),
+  };
+}
+
 export function buildCloudflareWorkerScript(relayAuth: string): string {
   // relayAuth is generated server-side via randomBytes(24).toString("hex") — no
   // user-controlled input ever reaches this template, so direct interpolation
@@ -57,51 +110,53 @@ function isPrivateHostname(h) {
   return false;
 }
 
-export default {
-  async fetch(request, env, ctx) {
-    const auth = request.headers.get("x-relay-auth");
-    if (auth !== "${relayAuth}") {
-      return new Response("Unauthorized", { status: 401 });
-    }
-    const target = request.headers.get("x-relay-target");
-    if (!target) {
-      return new Response("missing x-relay-target", { status: 400 });
-    }
-    let targetUrl;
-    try { targetUrl = new URL(target); } catch { return new Response("invalid x-relay-target", { status: 400 }); }
-    if (targetUrl.protocol !== "http:" && targetUrl.protocol !== "https:") {
-      return new Response("forbidden x-relay-target protocol", { status: 403 });
-    }
-    if (targetUrl.username || targetUrl.password) {
-      return new Response("forbidden x-relay-target (embedded credentials)", { status: 403 });
-    }
-    if (isPrivateHostname(targetUrl.hostname)) {
-      return new Response("forbidden x-relay-target (private/loopback host)", { status: 403 });
-    }
-    const relayPath = request.headers.get("x-relay-path") || "/";
-    const headers = new Headers(request.headers);
-    ["x-relay-target", "x-relay-path", "x-relay-auth", "host"].forEach((h) => headers.delete(h));
-    const init = {
-      method: request.method,
-      headers,
-    };
-    if (request.method !== "GET" && request.method !== "HEAD") {
-      init.body = request.body;
-      init.duplex = "half";
-    }
-    try {
-      const upstream = await fetch(target.replace(/\\/$/, "") + relayPath, init);
-      return new Response(upstream.body, {
-        status: upstream.status,
-        headers: upstream.headers,
-      });
-    } catch (error) {
-      return new Response(JSON.stringify({ error: error && error.message ? error.message : "relay error" }), {
-        status: 502,
-        headers: { "content-type": "application/json" },
-      });
-    }
-  },
-};
+async function handleRelay(request) {
+  const auth = request.headers.get("x-relay-auth");
+  if (auth !== "${relayAuth}") {
+    return new Response("Unauthorized", { status: 401 });
+  }
+  const target = request.headers.get("x-relay-target");
+  if (!target) {
+    return new Response("missing x-relay-target", { status: 400 });
+  }
+  let targetUrl;
+  try { targetUrl = new URL(target); } catch { return new Response("invalid x-relay-target", { status: 400 }); }
+  if (targetUrl.protocol !== "http:" && targetUrl.protocol !== "https:") {
+    return new Response("forbidden x-relay-target protocol", { status: 403 });
+  }
+  if (targetUrl.username || targetUrl.password) {
+    return new Response("forbidden x-relay-target (embedded credentials)", { status: 403 });
+  }
+  if (isPrivateHostname(targetUrl.hostname)) {
+    return new Response("forbidden x-relay-target (private/loopback host)", { status: 403 });
+  }
+  const relayPath = request.headers.get("x-relay-path") || "/";
+  const headers = new Headers(request.headers);
+  ["x-relay-target", "x-relay-path", "x-relay-auth", "host"].forEach((h) => headers.delete(h));
+  const init = {
+    method: request.method,
+    headers,
+  };
+  if (request.method !== "GET" && request.method !== "HEAD") {
+    init.body = request.body;
+    init.duplex = "half";
+  }
+  try {
+    const upstream = await fetch(target.replace(/\\\\/$/, "") + relayPath, init);
+    return new Response(upstream.body, {
+      status: upstream.status,
+      headers: upstream.headers,
+    });
+  } catch (error) {
+    return new Response(JSON.stringify({ error: error && error.message ? error.message : "relay error" }), {
+      status: 502,
+      headers: { "content-type": "application/json" },
+    });
+  }
+}
+
+addEventListener("fetch", (event) => {
+  event.respondWith(handleRelay(event.request));
+});
 `;
 }
diff --git a/src/lib/quota/saturationSignals.ts b/src/lib/quota/saturationSignals.ts
index 84b07e441f..4ec9a8baf1 100644
--- a/src/lib/quota/saturationSignals.ts
+++ b/src/lib/quota/saturationSignals.ts
@@ -281,11 +281,19 @@ function codexWindowKey(window: QuotaWindow): string {
 
 async function fetchCodexSaturation(
   connectionId: string,
-  dim: DimensionSpec
+  dim: DimensionSpec,
+  connection?: Record<string, unknown>
 ): Promise<number> {
   // Dynamic import — codexQuotaFetcher lives in open-sse workspace
   const mod = await import("@omniroute/open-sse/services/codexQuotaFetcher");
-  const quota = await mod.fetchCodexQuota(connectionId);
+  // #6379: pass the loaded connection snapshot through so fetchCodexQuota can
+  // read its accessToken/workspaceId even when this connection was never
+  // registered via registerCodexConnection() (e.g. during headroom ranking,
+  // which runs BEFORE any request is dispatched for the candidate). Without
+  // this, fetchCodexQuota returns null for every candidate and saturation
+  // fails open to 0 across the board — headroom then can't tell accounts
+  // apart and keeps the original combo order.
+  const quota = await mod.fetchCodexQuota(connectionId, connection);
   if (!quota) return 0;
 
   const winKey = codexWindowKey(dim.window);
@@ -524,7 +532,8 @@ async function fetchGenericSaturation(
 export async function getSaturation(
   connectionId: string,
   provider: string,
-  dim: DimensionSpec
+  dim: DimensionSpec,
+  connection?: Record<string, unknown>
 ): Promise<number> {
   const key = cacheKey(connectionId, provider, dim);
   const cached = _cache.get(key);
@@ -536,7 +545,7 @@ export async function getSaturation(
   try {
     switch (provider) {
       case "codex":
-        value = await fetchCodexSaturation(connectionId, dim);
+        value = await fetchCodexSaturation(connectionId, dim, connection);
         break;
       case "bailian":
         value = await fetchBailianSaturation(connectionId, dim);
diff --git a/src/lib/services/embedWsProxy.ts b/src/lib/services/embedWsProxy.ts
index 8ab9052545..b2b1e10370 100644
--- a/src/lib/services/embedWsProxy.ts
+++ b/src/lib/services/embedWsProxy.ts
@@ -227,7 +227,7 @@ async function proxyUpgrade(req: IncomingMessage, socket: net.Socket, head: Buff
  *
  * `EMBED_WS_PROXY_HOST` takes precedence, but we fall back to `LIVE_WS_HOST`
  * so a single env var exposes BOTH WebSocket sockets (the Live dashboard server
- * on :20129 and this embed proxy on :20131) in Docker / behind a reverse proxy
+ * on :20132 and this embed proxy on :20131) in Docker / behind a reverse proxy
  * or tunnel. Without this fallback the embed proxy stayed bound to 127.0.0.1
  * even when the operator set `LIVE_WS_HOST=0.0.0.0`, so the Live view was
  * permanently "disconnected" in headless deployments (#5110). Defaults to
diff --git a/src/lib/skills/containerProvider.ts b/src/lib/skills/containerProvider.ts
new file mode 100644
index 0000000000..129ac2f2ae
--- /dev/null
+++ b/src/lib/skills/containerProvider.ts
@@ -0,0 +1,479 @@
+/**
+ * Container runtime providers for the OmniRoute skill sandbox.
+ *
+ * The sandbox historically hardcoded the `docker` CLI. This module abstracts
+ * the container runtime so OmniRoute can pick the most performant / native
+ * runtime available on each host:
+ *
+ *   - macOS:  Apple Container (`container` CLI)  >  OrbStack (docker shim)  >  Podman  >  Docker
+ *   - Windows: WSL Container (`wslc` CLI)       >  Docker Desktop          >  Podman
+ *   - Linux:   Podman (rootless, daemonless)    >  Docker
+ *
+ * The user can override the auto-detected choice with `SKILLS_SANDBOX_RUNTIME`
+ * (`auto | docker | apple | wsl | orbstack | podman`). Each provider maps the
+ * sandbox's intent (resource caps, network isolation, capability drops,
+ * read-only fs, tmpfs workspaces) onto the runtime's native flag set.
+ */
+
+import { createRequire } from "module";
+import os from "os";
+
+const require = createRequire(import.meta.url);
+const childProcess = require("child_process") as typeof import("child_process");
+
+export type SandboxRuntimeId = "docker" | "apple" | "wsl" | "orbstack" | "podman";
+
+export interface SandboxConfig {
+  cpuLimit: number;
+  memoryLimit: number;
+  timeout: number;
+  networkEnabled: boolean;
+  readOnly: boolean;
+}
+
+export interface ResolvedContainerCommand {
+  /** Absolute command to spawn (e.g. `"docker"`, `"container"`, `"wslc"`). */
+  command: string;
+  /** Arguments for the command. */
+  args: string[];
+  /** Arguments appended for the `kill` cleanup path. */
+  killArgs: (containerName: string) => string[];
+}
+
+export interface ContainerProvider {
+  readonly id: SandboxRuntimeId;
+  readonly displayName: string;
+  /** Returns true when this runtime is installed and usable on the host. */
+  detect(): boolean;
+  /** Build a run command for the given image, command, and config. */
+  buildRun(
+    image: string,
+    command: string[],
+    sandboxId: string,
+    config: SandboxConfig,
+  ): ResolvedContainerCommand;
+  /** Build a kill/stop command for a running container. */
+  killCommand: string;
+  buildKillArgs(name: string): string[];
+}
+
+// ----------------------------------------------------------------
+//  Helpers
+// ----------------------------------------------------------------
+
+const SANDBOX_NAME = (sandboxId: string) => `omniroute-${sandboxId}`;
+
+/**
+ * Probe whether a CLI binary exists on PATH.
+ * Uses `where` on Windows, `which` on *nix — both via spawnSync so existing
+ * test mocks on `spawn` (but not `spawnSync`) are not disturbed.
+ */
+function probeCommand(binary: string): boolean {
+  const args =
+    process.platform === "win32" ? ["where", binary] : ["which", binary];
+  const r = childProcess.spawnSync(args[0], args.slice(1), {
+    encoding: "utf8",
+    stdio: "ignore",
+  });
+  return r.status === 0;
+}
+
+/**
+ * Probe whether a binary responds to `--version` with exit 0 and
+ * a plausible version string.
+ */
+function probeVersion(binary: string, expects = "v"): boolean {
+  const r = childProcess.spawnSync(binary, ["--version"], {
+    encoding: "utf8",
+    stdio: "pipe",
+  });
+  return r.status === 0 && !!r.stdout?.trim()?.includes(expects);
+}
+
+// ----------------------------------------------------------------
+//  DockerProvider
+// ----------------------------------------------------------------
+
+class DockerProvider implements ContainerProvider {
+  readonly id: SandboxRuntimeId = "docker";
+  readonly displayName = "Docker";
+  readonly killCommand = "docker";
+
+  detect(): boolean {
+    return probeCommand("docker") && probeVersion("docker");
+  }
+
+  buildRun(
+    image: string,
+    command: string[],
+    sandboxId: string,
+    config: SandboxConfig,
+  ): ResolvedContainerCommand {
+    const args = [
+      "run",
+      "--rm",
+      "--name",
+      SANDBOX_NAME(sandboxId),
+      "--cpus",
+      `${config.cpuLimit / 100}`,
+      "--memory",
+      `${config.memoryLimit}m`,
+      "--network",
+      config.networkEnabled ? "bridge" : "none",
+      "--cap-drop",
+      "ALL",
+      "--security-opt",
+      "no-new-privileges",
+      "--pids-limit",
+      "100",
+      "--tmpfs",
+      "/tmp:rw,noexec,nosuid,size=64m",
+      "--tmpfs",
+      "/workspace:rw,noexec,nosuid,size=64m",
+      "--workdir",
+      "/workspace",
+    ];
+    if (config.readOnly) args.push("--read-only");
+    args.push(image, ...command);
+    return {
+      command: "docker",
+      args,
+      killArgs: (name) => ["kill", name],
+    };
+  }
+
+  buildKillArgs(name: string): string[] {
+    return ["kill", name];
+  }
+}
+
+// ----------------------------------------------------------------
+//  AppleContainerProvider  (native Apple Container on macOS)
+// ----------------------------------------------------------------
+
+class AppleContainerProvider implements ContainerProvider {
+  readonly id: SandboxRuntimeId = "apple";
+  readonly displayName = "Apple Container";
+  readonly killCommand = "container";
+
+  detect(): boolean {
+    return probeCommand("container") && probeVersion("container", "c");
+  }
+
+  buildRun(
+    image: string,
+    command: string[],
+    sandboxId: string,
+    config: SandboxConfig,
+  ): ResolvedContainerCommand {
+    const args = [
+      "run",
+      "--rm",
+      "--name",
+      SANDBOX_NAME(sandboxId),
+      "--cpus",
+      `${config.cpuLimit}`,
+      "--memory",
+      `${config.memoryLimit}m`,
+      "--network",
+      config.networkEnabled ? "bridge" : "none",
+      "--cap-drop",
+      "ALL",
+      "--security-opt",
+      "no-new-privileges",
+      "--tmpfs",
+      "/tmp:rw,noexec,nosuid,size=64m",
+      "--tmpfs",
+      "/workspace:rw,noexec,nosuid,size=64m",
+      "--workdir",
+      "/workspace",
+    ];
+    if (config.readOnly) args.push("--read-only");
+    args.push(image, ...command);
+    return {
+      command: "container",
+      args,
+      killArgs: (name) => ["kill", name],
+    };
+  }
+
+  buildKillArgs(name: string): string[] {
+    return ["kill", name];
+  }
+}
+
+// ----------------------------------------------------------------
+//  WslContainerProvider  (WSL 2 container CLI on Windows)
+// ----------------------------------------------------------------
+
+class WslContainerProvider implements ContainerProvider {
+  readonly id: SandboxRuntimeId = "wsl";
+  readonly displayName = "WSL Container";
+  readonly killCommand = "wslc";
+
+  detect(): boolean {
+    return probeCommand("wslc") && probeVersion("wslc");
+  }
+
+  buildRun(
+    image: string,
+    command: string[],
+    sandboxId: string,
+    config: SandboxConfig,
+  ): ResolvedContainerCommand {
+    const args = [
+      "run",
+      "--rm",
+      "--name",
+      SANDBOX_NAME(sandboxId),
+      "--cpus",
+      `${config.cpuLimit}`,
+      "--memory",
+      `${config.memoryLimit}m`,
+      "--network",
+      config.networkEnabled ? "bridge" : "none",
+      "--tmpfs",
+      "/tmp:rw,noexec,nosuid,size=64m",
+      "--tmpfs",
+      "/workspace:rw,noexec,nosuid,size=64m",
+      "--workdir",
+      "/workspace",
+    ];
+    if (config.readOnly) args.push("--read-only");
+    args.push(image, ...command);
+    return {
+      command: "wslc",
+      args,
+      killArgs: (name) => ["kill", name],
+    };
+  }
+
+  buildKillArgs(name: string): string[] {
+    return ["kill", name];
+  }
+}
+
+// ----------------------------------------------------------------
+//  OrbStackProvider  (high-perf Linux VM on macOS)
+// ----------------------------------------------------------------
+
+class OrbStackProvider implements ContainerProvider {
+  readonly id: SandboxRuntimeId = "orbstack";
+  readonly displayName = "OrbStack";
+  readonly killCommand = "orbstack";
+
+  detect(): boolean {
+    return probeCommand("orbstack") && probeVersion("orbstack");
+  }
+
+  buildRun(
+    image: string,
+    command: string[],
+    sandboxId: string,
+    config: SandboxConfig,
+  ): ResolvedContainerCommand {
+    // OrbStack wraps Docker inside a Linux VM.  We invoke the `orbstack`
+    // binary which shims `docker` transparently.
+    const args = [
+      "run",
+      "--rm",
+      "--name",
+      SANDBOX_NAME(sandboxId),
+      "--cpus",
+      `${config.cpuLimit}`,
+      "--memory",
+      `${config.memoryLimit}m`,
+      "--network",
+      config.networkEnabled ? "bridge" : "none",
+      "--tmpfs",
+      "/tmp:rw,noexec,nosuid,size=64m",
+      "--tmpfs",
+      "/workspace:rw,noexec,nosuid,size=64m",
+      "--workdir",
+      "/workspace",
+    ];
+    if (config.readOnly) args.push("--read-only");
+    args.push(image, ...command);
+    return {
+      command: "orbstack",
+      args,
+      killArgs: (name) => ["kill", name],
+    };
+  }
+
+  buildKillArgs(name: string): string[] {
+    return ["kill", name];
+  }
+}
+
+// ----------------------------------------------------------------
+//  PodmanProvider  (rootless Linux alternative)
+// ----------------------------------------------------------------
+
+class PodmanProvider implements ContainerProvider {
+  readonly id: SandboxRuntimeId = "podman";
+  readonly displayName = "Podman";
+  readonly killCommand = "podman";
+
+  detect(): boolean {
+    return probeCommand("podman") && probeVersion("podman");
+  }
+
+  buildRun(
+    image: string,
+    command: string[],
+    sandboxId: string,
+    config: SandboxConfig,
+  ): ResolvedContainerCommand {
+    const args = [
+      "run",
+      "--rm",
+      "--name",
+      SANDBOX_NAME(sandboxId),
+      "--cpus",
+      `${config.cpuLimit / 100}`,
+      "--memory",
+      `${config.memoryLimit}m`,
+      "--network",
+      config.networkEnabled ? "bridge" : "none",
+      "--cap-drop",
+      "ALL",
+      "--security-opt",
+      "no-new-privileges",
+      "--tmpfs",
+      "/tmp:rw,noexec,nosuid,size=64m",
+      "--tmpfs",
+      "/workspace:rw,noexec,nosuid,size=64m",
+      "--workdir",
+      "/workspace",
+    ];
+    if (config.readOnly) args.push("--read-only");
+    args.push(image, ...command);
+    return {
+      command: "podman",
+      args,
+      killArgs: (name) => ["kill", name],
+    };
+  }
+
+  buildKillArgs(name: string): string[] {
+    return ["kill", name];
+  }
+}
+
+// ----------------------------------------------------------------
+//  Registry & auto-detection
+// ----------------------------------------------------------------
+
+export const ALL_PROVIDERS: ContainerProvider[] = [
+  new DockerProvider(),
+  new AppleContainerProvider(),
+  new WslContainerProvider(),
+  new OrbStackProvider(),
+  new PodmanProvider(),
+];
+
+export const PROVIDER_BY_ID = new Map<SandboxRuntimeId, ContainerProvider>(
+  ALL_PROVIDERS.map((p) => [p.id, p]),
+);
+
+/** Priority order for auto-detection on each platform. */
+export function platformPriority(): SandboxRuntimeId[] {
+  switch (os.platform()) {
+    case "darwin":
+      // Apple Container is the native micro-VM runtime on Apple Silicon —
+      // fastest startup, lowest overhead.  OrbStack provides a Docker shim
+      // inside a tuned Linux VM; better than stock Docker Desktop.
+      return ["apple", "orbstack", "podman", "docker"];
+    case "win32":
+      // WSL Container CLI (wslc.exe) is Windows-native via WSL 2.
+      return ["wsl", "docker", "podman"];
+    default:
+      // Linux — podman is rootless + daemonless and therefore preferred.
+      return ["podman", "docker"];
+  }
+}
+
+// Detect-once memoization
+let detectionInFlight: Promise<void> | null = null;
+const detectionCache = new Map<SandboxRuntimeId, boolean>();
+
+function clearDetectionCache(): void {
+  detectionInFlight = null;
+  detectionCache.clear();
+}
+
+async function runDetection(): Promise<void> {
+  // Run all probes in parallel for speed
+  await Promise.all(
+    ALL_PROVIDERS.map(async (provider) => {
+      const ok = await Promise.resolve(provider.detect());
+      detectionCache.set(provider.id, ok);
+    }),
+  );
+}
+
+function normaliseRuntimeOverride(
+  raw: string | undefined,
+): SandboxRuntimeId | null {
+  if (!raw || raw === "auto") return null;
+  const lowered = raw.toLowerCase().trim();
+  if (PROVIDER_BY_ID.has(lowered as SandboxRuntimeId))
+    return lowered as SandboxRuntimeId;
+  return null;
+}
+
+/**
+ * Resolves which runtime the sandbox should use for the current host.
+ *
+ * Resolution rules (in order):
+ *   1. Explicit override via `SKILLS_SANDBOX_RUNTIME`.
+ *   2. Auto-detect: walk the platform priority list and pick the first
+ *      runtime whose `detect()` succeeds.
+ *   3. Fall back to the Docker provider (the historical default) even if
+ *      detection fails — the spawn will surface a clear "docker not
+ *      found" error if Docker really is missing.
+ */
+export async function resolveProvider(): Promise<ContainerProvider> {
+  if (!detectionInFlight) {
+    detectionInFlight = runDetection();
+  }
+  await detectionInFlight;
+
+  const override = normaliseRuntimeOverride(
+    process.env.SKILLS_SANDBOX_RUNTIME,
+  );
+  if (override) {
+    const provider = PROVIDER_BY_ID.get(override)!;
+    if (detectionCache.get(provider.id)) return provider;
+    // Honour the explicit override even if detection failed — the user may
+    // be running inside an environment where the runtime is reachable but
+    // our probe failed (e.g. very locked-down CI).
+    return provider;
+  }
+
+  for (const id of platformPriority()) {
+    if (detectionCache.get(id)) return PROVIDER_BY_ID.get(id)!;
+  }
+  return PROVIDER_BY_ID.get("docker")!;
+}
+
+/** Exposed for tests — forces a fresh detection pass. */
+export function _resetProviderCacheForTests(): void {
+  clearDetectionCache();
+}
+
+/**
+ * Returns the kill command for the given provider, parameterised with the
+ * sandbox's container name. Used by SandboxRunner.kill/killAll.
+ */
+export function buildKillCommand(
+  provider: ContainerProvider,
+  sandboxId: string,
+): { command: string; args: string[] } {
+  const name = SANDBOX_NAME(sandboxId);
+  return {
+    command: provider.killCommand,
+    args: provider.buildKillArgs(name),
+  };
+}
\ No newline at end of file
diff --git a/src/lib/skills/githubCollector.ts b/src/lib/skills/githubCollector.ts
index 48a8deb867..6dc9ca167f 100644
--- a/src/lib/skills/githubCollector.ts
+++ b/src/lib/skills/githubCollector.ts
@@ -37,7 +37,7 @@ export interface ScanFinding {
 export interface SkillInstallResult {
   target: string;
   ok: boolean;
-  action: "installed" | "already_up_to_date" | "skipped" | "error";
+  action: "installed" | "planned" | "already_up_to_date" | "skipped" | "error";
   error?: string;
   destDir?: string;
 }
diff --git a/src/lib/skills/sandbox.ts b/src/lib/skills/sandbox.ts
index 820d58c80c..556506b5f1 100644
--- a/src/lib/skills/sandbox.ts
+++ b/src/lib/skills/sandbox.ts
@@ -1,20 +1,20 @@
 import { createRequire } from "module";
 import type { ChildProcess } from "child_process";
 import { randomUUID } from "crypto";
+import {
+  resolveProvider,
+  buildKillCommand,
+  type ContainerProvider,
+  type SandboxConfig,
+  type SandboxRuntimeId,
+} from "./containerProvider.ts";
 
 const require = createRequire(import.meta.url);
 const childProcess = require("child_process") as typeof import("child_process");
 
-interface SandboxConfig {
-  cpuLimit: number;
-  memoryLimit: number;
-  timeout: number;
-  networkEnabled: boolean;
-  readOnly: boolean;
-}
-
 interface SandboxResult {
   id: string;
+  runtime: SandboxRuntimeId;
   exitCode: number | null;
   stdout: string;
   stderr: string;
@@ -34,6 +34,7 @@ class SandboxRunner {
   private static instance: SandboxRunner;
   private runningContainers: Map<string, ChildProcess> = new Map();
   private config: SandboxConfig;
+  private cachedProvider: ContainerProvider | null = null;
 
   private constructor(config: Partial<SandboxConfig> = {}) {
     this.config = { ...DEFAULT_CONFIG, ...config };
@@ -50,6 +51,19 @@ class SandboxRunner {
     this.config = { ...this.config, ...config };
   }
 
+  /**
+   * Returns the container provider that the next `run()` call will use.
+   * Resolution is async (it shells out to probe installed runtimes) so the
+   * caller must `await`. The result is cached on the runner for the
+   * remainder of the process so subsequent `run()` calls stay sync-friendly.
+   */
+  async getProvider(): Promise<ContainerProvider> {
+    if (!this.cachedProvider) {
+      this.cachedProvider = await resolveProvider();
+    }
+    return this.cachedProvider;
+  }
+
   async run(
     image: string,
     command: string[],
@@ -59,40 +73,11 @@ class SandboxRunner {
     const sandboxId = randomUUID();
     const startTime = Date.now();
     const config = { ...this.config, ...configOverride };
-
-    const dockerArgs = [
-      "run",
-      "--rm",
-      "--name",
-      `omniroute-sandbox-${sandboxId}`,
-      "--cpus",
-      `${config.cpuLimit / 1000}`,
-      "--memory",
-      `${config.memoryLimit}m`,
-      "--network",
-      config.networkEnabled ? "bridge" : "none",
-      "--cap-drop",
-      "ALL",
-      "--security-opt",
-      "no-new-privileges",
-      "--pids-limit",
-      "100",
-      "--tmpfs",
-      "/tmp:rw,noexec,nosuid,size=64m",
-      "--tmpfs",
-      "/workspace:rw,noexec,nosuid,size=64m",
-      "--workdir",
-      "/workspace",
-    ];
-
-    if (config.readOnly) {
-      dockerArgs.push("--read-only");
-    }
-
-    dockerArgs.push(image, ...command);
+    const provider = await this.getProvider();
+    const resolved = provider.buildRun(image, command, sandboxId, config);
 
     return new Promise((resolve) => {
-      const proc = childProcess.spawn("docker", dockerArgs, {
+      const proc = childProcess.spawn(resolved.command, resolved.args, {
         env: { ...process.env, ...env },
         stdio: ["ignore", "pipe", "pipe"],
       });
@@ -120,6 +105,7 @@ class SandboxRunner {
 
         resolve({
           id: sandboxId,
+          runtime: provider.id,
           exitCode: code,
           stdout,
           stderr,
@@ -134,6 +120,7 @@ class SandboxRunner {
 
         resolve({
           id: sandboxId,
+          runtime: provider.id,
           exitCode: -1,
           stdout,
           stderr: err.message,
@@ -149,18 +136,32 @@ class SandboxRunner {
     if (proc) {
       proc.kill("SIGTERM");
       this.runningContainers.delete(sandboxId);
-      childProcess.spawn("docker", ["kill", `omniroute-sandbox-${sandboxId}`], {
-        stdio: "ignore",
-      });
+      const provider = this.cachedProvider;
+      if (provider) {
+        const kill = buildKillCommand(provider, sandboxId);
+        childProcess.spawn(kill.command, kill.args, { stdio: "ignore" });
+      } else {
+        childProcess.spawn("docker", ["kill", `omniroute-${sandboxId}`], {
+          stdio: "ignore",
+        });
+      }
       return true;
     }
     return false;
   }
 
   killAll(): void {
+    const provider = this.cachedProvider;
     for (const [id, proc] of this.runningContainers) {
       proc.kill("SIGTERM");
-      childProcess.spawn("docker", ["kill", `omniroute-sandbox-${id}`], { stdio: "ignore" });
+      if (provider) {
+        const kill = buildKillCommand(provider, id);
+        childProcess.spawn(kill.command, kill.args, { stdio: "ignore" });
+      } else {
+        childProcess.spawn("docker", ["kill", `omniroute-${id}`], {
+          stdio: "ignore",
+        });
+      }
     }
     this.runningContainers.clear();
   }
@@ -175,4 +176,4 @@ class SandboxRunner {
 }
 
 export const sandboxRunner = SandboxRunner.getInstance();
-export type { SandboxConfig, SandboxResult };
+export type { SandboxConfig, SandboxResult };
\ No newline at end of file
diff --git a/src/lib/tokenHealthCheck.ts b/src/lib/tokenHealthCheck.ts
index 1fa4f48d7f..b21b91005c 100644
--- a/src/lib/tokenHealthCheck.ts
+++ b/src/lib/tokenHealthCheck.ts
@@ -532,7 +532,9 @@ export async function checkConnection(conn) {
     "gitlab-duo",
     "claude",
   ]);
-  const isRotatingProvider = ROTATING_REFRESH_PROVIDERS.has(conn.provider);
+  const isRotatingProvider = ROTATING_REFRESH_PROVIDERS.has(
+    String(conn.provider || "").toLowerCase()
+  );
   const shouldRefreshByInterval =
     !hasKnownExpiry && !isRotatingProvider && Date.now() - lastCheck >= intervalMs;
 
@@ -755,7 +757,7 @@ export async function checkConnection(conn) {
     // GitHub OAuth token. The health check must also refresh this sub-token before
     // it expires mid-session. The Copilot token expiry is stored in
     // providerSpecificData.copilotTokenExpiresAt (Unix seconds).
-    if (conn.provider === "github") {
+    if (String(conn.provider || "").toLowerCase() === "github") {
       // Re-read the latest connection after the OAuth refresh (onPersist may have updated it).
       const latestConn = (await getProviderConnectionById(conn.id).catch(() => null)) || conn;
       const accessTokenForCopilot = result.accessToken || latestConn.accessToken;
diff --git a/src/lib/usage/costCalculator.ts b/src/lib/usage/costCalculator.ts
index 59d16c5244..a8976319ba 100644
--- a/src/lib/usage/costCalculator.ts
+++ b/src/lib/usage/costCalculator.ts
@@ -37,6 +37,34 @@ export type CostCalculationOptions = {
   flatRateAsZero?: boolean;
 };
 
+/**
+ * xAI reports the exact provider-billed cost of a request in the chat-completions
+ * `usage` object via `cost_in_usd_ticks` (port of decolua/9router#2453, capability
+ * A — @ryanngit). Per the official docs — both
+ * https://docs.x.ai/developers/cost-tracking and the API reference's usage schema
+ * ("TICKS_IN_USD_CENT: i64 = 100_000_000") — there are 10_000_000_000 (1e10) ticks
+ * per USD. Example from the docs: 37756000 ticks ≈ $0.0038.
+ *
+ * NOTE: this divisor is intentionally 1e10, not the 1e12 used by the upstream PR
+ * (which under-reports cost 100x) — verified directly against the xAI docs.
+ */
+const USD_TICKS_PER_DOLLAR = 10_000_000_000;
+
+/**
+ * Extract an exact, provider-reported USD cost from a token/usage record when one
+ * is present, so callers can trust it over the token × pricing estimate. Currently
+ * only xAI's `cost_in_usd_ticks` field is handled — see comment above.
+ */
+function extractExactCostUsd(
+  tokens: Record<string, number | undefined> | null | undefined
+): number | null {
+  const ticks = tokens?.cost_in_usd_ticks;
+  if (typeof ticks === "number" && Number.isFinite(ticks) && ticks >= 0) {
+    return ticks / USD_TICKS_PER_DOLLAR;
+  }
+  return null;
+}
+
 function toNumber(value: unknown, fallback = 0): number {
   if (typeof value === "number" && Number.isFinite(value)) return value;
   if (typeof value === "string" && value.trim().length > 0) {
@@ -51,7 +79,7 @@ function normalizeServiceTier(value: unknown): string {
 }
 
 function stripCodexEffortSuffix(model: string): string {
-  return model.replace(/-(?:xhigh|high|medium|low|none)$/i, "");
+  return model.replace(/-(?:ultra|max|xhigh|high|medium|low|none)$/i, "");
 }
 
 export function getCodexFastCostMultiplier(
@@ -73,6 +101,12 @@ export function getCodexFastCostMultiplier(
 
   const modelKey = stripCodexEffortSuffix(normalizeModelName(String(model || "")).toLowerCase());
   const compactModelKey = modelKey.replace(/-/g, "");
+  if (
+    /^gpt-5\.6-(?:sol|terra|luna)$/.test(modelKey) ||
+    /^gpt5\.6(?:sol|terra|luna)$/.test(compactModelKey)
+  ) {
+    return 1.5;
+  }
   if (modelKey === "gpt-5.5" || compactModelKey === "gpt5.5") return 2.5;
   if (modelKey === "gpt-5.4" || compactModelKey === "gpt5.4") return 2;
   return 1;
@@ -95,7 +129,12 @@ export function computeCostFromPricing(
   tokens: Record<string, number | undefined> | null | undefined,
   options: CostCalculationOptions = {}
 ): number {
-  if (!pricing || !tokens) return 0;
+  if (!tokens) return 0;
+  // Trust an exact, provider-reported cost over the token × pricing estimate
+  // when one is present — works even when no local pricing row exists yet.
+  const exactCostUsd = extractExactCostUsd(tokens);
+  if (exactCostUsd !== null) return exactCostUsd;
+  if (!pricing) return 0;
   // Flat-rate (subscription / cookie-web) providers don't bill per token — their
   // per-token pricing rows exist only for estimation, so display surfaces opt in
   // to show $0 instead of an inflated estimate (#5552).
@@ -138,6 +177,11 @@ export async function calculateCost(
 ): Promise<number> {
   if (!tokens || !provider || !model) return 0;
 
+  // Short-circuit before any pricing DB lookup when an exact, provider-reported
+  // cost is present (currently xAI's `cost_in_usd_ticks` — see extractExactCostUsd).
+  const exactCostUsd = extractExactCostUsd(tokens);
+  if (exactCostUsd !== null) return exactCostUsd;
+
   try {
     const { getPricingForModel } = await import("@/lib/localDb");
 
@@ -199,7 +243,10 @@ export function computeAudioCost(
   }
   const characters = toNumber(usage.characters, 0);
   if (characters > 0) {
-    const perChar = toNumber(pricing.input_cost_per_character ?? pricing.output_cost_per_character, 0);
+    const perChar = toNumber(
+      pricing.input_cost_per_character ?? pricing.output_cost_per_character,
+      0
+    );
     // Round to 10 decimals to drop binary-FP artifacts (e.g. 0.000015 * 1000).
     if (perChar > 0) return Math.round(perChar * characters * 1e10) / 1e10;
   }
diff --git a/src/lib/usage/migrations.ts b/src/lib/usage/migrations.ts
index 10c8d6ede0..df41bb2be5 100644
--- a/src/lib/usage/migrations.ts
+++ b/src/lib/usage/migrations.ts
@@ -13,6 +13,7 @@ import path from "path";
 import { ZipFile } from "yazl";
 import { getDbInstance, isCloud, isBuildPhase, DATA_DIR } from "../db/core";
 import { getLegacyDotDataDir, isSamePath } from "../dataPaths";
+import { getAppLogFilePath } from "../logEnv";
 import { protectPayloadForLog } from "../logPayloads";
 import { sanitizePII } from "../piiSanitizer";
 import { writeCallArtifact, type CallLogArtifact } from "./callLogArtifacts";
@@ -110,17 +111,45 @@ function ensureArchiveDir() {
   fs.mkdirSync(LOG_ARCHIVES_DIR, { recursive: true });
 }
 
-function listArchiveTargets(): ArchiveTarget[] {
+/**
+ * Directory the live file logger writes to (`buildLogger()` in
+ * `src/shared/utils/logger.ts`), so the legacy-log sweep below never zips-then-deletes
+ * a directory it does not own. Since PR #6234 (fix for #6197) the default app log path
+ * moved from a `process.cwd()`-anchored location to `DATA_DIR/logs/application/app.log`,
+ * landing it inside the same `DATA_DIR/logs` tree this "legacy" migration sweeps (#6799).
+ */
+function getLiveAppLogDir(): string | null {
+  try {
+    return path.dirname(getAppLogFilePath());
+  } catch {
+    return null;
+  }
+}
+
+function listRequestLogArchiveEntries(): ArchiveTarget[] {
+  if (!CURRENT_REQUEST_LOGS_DIR || !fs.existsSync(CURRENT_REQUEST_LOGS_DIR)) return [];
+
+  const liveAppLogDir = getLiveAppLogDir();
+  const entries = fs.readdirSync(CURRENT_REQUEST_LOGS_DIR);
   const targets: ArchiveTarget[] = [];
 
-  if (CURRENT_REQUEST_LOGS_DIR && fs.existsSync(CURRENT_REQUEST_LOGS_DIR)) {
+  for (const entry of entries) {
+    const entryPath = path.join(CURRENT_REQUEST_LOGS_DIR, entry);
+    if (liveAppLogDir && isSamePath(entryPath, liveAppLogDir)) continue;
+
     targets.push({
-      sourcePath: CURRENT_REQUEST_LOGS_DIR,
-      archiveRoot: "data/logs",
+      sourcePath: entryPath,
+      archiveRoot: path.posix.join("data/logs", entry),
       deleteAfterArchive: true,
     });
   }
 
+  return targets;
+}
+
+function listArchiveTargets(): ArchiveTarget[] {
+  const targets: ArchiveTarget[] = listRequestLogArchiveEntries();
+
   if (CURRENT_REQUEST_SUMMARY_FILE && fs.existsSync(CURRENT_REQUEST_SUMMARY_FILE)) {
     targets.push({
       sourcePath: CURRENT_REQUEST_SUMMARY_FILE,
@@ -173,11 +202,27 @@ function createLegacyArchive(targets: ArchiveTarget[]): Promise<string> {
     const zipFile = new ZipFile();
     const output = fs.createWriteStream(archivePath);
 
-    output.on("close", () => resolve(archiveFilename));
-    output.on("error", (error) => {
+    let settled = false;
+    // yazl detects a stat->stream size mismatch (a file growing while being zipped, e.g.
+    // an actively-written log — #6401) by emitting "error" on the ZipFile instance itself,
+    // not on `output`. Left unwired, that "error" event has no listener and Node re-throws
+    // it as an uncaughtException that crashes the process. Wiring it here converts that
+    // crash into a normal rejection the caller's try/catch already handles.
+    const fail = (error: Error) => {
+      if (settled) return;
+      settled = true;
+      output.destroy();
       fs.rmSync(archivePath, { force: true });
       reject(error);
+    };
+
+    output.on("close", () => {
+      if (settled) return;
+      settled = true;
+      resolve(archiveFilename);
     });
+    output.on("error", fail);
+    zipFile.on("error", fail);
     zipFile.outputStream.pipe(output);
 
     try {
@@ -186,9 +231,7 @@ function createLegacyArchive(targets: ArchiveTarget[]): Promise<string> {
       }
       zipFile.end();
     } catch (error) {
-      fs.rmSync(archivePath, { force: true });
-      zipFile.end();
-      reject(error);
+      fail(error as Error);
     }
   });
 }
diff --git a/src/lib/usage/providerLimits.ts b/src/lib/usage/providerLimits.ts
index 588350d523..6dcafb051f 100644
--- a/src/lib/usage/providerLimits.ts
+++ b/src/lib/usage/providerLimits.ts
@@ -75,6 +75,7 @@ const PROVIDER_LIMITS_APIKEY_PROVIDERS = new Set([
   "vertex",
   "vertex-partner",
   "kimi-coding-apikey",
+  "kiro",
   // Qoder connections are PAT-based (authType "apikey"); the usage fetcher
   // exchanges the PAT for a job token and reads openapi.qoder.sh/user/status.
   "qoder",
@@ -187,7 +188,8 @@ export function isSupportedUsageConnection(connection: ProviderConnectionLike |
 
   if (connection.authType === "oauth") return true;
   return (
-    connection.authType === "apikey" && PROVIDER_LIMITS_APIKEY_PROVIDERS.has(connection.provider)
+    (connection.authType === "apikey" || connection.authType === "api_key") &&
+    PROVIDER_LIMITS_APIKEY_PROVIDERS.has(connection.provider)
   );
 }
 
diff --git a/src/lib/usage/usageHistory.ts b/src/lib/usage/usageHistory.ts
index 74fec28f16..a13ffb13f6 100644
--- a/src/lib/usage/usageHistory.ts
+++ b/src/lib/usage/usageHistory.ts
@@ -553,17 +553,58 @@ export async function getUsageDb(sinceIso?: string | null, limit?: number, curso
   });
 
   // Provide next cursor if we hit the limit (more rows exist)
-  const nextCursor = rows.length === maxRows ? (rows[rows.length - 1] as any)?.timestamp : null;
+  const nextCursor =
+    rows.length === maxRows ? toStringOrNull(asRecord(rows[rows.length - 1]).timestamp) : null;
 
   return { data: { history, nextCursor } };
 }
 
 // ──────────────── Save Request Usage ────────────────
 
+/**
+ * DB-entity-mapped shape accepted by {@link saveRequestUsage}, mirroring the
+ * `usage_history` table columns 1:1 (see `src/lib/db/migrations/`). Convention
+ * (#3512): every `usage_history` writer should type its entry against this
+ * interface instead of an inline anonymous object or `any` — call sites are
+ * intentionally permissive (fields optional/nullable) because rows are built
+ * incrementally across several extraction points (chatCore success/failure
+ * paths, rejected-request accounting, the Codex Responses WS bridge).
+ *
+ * `tokens` stays `unknown` on purpose: callers pass either the raw
+ * provider-shaped usage object (OpenAI `prompt_tokens`/`completion_tokens`,
+ * Anthropic `input_tokens`/`cache_read_input_tokens`, …) or the already
+ * normalized `{ input, output, cacheRead, cacheCreation, reasoning }` shape —
+ * `getLoggedInputTokens`/`getLoggedOutputTokens`/`getPromptCache*Tokens` in
+ * `./tokenAccounting` accept both and extract the right fields.
+ */
+export interface UsageEntry {
+  provider?: string | null;
+  model?: string | null;
+  /** Raw or normalized token usage — see the interface doc above. */
+  tokens?: unknown;
+  status?: string | null;
+  success?: boolean;
+  latencyMs?: number;
+  timeToFirstTokenMs?: number;
+  errorCode?: string | null;
+  /** ISO timestamp; defaults to `new Date().toISOString()` when omitted. */
+  timestamp?: string;
+  connectionId?: string | null;
+  apiKeyId?: string | null;
+  apiKeyName?: string | null;
+  serviceTier?: string | null;
+  /** @deprecated legacy snake_case fallback, read only if `serviceTier` is unset. */
+  service_tier?: string | null;
+  comboStrategy?: string | null;
+  /** @deprecated legacy snake_case fallback, read only if `comboStrategy` is unset. */
+  combo_strategy?: string | null;
+  endpoint?: string | null;
+}
+
 /**
  * Save request usage entry to SQLite.
  */
-export async function saveRequestUsage(entry: any) {
+export async function saveRequestUsage(entry: UsageEntry) {
   if (!shouldPersistToDisk) return;
 
   try {
@@ -666,10 +707,17 @@ export async function saveRequestUsage(entry: any) {
 
 // ──────────────── Get Usage History ────────────────
 
+export interface UsageHistoryFilter {
+  provider?: string;
+  model?: string;
+  startDate?: string | number | Date;
+  endDate?: string | number | Date;
+}
+
 /**
  * Get usage history with optional filters.
  */
-export async function getUsageHistory(filter: any = {}) {
+export async function getUsageHistory(filter: UsageHistoryFilter = {}) {
   const db = getDbInstance();
   let sql = "SELECT * FROM usage_history";
   const conditions: string[] = [];
@@ -875,7 +923,7 @@ export async function appendRequestLog({
   model?: string;
   provider?: string;
   connectionId?: string;
-  tokens?: any;
+  tokens?: unknown;
   status?: string | number;
 }) {
   // Deprecated: request summaries now come from SQLite call_logs.
@@ -909,8 +957,11 @@ export async function getRecentLogs(limit = 200) {
       const status = typeof row.status === "number" ? row.status : String(row.status || "-");
       return `${timestamp} | ${model} | ${provider} | ${account} | ${tokensIn} | ${tokensOut} | ${status}`;
     });
-  } catch (error: any) {
-    console.error("[usageDb] Failed to read recent call logs:", error.message);
+  } catch (error) {
+    console.error(
+      "[usageDb] Failed to read recent call logs:",
+      error instanceof Error ? error.message : String(error)
+    );
     return [];
   }
 }
diff --git a/src/lib/vscode/reasoningMetadata.ts b/src/lib/vscode/reasoningMetadata.ts
index 60c1d30c1f..03780176d5 100644
--- a/src/lib/vscode/reasoningMetadata.ts
+++ b/src/lib/vscode/reasoningMetadata.ts
@@ -1,6 +1,7 @@
 import { supportsXHighEffort } from "@omniroute/open-sse/config/providerModels";
 import { parseModel } from "@omniroute/open-sse/services/model";
 import { stripVscodeServiceTierVariantModelId } from "@/lib/vscode/serviceTierVariants";
+import { extendCodexGpt56EffortValues } from "@/shared/reasoning/effortStandardization";
 
 export type VscodeCatalogModel = {
   id?: string;
@@ -15,9 +16,10 @@ export type VscodeCatalogModel = {
   default_reasoning_effort?: string;
 };
 
-const EFFORT_SUFFIX_PATTERN = /-(xhigh|high|medium|low|none)$/i;
+const STANDARD_EFFORT_SUFFIX_PATTERN = /-(xhigh|high|medium|low|none)$/i;
+const GPT_5_6_EXTENDED_EFFORT_SUFFIX_PATTERN = /^(.*gpt-5\.6-(?:sol|terra|luna))-(max|ultra)$/i;
 const DEFAULT_REASONING_EFFORT = "none";
-const KNOWN_REASONING_EFFORTS = new Set(["none", "low", "medium", "high", "xhigh"]);
+const KNOWN_REASONING_EFFORTS = new Set(["none", "low", "medium", "high", "xhigh", "max", "ultra"]);
 
 export type VscodeModelConfigSchema = {
   type: "object";
@@ -38,6 +40,20 @@ export function getCatalogModelName(model: VscodeCatalogModel) {
   return stripVscodeServiceTierVariantModelId(model.id || model.name || model.root || "");
 }
 
+function matchReasoningEffortSuffix(modelId: string) {
+  const extendedMatch = modelId.match(GPT_5_6_EXTENDED_EFFORT_SUFFIX_PATTERN);
+  if (extendedMatch?.[1] && extendedMatch[2]) {
+    return { baseModelId: extendedMatch[1], effort: extendedMatch[2].toLowerCase() };
+  }
+
+  const standardMatch = modelId.match(STANDARD_EFFORT_SUFFIX_PATTERN);
+  if (!standardMatch?.[1]) return undefined;
+  return {
+    baseModelId: modelId.slice(0, -standardMatch[0].length),
+    effort: standardMatch[1].toLowerCase(),
+  };
+}
+
 function normalizeReasoningEffortValue(value: string) {
   const normalized = value
     .trim()
@@ -104,7 +120,7 @@ export function getReasoningEffortValues(model: VscodeCatalogModel) {
     values.push("xhigh");
   }
 
-  return values;
+  return extendCodexGpt56EffortValues(providerId, providerModelId, values);
 }
 
 export function formatReasoningEffortLabel(level: string) {
@@ -123,7 +139,11 @@ function describeReasoningEffort(level: string) {
     case "high":
       return "Uses an extended amount of reasoning.";
     case "xhigh":
+      return "Uses extra-high reasoning effort.";
+    case "max":
       return "Uses the maximum available reasoning effort.";
+    case "ultra":
+      return "Uses the Ultra reasoning preset.";
     default:
       return `Uses ${formatReasoningEffortLabel(level)} reasoning effort.`;
   }
@@ -138,11 +158,10 @@ export function inferSelectedReasoningEffort(
   supportedValues?: string[]
 ) {
   const modelId = getCatalogModelName(model);
-  const match = modelId.match(EFFORT_SUFFIX_PATTERN);
+  const match = matchReasoningEffortSuffix(modelId);
   if (!match) return undefined;
 
-  const selected = match[1]?.toLowerCase();
-  if (!selected) return undefined;
+  const selected = match.effort;
   if (
     Array.isArray(supportedValues) &&
     supportedValues.length > 0 &&
@@ -155,7 +174,7 @@ export function inferSelectedReasoningEffort(
 }
 
 export function getReasoningVariantBaseModelId(modelId: string) {
-  return modelId.replace(EFFORT_SUFFIX_PATTERN, "");
+  return matchReasoningEffortSuffix(modelId)?.baseModelId || modelId;
 }
 
 export function getDefaultReasoningEffort(model: VscodeCatalogModel, supportedValues?: string[]) {
diff --git a/src/mitm/cert/generate.ts b/src/mitm/cert/generate.ts
index d76c52b6cd..6eb26878bd 100644
--- a/src/mitm/cert/generate.ts
+++ b/src/mitm/cert/generate.ts
@@ -1,8 +1,17 @@
 import path from "path";
 import fs from "fs";
 import { resolveMitmDataDir } from "../dataDir.ts";
+import { ANTIGRAVITY_TARGET } from "../targets/antigravity.ts";
 
-const TARGET_HOST = "daily-cloudcode-pa.googleapis.com";
+// #6494: the proxy terminates TLS locally for all 4 antigravity/cloudcode
+// hosts (see `TARGET_HOSTS` in server.cjs), but the generated cert previously
+// only carried a SAN entry for the first one — every other host served a cert
+// whose CN/SAN didn't match, breaking MITM interception. `ANTIGRAVITY_TARGET.hosts`
+// is the single authoritative host list (kept in lock-step with server.cjs /
+// dnsConfig.ts / mitmToolHosts.ts by their own drift tests) — reuse it here
+// instead of hard-coding a second copy.
+const TARGET_HOSTS: string[] = ANTIGRAVITY_TARGET.hosts;
+const TARGET_HOST = TARGET_HOSTS[0];
 
 /**
  * Generate self-signed SSL certificate using selfsigned (pure JS, no openssl needed)
@@ -30,12 +39,17 @@ export async function generateCert(): Promise<{ key: string; cert: string }> {
     keySize: 2048,
     algorithm: "sha256",
     notAfterDate: notAfter,
-    extensions: [{ name: "subjectAltName", altNames: [{ type: 2, value: TARGET_HOST }] }],
+    extensions: [
+      {
+        name: "subjectAltName",
+        altNames: TARGET_HOSTS.map((value) => ({ type: 2, value })),
+      },
+    ],
   });
 
   fs.writeFileSync(keyPath, pems.private);
   fs.writeFileSync(certPath, pems.cert);
 
-  console.log(`✅ Generated SSL certificate for ${TARGET_HOST}`);
+  console.log(`✅ Generated SSL certificate for ${TARGET_HOSTS.join(", ")}`);
   return { key: keyPath, cert: certPath };
 }
diff --git a/src/mitm/dns/dnsConfig.ts b/src/mitm/dns/dnsConfig.ts
index ef57782ff4..6b6f78a523 100644
--- a/src/mitm/dns/dnsConfig.ts
+++ b/src/mitm/dns/dnsConfig.ts
@@ -8,6 +8,7 @@ import {
   quotePowerShell,
   runElevatedPowerShell,
 } from "../systemCommands.ts";
+import { ALL_TARGETS } from "../targets/index.ts";
 
 // Legacy Antigravity defaults preserved for backward compat.
 const ANTIGRAVITY_HOSTS = [
@@ -17,6 +18,12 @@ const ANTIGRAVITY_HOSTS = [
   "autopush-cloudcode-pa.sandbox.googleapis.com",
 ];
 
+function resolveHostsForAgent(agentId?: string): string[] {
+  if (!agentId) return ANTIGRAVITY_HOSTS;
+  const target = ALL_TARGETS.find((t) => t.id === agentId);
+  return target?.hosts ?? ANTIGRAVITY_HOSTS;
+}
+
 const IS_WIN = process.platform === "win32";
 const HOSTS_FILE = IS_WIN
   ? path.join(process.env.SystemRoot || "C:\\Windows", "System32", "drivers", "etc", "hosts")
@@ -108,9 +115,13 @@ function hasHostEntry(hostsContent: string, hostname: string): boolean {
  * Add /etc/hosts entries for every hostname in `hosts`.
  * Idempotent — existing entries are not duplicated.
  * Complies with Hard Rule #13: no string interpolation in shell commands.
+ *
+ * On Windows, all missing entries are batched into a single elevated PowerShell
+ * invocation so the user gets one UAC prompt instead of one per line.
  */
 export async function addDNSEntries(hosts: string[], sudoPassword: string): Promise<void> {
   const hostsContent = readHostsFile();
+  const missingEntries: string[] = [];
 
   for (const hostname of hosts) {
     const lines = dnsLines(hostname);
@@ -122,29 +133,23 @@ export async function addDNSEntries(hosts: string[], sudoPassword: string): Prom
         return parts.length >= 2 && parts[0] === ip && parts.includes(host);
       });
     });
+    missingEntries.push(...missing);
+  }
 
-    for (const entry of missing) {
-      if (IS_WIN) {
-        // HR#13: build PowerShell command via concat (not template literal) so grep
-        // for `\${` inside script bodies returns zero hits. Values pass through
-        // `quotePowerShell()` for single-quote escaping — safe against injection
-        // since both HOSTS_FILE (OS const) and entry (internal `IP host` string)
-        // are non-user-supplied.
-        const cmd =
-          "Add-Content -LiteralPath " +
-          quotePowerShell(HOSTS_FILE) +
-          " -Value " +
-          quotePowerShell(entry);
-        await runElevatedPowerShell(cmd);
-      } else {
-        // Hard Rule #13: entry is passed as stdin data, not interpolated into the command.
-        await execFileWithPassword(
-          "sudo",
-          ["-S", "tee", "-a", HOSTS_FILE],
-          sudoPassword,
-          `${entry}\n`
-        );
-      }
+  if (missingEntries.length === 0) return;
+
+  if (IS_WIN) {
+    const psHostsFile = quotePowerShell(HOSTS_FILE);
+    const psEntries = missingEntries.map((e) => quotePowerShell(e)).join(", ");
+    const script = "Add-Content -LiteralPath " + psHostsFile + " -Value " + psEntries;
+    await runElevatedPowerShell(script);
+    for (const entry of missingEntries) {
+      console.log(`[DNS] Added entry: ${entry}`);
+    }
+  } else {
+    const data = missingEntries.map((e) => `${e}\n`).join("");
+    await execFileWithPassword("sudo", ["-S", "tee", "-a", HOSTS_FILE], sudoPassword, data);
+    for (const entry of missingEntries) {
       console.log(`[DNS] Added entry: ${entry}`);
     }
   }
@@ -168,46 +173,43 @@ fs.writeFileSync(filePath, filtered.join("\\n").replace(/\\n*$/, "\\n"));
  * Remove /etc/hosts entries for every hostname in `hosts`.
  * Idempotent — silently skips hosts that are not present.
  * Complies with Hard Rule #13: HOSTS_FILE and hostname are passed as argv, not interpolated.
+ *
+ * On Windows, all hostnames are filtered in a single elevated PowerShell
+ * invocation so the user gets one UAC prompt instead of one per host.
  */
 export async function removeDNSEntries(hosts: string[], sudoPassword: string): Promise<void> {
   const hostsContent = readHostsFile();
+  const presentHosts = hosts.filter((h) => hasHostEntry(hostsContent, h));
 
-  for (const hostname of hosts) {
-    if (!hasHostEntry(hostsContent, hostname)) {
-      console.log(`[DNS] Entry for ${hostname} not present — skipping`);
-      continue;
-    }
+  if (presentHosts.length === 0) return;
 
-    try {
-      if (IS_WIN) {
-        // HR#13: build PowerShell script via concat (not template literal) so grep
-        // for `\${` inside script bodies returns zero hits. `psHostsFile` and
-        // `psTargetHost` are quotePowerShell-escaped values (single-quote escape).
-        const psHostsFile = quotePowerShell(HOSTS_FILE);
-        const psTargetHost = quotePowerShell(hostname);
-        const script =
-          "\n          $hostsFile = " +
-          psHostsFile +
-          ";\n          $targetHost = " +
-          psTargetHost +
-          ";\n          $lines = Get-Content -LiteralPath $hostsFile;\n" +
-          "          $filtered = $lines | Where-Object {\n" +
-          "            $parts = ($_ -split '\\s+') | Where-Object { $_ };\n" +
-          "            -not (($parts.Length -ge 2) -and ($parts -contains $targetHost))\n" +
-          "          };\n" +
-          "          Set-Content -LiteralPath $hostsFile -Value $filtered;\n        ";
-        await runElevatedPowerShell(script);
-      } else {
-        // Hard Rule #13: HOSTS_FILE and hostname are argv arguments, not interpolated.
-        await execFileWithPassword(
-          "sudo",
-          ["-S", process.execPath, "-e", REMOVE_HOSTS_ENTRY_SCRIPT, HOSTS_FILE, hostname],
-          sudoPassword
-        );
-      }
+  if (IS_WIN) {
+    const psHostsFile = quotePowerShell(HOSTS_FILE);
+    const psTargets = presentHosts.map((h) => quotePowerShell(h)).join(", ");
+    const script =
+      "$hostsFile = " +
+      psHostsFile +
+      ";\n          $targetHosts = @(" +
+      psTargets +
+      ");\n" +
+      "          $lines = Get-Content -LiteralPath $hostsFile;\n" +
+      "          $filtered = $lines | Where-Object {\n" +
+      "            $part = ($_ -split '\\s+') | Where-Object { $_ };\n" +
+      "            -not ($part.Length -ge 2 -and ($targetHosts -contains $part[1]))\n" +
+      "          };\n" +
+      "          Set-Content -LiteralPath $hostsFile -Value $filtered;\n        ";
+    await runElevatedPowerShell(script);
+    for (const hostname of presentHosts) {
+      console.log(`[DNS] Removed entries for ${hostname}`);
+    }
+  } else {
+    for (const hostname of presentHosts) {
+      await execFileWithPassword(
+        "sudo",
+        ["-S", process.execPath, "-e", REMOVE_HOSTS_ENTRY_SCRIPT, HOSTS_FILE, hostname],
+        sudoPassword
+      );
       console.log(`[DNS] Removed entries for ${hostname}`);
-    } catch (error) {
-      throw new Error(`Failed to remove DNS entry for ${hostname}: ${getErrorMessage(error)}`);
     }
   }
 }
@@ -226,17 +228,19 @@ export function checkDNSEntry(): boolean {
 }
 
 /**
- * Add DNS entries for the Antigravity default hosts.
+ * Add DNS entries for the Antigravity default hosts, or for a specific agent
+ * when `agentId` is provided.
  * Delegates to `addDNSEntries` — backward compat wrapper.
  */
-export async function addDNSEntry(sudoPassword: string): Promise<void> {
-  await addDNSEntries(ANTIGRAVITY_HOSTS, sudoPassword);
+export async function addDNSEntry(sudoPassword: string, agentId?: string): Promise<void> {
+  await addDNSEntries(resolveHostsForAgent(agentId), sudoPassword);
 }
 
 /**
- * Remove DNS entries for the Antigravity default hosts.
+ * Remove DNS entries for the Antigravity default hosts, or for a specific agent
+ * when `agentId` is provided.
  * Delegates to `removeDNSEntries` — backward compat wrapper.
  */
-export async function removeDNSEntry(sudoPassword: string): Promise<void> {
-  await removeDNSEntries(ANTIGRAVITY_HOSTS, sudoPassword);
+export async function removeDNSEntry(sudoPassword: string, agentId?: string): Promise<void> {
+  await removeDNSEntries(resolveHostsForAgent(agentId), sudoPassword);
 }
diff --git a/src/mitm/manager.ts b/src/mitm/manager.ts
index 856c3c84fd..47765bf515 100644
--- a/src/mitm/manager.ts
+++ b/src/mitm/manager.ts
@@ -552,7 +552,12 @@ async function startMitmInternal(
   const certPath = path.join(resolveMitmDataDir(), "mitm", "server.crt");
   if (!fs.existsSync(certPath)) {
     log.info("Generating SSL certificate...");
-    await generateCert();
+    try {
+      await generateCert();
+    } catch (err) {
+      log.error({ err }, "Failed to generate SSL certificate");
+      throw err;
+    }
   }
 
   // 2. Install certificate to system keychain. A failure here must NOT abort the
@@ -576,7 +581,11 @@ async function startMitmInternal(
   // 3. Add DNS entries: Antigravity defaults + all agents with dns_enabled=true +
   //    all custom hosts with enabled=true. Best-effort — see provisionDnsEntries.
   log.info("Adding DNS entries...");
-  await provisionDnsEntries(sudoPassword);
+  try {
+    await provisionDnsEntries(sudoPassword);
+  } catch (err) {
+    log.error({ err }, "DNS provisioning threw unexpectedly (continuing)");
+  }
 
   // 4. Start MITM server
   log.info("Starting MITM server...");
@@ -619,9 +628,13 @@ async function startMitmInternal(
   const proc = serverProcess;
   serverPid = proc.pid ?? null;
 
-  // Save PID to file
+  // Save PID to file — best-effort, must not orphan spawned child process
   if (serverPid !== null) {
-    fs.writeFileSync(PID_FILE, String(serverPid));
+    try {
+      fs.writeFileSync(PID_FILE, String(serverPid));
+    } catch (err) {
+      log.error({ err, pid: serverPid }, "Failed to write MITM PID file (continuing)");
+    }
   }
 
   // Buffer recent stderr so a startup failure can be reported with its real
diff --git a/src/server/authz/pipeline.ts b/src/server/authz/pipeline.ts
index 84b6550aa3..b440bad49f 100644
--- a/src/server/authz/pipeline.ts
+++ b/src/server/authz/pipeline.ts
@@ -38,6 +38,29 @@ const POLICIES: Record<RouteClass, RoutePolicy> = {
   MANAGEMENT: managementPolicy,
 };
 
+let staleDashboardJwtWarningEmitted = false;
+
+function isStaleDashboardJwtError(error: unknown): boolean {
+  const code =
+    typeof error === "object" &&
+    error !== null &&
+    "code" in error &&
+    typeof (error as { code?: unknown }).code === "string"
+      ? (error as { code: string }).code
+      : "";
+
+  if (
+    code === "ERR_JWS_SIGNATURE_VERIFICATION_FAILED" ||
+    code === "ERR_JWT_EXPIRED" ||
+    code === "ERR_JWS_INVALID" ||
+    code === "ERR_JWT_CLAIM_VALIDATION_FAILED"
+  ) {
+    return true;
+  }
+
+  return error instanceof Error && error.message.includes("signature verification failed");
+}
+
 function stampSubject(headers: Headers, subject: AuthSubject): void {
   headers.set(AUTHZ_HEADER_AUTH_KIND, subject.kind);
   headers.set(AUTHZ_HEADER_AUTH_ID, subject.id);
@@ -144,6 +167,15 @@ async function refreshDashboardSessionIfNeeded(
       path: "/",
     });
   } catch (error) {
+    if (isStaleDashboardJwtError(error)) {
+      response.cookies.delete("auth_token");
+      if (!staleDashboardJwtWarningEmitted) {
+        staleDashboardJwtWarningEmitted = true;
+        console.warn("[Authz] Dropped stale dashboard session cookie during auto-refresh");
+      }
+      return;
+    }
+
     console.error("[Authz] JWT auto-refresh failed:", error);
   }
 }
diff --git a/src/server/authz/policies/clientApi.ts b/src/server/authz/policies/clientApi.ts
index 1f2363d36c..6545b11d02 100644
--- a/src/server/authz/policies/clientApi.ts
+++ b/src/server/authz/policies/clientApi.ts
@@ -4,6 +4,19 @@ import { extractApiKey } from "@/sse/services/auth.ts";
 import type { AuthOutcome, PolicyContext, RoutePolicy } from "../context";
 import { allow, reject } from "../context";
 
+const HANDSHAKE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+
+function isWsHandshake(ctx: PolicyContext): boolean {
+  if (ctx.classification.normalizedPath !== "/api/v1/ws") return false;
+  if (!HANDSHAKE_METHODS.has(ctx.request.method.toUpperCase())) return false;
+
+  try {
+    return new URL(ctx.request.url, "http://localhost").searchParams.get("handshake") === "1";
+  } catch {
+    return false;
+  }
+}
+
 function extractBearer(request: Request): string | null {
   const raw = request.headers.get("authorization") ?? request.headers.get("Authorization");
   const xApiKey = request.headers.get("x-api-key") ?? request.headers.get("X-Api-Key");
@@ -37,6 +50,13 @@ export const clientApiPolicy: RoutePolicy = {
   async evaluate(ctx: PolicyContext): Promise<AuthOutcome> {
     const bearer = extractBearer(ctx.request as Request);
     if (!bearer) {
+      // The WS descriptor handshake is a metadata read; the route handler
+      // performs the actual wsAuth/dashboard/API-key decision and returns the
+      // protocol details the browser needs before opening the socket.
+      if (isWsHandshake(ctx)) {
+        return allow({ kind: "anonymous", id: "ws-handshake" });
+      }
+
       if (await isDashboardSessionAuthenticated(ctx.request)) {
         return allow({ kind: "dashboard_session", id: "dashboard" });
       }
diff --git a/src/server/authz/routeGuard.ts b/src/server/authz/routeGuard.ts
index b921eb57cc..d9479e1e89 100644
--- a/src/server/authz/routeGuard.ts
+++ b/src/server/authz/routeGuard.ts
@@ -29,6 +29,8 @@ const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1"]);
 export const LOCAL_ONLY_API_PREFIXES: ReadonlyArray<string> = [
   "/api/mcp/",
   "/api/cli-tools/runtime/",
+  "/api/cli-tools/omp-settings", // spawns `which omp` to detect the CLI install (Hard Rules #15 + #17, #6318)
+  "/api/cli-tools/letta-settings", // spawns `which letta` to detect the CLI install (Hard Rules #15 + #17, #6318)
   "/api/services/", // T-10: embedded service lifecycle (spawn child processes)
   "/dashboard/providers/services/", // T-07: reverse proxy to embedded service UIs
   "/api/copilot/", // unauthenticated LLM driver — CLI-only by default; admins can opt-in to remote access via manage-scope bypass
@@ -36,12 +38,14 @@ export const LOCAL_ONLY_API_PREFIXES: ReadonlyArray<string> = [
   "/api/tools/traffic-inspector/", // Traffic Inspector: http-proxy listener + system proxy (Hard Rules #15 + #17)
   "/api/plugins/", // plugins: load/execute via worker_threads + child_process (Hard Rules #15 + #17)
   "/api/plugins", // bare path: GET list + POST install also trigger plugin loading
+  "/api/middleware/", // SECURITY_AUDIT M8: middleware hooks compile+run arbitrary JS via new vm.Script (src/lib/middleware/registry.ts) on the request hot path — same code-exec class as /api/plugins/, so loopback-gate it for parity (Hard Rules #15 + #17)
   "/api/system/version", // auto-update: spawns git checkout + npm install — RCE-via-tunnel surface (Hard Rules #15 + #17, found by 6A.8 route-guard gate)
   "/api/db-backups/exportAll", // spawns tar for export archive (Hard Rules #15 + #17, found by 6A.8 route-guard gate)
   "/api/local/", // T-12: 1-click local service launchers (Redis today; spawns podman/docker) — loopback-enforced by isLocalRequestAllowed() in src/lib/security/localEndpoints.ts (Hard Rules #15 + #17)
   "/api/headroom/start", // Headroom token-saver proxy lifecycle: spawns headroom-ai python CLI (Hard Rules #15 + #17)
   "/api/headroom/stop", // Headroom token-saver proxy lifecycle: sends SIGTERM/SIGKILL to managed PID (Hard Rules #15 + #17)
   "/api/oauth/cursor/auto-import", // spawns `execFile("which", ["cursor"])` to verify a local Cursor install before importing creds — RCE-via-tunnel surface (Hard Rules #15 + #17, found by 6A.8 route-guard gate). Specific path only: the rest of /api/oauth/ (browser redirect/callback flows) must stay remote-reachable.
+  "/api/skills/collect/", // Skill Collector CLI detection: GET .../detect probes getCliRuntimeStatus() per CLI_TOOL_IDS entry, which spawns a child process to check each tool — RCE-via-tunnel surface (Hard Rules #15 + #17, PR #6294 review).
   "/api/discovery/", // Discovery tool (opt-in provider scanner): the scan route makes outbound probes to provider endpoints (SSRF-adjacent) and the whole surface is an admin research tool — strict-loopback only, no manage-scope bypass (NOT in LOCAL_ONLY_MANAGE_SCOPE_BYPASS_PREFIXES). See _tasks/features-v3.8.42/gaps/DISCOVERY_TOOL_DESIGN.md.
 ];
 
diff --git a/src/server/ws/liveServer.ts b/src/server/ws/liveServer.ts
index c3bbccdc89..a4a910a8fb 100644
--- a/src/server/ws/liveServer.ts
+++ b/src/server/ws/liveServer.ts
@@ -1,7 +1,7 @@
 /**
  * Live Dashboard WebSocket Server
  *
- * Separate process (runs alongside Next.js on port 20129).
+ * Separate process (runs alongside Next.js on port 20132).
  * Forwards EventBus events to subscribed dashboard clients.
  *
  * Protocol:
@@ -36,7 +36,7 @@ import {
 
 // ── Config ────────────────────────────────────────────────────────────────
 
-const DEFAULT_PORT = 20129;
+const DEFAULT_PORT = 20132;
 // Loopback by default. Opt-in to LAN exposure via LIVE_WS_HOST=0.0.0.0 — the
 // caller is then responsible for fronting it with a TLS terminator + origin
 // allow-list. Mirrors the route guard "local-only by default" posture.
diff --git a/src/shared/components/KiroAuthModal.tsx b/src/shared/components/KiroAuthModal.tsx
index f17d5f49e4..bf890af46c 100644
--- a/src/shared/components/KiroAuthModal.tsx
+++ b/src/shared/components/KiroAuthModal.tsx
@@ -28,8 +28,11 @@ export default function KiroAuthModal({
   const [idcStartUrl, setIdcStartUrl] = useState("");
   const [idcRegion, setIdcRegion] = useState("us-east-1");
   const [refreshToken, setRefreshToken] = useState("");
+  const [apiKey, setApiKey] = useState("");
+  const [apiKeyRegion, setApiKeyRegion] = useState("us-east-1");
   const [error, setError] = useState(null);
   const [importing, setImporting] = useState(false);
+  const [importingApiKey, setImportingApiKey] = useState(false);
   const [autoDetecting, setAutoDetecting] = useState(false);
   const [autoDetected, setAutoDetected] = useState(false);
   // IDC/organization credentials returned by auto-import when the SSO cache token
@@ -126,6 +129,43 @@ export default function KiroAuthModal({
     }
   };
 
+  const handleImportApiKey = async () => {
+    if (!apiKey.trim()) {
+      setError("Please enter a Kiro API key");
+      return;
+    }
+
+    setImportingApiKey(true);
+    setError(null);
+
+    try {
+      const res = await fetch(
+        `/api/oauth/kiro/api-key?targetProvider=${encodeURIComponent(providerId)}`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            apiKey: apiKey.trim(),
+            region: apiKeyRegion.trim() || "us-east-1",
+          }),
+        }
+      );
+
+      const data = await res.json();
+
+      if (!res.ok) {
+        throw new Error(data.error?.message || data.error || "API key import failed");
+      }
+
+      onMethodSelect("api-key");
+      onClose();
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "API key import failed");
+    } finally {
+      setImportingApiKey(false);
+    }
+  };
+
   const handleIdcContinue = () => {
     if (!idcStartUrl.trim()) {
       setError("Please enter your IDC start URL");
@@ -226,6 +266,23 @@ export default function KiroAuthModal({
                 </div>
               </div>
             </button>
+
+            {/* API Key */}
+            <button
+              onClick={() => handleMethodSelect("api-key")}
+              className="w-full p-4 text-left border border-border rounded-lg hover:bg-sidebar transition-colors"
+            >
+              <div className="flex items-start gap-3">
+                <span className="material-symbols-outlined text-primary mt-0.5">key</span>
+                <div className="flex-1">
+                  <h3 className="font-semibold mb-1">API Key</h3>
+                  <p className="text-sm text-text-muted">
+                    Paste a long-lived {providerLabel} / CodeWhisperer API key. It is stored as a
+                    bearer credential with no refresh token; profile discovery is best-effort.
+                  </p>
+                </div>
+              </div>
+            </button>
           </div>
         )}
 
@@ -419,6 +476,58 @@ export default function KiroAuthModal({
             )}
           </div>
         )}
+
+        {/* API Key Import */}
+        {selectedMethod === "api-key" && (
+          <div className="space-y-4">
+            <div>
+              <label className="block text-sm font-medium mb-2">
+                API Key <span className="text-red-500">*</span>
+              </label>
+              <Input
+                value={apiKey}
+                onChange={(e) => setApiKey(e.target.value)}
+                placeholder={`Paste your ${providerLabel} API key...`}
+                className="font-mono text-sm"
+              />
+              <p className="text-xs text-text-muted mt-1">
+                Stored encrypted as a long-lived bearer credential. There is no refresh flow.
+              </p>
+            </div>
+
+            <div>
+              <label className="block text-sm font-medium mb-2">AWS Region</label>
+              <Input
+                value={apiKeyRegion}
+                onChange={(e) => setApiKeyRegion(e.target.value)}
+                placeholder="us-east-1"
+                className="font-mono text-sm"
+              />
+              <p className="text-xs text-text-muted mt-1">
+                AWS region for the key (default: us-east-1)
+              </p>
+            </div>
+
+            {error && (
+              <div className="bg-red-50 dark:bg-red-900/20 p-3 rounded-lg border border-red-200 dark:border-red-800">
+                <p className="text-sm text-red-600 dark:text-red-400">{error}</p>
+              </div>
+            )}
+
+            <div className="flex gap-2">
+              <Button
+                onClick={handleImportApiKey}
+                fullWidth
+                disabled={importingApiKey || !apiKey.trim()}
+              >
+                {importingApiKey ? "Validating..." : "Validate and Save API Key"}
+              </Button>
+              <Button onClick={handleBack} variant="ghost" fullWidth>
+                Back
+              </Button>
+            </div>
+          </div>
+        )}
       </div>
     </Modal>
   );
diff --git a/src/shared/components/KiroOAuthWrapper.tsx b/src/shared/components/KiroOAuthWrapper.tsx
index aff30c2bdd..19b91ee85f 100644
--- a/src/shared/components/KiroOAuthWrapper.tsx
+++ b/src/shared/components/KiroOAuthWrapper.tsx
@@ -24,7 +24,7 @@ export default function KiroOAuthWrapper({
   onClose,
   reauthConnection,
 }: KiroOAuthWrapperProps) {
-  const [authMethod, setAuthMethod] = useState(null); // null | "builder-id" | "idc" | "social" | "import"
+  const [authMethod, setAuthMethod] = useState(null); // null | "builder-id" | "idc" | "social" | "import" | "api-key"
   const [socialProvider, setSocialProvider] = useState(null); // "google" | "github"
   const [idcConfig, setIdcConfig] = useState(null);
 
@@ -44,6 +44,9 @@ export default function KiroOAuthWrapper({
       } else if (method === "import") {
         // Import handled in KiroAuthModal, just close
         onSuccess?.();
+      } else if (method === "api-key") {
+        // API-key import is handled in KiroAuthModal.
+        onSuccess?.();
       }
     },
     [onSuccess]
diff --git a/src/shared/components/Modal.tsx b/src/shared/components/Modal.tsx
index dfff5de2f1..5e385ebf8d 100644
--- a/src/shared/components/Modal.tsx
+++ b/src/shared/components/Modal.tsx
@@ -4,6 +4,14 @@ import { useEffect, useRef, useId } from "react";
 import { cn } from "@/shared/utils/cn";
 import Button from "./Button";
 
+// #6265 — preset for content-heavy modals: caps height on the OUTERMOST dialog
+// wrapper only (single scroll owner) and keeps the inner body plain (no
+// independent max-h/overflow), avoiding a double height cap that clips content.
+export const TALL_MODAL_PROPS = {
+  className: "max-h-[90vh] overflow-y-auto",
+  bodyClassName: "p-6",
+};
+
 interface ModalProps {
   isOpen: boolean;
   onClose: () => void;
diff --git a/src/shared/components/ProviderIcon.tsx b/src/shared/components/ProviderIcon.tsx
index c12fb7ec7c..5655482235 100644
--- a/src/shared/components/ProviderIcon.tsx
+++ b/src/shared/components/ProviderIcon.tsx
@@ -1,17 +1,19 @@
 "use client";
 
 /**
- * ProviderIcon — Renders a provider logo using @lobehub/icons with static asset fallbacks.
+ * ProviderIcon — Renders a provider logo prioritizing local SVGs for speed.
  *
  * Strategy (#529):
  * 0. If `src` is set (operator-supplied remote icon URL, #2166), render it — this always
- *    wins over the @lobehub/static resolution below. On load error, falls back to
+ *    wins over the resolution below. On load error, falls back to
  *    `fallbackText`/`fallbackColor` (a colored text badge) if provided, otherwise falls
- *    through to steps 1-4.
- * 1. Try @lobehub/icons direct icon components (no @lobehub/ui peer runtime)
- * 2. Fall back to /providers/{id}.png (existing static assets)
- * 3. Fall back to /providers/{id}.svg (SVG assets)
- * 4. Fall back to a generic AI icon
+ *    through to steps 1-6.
+ * 1. Theme-aware static SVGs (`THEMED_SVGS`, e.g. arena-light/dark for lmarena)
+ * 2. Try /providers/{id}.svg (local SVG assets — fastest, cached separately from JS bundle)
+ * 3. Try @lobehub/icons direct React components (no @lobehub/ui peer runtime)
+ * 4. Fall back to thesvg.org CDN (external SVG)
+ * 5. Fall back to /providers/{id}.png (legacy static assets)
+ * 6. Fall back to a generic AI icon
  *
  * Usage:
  *   <ProviderIcon providerId="openai" size={24} />
@@ -22,6 +24,8 @@
 import { createElement, memo, useState } from "react";
 import Image from "next/image";
 
+import { useTheme } from "@/shared/hooks/useTheme";
+
 import { getLobeProviderIcon } from "./lobeProviderIcons";
 
 interface ProviderIconProps {
@@ -33,7 +37,7 @@ interface ProviderIconProps {
   /**
    * Optional operator-supplied remote icon URL (#2166) — e.g. a custom icon set for an
    * OpenAI-/Anthropic-compatible provider node. When set, this always takes priority
-   * over the @lobehub/static resolution. On load error, falls back to `fallbackText`
+   * over the resolution chain. On load error, falls back to `fallbackText`
    * (if provided) or the normal resolution chain below.
    */
   src?: string;
@@ -51,85 +55,227 @@ function GenericProviderIcon({ size }: { size: number }) {
   );
 }
 
+const KNOWN_SVGS = new Set([
+  "360ai",
+  "alibaba",
+  "anthropic",
+  "api-airforce",
+  "apikey",
+  "arcee",
+  "arcee-ai",
+  "assemblyai",
+  "auggie",
+  "aws",
+  "azure",
+  "azureai",
+  "baichuan",
+  "baidu",
+  "bailian",
+  "baseten",
+  "bazaarlink",
+  "bluesminds",
+  "brave",
+  "brave-search",
+  "byteplus",
+  "bytez",
+  "cartesia",
+  "cerebras",
+  "charm-hyper",
+  "chipotle",
+  "chutes",
+  "clarifai",
+  "claude",
+  "claude-web",
+  "cline",
+  "cloudflare",
+  "codex",
+  "cohere",
+  "comfyui",
+  "command-code",
+  "continue",
+  "copilot",
+  "coze",
+  "crof",
+  "cursor",
+  "deepgram",
+  "deepinfra",
+  "deepseek",
+  "dgrid",
+  "dify",
+  "digitalocean",
+  "dit",
+  "docker-model-runner",
+  "doubao",
+  "droid",
+  "duckduckgo-web",
+  "elevenlabs",
+  "exa",
+  "factory",
+  "fal",
+  "fireworks",
+  "freeaiapikey",
+  "freemodel-dev",
+  "friendli",
+  "galadriel",
+  "gemini",
+  "gitlab",
+  "gitlab-duo",
+  "gitlawb",
+  "gitlawb-gmi",
+  "google",
+  "grok",
+  "groq",
+  "hackclub",
+  "haiper",
+  "hcnsec",
+  "heroku",
+  "huggingchat",
+  "huggingface",
+  "hyperbolic",
+  "ibm",
+  "ideogram",
+  "iflytek",
+  "inclusionai",
+  "inference",
+  "inworld",
+  "kenari",
+  "kilo-gateway",
+  "kilocode",
+  "kimi",
+  "kiro",
+  "krutrim",
+  "lambda",
+  "leonardo",
+  "liquid",
+  "llm7",
+  "longcat",
+  "meta",
+  "metaai",
+  "minimax",
+  "mistral",
+  "modal",
+  "modelscope",
+  "monsterapi",
+  "moonshot",
+  "morph",
+  "nebius",
+  "nlpcloud",
+  "nomic",
+  "novita",
+  "nube",
+  "nvidia",
+  "oauth",
+  "oci",
+  "ollama",
+  "openadapter",
+  "openai",
+  "openclaw",
+  "opencode",
+  "openrouter",
+  "orcarouter",
+  "ovhcloud",
+  "perplexity",
+  "phind",
+  "picoclaw",
+  "pioneer",
+  "playht",
+  "poe",
+  "pollinations",
+  "poolside",
+  "publicai",
+  "puter",
+  "qianfan",
+  "qiniu",
+  "qwen",
+  "recraft",
+  "replicate",
+  "requesty",
+  "roocode",
+  "runway",
+  "sambanova",
+  "sap",
+  "scaleway",
+  "searchapi",
+  "searxng-search",
+  "sensenova",
+  "serper-search",
+  "snowflake",
+  "sparkdesk",
+  "stepfun",
+  "sumopod",
+  "suno",
+  "synthetic",
+  "t3-web",
+  "tavily",
+  "tencent",
+  "theoldllm",
+  "tokenrouter",
+  "topazlabs",
+  "trae",
+  "udio",
+  "uncloseai",
+  "upstage",
+  "v0",
+  "veoaifree-web",
+  "vercel",
+  "vllm",
+  "volcengine",
+  "voyage",
+  "wafer",
+  "wandb",
+  "windsurf",
+  "x5lab",
+  "xai",
+  "xinference",
+  "yi",
+  "youcom-search",
+  "yuanbao-web",
+  "zed-hosted",
+  "zenmux",
+  "zenmux-free",
+  "zhipu",
+]);
+
 const KNOWN_PNGS = new Set([
+  "adapta-web",
   "agentrouter",
-  "inner-ai",
   "aimlapi",
   "anthropic-m",
   "blackbox",
-  "claude",
-  "continue",
-  "copilot",
-  "cursor",
-  "deepgram",
-  "ironclaw",
-  "kie",
-  "nanobot",
-  "oai-cc",
-  "oai-r",
-  "openclaw",
-  "zeroclaw",
-  "adapta-web",
   "blackbox-web",
   "cliproxyapi",
   "empower",
   "gigachat",
-  "heroku",
+  "inner-ai",
+  "ironclaw",
+  "kie",
   "lemonade",
   "linkup-search",
   "llamafile",
   "llamagate",
   "maritalk",
+  "nanobot",
   "nanogpt",
   "nscale",
-  "ovhcloud",
+  "oai-cc",
+  "oai-r",
   "piapi",
   "predibase",
   "reka",
+  "zeroclaw",
 ]);
-const KNOWN_SVGS = new Set([
-  "apikey",
-  "bazaarlink",
-  "brave",
-  "brave-search",
-  "cartesia",
-  "360ai",
-  "huggingchat",
-  "iflytek",
-  "sparkdesk",
-  "arcee-ai",
-  "inclusionai",
-  "liquid",
-  "monsterapi",
-  "nomic",
-  "poolside",
-  "clarifai",
-  "command-code",
-  "claude-web",
-  "docker-model-runner",
-  "droid",
-  "gitlab",
-  "gitlab-duo",
-  "inworld",
-  "kiro",
-  "kilo-gateway",
-  "kilocode",
-  "modal",
-  "nlpcloud",
-  "oauth",
-  "oci",
-  "opencode",
-  "playht",
-  "puter",
-  "qianfan",
-  "sap",
-  "scaleway",
-  "serper-search",
-  "searxng-search",
-  "synthetic",
-  "wandb",
-  "youcom-search",
-]);
+
+const THEMED_SVGS: Record<string, { light: string; dark: string }> = {
+  // Arena (formerly LMArena) — wire id stays `lmarena`; alias `lma` also accepted.
+  lmarena: {
+    light: "/providers/arena-light.svg",
+    dark: "/providers/arena-dark.svg",
+  },
+  lma: {
+    light: "/providers/arena-light.svg",
+    dark: "/providers/arena-dark.svg",
+  },
+};
 
 const ProviderIcon = memo(function ProviderIcon({
   providerId,
@@ -142,26 +288,35 @@ const ProviderIcon = memo(function ProviderIcon({
   fallbackText,
   fallbackColor,
 }: ProviderIconProps) {
+  const { isDark } = useTheme();
   const normalizedId = providerId.toLowerCase();
   const lobeIcon = getLobeProviderIcon(normalizedId, type);
-  const hasPng = KNOWN_PNGS.has(normalizedId);
+  const themedSvg = THEMED_SVGS[normalizedId];
   const hasSvg = KNOWN_SVGS.has(normalizedId);
+  const hasPng = KNOWN_PNGS.has(normalizedId);
 
   const [failedAssets, setFailedAssets] = useState<Record<string, true>>({});
   const [remoteSrcFailed, setRemoteSrcFailed] = useState(false);
-  const pngKey = `${normalizedId}:png`;
+  const themedKey = `${normalizedId}:themed`;
   const svgKey = `${normalizedId}:svg`;
-  const usePng = !lobeIcon && hasPng && !failedAssets[pngKey];
-  const useSvg = !lobeIcon && hasSvg && !failedAssets[svgKey] && (!hasPng || failedAssets[pngKey]);
+  const pngKey = `${normalizedId}:png`;
+  const theSvgKey = `${normalizedId}:thesvg`;
 
   const trimmedSrc = typeof src === "string" ? src.trim() : "";
+  const themedFailed = failedAssets[themedKey];
+  const svgFailed = failedAssets[svgKey];
+  const theSvgFailed = failedAssets[theSvgKey];
+  const pngFailed = failedAssets[pngKey];
 
-  // #2166: a custom remote icon URL always wins over the @lobehub/static resolution
-  // below. It is a plain <img> (not next/image) so operators can point at any host
+  // #2166: a custom remote icon URL always wins over the resolution chain below.
+  // It is a plain <img> (not next/image) so operators can point at any host
   // without requiring `images.remotePatterns` allow-listing for arbitrary domains.
   if (trimmedSrc && !remoteSrcFailed) {
     return (
-      <span className={className} style={{ display: "inline-flex", alignItems: "center", ...style }}>
+      <span
+        className={className}
+        style={{ display: "inline-flex", alignItems: "center", ...style }}
+      >
         {/* eslint-disable-next-line @next/next/no-img-element -- operator-supplied remote URL, not a static/known asset */}
         <img
           src={trimmedSrc}
@@ -197,43 +352,29 @@ const ProviderIcon = memo(function ProviderIcon({
     );
   }
 
-  if (lobeIcon) {
-    return (
-      <span
-        className={className}
-        style={{ display: "inline-flex", alignItems: "center", ...style }}
-      >
-        {createElement(lobeIcon, {
-          "aria-label": providerId,
-          size,
-          style: { flex: "none" },
-        })}
-      </span>
-    );
-  }
-
-  if (usePng) {
+  // Tier 1: Theme-aware local SVGs (e.g. Arena light/dark)
+  if (themedSvg && !themedFailed) {
+    const themedSrc = isDark ? themedSvg.dark : themedSvg.light;
     return (
       <span
         className={className}
         style={{ display: "inline-flex", alignItems: "center", ...style }}
       >
         <Image
-          src={`/providers/${normalizedId}.png`}
+          src={themedSrc}
           alt={providerId}
           width={size}
           height={size}
           style={{ objectFit: "contain" }}
-          onError={() => {
-            setFailedAssets((current) => ({ ...current, [pngKey]: true }));
-          }}
+          onError={() => setFailedAssets((current) => ({ ...current, [themedKey]: true }))}
           unoptimized
         />
       </span>
     );
   }
 
-  if (useSvg) {
+  // Tier 2: Local SVG — fastest, cached separately from the JS bundle
+  if (hasSvg && !svgFailed) {
     return (
       <span
         className={className}
@@ -252,6 +393,63 @@ const ProviderIcon = memo(function ProviderIcon({
     );
   }
 
+  // Tier 3: LobeHub npm icons — only when no local SVG (or SVG failed to load)
+  if (lobeIcon) {
+    return (
+      <span
+        className={className}
+        style={{ display: "inline-flex", alignItems: "center", ...style }}
+      >
+        {createElement(lobeIcon, {
+          "aria-label": providerId,
+          size,
+          style: { flex: "none" },
+        })}
+      </span>
+    );
+  }
+
+  // Tier 4: thesvg.org CDN — external SVG fallback for unknown providers
+  if (!theSvgFailed) {
+    return (
+      <span
+        className={className}
+        style={{ display: "inline-flex", alignItems: "center", ...style }}
+      >
+        {/* eslint-disable-next-line @next/next/no-img-element -- external SVG from thesvg.org, not a static/known asset */}
+        <img
+          src={`https://thesvg.org/icons/${normalizedId}/default.svg`}
+          alt={providerId}
+          width={size}
+          height={size}
+          style={{ objectFit: "contain", flex: "none" }}
+          onError={() => setFailedAssets((current) => ({ ...current, [theSvgKey]: true }))}
+        />
+      </span>
+    );
+  }
+
+  // Tier 5: Local PNG — last resort before generic icon
+  if (hasPng && !pngFailed) {
+    return (
+      <span
+        className={className}
+        style={{ display: "inline-flex", alignItems: "center", ...style }}
+      >
+        <Image
+          src={`/providers/${normalizedId}.png`}
+          alt={providerId}
+          width={size}
+          height={size}
+          style={{ objectFit: "contain" }}
+          onError={() => setFailedAssets((current) => ({ ...current, [pngKey]: true }))}
+          unoptimized
+        />
+      </span>
+    );
+  }
+
+  // Tier 6: Generic AI icon
   return (
     <span className={className} style={{ display: "inline-flex", alignItems: "center", ...style }}>
       <GenericProviderIcon size={size} />
diff --git a/src/shared/components/RequestLoggerV2.tsx b/src/shared/components/RequestLoggerV2.tsx
index 3c7b266e96..89de367a30 100644
--- a/src/shared/components/RequestLoggerV2.tsx
+++ b/src/shared/components/RequestLoggerV2.tsx
@@ -179,23 +179,15 @@ const RequestLoggerV2 = forwardRef<RequestLoggerV2Handle, { initialSelectedId?:
     const [refreshIntervalSec, setRefreshIntervalSec] = useState(DEFAULT_REFRESH_INTERVAL_SEC);
     const intervalRef = useRef(null);
     const refreshIntervalSecRef = useRef(DEFAULT_REFRESH_INTERVAL_SEC);
+    const detailRequestRef = useRef("");
     const hasLoadedRef = useRef(false);
     const logsSignatureRef = useRef("");
     const scrollContainerRef = useRef(null);
     const loadMoreSentinelRef = useRef(null);
-    // #4269: gates the infinite-scroll observer so a "ghost" loadMore can't fire on
-    // mount (sentinel visible when the first page doesn't fill the viewport), which
-    // grew the window past PAGE_SIZE and permanently paused auto-refresh.
     const hasScrolledRef = useRef(false);
     const [providerNodes, setProviderNodes] = useState([]);
-    // #4054: fail-open. The auto-refresh pause is event-driven — we start assuming
-    // the tab is visible (poll) and only flip to paused on a real `visibilitychange`
-    // → hidden transition. Seeding from a static `document.visibilityState` read froze
-    // polling forever in embedded/proxied hosts that report a permanent non-"visible"
-    // state without ever dispatching the event (Docker dashboard wrappers, webviews).
     const visibleRef = useRef(true);
 
-    // Column visibility with localStorage persistence
     const [visibleColumns, setVisibleColumns] = useState(() => {
       const defaultVisible = Object.fromEntries(columns.map((c) => [c.key, true]));
       if (globalThis.window === undefined) return defaultVisible;
@@ -543,6 +535,10 @@ const RequestLoggerV2 = forwardRef<RequestLoggerV2Handle, { initialSelectedId?:
         return;
       }
 
+      const requestToken = `${logEntry.id}:${Date.now()}:${Math.random()}`;
+      detailRequestRef.current = requestToken;
+      const isCurrentDetailRequest = () => detailRequestRef.current === requestToken;
+
       setSelectedLog(logEntry);
       try {
         const url = new URL(globalThis.location.href);
@@ -557,6 +553,7 @@ const RequestLoggerV2 = forwardRef<RequestLoggerV2Handle, { initialSelectedId?:
         const res = await fetch(`/api/logs/${logEntry.id}`, { cache: "no-store" });
         if (res.ok) {
           const data = await res.json();
+          if (!isCurrentDetailRequest()) return;
           const dataHasPipeline =
             data?.pipelinePayloads && Object.keys(data.pipelinePayloads || {}).length > 0;
           setDetailData((prev: { pipelinePayloads: any }) => ({
@@ -576,6 +573,7 @@ const RequestLoggerV2 = forwardRef<RequestLoggerV2Handle, { initialSelectedId?:
           // A deep-linked id can legitimately 404 while the request is still
           // finalizing. Keep the modal open and poll /api/logs/[id] instead of
           // falling back to an in-memory active-request endpoint.
+          if (!isCurrentDetailRequest()) return;
           if (res.status === 404) {
             if (logEntry.pendingLookup || logEntry.active) {
               setSelectedLog((prev: { method: any; path: any }) => ({
@@ -599,17 +597,19 @@ const RequestLoggerV2 = forwardRef<RequestLoggerV2Handle, { initialSelectedId?:
           // other errors: show a minimal error indicator by setting detailData to an error object
           try {
             const body = await res.text().catch(() => null);
+            if (!isCurrentDetailRequest()) return;
             setDetailData({ error: `Failed to fetch log (status ${res.status})`, body });
           } catch {}
         }
       } catch (error) {
         console.error("Failed to fetch log detail:", error);
       } finally {
-        setDetailLoading(false);
+        if (isCurrentDetailRequest()) setDetailLoading(false);
       }
     };
 
     const closeDetail = () => {
+      detailRequestRef.current = "";
       setSelectedLog(null);
       setDetailData(null);
       try {
diff --git a/src/shared/components/Sidebar.search.test.tsx b/src/shared/components/Sidebar.search.test.tsx
new file mode 100644
index 0000000000..281330078f
--- /dev/null
+++ b/src/shared/components/Sidebar.search.test.tsx
@@ -0,0 +1,113 @@
+// @vitest-environment jsdom
+import React from "react";
+import { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+// Skip CloudSyncStatus entirely (it polls /api/sync/cloud + uses next/navigation's
+// useRouter, which we don't otherwise need to mock for this component).
+process.env.NEXT_PUBLIC_OMNIROUTE_E2E_MODE = "1";
+
+vi.mock("next-intl", () => ({
+  useTranslations: () => {
+    const translate = (key: string) => key;
+    translate.has = () => false;
+    return translate;
+  },
+}));
+
+vi.mock("next/navigation", () => ({
+  usePathname: () => "/dashboard/combos",
+}));
+
+const cleanupCallbacks: Array<() => void> = [];
+
+function makeContainer(): HTMLElement {
+  const container = document.createElement("div");
+  document.body.appendChild(container);
+  cleanupCallbacks.push(() => container.remove());
+  return container;
+}
+
+function jsonResponse(body: unknown) {
+  return { ok: true, status: 200, json: async () => body } as Response;
+}
+
+describe("Sidebar search/filter (#4013)", () => {
+  let root: Root | undefined;
+
+  beforeEach(() => {
+    (
+      globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }
+    ).IS_REACT_ACT_ENVIRONMENT = true;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async (url: string) => {
+        if (String(url).includes("/api/settings")) return jsonResponse({});
+        return jsonResponse({});
+      })
+    );
+  });
+
+  afterEach(() => {
+    if (root) {
+      act(() => root!.unmount());
+      root = undefined;
+    }
+    while (cleanupCallbacks.length > 0) cleanupCallbacks.pop()?.();
+    document.body.innerHTML = "";
+    vi.unstubAllGlobals();
+    vi.resetModules();
+  });
+
+  it("renders a search input at the top of the expanded sidebar", async () => {
+    // First import in this file pays the one-time cost of compiling Sidebar's
+    // large transitive dependency graph (sidebarVisibility sections, icons, etc).
+    const { default: Sidebar } = await import("@/shared/components/Sidebar");
+    const container = makeContainer();
+    root = createRoot(container);
+    await act(async () => {
+      root!.render(<Sidebar />);
+    });
+
+    const input = container.querySelector('input[type="search"]');
+    expect(input).toBeTruthy();
+  }, 20000);
+
+  it("filters visible nav items down to those matching the typed query", async () => {
+    const { default: Sidebar } = await import("@/shared/components/Sidebar");
+    const container = makeContainer();
+    root = createRoot(container);
+    await act(async () => {
+      root!.render(<Sidebar />);
+    });
+
+    const linksBefore = container.querySelectorAll("nav a");
+    expect(linksBefore.length).toBeGreaterThan(1);
+
+    const input = container.querySelector('input[type="search"]') as HTMLInputElement;
+    expect(input).toBeTruthy();
+
+    const nativeSetter = Object.getOwnPropertyDescriptor(
+      HTMLInputElement.prototype,
+      "value"
+    )!.set!;
+
+    await act(async () => {
+      nativeSetter.call(input, "zzz-no-such-nav-item-zzz");
+      input.dispatchEvent(new Event("input", { bubbles: true }));
+    });
+
+    const linksAfterNoMatch = container.querySelectorAll("nav a");
+    expect(linksAfterNoMatch.length).toBe(0);
+    expect(container.querySelector("nav")?.textContent).toBeTruthy();
+
+    await act(async () => {
+      nativeSetter.call(input, "");
+      input.dispatchEvent(new Event("input", { bubbles: true }));
+    });
+
+    const linksAfterClear = container.querySelectorAll("nav a");
+    expect(linksAfterClear.length).toBe(linksBefore.length);
+  });
+});
diff --git a/src/shared/components/Sidebar.tsx b/src/shared/components/Sidebar.tsx
index b72636b79c..ead99f0224 100644
--- a/src/shared/components/Sidebar.tsx
+++ b/src/shared/components/Sidebar.tsx
@@ -5,9 +5,11 @@ import Link from "next/link";
 import { usePathname } from "next/navigation";
 import { cn } from "@/shared/utils/cn";
 import { getActiveSidebarHref } from "@/shared/utils/sidebarRouteMatch";
+import { filterSidebarSectionsByQuery } from "@/shared/utils/sidebarSearch";
 import { APP_CONFIG } from "@/shared/constants/appConfig";
 import OmniRouteLogo from "./OmniRouteLogo";
 import Button from "./Button";
+import Input from "./Input";
 import { ConfirmModal } from "./Modal";
 import CloudSyncStatus from "./CloudSyncStatus";
 import { useTranslations } from "next-intl";
@@ -101,6 +103,7 @@ export default function Sidebar({
   );
   const [pinnedSections, setPinnedSections] = useState<Set<SidebarSectionId>>(new Set());
   const [hoveredItem, setHoveredItem] = useState<HoveredItem>(null);
+  const [searchQuery, setSearchQuery] = useState("");
 
   // Load persisted state on mount; OmniProxy is pinned by default on first visit
   useEffect(() => {
@@ -266,6 +269,11 @@ export default function Sidebar({
 
   const activeHref = getActiveSidebarHref(pathname, allVisibleItems);
 
+  const isSearching = searchQuery.trim().length > 0;
+  const displaySections = isSearching
+    ? filterSidebarSectionsByQuery(visibleSections, searchQuery)
+    : visibleSections;
+
   // Auto-expand the section containing the active page (without closing others)
   useEffect(() => {
     if (collapsed) return;
@@ -518,6 +526,21 @@ export default function Sidebar({
           </Link>
         </div>
 
+        {!collapsed && (
+          <div className="px-4 pb-2">
+            <Input
+              type="search"
+              value={searchQuery}
+              onChange={(e) => setSearchQuery(e.target.value)}
+              placeholder={tc("search")}
+              aria-label={tc("search")}
+              icon="search"
+              className="gap-0"
+              inputClassName="py-1.5 text-xs"
+            />
+          </div>
+        )}
+
         <nav
           aria-label="Main navigation"
           className={cn(
@@ -525,9 +548,12 @@ export default function Sidebar({
             collapsed ? "px-2 space-y-0.5" : "px-3"
           )}
         >
-          {visibleSections.map((section, idx) => {
+          {isSearching && displaySections.length === 0 && (
+            <p className="px-2 py-3 text-xs text-text-muted/60">{tc("noResults")}</p>
+          )}
+          {displaySections.map((section, idx) => {
             const sectionId = section.id as SidebarSectionId;
-            const isExpanded = expandedSections.has(sectionId);
+            const isExpanded = isSearching || expandedSections.has(sectionId);
             const isPinned = pinnedSections.has(sectionId);
             const isFirst = idx === 0;
             const sectionItems = section.children.flatMap((child: any) =>
diff --git a/src/shared/components/UsageAnalytics.tsx b/src/shared/components/UsageAnalytics.tsx
index c9282d03cc..02c5a62b26 100644
--- a/src/shared/components/UsageAnalytics.tsx
+++ b/src/shared/components/UsageAnalytics.tsx
@@ -23,6 +23,7 @@ import {
   ServiceTierBreakdown,
   ApiKeyFilterDropdown,
   CustomRangePicker,
+  RequestCountByProviderDateTable,
 } from "./analytics";
 
 // ============================================================================
@@ -404,6 +405,9 @@ export default function UsageAnalytics() {
       {/* Provider Breakdown Table */}
       <ProviderTable byProvider={analytics?.byProvider} />
 
+      {/* Request Count by Provider & Date — #4009 (some providers bill per-request) */}
+      <RequestCountByProviderDateTable range={range} />
+
       {/* API Key Table */}
       <ApiKeyTable byApiKey={analytics?.byApiKey} />
 
diff --git a/src/shared/components/analytics/RequestCountByProviderDateTable.tsx b/src/shared/components/analytics/RequestCountByProviderDateTable.tsx
new file mode 100644
index 0000000000..e63eaa552c
--- /dev/null
+++ b/src/shared/components/analytics/RequestCountByProviderDateTable.tsx
@@ -0,0 +1,80 @@
+"use client";
+
+/**
+ * RequestCountByProviderDateTable — #4009
+ *
+ * Some providers bill by request rather than by token, so operators need a
+ * plain per-provider, per-date request count (not just token aggregates).
+ * Self-contained: fetches its own data (via useProviderDailyUsage) from a
+ * dedicated endpoint so the main analytics route (frozen at the file-size
+ * baseline) stays untouched. Header + table markup are split into
+ * RequestCountDateFilter / RequestCountTable to keep this container under
+ * the max-lines-per-function complexity gate.
+ */
+
+import { useCallback, useMemo, useState } from "react";
+import { useTranslations } from "next-intl";
+import Card from "../Card";
+import RequestCountDateFilter from "./RequestCountDateFilter";
+import RequestCountTable, { type RequestCountSortField } from "./RequestCountTable";
+import { useProviderDailyUsage } from "./useProviderDailyUsage";
+import { sortProviderDailyUsageRows } from "./requestCountSort";
+
+export default function RequestCountByProviderDateTable({ range }: { range: string }) {
+  const t = useTranslations("analytics");
+  const tCommon = useTranslations("common");
+  const [dateFilter, setDateFilter] = useState("");
+  const [sortBy, setSortBy] = useState<RequestCountSortField>("date");
+  const [sortOrder, setSortOrder] = useState<"asc" | "desc">("desc");
+
+  const { rows, loading, error } = useProviderDailyUsage(range, dateFilter);
+
+  const toggleSort = useCallback(
+    (field: RequestCountSortField) => {
+      if (sortBy === field) {
+        setSortOrder((prev) => (prev === "asc" ? "desc" : "asc"));
+      } else {
+        setSortBy(field);
+        setSortOrder("desc");
+      }
+    },
+    [sortBy]
+  );
+
+  const sorted = useMemo(
+    () => sortProviderDailyUsageRows(rows, sortBy, sortOrder),
+    [rows, sortBy, sortOrder]
+  );
+
+  return (
+    <Card className="overflow-hidden">
+      <RequestCountDateFilter
+        title={t("chartRequestsByProviderDate")}
+        dateLabel={t("chartDate")}
+        value={dateFilter}
+        onChange={setDateFilter}
+      />
+
+      {loading && rows.length === 0 ? (
+        <div className="text-center text-text-muted text-sm py-8">{tCommon("loading")}</div>
+      ) : error ? (
+        <div className="text-center text-red-500 text-sm py-8">
+          {tCommon("errorShort")}: {error}
+        </div>
+      ) : sorted.length === 0 ? (
+        <div className="text-center text-text-muted text-sm py-8">{t("chartNoData")}</div>
+      ) : (
+        <RequestCountTable
+          rows={sorted}
+          sortBy={sortBy}
+          sortOrder={sortOrder}
+          onToggleSort={toggleSort}
+          dateLabel={t("chartDate")}
+          providerLabel={t("chartProvider")}
+          requestsLabel={t("chartRequests")}
+          totalLabel={t("chartTotal")}
+        />
+      )}
+    </Card>
+  );
+}
diff --git a/src/shared/components/analytics/RequestCountDateFilter.tsx b/src/shared/components/analytics/RequestCountDateFilter.tsx
new file mode 100644
index 0000000000..908b4af1ba
--- /dev/null
+++ b/src/shared/components/analytics/RequestCountDateFilter.tsx
@@ -0,0 +1,41 @@
+"use client";
+
+/**
+ * RequestCountDateFilter — title + single-date filter row for #4009's
+ * request-count-by-provider-date table. Split out to keep the container
+ * component under the max-lines-per-function complexity gate.
+ */
+
+interface RequestCountDateFilterProps {
+  title: string;
+  dateLabel: string;
+  value: string;
+  onChange: (value: string) => void;
+}
+
+export default function RequestCountDateFilter({
+  title,
+  dateLabel,
+  value,
+  onChange,
+}: RequestCountDateFilterProps) {
+  return (
+    <div className="p-4 border-b border-border flex items-center justify-between flex-wrap gap-2">
+      <h3 className="text-sm font-semibold text-text-muted uppercase tracking-wider">{title}</h3>
+      <div className="flex items-center gap-2">
+        <input
+          type="date"
+          value={value}
+          onChange={(e) => onChange(e.target.value)}
+          aria-label={dateLabel}
+          className="px-2 py-1 rounded-md text-xs bg-black/[0.03] dark:bg-white/[0.03] border border-black/5 dark:border-white/5"
+        />
+        {value && (
+          <button onClick={() => onChange("")} className="text-xs text-text-muted hover:text-text-main">
+            <span className="material-symbols-outlined text-[14px]">close</span>
+          </button>
+        )}
+      </div>
+    </div>
+  );
+}
diff --git a/src/shared/components/analytics/RequestCountTable.tsx b/src/shared/components/analytics/RequestCountTable.tsx
new file mode 100644
index 0000000000..71419a7d75
--- /dev/null
+++ b/src/shared/components/analytics/RequestCountTable.tsx
@@ -0,0 +1,104 @@
+"use client";
+
+/**
+ * RequestCountTable — pure presentational table for #4009.
+ * Split out of RequestCountByProviderDateTable to keep that container under
+ * the max-lines-per-function complexity gate.
+ */
+
+import { PROVIDER_COLORS } from "./chartColors";
+import { fmtCompact as fmt, fmtFull } from "@/shared/utils/formatting";
+import { SortIndicator } from "./charts";
+
+export interface ProviderDailyUsageRow {
+  date: string;
+  provider: string;
+  requests: number;
+  promptTokens: number;
+  completionTokens: number;
+  totalTokens: number;
+}
+
+export type RequestCountSortField = "date" | "provider" | "requests" | "totalTokens";
+
+interface RequestCountTableProps {
+  rows: ProviderDailyUsageRow[];
+  sortBy: RequestCountSortField;
+  sortOrder: "asc" | "desc";
+  onToggleSort: (field: RequestCountSortField) => void;
+  dateLabel: string;
+  providerLabel: string;
+  requestsLabel: string;
+  totalLabel: string;
+}
+
+export default function RequestCountTable({
+  rows,
+  sortBy,
+  sortOrder,
+  onToggleSort,
+  dateLabel,
+  providerLabel,
+  requestsLabel,
+  totalLabel,
+}: RequestCountTableProps) {
+  return (
+    <div className="overflow-x-auto">
+      <table className="w-full text-sm">
+        <thead className="text-xs text-text-muted uppercase bg-black/[0.02] dark:bg-white/[0.02]">
+          <tr>
+            <th
+              className="px-4 py-2.5 text-left cursor-pointer group"
+              onClick={() => onToggleSort("date")}
+            >
+              {dateLabel} <SortIndicator active={sortBy === "date"} sortOrder={sortOrder} />
+            </th>
+            <th
+              className="px-4 py-2.5 text-left cursor-pointer group"
+              onClick={() => onToggleSort("provider")}
+            >
+              {providerLabel} <SortIndicator active={sortBy === "provider"} sortOrder={sortOrder} />
+            </th>
+            <th
+              className="px-4 py-2.5 text-right cursor-pointer group"
+              onClick={() => onToggleSort("requests")}
+            >
+              {requestsLabel} <SortIndicator active={sortBy === "requests"} sortOrder={sortOrder} />
+            </th>
+            <th
+              className="px-4 py-2.5 text-right cursor-pointer group"
+              onClick={() => onToggleSort("totalTokens")}
+            >
+              {totalLabel} <SortIndicator active={sortBy === "totalTokens"} sortOrder={sortOrder} />
+            </th>
+          </tr>
+        </thead>
+        <tbody className="divide-y divide-border">
+          {rows.map((row, i) => (
+            <tr
+              key={`${row.date}::${row.provider}`}
+              className="hover:bg-black/[0.02] dark:hover:bg-white/[0.02] transition-colors"
+            >
+              <td className="px-4 py-2.5 font-mono text-text-muted">{row.date}</td>
+              <td className="px-4 py-2.5">
+                <div className="flex items-center gap-2">
+                  <span
+                    className="w-2 h-2 rounded-full shrink-0"
+                    style={{ backgroundColor: PROVIDER_COLORS[i % PROVIDER_COLORS.length] }}
+                  />
+                  <span className="font-medium capitalize">{row.provider}</span>
+                </div>
+              </td>
+              <td className="px-4 py-2.5 text-right font-mono font-semibold">
+                {fmtFull(row.requests)}
+              </td>
+              <td className="px-4 py-2.5 text-right font-mono text-text-muted">
+                {fmt(row.totalTokens)}
+              </td>
+            </tr>
+          ))}
+        </tbody>
+      </table>
+    </div>
+  );
+}
diff --git a/src/shared/components/analytics/index.tsx b/src/shared/components/analytics/index.tsx
index 41e82ca084..a9eb9d34ee 100644
--- a/src/shared/components/analytics/index.tsx
+++ b/src/shared/components/analytics/index.tsx
@@ -26,3 +26,4 @@ export { DailyTrendChart, ModelOverTimeChart } from "./rechartsUsageCharts";
 
 export { default as ApiKeyFilterDropdown } from "./ApiKeyFilterDropdown";
 export { default as CustomRangePicker } from "./CustomRangePicker";
+export { default as RequestCountByProviderDateTable } from "./RequestCountByProviderDateTable";
diff --git a/src/shared/components/analytics/requestCountSort.ts b/src/shared/components/analytics/requestCountSort.ts
new file mode 100644
index 0000000000..fa83588f9d
--- /dev/null
+++ b/src/shared/components/analytics/requestCountSort.ts
@@ -0,0 +1,24 @@
+/**
+ * requestCountSort — pure sort helper for #4009's request-count-by-provider-date table.
+ * Split out of RequestCountByProviderDateTable to keep that container under the
+ * max-lines-per-function complexity gate.
+ */
+
+import type { ProviderDailyUsageRow, RequestCountSortField } from "./RequestCountTable";
+
+export function sortProviderDailyUsageRows(
+  rows: ProviderDailyUsageRow[],
+  sortBy: RequestCountSortField,
+  sortOrder: "asc" | "desc"
+): ProviderDailyUsageRow[] {
+  const arr = [...rows];
+  arr.sort((a, b) => {
+    const va = a[sortBy];
+    const vb = b[sortBy];
+    if (typeof va === "string" && typeof vb === "string") {
+      return sortOrder === "asc" ? va.localeCompare(vb) : vb.localeCompare(va);
+    }
+    return sortOrder === "asc" ? Number(va) - Number(vb) : Number(vb) - Number(va);
+  });
+  return arr;
+}
diff --git a/src/shared/components/analytics/useProviderDailyUsage.ts b/src/shared/components/analytics/useProviderDailyUsage.ts
new file mode 100644
index 0000000000..da2a5265f3
--- /dev/null
+++ b/src/shared/components/analytics/useProviderDailyUsage.ts
@@ -0,0 +1,46 @@
+"use client";
+
+/**
+ * useProviderDailyUsage — data hook for #4009's request-count-by-provider-date table.
+ * Split out of RequestCountByProviderDateTable to keep that container under the
+ * max-lines-per-function complexity gate.
+ */
+
+import { useCallback, useEffect, useState } from "react";
+import { useTranslations } from "next-intl";
+import { readFetchErrorMessage } from "@/shared/utils/fetchError";
+import type { ProviderDailyUsageRow } from "./RequestCountTable";
+
+export function useProviderDailyUsage(range: string, dateFilter: string) {
+  const tCommon = useTranslations("common");
+  const [rows, setRows] = useState<ProviderDailyUsageRow[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+
+  const fetchRows = useCallback(async () => {
+    try {
+      setLoading(true);
+      const params = new URLSearchParams();
+      if (dateFilter) {
+        params.set("date", dateFilter);
+      } else {
+        params.set("range", range);
+      }
+      const res = await fetch(`/api/usage/requests-by-provider-date?${params.toString()}`);
+      if (!res.ok) throw new Error(await readFetchErrorMessage(res, tCommon("error")));
+      const data = await res.json();
+      setRows(Array.isArray(data.rows) ? data.rows : []);
+      setError(null);
+    } catch (err) {
+      setError((err as Error).message);
+    } finally {
+      setLoading(false);
+    }
+  }, [range, dateFilter, tCommon]);
+
+  useEffect(() => {
+    fetchRows();
+  }, [fetchRows]);
+
+  return { rows, loading, error };
+}
diff --git a/src/shared/components/index.tsx b/src/shared/components/index.tsx
index a7ffdf4f36..774165b1ce 100644
--- a/src/shared/components/index.tsx
+++ b/src/shared/components/index.tsx
@@ -6,7 +6,7 @@ export { default as Checkbox } from "./Checkbox";
 export { default as Textarea } from "./Textarea";
 export { default as Card } from "./Card";
 export { default as Collapsible } from "./Collapsible";
-export { default as Modal, ConfirmModal } from "./Modal";
+export { default as Modal, ConfirmModal, TALL_MODAL_PROPS } from "./Modal";
 export { default as Loading, Spinner, PageLoading, Skeleton, CardSkeleton } from "./Loading";
 export { default as Avatar } from "./Avatar";
 export { default as Badge } from "./Badge";
diff --git a/src/shared/components/lobeProviderIcons.ts b/src/shared/components/lobeProviderIcons.ts
index d709e2a5c4..1da9c26e5b 100644
--- a/src/shared/components/lobeProviderIcons.ts
+++ b/src/shared/components/lobeProviderIcons.ts
@@ -320,6 +320,7 @@ const LOBE_PROVIDER_ALIASES = {
   azure: "Azure",
   "azure-ai": "AzureAI",
   "azure-openai": "AzureAI",
+  bai: "Baichuan",
   baidu: "Baidu",
   "bailian-coding-plan": "Bailian",
   baseten: "Baseten",
@@ -331,6 +332,7 @@ const LOBE_PROVIDER_ALIASES = {
   claude: "ClaudeCode",
   "claude-web": "Claude",
   cline: "Cline",
+  clinepass: "Cline",
   cloudflare: "Cloudflare",
   "cloudflare-ai": "WorkersAI",
   codestral: "Mistral",
@@ -339,6 +341,7 @@ const LOBE_PROVIDER_ALIASES = {
   cohere: "Cohere",
   comfyui: "ComfyUI",
   copilot: "GithubCopilot",
+  "copilot-m365-web": "Copilot",
   "copilot-web": "Copilot",
   coze: "Coze",
   cursor: "Cursor",
diff --git a/src/shared/constants/cliTools.ts b/src/shared/constants/cliTools.ts
index 70245a675b..178e6ae156 100644
--- a/src/shared/constants/cliTools.ts
+++ b/src/shared/constants/cliTools.ts
@@ -796,6 +796,59 @@ OPENAI_API_KEY: "{{apiKey}}"`,
     },
   },
 
+  omp: {
+    id: "omp",
+    name: "Oh My Pi",
+    image: "/providers/omp.png",
+    color: "#111111",
+    docsUrl: "https://github.com/can1357/oh-my-pi",
+    description: "Oh My Pi terminal coding agent via OmniRoute",
+    configType: "custom",
+    category: "agent",
+    vendor: "OSS",
+    acpSpawnable: true,
+    baseUrlSupport: "full",
+    defaultCommand: "omp",
+    notes: [
+      {
+        type: "info",
+        text: "Oh My Pi reads custom OpenAI-compatible providers from ~/.omp/agent/models.yml. OmniRoute adds itself as a provider with auto-discovery — models appear automatically in omp's /model menu.",
+      },
+      {
+        type: "warning",
+        text: "Config path: Linux/macOS ~/.omp/agent/models.yml • Windows %USERPROFILE%\\.omp\\.omp\\agent\\models.yml",
+      },
+    ],
+  },
+
+  letta: {
+    id: "letta",
+    name: "Letta CLI",
+    image: "/providers/letta.png",
+    color: "#FF6B35",
+    description: "Letta CLI — AI agent with persistent memory and tool use",
+    configType: "custom",
+    category: "agent",
+    vendor: "Letta",
+    acpSpawnable: false,
+    baseUrlSupport: "full",
+    docsUrl: "https://docs.letta.com",
+    notes: [
+      {
+        type: "info",
+        text: "Letta CLI uses pi-ai which sends OpenAI-compatible requests. OmniRoute configures it as an OpenAI provider with custom base URL.",
+      },
+      {
+        type: "info",
+        text: "CLI (Local Mode): OmniRoute auto-configures ~/.letta/lc-local-backend/providers/auth.json. Use 'letta --info' to check if local mode is enabled.",
+      },
+      {
+        type: "warning",
+        text: "Local mode config path: ~/.letta/lc-local-backend/providers/auth.json (CLI only)",
+      },
+    ],
+  },
+
   /** ★ Added by plan 14 (CLI Pages Redesign) — 2026-05-27 */
   warp: {
     id: "warp",
diff --git a/src/shared/constants/clientIdentityProfiles.ts b/src/shared/constants/clientIdentityProfiles.ts
index 3b3ef31e5a..3788bd507b 100644
--- a/src/shared/constants/clientIdentityProfiles.ts
+++ b/src/shared/constants/clientIdentityProfiles.ts
@@ -30,7 +30,7 @@ const CLAUDE_CLI_PROFILE: ClientIdentityProfile = Object.freeze({
   id: "claude-cli",
   label: "Claude CLI",
   headers: Object.freeze({
-    "User-Agent": "claude-cli/2.1.195 (external, cli)",
+    "User-Agent": "claude-cli/2.1.207 (external, cli)",
     "X-App": "cli",
   }),
 });
@@ -39,7 +39,7 @@ const CODEX_CLI_PROFILE: ClientIdentityProfile = Object.freeze({
   id: "codex-cli",
   label: "Codex CLI",
   headers: Object.freeze({
-    "User-Agent": "codex_cli_rs/0.136.0",
+    "User-Agent": "codex_cli_rs/0.144.1",
     originator: "codex_cli_rs",
   }),
 });
@@ -61,9 +61,7 @@ export const CLIENT_IDENTITY_PROFILES: Readonly<Record<string, ClientIdentityPro
     "gemini-cli": GEMINI_CLI_PROFILE,
   });
 
-export const CLIENT_IDENTITY_PROFILE_IDS: readonly string[] = Object.keys(
-  CLIENT_IDENTITY_PROFILES
-);
+export const CLIENT_IDENTITY_PROFILE_IDS: readonly string[] = Object.keys(CLIENT_IDENTITY_PROFILES);
 
 export const CLIENT_IDENTITY_PROFILE_OPTIONS: ReadonlyArray<{ value: string; label: string }> =
   CLIENT_IDENTITY_PROFILE_IDS.map((id) => ({
@@ -72,7 +70,10 @@ export const CLIENT_IDENTITY_PROFILE_OPTIONS: ReadonlyArray<{ value: string; lab
   }));
 
 export function isClientIdentityProfileId(value: unknown): value is string {
-  return typeof value === "string" && Object.prototype.hasOwnProperty.call(CLIENT_IDENTITY_PROFILES, value);
+  return (
+    typeof value === "string" &&
+    Object.prototype.hasOwnProperty.call(CLIENT_IDENTITY_PROFILES, value)
+  );
 }
 
 /**
diff --git a/src/shared/constants/featureFlagDefinitions.ts b/src/shared/constants/featureFlagDefinitions.ts
index b42c26506a..166338f321 100644
--- a/src/shared/constants/featureFlagDefinitions.ts
+++ b/src/shared/constants/featureFlagDefinitions.ts
@@ -306,7 +306,7 @@ export const FEATURE_FLAG_DEFINITIONS: FeatureFlagDefinition[] = [
     key: "OMNIROUTE_ENABLE_LIVE_WS",
     label: "Live Dashboard WebSocket",
     description:
-      "Start the real-time dashboard WebSocket server on import (port 20129, loopback-bound by default). Default: enabled. Set to '0' or 'false' to disable. LAN exposure requires LIVE_WS_HOST=0.0.0.0 + LIVE_WS_ALLOWED_ORIGINS.",
+      "Start the real-time dashboard WebSocket server on import (port 20132, loopback-bound by default). Default: enabled. Set to '0' or 'false' to disable. LAN exposure requires LIVE_WS_HOST=0.0.0.0 + LIVE_WS_ALLOWED_ORIGINS.",
     descriptionI18nKey: "featureFlagOmnirouteEnableLiveWsDescription",
     category: "runtime",
     defaultValue: "true",
diff --git a/src/shared/constants/modelSpecs.ts b/src/shared/constants/modelSpecs.ts
index b724487326..e70783b4ef 100644
--- a/src/shared/constants/modelSpecs.ts
+++ b/src/shared/constants/modelSpecs.ts
@@ -65,7 +65,32 @@ const AUTHORITATIVE_PROVIDER_CONTEXT_WINDOWS = new Map<string, number>([
   ["zenmux/z-ai/glm-5.2-free", 1000000],
 ]);
 
+const GPT_5_6_MODEL_SPEC = {
+  maxOutputTokens: 128000,
+  contextWindow: 1050000,
+  supportsThinking: true,
+  supportsTools: true,
+  supportsVision: true,
+} satisfies ModelSpec;
+
 export const MODEL_SPECS: Record<string, ModelSpec> = {
+  "gpt-5.6": {
+    ...GPT_5_6_MODEL_SPEC,
+    aliases: ["openai/gpt-5.6"],
+  },
+  "gpt-5.6-sol": {
+    ...GPT_5_6_MODEL_SPEC,
+    aliases: ["openai/gpt-5.6-sol"],
+  },
+  "gpt-5.6-terra": {
+    ...GPT_5_6_MODEL_SPEC,
+    aliases: ["openai/gpt-5.6-terra"],
+  },
+  "gpt-5.6-luna": {
+    ...GPT_5_6_MODEL_SPEC,
+    aliases: ["openai/gpt-5.6-luna"],
+  },
+
   "gpt-5.5": {
     maxOutputTokens: 128000,
     contextWindow: 1050000,
diff --git a/src/shared/constants/pricing/frontier-labs.ts b/src/shared/constants/pricing/frontier-labs.ts
index 3c6d4819d3..0c7117cb57 100644
--- a/src/shared/constants/pricing/frontier-labs.ts
+++ b/src/shared/constants/pricing/frontier-labs.ts
@@ -4,6 +4,9 @@
  */
 import {
   GPT_5_5_PRICING,
+  GPT_5_6_LUNA_PRICING,
+  GPT_5_6_SOL_PRICING,
+  GPT_5_6_TERRA_PRICING,
   CLAUDE_FABLE_5_PRICING,
   CLAUDE_OPUS_4_PRICING,
   CLAUDE_SONNET_4_PRICING,
@@ -14,13 +17,16 @@ import {
 
 export const DEFAULT_PRICING_FRONTIER = {
   openai: {
+    "gpt-5.6": GPT_5_6_SOL_PRICING,
+    "gpt-5.6-sol": GPT_5_6_SOL_PRICING,
+    "gpt-5.6-terra": GPT_5_6_TERRA_PRICING,
+    "gpt-5.6-luna": GPT_5_6_LUNA_PRICING,
     "gpt-5.5": GPT_5_5_PRICING,
     // The -pro tier mirrors its base family pricing until OpenAI publishes a
     // distinct pro rate; without these rows the openai provider's gpt-5.x-pro
     // models (in the registry) resolved to $0 and tripped the catalog pricing gate.
     "gpt-5.5-pro": GPT_5_5_PRICING,
-    // gpt-5.4 family (public API tier; mirrors the codex 5.4 tier for the
-    // base/mini, with a lower nano tier). Without these rows the openai
+    // gpt-5.4 family (public API tier, with a lower nano tier). Without these rows the openai
     // provider's gpt-5.4* models resolved to $0.
     "gpt-5.4": {
       input: 5.0,
diff --git a/src/shared/constants/pricing/inference-hosts.ts b/src/shared/constants/pricing/inference-hosts.ts
index d076d1d2ac..b3dcf7b39f 100644
--- a/src/shared/constants/pricing/inference-hosts.ts
+++ b/src/shared/constants/pricing/inference-hosts.ts
@@ -15,6 +15,57 @@ export const DEFAULT_PRICING_INFERENCE = {
       cache_creation: 2.0,
     },
   },
+  synthetic: {
+    "hf:openai/gpt-oss-120b": {
+      input: 0.1,
+      output: 0.1,
+      cached: 0.1,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "hf:zai-org/GLM-5.2": {
+      input: 1.4,
+      output: 4.4,
+      cached: 1.4,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "hf:moonshotai/Kimi-K2.7-Code": {
+      input: 0.95,
+      output: 4,
+      cached: 0.95,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "hf:Qwen/Qwen3.6-27B": {
+      input: 0.45,
+      output: 3.6,
+      cached: 0.45,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "hf:MiniMaxAI/MiniMax-M3": {
+      input: 0.6,
+      output: 1.2,
+      cached: 0.6,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "hf:zai-org/GLM-4.7-Flash": {
+      input: 0.1,
+      output: 0.5,
+      cached: 0.1,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+    "hf:nvidia/NVIDIA-Nemotron-3-Super-120B-A12B-NVFP4": {
+      input: 0.3,
+      output: 1,
+      cached: 0.3,
+      reasoning: 0,
+      cache_creation: 0,
+    },
+  },
   groq: {
     "openai/gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
     "gpt-oss-120b": { input: 0, output: 0, cached: 0, reasoning: 0, cache_creation: 0 },
diff --git a/src/shared/constants/pricing/oauth-subscriptions.ts b/src/shared/constants/pricing/oauth-subscriptions.ts
index 04792b5ea1..19c1f2e991 100644
--- a/src/shared/constants/pricing/oauth-subscriptions.ts
+++ b/src/shared/constants/pricing/oauth-subscriptions.ts
@@ -2,7 +2,13 @@
  * Pricing data — oauth-subscriptions family (OAuth / IDE subscription aliases (cc, codex, antigravity, copilot, kiro…)).
  * Pure data; merged by default-pricing.ts via spread (god-file decomposition; semantic split).
  */
-import { GPT_5_3_CODEX_PRICING, GPT_5_5_PRICING } from "./shared-tiers";
+import {
+  GPT_5_3_CODEX_PRICING,
+  GPT_5_5_PRICING,
+  GPT_5_6_LUNA_PRICING,
+  GPT_5_6_SOL_PRICING,
+  GPT_5_6_TERRA_PRICING,
+} from "./shared-tiers";
 
 export const DEFAULT_PRICING_OAUTH = {
   cc: {
@@ -72,6 +78,28 @@ export const DEFAULT_PRICING_OAUTH = {
   },
   cx: {
     "codex-auto-review": GPT_5_5_PRICING,
+    // Codex uses credits per 1M tokens. OmniRoute stores the dollar-equivalent
+    // values below at the documented conversion of 25 credits per USD.
+    "gpt-5.6-sol": GPT_5_6_SOL_PRICING,
+    "gpt-5.6-sol-ultra": GPT_5_6_SOL_PRICING,
+    "gpt-5.6-sol-max": GPT_5_6_SOL_PRICING,
+    "gpt-5.6-sol-xhigh": GPT_5_6_SOL_PRICING,
+    "gpt-5.6-sol-high": GPT_5_6_SOL_PRICING,
+    "gpt-5.6-sol-medium": GPT_5_6_SOL_PRICING,
+    "gpt-5.6-sol-low": GPT_5_6_SOL_PRICING,
+    "gpt-5.6-terra": GPT_5_6_TERRA_PRICING,
+    "gpt-5.6-terra-ultra": GPT_5_6_TERRA_PRICING,
+    "gpt-5.6-terra-max": GPT_5_6_TERRA_PRICING,
+    "gpt-5.6-terra-xhigh": GPT_5_6_TERRA_PRICING,
+    "gpt-5.6-terra-high": GPT_5_6_TERRA_PRICING,
+    "gpt-5.6-terra-medium": GPT_5_6_TERRA_PRICING,
+    "gpt-5.6-terra-low": GPT_5_6_TERRA_PRICING,
+    "gpt-5.6-luna": GPT_5_6_LUNA_PRICING,
+    "gpt-5.6-luna-max": GPT_5_6_LUNA_PRICING,
+    "gpt-5.6-luna-xhigh": GPT_5_6_LUNA_PRICING,
+    "gpt-5.6-luna-high": GPT_5_6_LUNA_PRICING,
+    "gpt-5.6-luna-medium": GPT_5_6_LUNA_PRICING,
+    "gpt-5.6-luna-low": GPT_5_6_LUNA_PRICING,
     // GPT 5.5
     "gpt-5.5": GPT_5_5_PRICING,
     "gpt5.5": GPT_5_5_PRICING,
@@ -80,42 +108,6 @@ export const DEFAULT_PRICING_OAUTH = {
     "gpt-5.5-medium": GPT_5_5_PRICING,
     "gpt-5.5-low": GPT_5_5_PRICING,
     "gpt-5.5-none": GPT_5_5_PRICING,
-    // GPT 5.4
-    "gpt-5.4": {
-      input: 5.0,
-      output: 20.0,
-      cached: 2.5,
-      reasoning: 30.0,
-      cache_creation: 5.0,
-    },
-    "gpt5.4": {
-      input: 5.0,
-      output: 20.0,
-      cached: 2.5,
-      reasoning: 30.0,
-      cache_creation: 5.0,
-    },
-    // T12: fallback pricing for gpt-5.4 mini variants
-    "gpt-5.4-mini": {
-      input: 1.5,
-      output: 6.0,
-      cached: 0.75,
-      reasoning: 9.0,
-      cache_creation: 1.5,
-    },
-    "gpt5.4-mini": {
-      input: 1.5,
-      output: 6.0,
-      cached: 0.75,
-      reasoning: 9.0,
-      cache_creation: 1.5,
-    },
-    // gpt-5.4 reasoning-effort variants share the gpt-5.4 tier (registry exposes
-    // -xhigh/-high/-medium/-low; without these rows they resolved to $0).
-    "gpt-5.4-xhigh": GPT_5_3_CODEX_PRICING,
-    "gpt-5.4-high": GPT_5_3_CODEX_PRICING,
-    "gpt-5.4-medium": GPT_5_3_CODEX_PRICING,
-    "gpt-5.4-low": GPT_5_3_CODEX_PRICING,
     // GPT 5.3 Codex family (all same pricing tier)
     "gpt-5.3-codex-spark": GPT_5_3_CODEX_PRICING,
     "gpt-5.3-codex": GPT_5_3_CODEX_PRICING,
@@ -584,10 +576,8 @@ export const DEFAULT_PRICING_OAUTH = {
       reasoning: 8.0,
       cache_creation: 2.0,
     },
-    // Kiro "Auto" pricing — retained as a fallback price for any legacy "auto"
-    // reference. The "auto-kiro" registry model was removed (Kiro's API has no
-    // "auto" model id — it 400'd "Invalid model"), so its dedicated price key
-    // was dropped with it. See kiro cluster #6112/#6113/#6099.
+    // Kiro "Auto" pricing — retained for both the upstream "auto" id and the
+    // local "auto-kiro" selector. The translator maps auto-kiro back to auto.
     auto: {
       input: 3.0,
       output: 15.0,
@@ -595,5 +585,12 @@ export const DEFAULT_PRICING_OAUTH = {
       reasoning: 15.0,
       cache_creation: 3.0,
     },
+    "auto-kiro": {
+      input: 3.0,
+      output: 15.0,
+      cached: 1.5,
+      reasoning: 15.0,
+      cache_creation: 3.0,
+    },
   },
 };
diff --git a/src/shared/constants/pricing/shared-tiers.ts b/src/shared/constants/pricing/shared-tiers.ts
index 1d6cec77e6..596fe17446 100644
--- a/src/shared/constants/pricing/shared-tiers.ts
+++ b/src/shared/constants/pricing/shared-tiers.ts
@@ -17,6 +17,30 @@ export const GPT_5_5_PRICING = {
   cache_creation: 5.0,
 };
 
+export const GPT_5_6_SOL_PRICING = {
+  input: 5.0,
+  output: 30.0,
+  cached: 0.5,
+  reasoning: 30.0,
+  cache_creation: 6.25,
+};
+
+export const GPT_5_6_TERRA_PRICING = {
+  input: 2.5,
+  output: 15.0,
+  cached: 0.25,
+  reasoning: 15.0,
+  cache_creation: 3.125,
+};
+
+export const GPT_5_6_LUNA_PRICING = {
+  input: 1.0,
+  output: 6.0,
+  cached: 0.1,
+  reasoning: 6.0,
+  cache_creation: 1.25,
+};
+
 export const CLAUDE_FABLE_5_PRICING = {
   input: 15.0,
   output: 75.0,
diff --git a/src/shared/constants/providers.ts b/src/shared/constants/providers.ts
index a246eddff9..9135bf4b04 100644
--- a/src/shared/constants/providers.ts
+++ b/src/shared/constants/providers.ts
@@ -71,8 +71,6 @@ export const AGGREGATOR_PROVIDER_IDS = new Set([
   "laozhang",
   "vercel-ai-gateway",
   "agentrouter",
-  "glhf",
-  "cablyai",
   "thebai",
   "fenayai",
   "empower",
diff --git a/src/shared/constants/providers/apikey/gateways.ts b/src/shared/constants/providers/apikey/gateways.ts
index 3d6de0cb9b..59d1b10fde 100644
--- a/src/shared/constants/providers/apikey/gateways.ts
+++ b/src/shared/constants/providers/apikey/gateways.ts
@@ -14,8 +14,7 @@ export const APIKEY_PROVIDERS_GATEWAYS = {
     website: "https://hyper.charm.land",
     hasFree: true,
     freeNote: "100 free monthly Hypercredits on signup",
-    apiHint:
-      "Create an API key at https://hyper.charm.land, then paste it here as a Bearer token.",
+    apiHint: "Create an API key at https://hyper.charm.land, then paste it here as a Bearer token.",
   },
   agentrouter: {
     id: "agentrouter",
@@ -42,20 +41,6 @@ export const APIKEY_PROVIDERS_GATEWAYS = {
       "Use a Command Code API key. Requests are sent to Command Code's /alpha/generate endpoint.",
     apiHint: "Create or copy an API key from Command Code, then paste it here as a Bearer token.",
   },
-  clinepass: {
-    id: "clinepass",
-    alias: "clinepass",
-    name: "ClinePass",
-    icon: "vpn_key",
-    color: "#5B9BD5",
-    textIcon: "CP",
-    passthroughModels: true,
-    website: "https://cline.bot",
-    notice: {
-      text: "ClinePass is Cline's paid BYOK gateway ($9.99/mo). Bring your own Cline API key; requests hit api.cline.bot with the cline-pass/* model namespace.",
-      apiKeyUrl: "https://app.cline.bot/settings/api-keys",
-    },
-  },
   openrouter: {
     id: "openrouter",
     alias: "openrouter",
@@ -275,23 +260,6 @@ export const APIKEY_PROVIDERS_GATEWAYS = {
     apiHint:
       "Works without API key (use 'unused' as key). Get free token at token.llm7.io for higher limits.",
   },
-  kluster: {
-    id: "kluster",
-    alias: "kluster",
-    name: "Kluster AI",
-    icon: "hub",
-    color: "#8B5CF6",
-    textIcon: "KL",
-    website: "https://kluster.ai",
-    hasFree: false,
-    freeNote: "Discontinued 2026 — kluster.ai sunset (2026-06-09); no free tier.",
-    apiHint: "Get API key at https://kluster.ai/dashboard/api-keys",
-    subscriptionRisk: true,
-    riskNoticeVariant: "deprecated",
-    deprecated: true,
-    deprecationReason:
-      "kluster.ai shut down (2026-06-09); api.kluster.ai no longer resolves (sweep 2026-06-19). Use another OpenAI-compatible provider.",
-  },
   llamagate: {
     id: "llamagate",
     alias: "llamagate",
@@ -391,40 +359,6 @@ export const APIKEY_PROVIDERS_GATEWAYS = {
     website: "https://api.laozhang.ai",
     passthroughModels: true,
   },
-  glhf: {
-    id: "glhf",
-    alias: "glhf",
-    name: "GLHF Chat",
-    icon: "hub",
-    color: "#10B981",
-    textIcon: "GH",
-    website: "https://glhf.chat",
-    authHint: "Bearer API key for the GLHF OpenAI-compatible gateway.",
-    hasFree: false,
-    freeNote: "Discontinued 2026 — glhf.chat free beta ended; no free tier.",
-    passthroughModels: true,
-    subscriptionRisk: true,
-    riskNoticeVariant: "deprecated",
-    deprecated: true,
-    deprecationReason:
-      "glhf.chat shut down (2026); its api.laf.run gateway no longer serves the catalog (sweep 2026-06-19).",
-  },
-  cablyai: {
-    id: "cablyai",
-    alias: "cablyai",
-    name: "CablyAI",
-    icon: "hub",
-    color: "#FF4081",
-    textIcon: "CA",
-    website: "https://cablyai.com",
-    authHint: "Bearer API key for the CablyAI OpenAI-compatible gateway.",
-    passthroughModels: true,
-    subscriptionRisk: true,
-    riskNoticeVariant: "deprecated",
-    deprecated: true,
-    deprecationReason:
-      "cablyai.com no longer resolves (DNS NXDOMAIN, verified 2026-06-30) — the domain is gone and every request fails with a DNS error (#5568).",
-  },
   thebai: {
     id: "thebai",
     alias: "thebai",
diff --git a/src/shared/constants/providers/apikey/inference-hosts.ts b/src/shared/constants/providers/apikey/inference-hosts.ts
index 9f0069872b..c51a3285a6 100644
--- a/src/shared/constants/providers/apikey/inference-hosts.ts
+++ b/src/shared/constants/providers/apikey/inference-hosts.ts
@@ -17,6 +17,20 @@ export const APIKEY_PROVIDERS_INFERENCE = {
       apiKeyUrl: "https://api.together.ai/settings/api-keys",
     },
   },
+  // OpenVecta — OpenAI-compatible AI inference gateway (https://openvecta.com/).
+  // Catalog seeded from the live /v1/models list (LLMs + embeddings); free credits
+  // advertised on signup. Bearer-token auth via Authorization: Bearer ov_sk_…
+  openvecta: {
+    id: "openvecta",
+    alias: "openvecta",
+    name: "OpenVecta",
+    icon: "vector_polygon",
+    color: "#7C3AED",
+    textIcon: "OV",
+    website: "https://openvecta.com",
+    hasFree: true,
+    freeNote: "Free credits on signup for OpenAI-compatible inference across LLMs, embeddings, and reasoning models",
+  },
   fireworks: {
     id: "fireworks",
     alias: "fireworks",
diff --git a/src/shared/constants/providers/apikey/regional.ts b/src/shared/constants/providers/apikey/regional.ts
index d91175340d..b6708bd268 100644
--- a/src/shared/constants/providers/apikey/regional.ts
+++ b/src/shared/constants/providers/apikey/regional.ts
@@ -337,24 +337,6 @@ export const APIKEY_PROVIDERS_REGIONAL = {
     passthroughModels: true,
     authHint: "Get API key at console.xfyun.cn",
   },
-  inclusionai: {
-    id: "inclusionai",
-    alias: "inclusion",
-    name: "InclusionAI",
-    icon: "psychology",
-    color: "#10B981",
-    textIcon: "IA",
-    website: "https://inclusionai.com",
-    hasFree: true,
-    freeNote: "Free Ling-2.6-flash model (1T-param MoE, 262K context). No credit card required.",
-    passthroughModels: true,
-    authHint: "Get API key at inclusionai.com",
-    subscriptionRisk: true,
-    riskNoticeVariant: "deprecated",
-    deprecated: true,
-    deprecationReason:
-      "api.inclusionai.tech no longer resolves (sweep 2026-06-19); the inference API appears discontinued.",
-  },
   hcnsec: {
     id: "hcnsec",
     alias: "hcnsec",
diff --git a/src/shared/constants/providers/oauth.ts b/src/shared/constants/providers/oauth.ts
index 14bdac4366..7eda70e794 100644
--- a/src/shared/constants/providers/oauth.ts
+++ b/src/shared/constants/providers/oauth.ts
@@ -191,6 +191,19 @@ export const OAUTH_PROVIDERS = {
     subscriptionRisk: true,
     riskNoticeVariant: "oauth",
   },
+  clinepass: {
+    id: "clinepass",
+    alias: "cp",
+    name: "ClinePass",
+    icon: "smart_toy",
+    color: "#9D4EDD",
+    textIcon: "CP",
+    website: "https://cline.bot/clinepass",
+    subscriptionRisk: true,
+    riskNoticeVariant: "oauth",
+    authHint:
+      "ClinePass is Cline's $9.99/mo subscription bundling 10 open coding models. Sign in with your Cline account (same login as the Cline CLI/IDE), or paste a direct ClinePass API key (app.cline.bot → Settings → API Keys). A ClinePass subscription unlocks the cline-pass/* models. Reuses the Cline WorkOS OAuth flow.",
+  },
   windsurf: {
     id: "windsurf",
     alias: "ws",
diff --git a/src/shared/constants/providers/web-cookie.ts b/src/shared/constants/providers/web-cookie.ts
index 1d8e767189..e284720fa9 100644
--- a/src/shared/constants/providers/web-cookie.ts
+++ b/src/shared/constants/providers/web-cookie.ts
@@ -171,18 +171,20 @@ export const WEB_COOKIE_PROVIDERS = {
       "Paste your __client cookie value from .clerk.agent.adapta.one (DevTools → Application → Cookies)",
   },
   lmarena: {
+    // Wire id stays `lmarena` for DB/combo/model-prefix back-compat.
+    // Product rebranded LMArena → Arena (arena.ai) in Jan 2026.
     id: "lmarena",
     alias: "lma",
-    name: "LMArena (Free)",
+    name: "Arena (Free)",
     icon: "auto_awesome",
     color: "#FF6B6B",
-    textIcon: "LMA",
-    website: "https://lmarena.ai",
+    textIcon: "AR",
+    website: "https://arena.ai",
     hasFree: true,
     freeNote:
-      "Free model comparison platform — 40+ models (GPT, Claude, Gemini, Llama). No subscription required.",
+      "Free model comparison platform (formerly LMArena) at arena.ai — Direct-chat catalog of chat models (GPT, Claude, Gemini, Llama, …). No subscription required.",
     authHint:
-      "Paste the full Cookie header from lmarena.ai (DevTools → Network → request → Cookie). The session is now split across arena-auth-prod-v1.0, .1, … — copy the whole header. Optional — works with free tier for basic comparisons.",
+      "Paste the full Cookie header from arena.ai (DevTools → Network → request → Cookie). Include arena-auth-prod-v1.0/.1… and cf_clearance/__cf_bm when present. OmniRoute uses Chrome TLS impersonation; if Arena still 403s, set providerSpecificData.recaptchaV3Token from a live browser session.",
     riskNoticeVariant: "webCookie",
   },
   "yuanbao-web": {
@@ -240,7 +242,13 @@ export const WEB_COOKIE_PROVIDERS = {
   },
   "v0-vercel-web": {
     id: "v0-vercel-web",
-    alias: "v0",
+    // #6343: was "v0", colliding with the unrelated "v0-vercel" API-key provider's
+    // alias. Aliases resolve 1:1 to a provider id, so the dashboard's model-string
+    // routing always picked v0-vercel, silently hiding this provider's own
+    // credentials. Follows the established secondary-web-variant convention (see
+    // kimi-web / qwen-web / huggingchat in tests/unit/provider-alias-uniqueness.test.ts):
+    // the web/secondary variant uses its own id as alias instead of a short prefix.
+    alias: "v0-vercel-web",
     name: "v0 Vercel Web (Code Gen)",
     icon: "auto_awesome",
     color: "#000000",
@@ -319,6 +327,21 @@ export const WEB_COOKIE_PROVIDERS = {
     authHint:
       "Login at zenmux.ai, then export all cookies using EditThisCookie or Cookie-Editor and paste the full Cookie header string here. Refresh every ~30 days.",
   },
+  "zai-web": {
+    id: "zai-web",
+    alias: "zw",
+    name: "Z.ai Web (Free)",
+    icon: "auto_awesome",
+    color: "#2563EB",
+    textIcon: "ZW",
+    website: "https://chat.z.ai",
+    hasFree: true,
+    freeNote:
+      "Free consumer web session — GLM chat models via chat.z.ai. Distinct from the API-key zai/glm providers. No subscription required.",
+    subscriptionRisk: true,
+    riskNoticeVariant: "webCookie",
+    authHint: "Paste the full Cookie header from chat.z.ai (must include the token=<JWT> cookie)",
+  },
 };
 
 /** Resolved public site for a web-session provider (href + display host). */
diff --git a/src/shared/constants/publicApiRoutes.ts b/src/shared/constants/publicApiRoutes.ts
index 70853e142a..a647a376f1 100644
--- a/src/shared/constants/publicApiRoutes.ts
+++ b/src/shared/constants/publicApiRoutes.ts
@@ -17,9 +17,17 @@ const PUBLIC_API_ROUTE_PREFIXES = [
   // The handler enforces its own auth via extractUsageCommandApiKey/isValidApiKey
   // and the allowUsageCommand flag — it must not be gated by management auth.
   "/api/usage/om-usage",
+  // Chaos Mode external dispatch endpoint (POST /api/skills/collect/chaos).
+  // This entry only bypasses the dashboard requireLogin (cookie) gate — the
+  // handler enforces its own Bearer-token auth (validateApiKey +
+  // chaosModeEnabled check) before doing any work. See src/app/api/skills/
+  // collect/chaos/route.ts. Do not widen this prefix to cover other
+  // /api/skills/collect/* routes without the same per-handler auth.
+  "/api/skills/collect/chaos",
 ];
 
 const PUBLIC_READONLY_API_ROUTE_PREFIXES = [
+  "/api/health/ping",
   "/api/monitoring/health",
   "/api/settings/require-login",
 ];
diff --git a/src/shared/constants/sidebarVisibility/sections.ts b/src/shared/constants/sidebarVisibility/sections.ts
index 043ddf45f4..67f1272116 100644
--- a/src/shared/constants/sidebarVisibility/sections.ts
+++ b/src/shared/constants/sidebarVisibility/sections.ts
@@ -170,6 +170,14 @@ export const COMPRESSION_CONTEXT_GROUP: SidebarItemGroup = {
       subtitleFallback: "Heuristic pruning",
       icon: "bolt",
     },
+    {
+      id: "context-omniglyph",
+      href: "/dashboard/context/omniglyph",
+      i18nKey: "contextOmniglyph",
+      labelFallback: "OmniGlyph",
+      subtitleFallback: "Context-as-image",
+      icon: "grain",
+    },
     {
       id: "compression-studio",
       href: "/dashboard/compression/studio",
@@ -507,6 +515,14 @@ const AGENTIC_FEATURES_ITEMS: readonly SidebarSectionChild[] = [
     subtitleKey: "agentSkillsSubtitle",
     icon: "share",
   },
+  {
+    id: "chaos-config",
+    href: "/dashboard/chaos",
+    i18nKey: "chaosConfig",
+    labelFallback: "Chaos Mode",
+    subtitleFallback: "Multi-model parallel execution",
+    icon: "blender",
+  },
   {
     id: "skills",
     href: "/dashboard/omni-skills",
diff --git a/src/shared/constants/sidebarVisibility/types.ts b/src/shared/constants/sidebarVisibility/types.ts
index ba486b6b0e..1a4f2cb2b9 100644
--- a/src/shared/constants/sidebarVisibility/types.ts
+++ b/src/shared/constants/sidebarVisibility/types.ts
@@ -21,6 +21,7 @@ export const HIDEABLE_SIDEBAR_ITEM_IDS = [
   "context-lite",
   "context-aggressive",
   "context-ultra",
+  "context-omniglyph",
   "compression-studio",
   // OmniProxy > Tools
   "cli-code",
@@ -73,6 +74,7 @@ export const HIDEABLE_SIDEBAR_ITEM_IDS = [
   "memory",
   "skills",
   "agent-skills",
+  "chaos-config",
   "mcp",
   "a2a",
   "plugins",
diff --git a/src/shared/constants/spawnCapablePrefixes.ts b/src/shared/constants/spawnCapablePrefixes.ts
index 5e83f3d546..87c2186a1d 100644
--- a/src/shared/constants/spawnCapablePrefixes.ts
+++ b/src/shared/constants/spawnCapablePrefixes.ts
@@ -30,6 +30,7 @@ export const SPAWN_CAPABLE_PREFIXES: ReadonlyArray<string> = [
   "/api/tools/traffic-inspector/", // http-proxy listener + system proxy (Hard Rules #15 + #17)
   "/api/plugins/", // plugins: load/execute via worker_threads + child_process (Hard Rules #15 + #17)
   "/api/local/", // T-12: 1-click local service launchers (Redis today) — must never be whitelistable via manage-scope bypass (Hard Rules #15 + #17)
+  "/api/skills/collect/", // Skill Collector CLI detection: GET .../detect spawns a child process per CLI_TOOL_IDS entry — must never be whitelistable via manage-scope bypass (Hard Rules #15 + #17, PR #6294 review)
   "/api/headroom/start", // spawns headroom-ai python CLI — must never be bypassable (Hard Rules #15 + #17)
   "/api/headroom/stop", // kills tracked PID — must never be bypassable (Hard Rules #15 + #17)
 ];
diff --git a/src/shared/middleware/requireJsonContentType.ts b/src/shared/middleware/requireJsonContentType.ts
new file mode 100644
index 0000000000..cf3f937f3e
--- /dev/null
+++ b/src/shared/middleware/requireJsonContentType.ts
@@ -0,0 +1,47 @@
+/**
+ * Content-Type guard for chat/message routes (#6414).
+ *
+ * OpenAI's reference API returns HTTP 415 `unsupported_media_type` when a POST to
+ * /v1/chat/completions arrives with a non-JSON Content-Type (or none). OmniRoute
+ * previously admitted such requests, silently parsed the body as JSON (via
+ * `request.clone().json().catch(() => null)`), and let them fall through to the
+ * provider-lookup layer — where they emerged as a misleading `model_not_found` /
+ * generic error rather than the RFC 7231 §6.5.13-mandated 415. This guard closes
+ * that gap at the route boundary, mirroring the pre-parse pattern already used by
+ * `chatBodyAdmission.ts`.
+ *
+ * Returns a ready 415 Response when the request must be rejected, or `null` to
+ * proceed. Only inspects the header — no body read, no I/O.
+ *
+ * @module shared/middleware/requireJsonContentType
+ */
+
+import { CORS_HEADERS } from "../utils/cors";
+
+/**
+ * Route-level guard. Rejects POST/PUT/PATCH requests whose `Content-Type` is not
+ * `application/json` (a `; charset=…` suffix is permitted). A missing header is
+ * treated as unsupported, matching the OpenAI reference behavior cited in #6414.
+ */
+export function requireJsonContentType(request: Request): Response | null {
+  const method = request.method.toUpperCase();
+  if (method !== "POST" && method !== "PUT" && method !== "PATCH") return null;
+
+  const raw = request.headers.get("content-type");
+  const ct = (raw ?? "").trim().toLowerCase();
+  if (ct.startsWith("application/json")) return null;
+
+  return new Response(
+    JSON.stringify({
+      error: {
+        message: "Content-Type must be application/json",
+        type: "invalid_request_error",
+        code: "unsupported_media_type",
+      },
+    }),
+    {
+      status: 415,
+      headers: { ...CORS_HEADERS, "Content-Type": "application/json" },
+    }
+  );
+}
diff --git a/src/shared/providers/webSessionCredentials.ts b/src/shared/providers/webSessionCredentials.ts
index 77d3d3ca5e..544083ec5e 100644
--- a/src/shared/providers/webSessionCredentials.ts
+++ b/src/shared/providers/webSessionCredentials.ts
@@ -14,6 +14,7 @@ export type WebSessionCredentialRequirement =
        * AND the Cookie header, so the one-line cookie hint reads circular).
        */
       hintKey?: string;
+      hintFallback?: string;
     }
   | {
       kind: "none";
@@ -227,18 +228,25 @@ export const WEB_SESSION_CREDENTIAL_REQUIREMENTS = {
     acceptsFullCookieHeader: true,
     storageKeys: ["cookie", "manus_session"],
   },
+  "zai-web": {
+    kind: "cookie",
+    credentialName: "token",
+    placeholder: "token=... or full Cookie header from chat.z.ai",
+    acceptsFullCookieHeader: true,
+    storageKeys: ["cookie", "token"],
+  },
   lmarena: {
     kind: "cookie",
-    // lmarena.ai's auth cookie is `arena-auth-prod-v1` (the legacy hint said `session`,
+    // arena.ai's auth cookie is `arena-auth-prod-v1` (the legacy hint said `session`,
     // which never matched the real cookie name and confused users). #3810
     //
     // #4271: LMArena migrated to Supabase SSR chunked cookies — the single
     // `arena-auth-prod-v1` cookie is now empty and the session is split across
     // `arena-auth-prod-v1.0`, `arena-auth-prod-v1.1`, … Users must paste the FULL
     // Cookie header so the executor can reconstruct the single cookie from chunks.
-    credentialName: "arena-auth-prod-v1",
+    credentialName: "full Cookie header (arena-auth-prod-v1.0 + arena-auth-prod-v1.1)",
     placeholder:
-      "Paste the full Cookie header from lmarena.ai (the session is now split across arena-auth-prod-v1.0, .1, …)",
+      "arena-auth-prod-v1.0=...; arena-auth-prod-v1.1=...; other=value (full Cookie header from arena.ai)",
     acceptsFullCookieHeader: true,
     storageKeys: [
       "cookie",
@@ -247,6 +255,9 @@ export const WEB_SESSION_CREDENTIAL_REQUIREMENTS = {
       "arena-auth-prod-v1.1",
       "session",
     ],
+    hintKey: "lmarenaWebCookieHint",
+    hintFallback:
+      "Open arena.ai, sign in, then copy the full Cookie header from a Network request. Include arena-auth-prod-v1.0 and arena-auth-prod-v1.1 (and further chunks if present), preferably with cf_clearance. Do not paste only the empty arena-auth-prod-v1 cookie. Optional: providerSpecificData.recaptchaV3Token if create-evaluation still returns 403.",
   },
 } satisfies Record<keyof typeof WEB_COOKIE_PROVIDERS, WebSessionCredentialRequirement>;
 
diff --git a/src/shared/reasoning/effortStandardization.ts b/src/shared/reasoning/effortStandardization.ts
index b71b721ec9..611433b8ff 100644
--- a/src/shared/reasoning/effortStandardization.ts
+++ b/src/shared/reasoning/effortStandardization.ts
@@ -11,16 +11,38 @@ import { z } from "zod";
  * provider-agnostic pair of request fields and folds them onto the fields the existing
  * mappers already read.
  *
- * Canonical effort vocabulary — the SAME five values used everywhere else in the codebase
- * (`providerSpecificData.ts` CODEX_REASONING_EFFORT_VALUES, `vscode/reasoningMetadata.ts`
- * KNOWN_REASONING_EFFORTS, `modelSpecs.ts`). We deliberately REUSE this set instead of
- * inventing a parallel Low/Medium/High/Extra/Max enum that would diverge from the rest of
- * the codebase.
+ * The provider-agnostic vocabulary remains five values. Provider-native additions such as
+ * Codex GPT-5.6 Max and Ultra are exposed separately without widening this request contract.
  */
 export const CANONICAL_EFFORT_VALUES = ["none", "low", "medium", "high", "xhigh"] as const;
 
 export type CanonicalEffort = (typeof CANONICAL_EFFORT_VALUES)[number];
 
+/** Add provider-native GPT-5.6 effort levels without widening the global request vocabulary. */
+export function extendCodexGpt56EffortValues(
+  provider: string | null | undefined,
+  model: string | null | undefined,
+  baseValues: readonly string[]
+): string[] {
+  const values = [...baseValues];
+  const normalizedProvider = provider?.trim().toLowerCase();
+  const normalizedModel = model
+    ?.trim()
+    .toLowerCase()
+    .replace(/^(?:codex|cx)\//, "");
+  if (!normalizedModel || (normalizedProvider !== "codex" && normalizedProvider !== "cx")) {
+    return values;
+  }
+
+  const match = normalizedModel.match(
+    /^gpt-5\.6-(sol|terra|luna)(?:-(?:none|low|medium|high|xhigh|max|ultra))?$/
+  );
+  if (!match) return values;
+
+  const additions = match[1] === "luna" ? ["max"] : ["max", "ultra"];
+  return [...new Set([...values, ...additions])];
+}
+
 /**
  * UI-facing tier synonyms mapped onto the canonical set. The issue (#6241) requested a
  * 5-tier UI vocabulary (Low / Medium / High / Extra / Max); that request collapses onto
@@ -95,18 +117,13 @@ export function normalizeReasoningRequest<T>(body: T): T {
 
   const reasoning = body.reasoning;
   const clientSetReasoningEffort = body.reasoning_effort !== undefined;
-  const clientSetReasoningObjEffort =
-    isPlainObject(reasoning) && reasoning.effort !== undefined;
+  const clientSetReasoningObjEffort = isPlainObject(reasoning) && reasoning.effort !== undefined;
 
   const next: Record<string, unknown> = { ...body };
 
   // Canonical effort → the fields the mappers read. Skip entirely if the client already
   // expressed a reasoning effort (either shape) so client intent is preserved.
-  if (
-    canonicalEffort !== undefined &&
-    !clientSetReasoningEffort &&
-    !clientSetReasoningObjEffort
-  ) {
+  if (canonicalEffort !== undefined && !clientSetReasoningEffort && !clientSetReasoningObjEffort) {
     next.reasoning_effort = canonicalEffort;
     next.reasoning = {
       ...(isPlainObject(reasoning) ? reasoning : {}),
diff --git a/src/shared/schemas/cliCatalog.ts b/src/shared/schemas/cliCatalog.ts
index 22ef529ec5..d5b43a55bc 100644
--- a/src/shared/schemas/cliCatalog.ts
+++ b/src/shared/schemas/cliCatalog.ts
@@ -63,4 +63,7 @@ export const CliCatalogSchema = z.record(CliCatalogEntrySchema);
 // +1 (2026-07-02): "codewhale" added as a dual entry alongside "deepseek-tui"
 // (CodeWhale is the actively-maintained successor to DeepSeek TUI).
 export const EXPECTED_CODE_COUNT = 20;
-export const EXPECTED_AGENT_COUNT = 6;
+// +2 (#6318): "omp" (Oh My Pi) and "letta" (Letta CLI) added as agent entries.
+// Note: #6318 originally also shipped duplicate "pi"/"jcode"/"codewhale" entries —
+// those tools were already delivered by a separate PR, so only omp+letta landed here.
+export const EXPECTED_AGENT_COUNT = 8;
diff --git a/src/shared/services/cliInstallFallback.ts b/src/shared/services/cliInstallFallback.ts
new file mode 100644
index 0000000000..dfe57c3bd8
--- /dev/null
+++ b/src/shared/services/cliInstallFallback.ts
@@ -0,0 +1,69 @@
+import fsSync from "fs";
+
+/**
+ * #6701 — 9router-parity fallback for CLI install detection.
+ *
+ * `getCliRuntimeStatus()` in `cliRuntime.ts` determines `installed` from
+ * binary resolution alone (known install paths + a `where`/`which` PATH
+ * search). If the binary is not currently resolvable — stale PATH inherited
+ * by a long-running/background OmniRoute process, the binary having moved,
+ * or an install method we don't enumerate yet — it used to unconditionally
+ * report `installed:false`, even when the tool's own settings/config file on
+ * disk proves it was installed and used before.
+ *
+ * Upstream 9router's equivalent route
+ * (`src/app/api/cli-tools/claude-settings/route.js::checkClaudeInstalled()`)
+ * has a second-chance fallback: when `where`/`which` fails, it still reports
+ * `installed:true` if the settings file exists. This restores that fallback
+ * for any CLI tool that declares a `settings` config path (currently
+ * `claude` and `droid` — see `CLI_TOOLS` in `cliRuntime.ts`).
+ *
+ * Only applies when the lookup's own reason is "not_found" — i.e. the binary
+ * genuinely couldn't be located on PATH/known install paths. Deliberate
+ * security rejections (unsafe/relative env override paths, symlink escapes,
+ * suspicious file sizes, etc.) must stay `installed:false` regardless of
+ * whether a settings file happens to exist.
+ */
+export interface NotInstalledResult {
+  installed: false;
+  runnable: boolean;
+  command: string | null;
+  commandPath: string | null;
+  reason: string;
+  runtimeMode: string;
+  requiresBinary: boolean;
+}
+
+export interface SettingsFallbackResult {
+  installed: true;
+  runnable: false;
+  command: string | null;
+  commandPath: null;
+  reason: "settings_found_binary_unresolved";
+  runtimeMode: string;
+  requiresBinary: boolean;
+}
+
+/**
+ * Given the resolved settings-file path for a tool (or undefined if the tool
+ * has none) and the "not installed" result the binary lookup already
+ * produced, return a settings-fallback result when the settings file exists
+ * on disk, or the original "not installed" result unchanged otherwise.
+ */
+export const withSettingsFallback = (
+  settingsPath: string | undefined,
+  notInstalledResult: NotInstalledResult
+): NotInstalledResult | SettingsFallbackResult => {
+  if (notInstalledResult.reason !== "not_found") return notInstalledResult;
+  if (!settingsPath || !fsSync.existsSync(settingsPath)) return notInstalledResult;
+
+  return {
+    installed: true,
+    runnable: false,
+    command: notInstalledResult.command,
+    commandPath: null,
+    reason: "settings_found_binary_unresolved",
+    runtimeMode: notInstalledResult.runtimeMode,
+    requiresBinary: notInstalledResult.requiresBinary,
+  };
+};
diff --git a/src/shared/services/cliRuntime.ts b/src/shared/services/cliRuntime.ts
index 737d7639c4..c7e778a9a0 100644
--- a/src/shared/services/cliRuntime.ts
+++ b/src/shared/services/cliRuntime.ts
@@ -5,7 +5,7 @@ import path from "path";
 import { spawn, execFileSync } from "child_process";
 import { getHermesHome } from "@/lib/cli-helper/config-generator/hermesHome";
 import { getCachedLoginShellPath, mergeShellPath } from "./loginShellPath";
-
+import { withSettingsFallback } from "./cliInstallFallback";
 const VALID_RUNTIME_MODES = new Set(["auto", "host", "container"]);
 const FALSE_VALUES = new Set(["0", "false", "no", "off"]);
 
@@ -210,6 +210,24 @@ const CLI_TOOLS: Record<string, any> = {
       config: ".config/deepseek-tui/config.toml",
     },
   },
+  omp: {
+    defaultCommand: "omp",
+    envBinKey: "CLI_OMP_BIN",
+    requiresBinary: true,
+    healthcheckTimeoutMs: 8000,
+    paths: {
+      config: ".omp/agent/models.yml",
+    },
+  },
+  letta: {
+    defaultCommand: "letta",
+    envBinKey: "CLI_LETTA_BIN",
+    requiresBinary: true,
+    healthcheckTimeoutMs: 8000,
+    paths: {
+      config: ".letta/lc-local-backend/providers/auth.json",
+    },
+  },
   codewhale: {
     defaultCommand: "codewhale",
     envBinKey: "CLI_CODEWHALE_BIN",
@@ -584,6 +602,16 @@ export const getKnownToolPaths = (toolId: string): string[] => {
       if (localAppData) {
         paths.push(path.join(localAppData, "Programs", "Claude", "claude.exe"));
         paths.push(path.join(localAppData, "claude-code", "claude.exe"));
+        paths.push(
+          path.join(
+            localAppData,
+            "Microsoft",
+            "WinGet",
+            "Packages",
+            "Anthropic.ClaudeCode_Microsoft.Winget.Source_8wekyb3d8bbwe",
+            "claude.exe"
+          )
+        );
       }
     }
 
@@ -1057,7 +1085,7 @@ export const getCliRuntimeStatus = async (toolId: string) => {
   const command = located.command;
 
   if (!located.installed) {
-    return {
+    return withSettingsFallback(getCliConfigPaths(toolId)?.settings, {
       installed: false,
       runnable: false,
       command,
@@ -1065,7 +1093,7 @@ export const getCliRuntimeStatus = async (toolId: string) => {
       reason: located.reason || "not_found",
       runtimeMode,
       requiresBinary,
-    };
+    });
   }
 
   if (located.reason === "not_executable") {
diff --git a/src/shared/services/codexCatalogRevalidation.ts b/src/shared/services/codexCatalogRevalidation.ts
new file mode 100644
index 0000000000..a65b7ad658
--- /dev/null
+++ b/src/shared/services/codexCatalogRevalidation.ts
@@ -0,0 +1,395 @@
+/**
+ * Codex catalog revalidation (Codex provider only)
+ *
+ * Runs scrub + live re-sync only in three cases:
+ *  1) first-start — no version marker yet
+ *  2) upgrade — app version marker changed after update/reboot
+ *  3) init — setup/onboarding just completed (explicit trigger)
+ *
+ * Success log (single line): kill deprecated models complete.
+ */
+
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { isCodexDiscoveryModelExcluded } from "@/shared/services/codexDiscoveryPolicy";
+import {
+  getSyncedAvailableModelsForConnection,
+  replaceSyncedAvailableModelsForConnection,
+  type SyncedAvailableModel,
+} from "@/lib/db/models";
+import { getProviderConnections } from "@/lib/db/providers";
+import { getSettings, updateSettings } from "@/lib/db/settings";
+
+export const CODEX_CATALOG_REVALIDATED_VERSION_KEY = "codex_catalog_revalidated_version";
+
+export type CodexCatalogRevalidationReason = "first-start" | "upgrade" | "init";
+
+type AppVersionOptions = {
+  runtimeRoot?: string;
+  packageVersion?: string | null;
+};
+
+function readNonEmptyTextFile(filePath: string): string | null {
+  try {
+    const value = readFileSync(filePath, "utf8").trim();
+    return value || null;
+  } catch {
+    return null;
+  }
+}
+
+function readInstalledPackageVersion(runtimeRoot: string): string | null {
+  try {
+    const pkg = JSON.parse(readFileSync(path.join(runtimeRoot, "package.json"), "utf8")) as {
+      version?: unknown;
+    };
+    return typeof pkg.version === "string" && pkg.version.trim() ? pkg.version.trim() : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Resolve a stable, source-qualified app identity for upgrade detection. */
+export function resolveCodexCatalogAppVersion(
+  env: NodeJS.ProcessEnv = process.env,
+  options: AppVersionOptions = {}
+): string | null {
+  for (const value of [env.OMNIROUTE_BUILD_SHA, env.BUILD_SHA]) {
+    if (typeof value === "string" && value.trim()) return `build:${value.trim()}`;
+  }
+
+  const runtimeRoot = options.runtimeRoot || process.cwd();
+  const buildSha = readNonEmptyTextFile(path.join(runtimeRoot, "BUILD_SHA"));
+  if (buildSha) return `build:${buildSha}`;
+
+  for (const buildIdPath of [
+    path.join(runtimeRoot, ".build", "next", "BUILD_ID"),
+    path.join(runtimeRoot, ".next", "BUILD_ID"),
+  ]) {
+    const buildId = readNonEmptyTextFile(buildIdPath);
+    if (buildId) return `next:${buildId}`;
+  }
+
+  const envPackageVersion = env.npm_package_version || env.OMNIROUTE_VERSION;
+  if (typeof envPackageVersion === "string" && envPackageVersion.trim()) {
+    return `pkg:${envPackageVersion.trim()}`;
+  }
+
+  const hasPackageVersionOverride = Object.prototype.hasOwnProperty.call(options, "packageVersion");
+  const packageVersion = hasPackageVersionOverride
+    ? options.packageVersion
+    : readInstalledPackageVersion(runtimeRoot);
+  return typeof packageVersion === "string" && packageVersion.trim()
+    ? `pkg:${packageVersion.trim()}`
+    : null;
+}
+
+/**
+ * Pure: map stored marker + current version → boot trigger, or null to skip.
+ * - no marker → first-start
+ * - marker !== version → upgrade
+ * - else → null (do nothing on this boot)
+ */
+export function resolveBootRevalidationReason(
+  previousVersion: string | null | undefined,
+  appVersion: string
+): CodexCatalogRevalidationReason | null {
+  if (!previousVersion || !String(previousVersion).trim()) return "first-start";
+  if (String(previousVersion).trim() !== appVersion) return "upgrade";
+  return null;
+}
+
+/** Pure helper: drop denylisted ids from a synced model list. */
+export function scrubSyncedModelsWithCodexDenylist(models: SyncedAvailableModel[]): {
+  kept: SyncedAvailableModel[];
+  removedIds: string[];
+} {
+  const removedIds: string[] = [];
+  const kept: SyncedAvailableModel[] = [];
+  for (const model of models) {
+    if (!model?.id) continue;
+    if (isCodexDiscoveryModelExcluded({ id: model.id })) {
+      removedIds.push(model.id);
+      continue;
+    }
+    kept.push(model);
+  }
+  return { kept, removedIds };
+}
+
+export type CodexCatalogScrubResult = {
+  connections: number;
+  connectionsChanged: number;
+  modelsRemoved: number;
+  removedIds: string[];
+};
+
+/** Offline pass: rewrite persisted Codex synced catalogs through the denylist. */
+export async function scrubCodexPersistedCatalogs(): Promise<CodexCatalogScrubResult> {
+  const connections = await getProviderConnections({ provider: "codex" });
+  const removedIds = new Set<string>();
+  let connectionsChanged = 0;
+
+  for (const connection of connections) {
+    const connectionId = String(connection.id || "");
+    if (!connectionId) continue;
+    const existing = await getSyncedAvailableModelsForConnection("codex", connectionId);
+    if (existing.length === 0) continue;
+    const { kept, removedIds: removed } = scrubSyncedModelsWithCodexDenylist(existing);
+    if (removed.length === 0) continue;
+    await replaceSyncedAvailableModelsForConnection("codex", connectionId, kept);
+    connectionsChanged += 1;
+    for (const id of removed) removedIds.add(id);
+  }
+
+  return {
+    connections: connections.length,
+    connectionsChanged,
+    modelsRemoved: removedIds.size,
+    removedIds: Array.from(removedIds).sort(),
+  };
+}
+
+async function listActiveCodexConnectionIds(): Promise<Array<{ id: string; name?: string }>> {
+  const connections = await getProviderConnections({ provider: "codex" });
+  return connections
+    .filter((conn) => conn.isActive !== false)
+    .map((conn) => ({
+      id: String(conn.id),
+      name: typeof conn.name === "string" ? conn.name : undefined,
+    }))
+    .filter((conn) => conn.id.length > 0);
+}
+
+export async function waitForLoopbackHttpReady(options?: {
+  apiBaseUrl?: string;
+  maxWaitMs?: number;
+  pollMs?: number;
+}): Promise<void> {
+  const maxWaitMs = options?.maxWaitMs ?? 15_000;
+  const pollMs = options?.pollMs ?? 50;
+  const { fetchModelSyncInternal, resolveModelSyncInternalBaseUrl } =
+    await import("./modelSyncScheduler");
+  const baseUrl = resolveModelSyncInternalBaseUrl(options?.apiBaseUrl);
+  const deadline = Date.now() + maxWaitMs;
+  let lastErr: unknown;
+
+  while (Date.now() < deadline) {
+    try {
+      const res = await fetchModelSyncInternal(
+        `${baseUrl}/api/providers/__readiness_probe__/models`,
+        {
+          redirect: "error",
+          signal: AbortSignal.timeout(1_500),
+        }
+      );
+      if (res.status >= 200 && res.status < 600) return;
+    } catch (err) {
+      lastErr = err;
+    }
+    await new Promise((r) => setTimeout(r, pollMs));
+  }
+
+  throw new Error(
+    `loopback not ready within ${maxWaitMs}ms: ${
+      lastErr instanceof Error ? lastErr.message : String(lastErr)
+    }`
+  );
+}
+
+export async function liveResyncCodexConnections(
+  apiBaseUrl?: string
+): Promise<{ attempted: number; succeeded: number }> {
+  const connections = await listActiveCodexConnectionIds();
+  if (connections.length === 0) {
+    return { attempted: 0, succeeded: 0 };
+  }
+
+  const { buildModelSyncInternalHeaders, fetchModelSyncInternal, resolveModelSyncInternalBaseUrl } =
+    await import("./modelSyncScheduler");
+  const base = resolveModelSyncInternalBaseUrl(apiBaseUrl);
+  const results = await Promise.allSettled(
+    connections.map(async (conn) => {
+      const res = await fetchModelSyncInternal(
+        `${base}/api/providers/${conn.id}/sync-models?quiet=1`,
+        {
+          method: "POST",
+          redirect: "error",
+          headers: {
+            "Content-Type": "application/json",
+            ...buildModelSyncInternalHeaders(),
+          },
+        }
+      );
+      if (!res.ok) {
+        throw new Error(`HTTP ${res.status}`);
+      }
+      return true;
+    })
+  );
+
+  const succeeded = results.filter((r) => r.status === "fulfilled").length;
+  return { attempted: connections.length, succeeded };
+}
+
+async function readPreviousVersionMarker(): Promise<string | null> {
+  try {
+    const settings = await getSettings();
+    const raw = settings?.[CODEX_CATALOG_REVALIDATED_VERSION_KEY];
+    return typeof raw === "string" && raw.trim() ? raw.trim() : null;
+  } catch {
+    return null;
+  }
+}
+
+async function writeVersionMarker(appVersion: string): Promise<boolean> {
+  try {
+    await updateSettings({ [CODEX_CATALOG_REVALIDATED_VERSION_KEY]: appVersion });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export type CodexCatalogRevalidationOutcome = {
+  complete: boolean;
+  attempted: number;
+  succeeded: number;
+};
+
+export async function executeCodexCatalogRevalidation(options: {
+  appVersion: string | null;
+  scrub: () => Promise<unknown>;
+  waitForReady: () => Promise<void>;
+  liveResync: () => Promise<{ attempted: number; succeeded: number }>;
+  writeMarker: (appVersion: string) => Promise<boolean>;
+  logSuccess: () => void;
+}): Promise<CodexCatalogRevalidationOutcome> {
+  await options.scrub();
+
+  try {
+    await options.waitForReady();
+  } catch {
+    return { complete: false, attempted: 0, succeeded: 0 };
+  }
+
+  const syncResult = await options.liveResync();
+  if (syncResult.succeeded !== syncResult.attempted) {
+    return { complete: false, ...syncResult };
+  }
+
+  if (!options.appVersion) return { complete: false, ...syncResult };
+  const markerWritten = await options.writeMarker(options.appVersion);
+  if (!markerWritten) return { complete: false, ...syncResult };
+
+  options.logSuccess();
+  return { complete: true, ...syncResult };
+}
+
+type CodexCatalogRevalidationRequest = {
+  apiBaseUrl?: string;
+  reason: CodexCatalogRevalidationReason;
+};
+
+export function createCodexCatalogRevalidationCoordinator(
+  run: (options: CodexCatalogRevalidationRequest) => Promise<void>
+): (options: CodexCatalogRevalidationRequest) => Promise<void> {
+  let activeRun: Promise<void> | null = null;
+  let activeReason: CodexCatalogRevalidationReason | null = null;
+  let queuedInit: CodexCatalogRevalidationRequest | null = null;
+
+  return (options) => {
+    if (activeRun) {
+      if (options.reason === "init" && activeReason !== "init") {
+        queuedInit = options;
+      }
+      return activeRun;
+    }
+
+    activeRun = (async () => {
+      let current: CodexCatalogRevalidationRequest | null = options;
+      let firstError: unknown;
+
+      try {
+        while (current) {
+          activeReason = current.reason;
+          try {
+            await run(current);
+          } catch (error) {
+            firstError ??= error;
+          }
+          current = queuedInit;
+          queuedInit = null;
+        }
+      } finally {
+        activeRun = null;
+        activeReason = null;
+      }
+
+      if (firstError) throw firstError;
+    })();
+
+    return activeRun;
+  };
+}
+
+/**
+ * Run scrub + live re-sync for an explicit reason, then mark version.
+ * Operator-facing success log is a single line.
+ */
+async function performCodexCatalogRevalidation(
+  options: CodexCatalogRevalidationRequest
+): Promise<void> {
+  const appVersion = resolveCodexCatalogAppVersion();
+  const { resolveModelSyncInternalBaseUrl } = await import("./modelSyncScheduler");
+  const apiBaseUrl = resolveModelSyncInternalBaseUrl(options.apiBaseUrl);
+
+  await executeCodexCatalogRevalidation({
+    appVersion,
+    scrub: scrubCodexPersistedCatalogs,
+    waitForReady: () => waitForLoopbackHttpReady({ apiBaseUrl }),
+    liveResync: () => liveResyncCodexConnections(apiBaseUrl),
+    writeMarker: writeVersionMarker,
+    logSuccess: () => console.log("kill deprecated models complete."),
+  });
+}
+
+const requestCodexCatalogRevalidation = createCodexCatalogRevalidationCoordinator(
+  performCodexCatalogRevalidation
+);
+
+export function revalidateCodexCatalogs(options: CodexCatalogRevalidationRequest): Promise<void> {
+  return requestCodexCatalogRevalidation(options);
+}
+
+/** Boot path: only first-start or upgrade. */
+export async function revalidateCodexCatalogsOnStartup(options?: {
+  apiBaseUrl?: string;
+}): Promise<void> {
+  const appVersion = resolveCodexCatalogAppVersion();
+  const previousVersion = await readPreviousVersionMarker();
+  const reason = appVersion
+    ? resolveBootRevalidationReason(previousVersion, appVersion)
+    : "first-start";
+  if (!reason) return;
+  await revalidateCodexCatalogs({ apiBaseUrl: options?.apiBaseUrl, reason });
+}
+
+function scheduleRun(run: () => Promise<void>): void {
+  const timer = setTimeout(() => {
+    void run().catch(() => {
+      // silent — success line only on full success
+    });
+  }, 0);
+  timer.unref?.();
+}
+
+/** Fire-and-forget boot schedule (first-start / upgrade only). */
+export function scheduleCodexCatalogRevalidation(options?: { apiBaseUrl?: string }): void {
+  scheduleRun(() => revalidateCodexCatalogsOnStartup({ apiBaseUrl: options?.apiBaseUrl }));
+}
+
+/** Fire-and-forget after setup/onboarding completes. */
+export function scheduleCodexCatalogRevalidationAfterInit(options?: { apiBaseUrl?: string }): void {
+  scheduleRun(() => revalidateCodexCatalogs({ apiBaseUrl: options?.apiBaseUrl, reason: "init" }));
+}
diff --git a/src/shared/services/codexDiscoveryPolicy.ts b/src/shared/services/codexDiscoveryPolicy.ts
new file mode 100644
index 0000000000..0da01f7035
--- /dev/null
+++ b/src/shared/services/codexDiscoveryPolicy.ts
@@ -0,0 +1,30 @@
+/** Exact Codex model ids retired after discovery merge. */
+export const CODEX_DISCOVERY_EXCLUDED_IDS: ReadonlySet<string> = new Set([
+  // Reserved for one-off retired ids that do not share a clean prefix family.
+]);
+
+/**
+ * Codex model-id families retired after discovery merge. Delimiter-aware
+ * matching prevents prefixes such as `gpt-5.40` from being removed.
+ */
+export const CODEX_DISCOVERY_EXCLUDED_ID_PREFIXES: readonly string[] = ["gpt-5.4"];
+
+export type CodexDiscoveryModelIdentity = {
+  id?: unknown;
+};
+
+export function isCodexDiscoveryModelExcluded(model: CodexDiscoveryModelIdentity): boolean {
+  const id = typeof model?.id === "string" ? model.id.trim().toLowerCase() : "";
+  if (!id) return true;
+  if (CODEX_DISCOVERY_EXCLUDED_IDS.has(id)) return true;
+
+  return CODEX_DISCOVERY_EXCLUDED_ID_PREFIXES.some((prefix) => {
+    const normalizedPrefix = prefix.toLowerCase();
+    return (
+      id === normalizedPrefix ||
+      id.startsWith(`${normalizedPrefix}-`) ||
+      id.startsWith(`${normalizedPrefix}_`) ||
+      id.startsWith(`${normalizedPrefix}.`)
+    );
+  });
+}
diff --git a/src/shared/services/modelSyncScheduler.ts b/src/shared/services/modelSyncScheduler.ts
index 553a6783e1..026ebee310 100644
--- a/src/shared/services/modelSyncScheduler.ts
+++ b/src/shared/services/modelSyncScheduler.ts
@@ -9,6 +9,7 @@
  */
 
 import { randomUUID } from "node:crypto";
+import { Agent, buildConnector, fetch as undiciFetch, type Dispatcher } from "undici";
 import { getSettings, updateSettings } from "@/lib/localDb";
 import { getRuntimePorts } from "@/lib/runtime/ports";
 
@@ -16,13 +17,15 @@ const DEFAULT_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
 const MODEL_SYNC_SETTING_KEY = "model_sync_last_run";
 const MODEL_SYNC_INTERNAL_AUTH_HEADER = "x-model-sync-internal-auth";
 
-const { dashboardPort } = getRuntimePorts();
+function normalizeInternalBasePath(value: string | undefined): string {
+  const trimmed = value?.trim();
+  if (!trimmed || trimmed === "/") return "";
+  if (!trimmed.startsWith("/") || /[?#\\]/.test(trimmed)) return "";
 
-const INTERNAL_BASE_URL =
-  process.env.BASE_URL ||
-  process.env.NEXT_PUBLIC_BASE_URL ||
-  process.env.NEXT_PUBLIC_APP_URL ||
-  `http://127.0.0.1:${dashboardPort}`;
+  const segments = trimmed.split("/").filter(Boolean);
+  if (segments.some((segment) => segment === "." || segment === "..")) return "";
+  return `/${segments.join("/")}`;
+}
 
 /**
  * Trusted origin for server-internal self-fetches (model sync, auto-discovery).
@@ -34,9 +37,80 @@ const INTERNAL_BASE_URL =
  * this loopback/env-pinned origin instead.
  */
 export function getModelSyncInternalBaseUrl(): string {
-  return INTERNAL_BASE_URL;
+  return resolveModelSyncInternalBaseUrl();
 }
 
+export function resolveModelSyncInternalBaseUrl(_candidate?: string): string {
+  const { dashboardPort } = getRuntimePorts();
+  const nativeTls = process.env.OMNIROUTE_INTERNAL_SCHEME === "https";
+  const origin = nativeTls
+    ? `https://localhost:${dashboardPort}`
+    : `http://127.0.0.1:${dashboardPort}`;
+  return `${origin}${normalizeInternalBasePath(process.env.OMNIROUTE_BASE_PATH)}`;
+}
+
+export function createPinnedModelSyncTlsConnector(
+  connect: buildConnector.connector = buildConnector({ servername: "localhost" })
+): buildConnector.connector {
+  return (options, callback) =>
+    connect(
+      {
+        ...options,
+        host: "localhost",
+        hostname: "127.0.0.1",
+        servername: "localhost",
+      },
+      callback
+    );
+}
+
+let pinnedModelSyncTlsDispatcher: Dispatcher | null = null;
+
+function getPinnedModelSyncTlsDispatcher(): Dispatcher {
+  if (!pinnedModelSyncTlsDispatcher) {
+    pinnedModelSyncTlsDispatcher = new Agent({
+      connect: createPinnedModelSyncTlsConnector(),
+      connections: 8,
+      pipelining: 0,
+    });
+  }
+  return pinnedModelSyncTlsDispatcher;
+}
+
+const fetchWithDispatcher = undiciFetch as unknown as (
+  input: RequestInfo | URL,
+  init: RequestInit & { dispatcher: Dispatcher }
+) => Promise<Response>;
+
+export const fetchModelSyncInternal: typeof fetch = async (input, init = {}) => {
+  const inputUrl =
+    typeof input === "string" || input instanceof URL ? new URL(input) : new URL(input.url);
+  const expectedBase = new URL(getModelSyncInternalBaseUrl());
+  if (
+    inputUrl.protocol !== expectedBase.protocol ||
+    inputUrl.hostname !== expectedBase.hostname ||
+    inputUrl.port !== expectedBase.port ||
+    inputUrl.username ||
+    inputUrl.password
+  ) {
+    throw new TypeError("model sync internal fetch must target the active dashboard listener");
+  }
+
+  const basePath = expectedBase.pathname === "/" ? "" : expectedBase.pathname;
+  if (basePath && inputUrl.pathname !== basePath && !inputUrl.pathname.startsWith(`${basePath}/`)) {
+    throw new TypeError("model sync internal fetch must stay under the configured base path");
+  }
+
+  const requestInit = { ...init, redirect: "error" as const };
+  if (inputUrl.protocol === "https:") {
+    return fetchWithDispatcher(inputUrl, {
+      ...requestInit,
+      dispatcher: getPinnedModelSyncTlsDispatcher(),
+    });
+  }
+  return globalThis.fetch(inputUrl.href, requestInit);
+};
+
 const globalState = globalThis as typeof globalThis & {
   __omnirouteModelSyncInternalAuthToken?: string;
 };
@@ -78,14 +152,22 @@ async function getAutoSyncConnections(): Promise<
   try {
     const { getProviderConnections } = await import("@/lib/localDb");
     const connections = await getProviderConnections();
-    return connections.filter((conn: any) => {
-      if (!conn.isActive && conn.isActive !== undefined) return false;
+    const autoSyncConnections: Array<{ id: string; provider: string; name?: string }> = [];
+    for (const conn of connections) {
+      if (!conn.isActive && conn.isActive !== undefined) continue;
       const psd =
         conn.providerSpecificData && typeof conn.providerSpecificData === "object"
-          ? conn.providerSpecificData
+          ? (conn.providerSpecificData as Record<string, unknown>)
           : {};
-      return psd.autoSync === true;
-    });
+      if (psd.autoSync !== true) continue;
+      if (typeof conn.id !== "string" || typeof conn.provider !== "string") continue;
+      autoSyncConnections.push({
+        id: conn.id,
+        provider: conn.provider,
+        ...(typeof conn.name === "string" ? { name: conn.name } : {}),
+      });
+    }
+    return autoSyncConnections;
   } catch (err) {
     console.warn("[ModelSync] Failed to load connections:", (err as Error).message);
     return [];
@@ -101,13 +183,17 @@ async function syncConnectionModels(
   baseUrl: string
 ): Promise<boolean> {
   try {
-    const res = await fetch(`${baseUrl}/api/providers/${connectionId}/sync-models`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        ...buildModelSyncInternalHeaders(),
-      },
-    });
+    const res = await fetchModelSyncInternal(
+      `${baseUrl}/api/providers/${connectionId}/sync-models`,
+      {
+        method: "POST",
+        redirect: "error",
+        headers: {
+          "Content-Type": "application/json",
+          ...buildModelSyncInternalHeaders(),
+        },
+      }
+    );
     if (!res.ok) {
       console.warn(
         `[ModelSync] ${provider} (${connectionId.slice(0, 8)}): sync returned ${res.status}`
@@ -177,7 +263,7 @@ async function runSyncCycle(apiBaseUrl: string): Promise<void> {
  * @param intervalMs — sync interval in milliseconds (default: 24h)
  */
 export function startModelSyncScheduler(
-  apiBaseUrl = INTERNAL_BASE_URL,
+  apiBaseUrl = getModelSyncInternalBaseUrl(),
   intervalMs = DEFAULT_INTERVAL_MS
 ): void {
   if (schedulerTimer) {
@@ -189,15 +275,25 @@ export function startModelSyncScheduler(
   const envHours = parseInt(process.env.MODEL_SYNC_INTERVAL_HOURS ?? "", 10);
   const effectiveIntervalMs =
     !isNaN(envHours) && envHours > 0 ? envHours * 60 * 60 * 1000 : intervalMs;
+  const trustedApiBaseUrl = resolveModelSyncInternalBaseUrl(apiBaseUrl);
 
   console.log(`[ModelSync] Scheduler started — interval: ${effectiveIntervalMs / 3_600_000}h`);
 
   // Run immediately on startup (staggered by 5s to avoid startup congestion)
-  const startupDelay = setTimeout(() => runSyncCycle(apiBaseUrl), 5_000);
+  const startupDelay = setTimeout(() => runSyncCycle(trustedApiBaseUrl), 5_000);
   startupDelay.unref?.();
 
+  // Codex-only: revalidate catalog only on first-start or app upgrade (not every boot).
+  void import("./codexCatalogRevalidation")
+    .then(({ scheduleCodexCatalogRevalidation }) => {
+      scheduleCodexCatalogRevalidation({ apiBaseUrl: trustedApiBaseUrl });
+    })
+    .catch(() => {
+      // silent
+    });
+
   // Then run on the regular interval
-  schedulerTimer = setInterval(() => runSyncCycle(apiBaseUrl), effectiveIntervalMs);
+  schedulerTimer = setInterval(() => runSyncCycle(trustedApiBaseUrl), effectiveIntervalMs);
   schedulerTimer.unref?.();
 }
 
diff --git a/src/shared/utils/clineAuth.ts b/src/shared/utils/clineAuth.ts
index 929e61cbae..13a52af98b 100644
--- a/src/shared/utils/clineAuth.ts
+++ b/src/shared/utils/clineAuth.ts
@@ -60,3 +60,26 @@ export function buildClineHeaders(
 
   return headers;
 }
+
+/**
+ * Build headers for a ClinePass request. ClinePass is dual-auth: an OAuth
+ * connection (workos:-prefixed token in `accessToken`) needs the full Cline
+ * client header set from `buildClineHeaders()`; a BYOK API-key connection
+ * (`sk_...` key, #5942) sends the key as a plain Bearer token — no `workos:`
+ * prefix — alongside the Cline identification headers.
+ */
+export function buildClinepassHeaders(
+  credentials: { accessToken?: unknown; apiKey?: unknown } | null | undefined,
+  effectiveKey?: string
+): Record<string, string> {
+  if (credentials?.accessToken) {
+    return buildClineHeaders(credentials.accessToken);
+  }
+  const headers: Record<string, string> = {
+    "HTTP-Referer": "https://cline.bot",
+    "X-Title": "Cline",
+  };
+  const byokKey = effectiveKey || (credentials?.apiKey as string | undefined);
+  if (byokKey) headers.Authorization = `Bearer ${byokKey}`;
+  return headers;
+}
diff --git a/src/shared/utils/logger.ts b/src/shared/utils/logger.ts
index ff71dd6be5..83c79a9b39 100644
--- a/src/shared/utils/logger.ts
+++ b/src/shared/utils/logger.ts
@@ -47,6 +47,34 @@ function getTransportCompatibleConfig(): pino.LoggerOptions {
   return Object.keys(safeFormatters).length > 0 ? { ...rest, formatters: safeFormatters } : rest;
 }
 
+/**
+ * Build a `pino.transport()` worker-thread stream and attach an `error` listener
+ * BEFORE handing it to `pino()`.
+ *
+ * `pino({ transport: {...} })` builds the same stream internally but never listens
+ * for its `error` event. A destination that stops existing mid-run (its directory is
+ * deleted — e.g. a test's tmp `DATA_DIR` removed in `after()`, or an operator wiping
+ * `logs/`) makes the worker's write fail with `ENOENT`; that surfaces as an unlistened
+ * `error` event on the main-thread stream, which Node re-throws as an uncaught
+ * exception (issue #6360 — "resource generated asynchronous activity after the test
+ * ended"). A logger must never crash its host process because its own log file
+ * vanished, so failed writes are dropped (best-effort stderr notice) instead of
+ * escalating.
+ */
+function buildFileTransportStream(targets: NonNullable<pino.TransportMultiOptions["targets"]>) {
+  const stream = pino.transport({ targets });
+  stream.on("error", (err: unknown) => {
+    try {
+      process.stderr.write(
+        `[logger] log transport write failed, dropping log line: ${(err as Error)?.message || err}\n`
+      );
+    } catch {
+      // Nothing more we can do — never let a logging failure crash the process.
+    }
+  });
+  return stream;
+}
+
 /**
  * Build the logger with optional file transport.
  * Uses pino transport targets for all destinations.
@@ -67,49 +95,43 @@ function buildLogger(): pino.Logger {
 
       if (isDev) {
         // Dev: pino-pretty → stdout, JSON → file
-        return pino({
-          ...transportConfig,
-          transport: {
-            targets: [
-              {
-                target: "pino-pretty",
-                options: {
-                  colorize: true,
-                  translateTime: "HH:MM:ss.l",
-                  ignore: "pid,hostname,service",
-                  messageFormat: "[{module}] {msg}",
-                  destination: 1,
-                },
-                level: logLevel,
-              },
-              {
-                target: "pino/file",
-                options: { destination: absLogPath, mkdir: true },
-                level: logLevel,
-              },
-            ],
+        const stream = buildFileTransportStream([
+          {
+            target: "pino-pretty",
+            options: {
+              colorize: true,
+              translateTime: "HH:MM:ss.l",
+              ignore: "pid,hostname,service",
+              messageFormat: "[{module}] {msg}",
+              destination: 1,
+            },
+            level: logLevel,
           },
-        });
+          {
+            target: "pino/file",
+            options: { destination: absLogPath, mkdir: true },
+            level: logLevel,
+          },
+        ]);
+        return pino(transportConfig, stream);
       }
 
       // Production: JSON → stdout + JSON → file
-      return pino({
-        ...transportConfig,
-        transport: {
-          targets: [
-            {
-              target: "pino/file",
-              options: { destination: 1 }, // stdout
-              level: logLevel,
-            },
-            {
-              target: "pino/file",
-              options: { destination: absLogPath, mkdir: true },
-              level: logLevel,
-            },
-          ],
-        },
-      });
+      {
+        const stream = buildFileTransportStream([
+          {
+            target: "pino/file",
+            options: { destination: 1 }, // stdout
+            level: logLevel,
+          },
+          {
+            target: "pino/file",
+            options: { destination: absLogPath, mkdir: true },
+            level: logLevel,
+          },
+        ]);
+        return pino(transportConfig, stream);
+      }
     } catch (err) {
       // Log the actual error for diagnostics (issue #165)
       try {
@@ -123,6 +145,15 @@ function buildLogger(): pino.Logger {
       try {
         const absLogPath = resolve(logConfig.logFilePath);
         const fileDestination = pino.destination({ dest: absLogPath, mkdir: true, sync: true });
+        fileDestination.on("error", (err: unknown) => {
+          try {
+            process.stderr.write(
+              `[logger] sync log destination write failed, dropping log line: ${(err as Error)?.message || err}\n`
+            );
+          } catch {
+            // Nothing more we can do — never let a logging failure crash the process.
+          }
+        });
 
         // Production fallback: JSON to both stdout and file via multistream
         return pino(
diff --git a/src/shared/utils/rateLimiter.ts b/src/shared/utils/rateLimiter.ts
index a4da29cf88..bb268ba5f0 100644
--- a/src/shared/utils/rateLimiter.ts
+++ b/src/shared/utils/rateLimiter.ts
@@ -1,4 +1,4 @@
-import Redis from "ioredis";
+import type Redis from "ioredis";
 
 // Redis is optional. When REDIS_URL is unset, use a process-local fallback
 // instead of probing localhost on every API request.
@@ -7,7 +7,17 @@ if (process.env.NODE_ENV === "production" && !REDIS_URL) {
   console.warn("[REDIS] REDIS_URL is not set in production. Using in-memory rate limiting.");
 }
 
-let redisClient: Redis | null = null;
+// #6559 — `ioredis` must stay a LAZY dependency here. This module is bundled
+// (via esbuild --packages=external) into the MCP server output, and esbuild
+// hoists any static top-level `import ... from "ioredis"` into a real
+// top-level ESM import in the compiled bundle — even though this module is
+// only ever reached through a dynamic `await import(...)` several call-sites
+// deep (apiKeys.ts -> mcpCallerIdentity.ts -> compressionTools.ts -> server.ts).
+// A static import forces Node to resolve `ioredis` at module-link time,
+// before any `--mcp` startup code runs, and `ioredis` is not guaranteed to
+// ship in the MCP-only bundle's node_modules. Mirrors the established
+// soft-dependency pattern in src/lib/quota/redisQuotaStore.ts.
+let redisClientPromise: Promise<Redis> | null = null;
 
 export function isRedisConfigured(): boolean {
   return REDIS_URL.length > 0;
@@ -43,29 +53,41 @@ export function _createRedisLogThrottleForTests() {
   return createRedisLogThrottle();
 }
 
-export function getRedisClient() {
+/**
+ * Return the singleton Redis client, creating it (lazily importing `ioredis`)
+ * on first call. Throws SYNCHRONOUSLY (not a rejected Promise) when Redis is
+ * not configured — callers rely on this to fail fast without an `await`.
+ * Otherwise returns a Promise that resolves once the client is constructed.
+ */
+export function getRedisClient(): Promise<Redis> {
   if (!isRedisConfigured()) {
     throw new Error("Redis is not configured");
   }
 
-  if (!redisClient) {
-    redisClient = new Redis(REDIS_URL, {
-      maxRetriesPerRequest: 3,
-      enableReadyCheck: false,
-      retryStrategy(times) {
-        return Math.min(times * 50, 2000); // Exponential backoff
-      },
-    });
-    redisClient.on("error", (err) => {
-      // Throttle: log once per error-state change instead of on every retry (#4878).
-      if (redisLogThrottle.shouldLog(err.message)) {
-        console.error("[REDIS] Error:", err.message);
-      }
-    });
-    // A successful connection resets the throttle so the next failure logs again.
-    redisClient.on("ready", () => redisLogThrottle.reset());
+  if (!redisClientPromise) {
+    redisClientPromise = (async () => {
+      // Lazy dynamic import — see the #6559 note above the singleton declaration.
+      const mod = await import("ioredis");
+      const RedisCtor = (mod.default ?? mod) as typeof Redis;
+      const client = new RedisCtor(REDIS_URL, {
+        maxRetriesPerRequest: 3,
+        enableReadyCheck: false,
+        retryStrategy(times) {
+          return Math.min(times * 50, 2000); // Exponential backoff
+        },
+      });
+      client.on("error", (err) => {
+        // Throttle: log once per error-state change instead of on every retry (#4878).
+        if (redisLogThrottle.shouldLog(err.message)) {
+          console.error("[REDIS] Error:", err.message);
+        }
+      });
+      // A successful connection resets the throttle so the next failure logs again.
+      client.on("ready", () => redisLogThrottle.reset());
+      return client;
+    })();
   }
-  return redisClient;
+  return redisClientPromise;
 }
 
 export interface RateLimitRule {
@@ -216,7 +238,7 @@ export async function checkRateLimit(
     return checkInMemoryRateLimit(FALLBACK_MEMORY_STORE, keyId, rules);
   }
 
-  const redis = getRedisClient();
+  const redis = await getRedisClient();
 
   const args: (string | number)[] = [Math.floor(Date.now() / 1000)];
 
diff --git a/src/shared/utils/sidebarSearch.ts b/src/shared/utils/sidebarSearch.ts
new file mode 100644
index 0000000000..6f5422cdec
--- /dev/null
+++ b/src/shared/utils/sidebarSearch.ts
@@ -0,0 +1,68 @@
+// Pure, framework-free filtering for the sidebar quick-search (#4013).
+// Operates on the already-resolved (labeled) section/child shape produced by
+// Sidebar.tsx, so it has no dependency on next-intl/React and stays trivially
+// unit-testable.
+
+export interface SearchableLabeled {
+  label: string;
+}
+
+export interface SearchableGroup<TItem extends SearchableLabeled> {
+  type: "group";
+  items: readonly TItem[];
+}
+
+export type SearchableChild<TItem extends SearchableLabeled> =
+  | TItem
+  | SearchableGroup<TItem>;
+
+export interface SearchableSection<TItem extends SearchableLabeled> {
+  children: readonly SearchableChild<TItem>[];
+}
+
+function isGroupChild<TItem extends SearchableLabeled>(
+  child: SearchableChild<TItem>
+): child is SearchableGroup<TItem> {
+  return (
+    typeof child === "object" &&
+    child !== null &&
+    "type" in child &&
+    (child as { type?: unknown }).type === "group"
+  );
+}
+
+/**
+ * Filters sidebar sections by a free-text query matched (case-insensitive,
+ * substring) against each item's resolved label. Groups are kept only if at
+ * least one of their items still matches; sections are kept only if at least
+ * one child (flat item or non-empty group) still matches. Passing an empty/
+ * whitespace-only query returns the input sections unchanged.
+ */
+export function filterSidebarSectionsByQuery<
+  TItem extends SearchableLabeled,
+  TSection extends SearchableSection<TItem>,
+>(sections: readonly TSection[], query: string): TSection[] {
+  const needle = query.trim().toLowerCase();
+  if (!needle) return [...sections];
+
+  const matches = (item: TItem) => item.label.toLowerCase().includes(needle);
+
+  const result: TSection[] = [];
+  for (const section of sections) {
+    const children: SearchableChild<TItem>[] = [];
+    for (const child of section.children) {
+      if (isGroupChild(child)) {
+        const items = child.items.filter(matches);
+        if (items.length > 0) {
+          children.push({ ...child, items });
+        }
+      } else if (matches(child)) {
+        children.push(child);
+      }
+    }
+    if (children.length > 0) {
+      result.push({ ...section, children } as TSection);
+    }
+  }
+  return result;
+}
diff --git a/src/shared/utils/wsPath.ts b/src/shared/utils/wsPath.ts
new file mode 100644
index 0000000000..b1a47d47db
--- /dev/null
+++ b/src/shared/utils/wsPath.ts
@@ -0,0 +1,29 @@
+/**
+ * Derive the live WebSocket path from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`.
+ *
+ * Only `ws://` or `wss://` URLs are accepted (mirrors the scheme guard in
+ * `getLivePublicUrl()`). The pathname is extracted and used as the WS upgrade
+ * path; if the URL has no pathname (or is `/`), falls back to `/live-ws`.
+ *
+ * Used by:
+ * - `src/app/api/v1/ws/route.ts` — handshake response `path` field
+ * - `src/hooks/useLiveDashboard.ts` — build-time path constant + runtime discovery
+ *
+ * No env var is introduced — this reads the existing `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`.
+ */
+export function deriveLiveWsPath(publicUrl?: string): string {
+  if (!publicUrl) return "/live-ws";
+  if (!publicUrl.startsWith("ws://") && !publicUrl.startsWith("wss://")) return "/live-ws";
+  try {
+    const parsed = new URL(publicUrl);
+    const pathname = parsed.pathname;
+    return pathname && pathname !== "/" ? pathname : "/live-ws";
+  } catch {
+    return "/live-ws";
+  }
+}
+
+/** Convenience: read the env var at call time and derive the path. */
+export function getLiveWsPath(): string {
+  return deriveLiveWsPath(process.env.NEXT_PUBLIC_LIVE_WS_PUBLIC_URL);
+}
diff --git a/src/shared/validation/compressionConfigSchemas.ts b/src/shared/validation/compressionConfigSchemas.ts
index 9a473598b0..c57be7dd7d 100644
--- a/src/shared/validation/compressionConfigSchemas.ts
+++ b/src/shared/validation/compressionConfigSchemas.ts
@@ -7,6 +7,7 @@ export const compressionModeSchema = z.enum([
   "aggressive",
   "ultra",
   "rtk",
+  "omniglyph",
   "stacked",
 ]);
 
@@ -60,6 +61,7 @@ export const rtkConfigSchema = z
     groupingThreshold: z.number().int().min(2).max(100).optional(),
     stripCodeComments: z.boolean().optional(),
     preserveDocstrings: z.boolean().optional(),
+    enableRenderers: z.boolean().optional(),
   })
   .strict();
 
@@ -139,6 +141,19 @@ export const ultraConfigSchema = z
 
 const noConfigSchema = z.object({}).strict();
 
+// Structural engines (session-dedup / ccr / headroom / relevance / llmlingua) do not
+// expose a fixed intensity enum in ENGINE_CATALOG — accept optional free-form intensity
+// and a loose config bag so GET→PUT round-trips of stackedPipeline succeed (#6747).
+const structuralStepConfigSchema = z.record(z.string(), z.unknown()).optional();
+
+/**
+ * Writable stacked-pipeline step shape for PUT /api/settings/compression and
+ * PUT /api/context/combos/[id]. MUST accept every engine id in ENGINE_CATALOG /
+ * GET /api/compression/engines and every engine the DB normalizer keeps
+ * (src/lib/db/compression.ts STACKED_PIPELINE_ENGINE_IDS). Issue #6747: a 5-engine
+ * discriminator rejected session-dedup/ccr/headroom/relevance/llmlingua on write even
+ * though GET returned them.
+ */
 export const stackedPipelineStepSchema = z.discriminatedUnion("engine", [
   z
     .object({
@@ -157,7 +172,8 @@ export const stackedPipelineStepSchema = z.discriminatedUnion("engine", [
   z
     .object({
       engine: z.literal("aggressive"),
-      intensity: z.literal("standard").optional(),
+      // #6747: previously only "standard"; GET / engines.level may echo "ultra"
+      intensity: z.enum(["standard", "ultra"]).optional(),
       config: aggressiveConfigSchema.optional(),
     })
     .strict(),
@@ -175,6 +191,48 @@ export const stackedPipelineStepSchema = z.discriminatedUnion("engine", [
       config: rtkConfigSchema.optional(),
     })
     .strict(),
+  z
+    .object({
+      engine: z.literal("session-dedup"),
+      intensity: z.string().optional(),
+      config: structuralStepConfigSchema,
+    })
+    .strict(),
+  z
+    .object({
+      engine: z.literal("ccr"),
+      intensity: z.string().optional(),
+      config: structuralStepConfigSchema,
+    })
+    .strict(),
+  z
+    .object({
+      engine: z.literal("headroom"),
+      intensity: z.string().optional(),
+      config: structuralStepConfigSchema,
+    })
+    .strict(),
+  z
+    .object({
+      engine: z.literal("relevance"),
+      intensity: z.string().optional(),
+      config: structuralStepConfigSchema,
+    })
+    .strict(),
+  z
+    .object({
+      engine: z.literal("llmlingua"),
+      intensity: z.string().optional(),
+      config: structuralStepConfigSchema,
+    })
+    .strict(),
+  z
+    .object({
+      engine: z.literal("omniglyph"),
+      intensity: z.string().optional(),
+      config: structuralStepConfigSchema,
+    })
+    .strict(),
 ]);
 
 /**
@@ -183,17 +241,23 @@ export const stackedPipelineStepSchema = z.discriminatedUnion("engine", [
  * dropdowns and `stackedPipelineStepSchema`: every engine/intensity offered here is,
  * by construction, accepted by the API update schema.
  *
- * Do NOT add an engine here that is not a branch of `stackedPipelineStepSchema` — the
- * `PUT /api/context/combos/[id]` route validates against that discriminated union and
- * would reject the payload with HTTP 400 (#4955: the UI previously offered `headroom`,
- * `session-dedup`, `ccr`, `llmlingua`, none of which the union accepts, so selecting
- * one silently failed the save). The parity is guarded by a unit test.
+ * Every ENGINE_CATALOG id must appear here (empty intensity list = no level selector).
+ * Parity with `stackedPipelineStepSchema` is guarded by unit tests (#4955 / #6747).
+ * #4955 fixed a UI/schema drift by shrinking the UI; #6747 expands the schema so the
+ * full catalog (and GET stackedPipeline) can round-trip on PUT.
  */
 export const STACKED_PIPELINE_ENGINE_INTENSITIES: Record<string, readonly string[]> = {
-  rtk: ["minimal", "standard", "aggressive"],
-  caveman: ["lite", "full", "ultra"],
+  // Order matches ENGINE_CATALOG stackPriority for readability
+  "session-dedup": [],
+  ccr: [],
   lite: ["lite"],
-  aggressive: ["standard"],
+  rtk: ["minimal", "standard", "aggressive"],
+  headroom: [],
+  relevance: [],
+  caveman: ["lite", "full", "ultra"],
+  aggressive: ["standard", "ultra"],
+  llmlingua: [],
+  omniglyph: [],
   ultra: ["ultra"],
 };
 
diff --git a/src/shared/validation/freeProxySchemas.ts b/src/shared/validation/freeProxySchemas.ts
index 445e9c90c0..39d3e6cd03 100644
--- a/src/shared/validation/freeProxySchemas.ts
+++ b/src/shared/validation/freeProxySchemas.ts
@@ -15,6 +15,8 @@ export const freeProxyListSchema = z.object({
     .optional()
     .transform((v) => v?.toUpperCase()),
   minQuality: z.coerce.number().int().min(0).max(100).optional(),
+  search: z.string().trim().min(1).max(128).optional(),
+  sortBy: z.enum(["quality", "latency", "recent"]).optional(),
   limit: z.coerce.number().int().min(1).max(1000).optional(),
   offset: z.coerce.number().int().min(0).optional(),
   onlyNotInPool: z
@@ -87,10 +89,7 @@ export const cloudflareDeploySchema = z.object({
     .string()
     .min(8, "Cloudflare Account ID looks too short")
     .max(64)
-    .regex(
-      /^[a-f0-9]+$/,
-      "Cloudflare Account ID must be lowercase hex"
-    ),
+    .regex(/^[a-f0-9]+$/, "Cloudflare Account ID must be lowercase hex"),
   // Cloudflare API tokens are opaque alphanumeric (40+ chars) — same alphabet
   // we accept for Vercel tokens; constrain length to catch paste accidents.
   apiToken: z
@@ -108,4 +107,3 @@ export const cloudflareDeploySchema = z.object({
     .regex(/^[a-z0-9-]+$/, "Worker name must be lowercase alphanumeric with hyphens")
     .default("omniroute-relay"),
 });
-
diff --git a/src/shared/validation/providerSpecificData.ts b/src/shared/validation/providerSpecificData.ts
index 0087dd0e64..c07aceb52e 100644
--- a/src/shared/validation/providerSpecificData.ts
+++ b/src/shared/validation/providerSpecificData.ts
@@ -13,7 +13,7 @@ function isHttpUrl(value: string): boolean {
   }
 }
 
-const CODEX_REASONING_EFFORT_VALUES = new Set(["none", "low", "medium", "high", "xhigh"]);
+const CODEX_REASONING_EFFORT_VALUES = new Set(["none", "low", "medium", "high", "xhigh", "max"]);
 const REQUEST_DEFAULT_SERVICE_TIER_VALUES = new Set(["default", "priority", "fast", "flex"]);
 
 export function validateProviderSpecificData(
@@ -131,7 +131,7 @@ export function validateProviderSpecificData(
         ctx.addIssue({
           code: z.ZodIssueCode.custom,
           message:
-            "providerSpecificData.requestDefaults.reasoningEffort must be one of none, low, medium, high, xhigh",
+            "providerSpecificData.requestDefaults.reasoningEffort must be one of none, low, medium, high, xhigh, max",
           path: ["requestDefaults", "reasoningEffort"],
         });
       }
diff --git a/src/shared/validation/schemas/auth.ts b/src/shared/validation/schemas/auth.ts
index 2e7e6bb1ac..0872bc890d 100644
--- a/src/shared/validation/schemas/auth.ts
+++ b/src/shared/validation/schemas/auth.ts
@@ -193,6 +193,16 @@ export const kiroImportSchema = z.object({
   clientSecret: z.string().optional(),
   authMethod: z.string().optional(),
   profileArn: z.string().optional(),
+  // External IdP ("Your organization" / Microsoft Entra) token fields — present
+  // when authMethod === "external_idp". The token is refreshed via a public-client
+  // OAuth2 grant against `tokenEndpoint` using `clientId` + `scopes` (no secret).
+  tokenEndpoint: z.string().optional(),
+  scopes: z.union([z.string(), z.array(z.string())]).optional(),
+});
+
+export const kiroApiKeyImportSchema = z.object({
+  apiKey: z.string().trim().min(1, "API key is required"),
+  region: z.string().trim().default("us-east-1"),
 });
 
 export const zedImportSchema = z.object({
diff --git a/src/shared/validation/schemas/cli.ts b/src/shared/validation/schemas/cli.ts
index b3e6a223e8..554ec47556 100644
--- a/src/shared/validation/schemas/cli.ts
+++ b/src/shared/validation/schemas/cli.ts
@@ -14,7 +14,6 @@ import {
 } from "@/shared/constants/upstreamHeaders";
 import { MAX_TIMER_TIMEOUT_MS } from "@/shared/utils/runtimeTimeouts";
 
-
 export const cliMitmStartSchema = z.object({
   apiKey: z.string().trim().min(1).nullable().optional(),
   keyId: z.string().trim().min(1).nullable().optional(),
@@ -69,7 +68,7 @@ export const cliModelConfigSchema = z.object({
   baseUrl: z.string().trim().min(1, "baseUrl and model are required"),
   apiKey: z.string().nullable().optional(),
   model: z.string().trim().min(1, "baseUrl and model are required"),
-  reasoningEffort: z.enum(["none", "low", "medium", "high", "xhigh"]).optional(),
+  reasoningEffort: z.enum(["none", "low", "medium", "high", "xhigh", "max", "ultra"]).optional(),
   wireApi: z.enum(["chat", "responses"]).optional(),
   modelMappings: z.record(z.string().trim().min(1), z.string().trim().min(1)).optional(),
 });
@@ -83,4 +82,10 @@ export const cliModelConfigSchema = z.object({
 export const cliMultiModelConfigSchema = cliModelConfigSchema.extend({
   models: z.array(z.string().trim().min(1)).optional(),
   activeModel: z.string().optional(),
-});
\ No newline at end of file
+});
+
+export const cliAuthOnlyConfigSchema = z.object({
+  baseUrl: z.string().trim().min(1, "baseUrl is required"),
+  apiKey: z.string().nullable().optional(),
+  overwrite: z.boolean().optional(),
+});
diff --git a/src/shared/validation/schemas/combo.ts b/src/shared/validation/schemas/combo.ts
index 96a76673e9..5c00a1be08 100644
--- a/src/shared/validation/schemas/combo.ts
+++ b/src/shared/validation/schemas/combo.ts
@@ -114,6 +114,7 @@ export const compressionModeSchema = z.enum([
   "ultra",
   "rtk",
   "stacked",
+  "omniglyph",
 ]);
 
 export const comboCompressionOverrideSchema = z.union([z.literal(""), compressionModeSchema]);
@@ -229,6 +230,18 @@ export const comboRuntimeConfigSchema = z
       })
       .strict()
       .optional(),
+    // Context window requirements for combo target filtering and sorting.
+    // minContextWindow: filters out models with context windows below this threshold.
+    // preferLargeContext: sorts remaining targets by context size (descending).
+    // contextFilterMode: "strict" excludes unknown-context models, "lenient" includes them.
+    contextRequirements: z
+      .object({
+        minContextWindow: z.coerce.number().int().min(0).max(10_000_000).optional(),
+        preferLargeContext: z.boolean().optional(),
+        contextFilterMode: z.enum(["strict", "lenient"]).optional(),
+      })
+      .strict()
+      .optional(),
   })
   .passthrough()
   .transform((config) => {
@@ -278,7 +291,11 @@ export const createComboSchema = z.object({
   // the `dimensions` field (and translated to `outputDimensionality` for Gemini).
   // Stored as a string to match the OpenAI API convention; coerced to number
   // by the embedding handler. Leave unset to use each model's default.
-  dimensions: z.string().regex(/^\d+$/, "dimensions must be a positive integer string").optional().nullable(),
+  dimensions: z
+    .string()
+    .regex(/^\d+$/, "dimensions must be a positive integer string")
+    .optional()
+    .nullable(),
 });
 
 export const updateComboDefaultsSchema = z
@@ -328,7 +345,11 @@ export const updateComboSchema = z
     context_cache_protection: z.boolean().optional(),
     context_length: z.number().int().min(1000).max(2000000).optional().nullable(),
     compressionOverride: comboCompressionOverrideSchema.optional(),
-    dimensions: z.string().regex(/^\d+$/, "dimensions must be a positive integer string").optional().nullable(),
+    dimensions: z
+      .string()
+      .regex(/^\d+$/, "dimensions must be a positive integer string")
+      .optional()
+      .nullable(),
   })
   .superRefine((value, ctx) => {
     if (
diff --git a/src/shared/validation/schemas/keys.ts b/src/shared/validation/schemas/keys.ts
index e3db9b7928..3bbe9543e8 100644
--- a/src/shared/validation/schemas/keys.ts
+++ b/src/shared/validation/schemas/keys.ts
@@ -25,6 +25,7 @@ export const createKeySchema = z.object({
   usageLimitEnabled: z.boolean().optional(),
   dailyUsageLimitUsd: z.coerce.number().min(0).optional().nullable(),
   weeklyUsageLimitUsd: z.coerce.number().min(0).optional().nullable(),
+  chaosModeEnabled: z.boolean().optional(),
   scopes: z.array(z.string().trim().min(1).max(64)).max(32).optional(),
 });
 
@@ -110,6 +111,7 @@ export const updateKeyPermissionsSchema = z
     usageLimitEnabled: z.boolean().optional(),
     dailyUsageLimitUsd: z.coerce.number().min(0).optional().nullable(),
     weeklyUsageLimitUsd: z.coerce.number().min(0).optional().nullable(),
+    chaosModeEnabled: z.boolean().optional(),
   })
   .superRefine((value, ctx) => {
     if (
@@ -133,7 +135,8 @@ export const updateKeyPermissionsSchema = z
       value.allowUsageCommand === undefined &&
       value.usageLimitEnabled === undefined &&
       value.dailyUsageLimitUsd === undefined &&
-      value.weeklyUsageLimitUsd === undefined
+      value.weeklyUsageLimitUsd === undefined &&
+      value.chaosModeEnabled === undefined
     ) {
       ctx.addIssue({
         code: z.ZodIssueCode.custom,
diff --git a/src/shared/validation/schemas/misc.ts b/src/shared/validation/schemas/misc.ts
index 54aa8e4e40..050598efdc 100644
--- a/src/shared/validation/schemas/misc.ts
+++ b/src/shared/validation/schemas/misc.ts
@@ -14,7 +14,6 @@ import {
 } from "@/shared/constants/upstreamHeaders";
 import { MAX_TIMER_TIMEOUT_MS } from "@/shared/utils/runtimeTimeouts";
 
-
 export function isHttpUrl(value: string): boolean {
   try {
     const parsed = new URL(value);
@@ -24,7 +23,14 @@ export function isHttpUrl(value: string): boolean {
   }
 }
 
-export const CODEX_REASONING_EFFORT_VALUES = new Set(["none", "low", "medium", "high", "xhigh"]);
+export const CODEX_REASONING_EFFORT_VALUES = new Set([
+  "none",
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+  "max",
+]);
 
 export const REQUEST_DEFAULT_SERVICE_TIER_VALUES = new Set(["default", "priority", "fast", "flex"]);
 
@@ -200,4 +206,4 @@ export const confirmedAccountSchema = z.object({
   fingerprint: z.string().min(1).max(100),
 });
 
-export type ConfirmedAccount = z.infer<typeof confirmedAccountSchema>;
\ No newline at end of file
+export type ConfirmedAccount = z.infer<typeof confirmedAccountSchema>;
diff --git a/src/shared/validation/schemas/provider.ts b/src/shared/validation/schemas/provider.ts
index 07b7d2ea1b..c45bd4fb2d 100644
--- a/src/shared/validation/schemas/provider.ts
+++ b/src/shared/validation/schemas/provider.ts
@@ -41,10 +41,21 @@ const providerNodeIconUrlSchema = z
   })
   .optional();
 
+// #6715: the `apiKey` field is reused as the raw `Cookie:` header value for
+// cookie-based web providers (Gemini Business, Copilot M365, ChatGPT Web,
+// Claude Web, …). Real multi-cookie session headers (many `__Secure-*` entries,
+// large session tokens) legitimately exceed the old 10,000-char cap, so saving
+// a cookie that the provider's own `validate` check (validateProviderApiKeySchema,
+// uncapped) had already accepted failed with HTTP 400 "Too big …<=10000". Raised
+// to a still-bounded ceiling — well under the 10 MB default request-body limit and
+// the unconstrained SQLite TEXT column — so garbage input is still rejected.
+// Same fix shape as #6562 (priority cap raised to 100_000).
+export const MAX_PROVIDER_CREDENTIAL_LENGTH = 100_000;
+
 export const createProviderSchema = z
   .object({
     provider: z.string().min(1).max(100),
-    apiKey: z.string().max(10000).optional(),
+    apiKey: z.string().max(MAX_PROVIDER_CREDENTIAL_LENGTH).optional(),
     name: z.string().min(1).max(200),
     priority: z.number().int().min(1).max(100).optional(),
     globalPriority: z.number().int().min(1).max(100).nullable().optional(),
@@ -91,7 +102,7 @@ export const bulkCreateProviderSchema = z
       .array(
         z.object({
           name: z.string().min(1).max(200),
-          apiKey: z.string().min(1).max(10000),
+          apiKey: z.string().min(1).max(MAX_PROVIDER_CREDENTIAL_LENGTH),
           // Per-key account id — required for cloudflare-ai (enforced in superRefine below).
           accountId: z.string().min(1).max(200).optional(),
         })
@@ -197,6 +208,12 @@ export const providerModelMutationSchema = z.object({
   // catalog); they persist as inputTokenLimit / outputTokenLimit.
   max_input_tokens: z.number().int().positive().optional(),
   max_output_tokens: z.number().int().positive().optional(),
+  // #4125: manual context-window override for a specific provider/model. Persisted
+  // via the Feature-5004 `model_context_overrides` table (source="manual") so it wins
+  // over the auto-discovery/static-catalog context window in `getModelContextLimit()`
+  // — fixes the "provider misreports context length" combo-drop case. `null` clears
+  // a previously set override.
+  contextWindowOverride: z.number().int().positive().nullable().optional(),
   normalizeToolCallId: z.boolean().optional(),
   preserveOpenAIDeveloperRole: z.boolean().nullable().optional(),
   upstreamHeaders: upstreamHeadersRecordSchema.nullable().optional(),
@@ -291,11 +308,20 @@ export const providerNodeValidateSchema = z.object({
 export const updateProviderConnectionSchema = z
   .object({
     name: z.string().max(200).optional(),
-    priority: z.coerce.number().int().min(1).max(100).optional(),
-    globalPriority: z.union([z.coerce.number().int().min(1).max(100), z.null()]).optional(),
+    // #6562: `priority` is auto-incremented on connection creation
+    // (src/lib/db/providers.ts::createProviderConnection — `MAX(priority)+1` per
+    // provider, unbounded) and the edit UI always round-trips the connection's
+    // current priority unchanged. Providers whose accounts are commonly rotated
+    // in bulk (e.g. Codex OAuth import-bulk, up to 50 entries per call, repeatable)
+    // routinely exceed 100 connections, so a `max(100)` UI-only ceiling here
+    // rejected re-saving an already-valid, already-persisted priority with
+    // "Invalid request" on every edit. Bounded well above any realistic
+    // connection count (still rejects garbage input) rather than removed.
+    priority: z.coerce.number().int().min(1).max(100_000).optional(),
+    globalPriority: z.union([z.coerce.number().int().min(1).max(100_000), z.null()]).optional(),
     defaultModel: z.union([z.string().max(200), z.null()]).optional(),
     isActive: z.boolean().optional(),
-    apiKey: z.string().max(10000).optional(),
+    apiKey: z.string().max(MAX_PROVIDER_CREDENTIAL_LENGTH).optional(),
     testStatus: z.string().max(50).optional(),
     lastError: z.union([z.string(), z.null()]).optional(),
     lastErrorAt: z.union([z.string(), z.null()]).optional(),
@@ -409,6 +435,21 @@ export const batchUpdateProviderConnectionsSchema = z.object({
   isActive: z.boolean(),
 });
 
+// PUT /api/providers/[id]/param-filters — upsert provider/model param filter config
+const paramFilterListSchema = z.array(z.string().trim().min(1).max(200)).max(500);
+
+const modelParamFilterSchema = z.object({
+  block: paramFilterListSchema.optional(),
+  allow: paramFilterListSchema.optional(),
+});
+
+export const updateParamFilterConfigSchema = z.object({
+  block: paramFilterListSchema.optional(),
+  allow: paramFilterListSchema.optional(),
+  models: z.record(z.string().trim().min(1).max(200), modelParamFilterSchema).optional(),
+  autoLearn: z.boolean().optional(),
+});
+
 export const validateProviderApiKeySchema = z
   .object({
     provider: z.string().trim().min(1, "Provider and API key required"),
diff --git a/src/shared/validation/schemas/proxy.ts b/src/shared/validation/schemas/proxy.ts
index b6673c15e6..ff49b75e78 100644
--- a/src/shared/validation/schemas/proxy.ts
+++ b/src/shared/validation/schemas/proxy.ts
@@ -14,7 +14,6 @@ import {
 } from "@/shared/constants/upstreamHeaders";
 import { MAX_TIMER_TIMEOUT_MS } from "@/shared/utils/runtimeTimeouts";
 
-
 export const proxyConfigSchema = z
   .object({
     type: z
@@ -109,8 +108,7 @@ export const proxyRegistryFieldsSchema = z
         (value) => (typeof value === "string" ? value.trim().toLowerCase() : value),
         z.enum(["http", "https", "socks5", "vercel", "deno", "cloudflare"])
       )
-      .optional()
-      .default("http"),
+      .optional(),
     host: z.string().trim().min(1, "host is required").max(255),
     port: z.coerce.number().int().min(1).max(65535),
     username: z.string().optional(),
@@ -136,6 +134,13 @@ export const proxyRegistryFieldsSchema = z
 
 export const createProxyRegistrySchema = proxyRegistryFieldsSchema
   .extend({
+    type: z
+      .preprocess(
+        (value) => (typeof value === "string" ? value.trim().toLowerCase() : value),
+        z.enum(["http", "https", "socks5", "vercel", "deno", "cloudflare"])
+      )
+      .optional()
+      .default("http"),
     assignment: inlineProxyAssignmentSchema.optional(),
   })
   .strict();
@@ -201,6 +206,7 @@ export const PROXY_POOL_ROTATION_STRATEGY_VALUES = [
   "round-robin",
   "random",
   "sticky",
+  "latency",
 ] as const;
 
 // Add/remove one proxy to/from a scope's pool. proxyId is REQUIRED (unlike the
@@ -240,4 +246,4 @@ export const proxyRotationStrategySchema = z
         path: ["scopeId"],
       });
     }
-  });
\ No newline at end of file
+  });
diff --git a/src/shared/validation/settingsSchemas.ts b/src/shared/validation/settingsSchemas.ts
index cb0b63d084..f38034ce07 100644
--- a/src/shared/validation/settingsSchemas.ts
+++ b/src/shared/validation/settingsSchemas.ts
@@ -183,6 +183,18 @@ export const updateSettingsSchema = z.object({
   fallbackStrategy: z.enum(ACCOUNT_FALLBACK_STRATEGY_VALUES).optional(),
   wildcardAliases: z.array(z.object({ pattern: z.string(), target: z.string() })).optional(),
   stickyRoundRobinLimit: z.number().int().min(0).max(1000).optional(),
+  /** 9router parity: global combo expansion strategy (fallback vs round-robin). */
+  comboStrategy: z.enum(["fallback", "round-robin"]).optional(),
+  comboStickyRoundRobinLimit: z.number().int().min(1).max(100).nullable().optional(),
+  providerStrategies: z
+    .record(
+      z.string().trim().min(1),
+      z.object({
+        fallbackStrategy: z.enum(ACCOUNT_FALLBACK_STRATEGY_VALUES).optional(),
+        stickyRoundRobinLimit: z.number().int().min(1).max(1000).optional(),
+      })
+    )
+    .optional(),
   // #6168: global session-stickiness opt-out (per-combo config overrides this).
   disableSessionStickiness: z.boolean().optional(),
   requestRetry: z.number().int().min(0).max(10).optional(),
diff --git a/src/sse/handlers/chat.ts b/src/sse/handlers/chat.ts
index b2539ad822..0bee6caa42 100644
--- a/src/sse/handlers/chat.ts
+++ b/src/sse/handlers/chat.ts
@@ -20,14 +20,12 @@ import {
 import { getModelInfo, getComboForModel } from "../services/model";
 import { resolveBareModelToConnectionDefault } from "@omniroute/open-sse/services/model.ts";
 import { errorResponse } from "@omniroute/open-sse/utils/error.ts";
+import { getImageModelEntry } from "@omniroute/open-sse/config/imageRegistry.ts";
 import { acceptHeaderForcesStream } from "@omniroute/open-sse/utils/aiSdkCompat.ts";
 import { isSelfInflictedUpstreamTimeout } from "@omniroute/open-sse/handlers/chatCore/cooldownClassification.ts";
 import { applyNoThinkingAlias } from "@omniroute/open-sse/utils/noThinkingAlias.ts";
 import { handleComboChat } from "@omniroute/open-sse/services/combo.ts";
-import {
-  resolveRequestModePack,
-  parseRequestBudgetCap,
-} from "@omniroute/open-sse/services/autoCombo/requestControls.ts";
+import { resolveRequestAutoControls } from "@omniroute/open-sse/services/autoCombo/requestControls.ts";
 import { resolveComboConfig } from "@omniroute/open-sse/services/comboConfig.ts";
 import { injectHandoffIntoBody } from "@omniroute/open-sse/services/contextHandoff.ts";
 import {
@@ -36,6 +34,7 @@ import {
 } from "@omniroute/open-sse/config/constants.ts";
 import { getTargetFormat } from "@omniroute/open-sse/services/provider.ts";
 import {
+  getModelsByProviderId,
   getModelTargetFormat,
   PROVIDER_ID_TO_ALIAS,
 } from "@omniroute/open-sse/config/providerModels.ts";
@@ -54,6 +53,7 @@ import { checkAndRefreshToken } from "../services/tokenRefresh";
 import { createHookContext, runHooks, initPreRequestRegistry } from "@/lib/middleware/registry";
 import { deleteHandoff, getHandoff } from "@/lib/db/contextHandoffs";
 import { updateCombo } from "@/lib/db/combos";
+import { isModelAllowedForKey } from "@/lib/db/apiKeys";
 import { promoteSuccessfulComboModel } from "@/lib/combos/autoPromote";
 import {
   deleteSessionAccountAffinity,
@@ -132,6 +132,7 @@ import {
   waitForCooldownAwareRetry,
 } from "../services/cooldownAwareRetry";
 import { constrainConnectionsToQuota, resolveQuotaKeyScope } from "../../lib/quota/quotaKey";
+import { checkConnectionCapacity } from "../utils/backpressure";
 
 registerCodexQuotaFetcher();
 
@@ -222,6 +223,12 @@ export async function handleChat(
   const reqId = correlationId || generateRequestId();
   const telemetry = new RequestTelemetry(reqId);
 
+  const backpressure = checkConnectionCapacity();
+  if (backpressure.shouldReject) {
+    log.warn("BACKPRESSURE", "Rejecting request: at connection limit");
+    return backpressure.response;
+  }
+
   let body;
   try {
     telemetry.startPhase("parse");
@@ -240,18 +247,30 @@ export async function handleChat(
   // reasoning_effort / reasoning / object-shaped thinking always wins (backward compatible).
   body = normalizeReasoningRequest(body);
 
-  // Early guard: an explicitly empty `messages` array is invalid for every
-  // upstream (Anthropic/OpenAI both reject "at least one message is required").
-  // Forwarding it produced a confusing raw upstream 400/502; reject it here with
-  // a clear OmniRoute-level error before any routing or upstream call (#5110).
-  // Responses-API requests use `input` (not `messages`) so they are unaffected,
-  // and an absent `messages` field is left to downstream validation.
-  if (
-    Array.isArray((body as { messages?: unknown }).messages) &&
-    (body as { messages: unknown[] }).messages.length === 0
-  ) {
-    log.warn("CHAT", "Rejecting request with empty messages array");
-    return errorResponse(HTTP_STATUS.BAD_REQUEST, "messages: at least one message is required");
+  // Early guard: an invalid `messages` field is rejected here with a clear
+  // OmniRoute-level 400 before any routing or upstream call (#5110, #6402).
+  // Without this guard, schema-invalid bodies fell through to model resolution
+  // and surfaced as a misleading 404 `model_not_found` from chatHelpers.ts (#6402).
+  // Cases covered:
+  //   - present-but-non-array (null, number, string, object) → 400 (#6402)
+  //   - empty array → 400 ("at least one message is required") (#5110)
+  //   - missing entirely, when the Responses-API `input` discriminator is also
+  //     absent → 400 (#6402). Responses-API requests use `input` (not `messages`)
+  //     and are still unaffected.
+  {
+    const b = body as { messages?: unknown; input?: unknown };
+    if ("messages" in b && !Array.isArray(b.messages)) {
+      log.warn("CHAT", "Rejecting request with non-array messages");
+      return errorResponse(HTTP_STATUS.BAD_REQUEST, "messages: Expected array");
+    }
+    if (Array.isArray(b.messages) && b.messages.length === 0) {
+      log.warn("CHAT", "Rejecting request with empty messages array");
+      return errorResponse(HTTP_STATUS.BAD_REQUEST, "messages: at least one message is required");
+    }
+    if (!("messages" in b) && !("input" in b)) {
+      log.warn("CHAT", "Rejecting request with missing messages");
+      return errorResponse(HTTP_STATUS.BAD_REQUEST, "messages: Expected array, received undefined");
+    }
   }
 
   // Reject non-string `model` before it reaches downstream code that calls
@@ -300,11 +319,7 @@ export async function handleChat(
       }
     }
     if (b.max_tokens !== undefined) {
-      if (
-        typeof b.max_tokens !== "number" ||
-        !Number.isInteger(b.max_tokens) ||
-        b.max_tokens < 1
-      ) {
+      if (typeof b.max_tokens !== "number" || !Number.isInteger(b.max_tokens) || b.max_tokens < 1) {
         return badParam("max_tokens", "must be a positive integer");
       }
     }
@@ -387,6 +402,25 @@ export async function handleChat(
     return errorResponse(HTTP_STATUS.BAD_REQUEST, "Missing model");
   }
 
+  // Reject image-generation models routed to /v1/chat/completions (#6457).
+  // Image-only models live in IMAGE_PROVIDERS (open-sse/config/imageRegistry.ts)
+  // and are served by /v1/images/generations. Forwarding them to a chat upstream
+  // yielded confusing raw provider 400s (e.g. HuggingFace: "not a chat model").
+  // Models such as Codex GPT-5.5 support both chat and image generation, so an
+  // image-registry match is only image-only when the same provider/model pair is
+  // absent from the chat catalog.
+  const imageModel = getImageModelEntry(modelStr);
+  const isChatCatalogModel = imageModel
+    ? getModelsByProviderId(imageModel.provider).some((model) => model.id === imageModel.model)
+    : false;
+  if (imageModel && !isChatCatalogModel) {
+    log.warn("CHAT", `Rejecting image-generation model on chat endpoint: ${modelStr}`);
+    return errorResponse(
+      HTTP_STATUS.BAD_REQUEST,
+      `Model '${modelStr}' is an image-generation model and cannot be used on /v1/chat/completions. Use POST /v1/images/generations instead.`
+    );
+  }
+
   // T04: client-provided external session header has priority over generated fingerprint.
   const externalSessionId = extractExternalSessionId(request.headers);
   const sessionId = externalSessionId || generateStableSessionId(body);
@@ -437,6 +471,23 @@ export async function handleChat(
     );
   }
   body = preCallGuardrails.payload;
+  if (body?.model && typeof body.model === "string" && body.model !== modelStr) {
+    const rerouteModel = body.model;
+    // A guardrail (e.g. Vision Bridge auto-reroute) can swap body.model AFTER
+    // enforceApiKeyPolicy already validated modelStr's allowlist/budget above.
+    // Re-check the new target against the same per-key allowlist so a
+    // policy-restricted key cannot be silently routed to an unchecked model.
+    const rerouteAllowed = await isModelAllowedForKey(apiKey, rerouteModel);
+    if (!rerouteAllowed) {
+      log.warn(
+        "POLICY",
+        `Guardrail reroute to "${rerouteModel}" rejected by API key policy (key=${apiKeyInfo?.id || "unknown"}); keeping original model "${modelStr}"`
+      );
+      body = { ...body, model: modelStr };
+    } else {
+      modelStr = rerouteModel;
+    }
+  }
   telemetry.endPhase();
 
   // T08: per-key active session limit (0 = unlimited).
@@ -721,17 +772,13 @@ export async function handleChat(
     ]);
     const relayConfig =
       combo.strategy === "context-relay" ? resolveComboConfig(combo, settings) : null;
-    // Per-request Auto-Combo controls (#6023 / #6024 / #6025): steer an `auto`
-    // combo on this single request without mutating its stored config.
-    const requestModeHeader = request.headers.get("x-omniroute-mode")?.trim() || null;
-    const requestBudgetHeader = request.headers.get("x-omniroute-budget")?.trim() || null;
-    const perRequestMode = resolveRequestModePack(requestModeHeader);
-    const perRequestBudgetCap = parseRequestBudgetCap(requestBudgetHeader);
+    // Per-request Auto-Combo controls (#6023 / #6024 / #6025 / #3470): steer an
+    // `auto` combo on this single request without mutating its stored config.
+    const perRequestAutoControls = resolveRequestAutoControls(request.headers);
     const relayOptions =
       combo.strategy === "context-relay" ||
       bypassProviderQuotaPolicy ||
-      perRequestMode.override ||
-      perRequestBudgetCap !== undefined
+      Object.keys(perRequestAutoControls).length > 0
         ? {
             ...(combo.strategy === "context-relay"
               ? {
@@ -740,8 +787,7 @@ export async function handleChat(
                 }
               : {}),
             ...(bypassProviderQuotaPolicy ? { bypassProviderQuotaPolicy: true } : {}),
-            ...(perRequestMode.override ? { mode: requestModeHeader } : {}),
-            ...(perRequestBudgetCap !== undefined ? { budgetCap: perRequestBudgetCap } : {}),
+            ...perRequestAutoControls,
           }
         : undefined;
     telemetry.endPhase();
@@ -862,27 +908,25 @@ export async function handleChat(
 
     // Record telemetry
     recordTelemetry(telemetry);
-    // Log combo failures that bypassed handleChatCore (e.g. all targets skipped by circuit breaker)
+    // Log combo failures that bypassed handleChatCore (e.g. all targets skipped by circuit breaker).
+    // Records BOTH a call_logs row (dashboard/logs) AND a usage_history row attributed to the api key
+    // (success:false) so gate/breaker-rejected traffic is counted per key — support-mesh 2026-07-08.
     if (!response.ok) {
       try {
-        const { saveCallLog } = await import("@/lib/usageDb");
-        saveCallLog({
-          id: undefined,
-          method: "POST",
-          path: clientRawRequest?.endpoint || "/v1/chat/completions",
+        const { recordRejectedRequestUsage } = await import("./rejectedRequestUsage");
+        await recordRejectedRequestUsage({
           status: response.status,
           model: body?.model || resolvedModelStr,
           requestedModel: body?.model || resolvedModelStr,
           provider: "-",
-          connectionId: undefined,
-          duration: Date.now() - (telemetry?.startTime || Date.now()),
-          tokens: {},
+          endpoint: clientRawRequest?.endpoint,
           error: `[${response.status}] Combo "${combo.name}" failed — all targets exhausted`,
           comboName: combo.name,
-          comboStepId: null,
-          comboExecutionKey: null,
+          apiKeyId: apiKeyInfo?.id ?? null,
+          apiKeyName: apiKeyInfo?.name ?? null,
           correlationId: reqId,
-        }).catch(() => {});
+          startTime: telemetry?.startTime,
+        });
       } catch {}
     }
     return withCorrelationId(withSessionHeader(response, sessionId), reqId);
@@ -1086,26 +1130,26 @@ async function handleSingleModelChat(
     ...(bypassReason ? { bypassReason } : {}),
   });
   if (gate) {
-    // Log the rejected request so it appears in /dashboard/logs
+    // Log the rejected request so it appears in /dashboard/logs AND is counted in the
+    // per-api-key usage analytics (usage_history, success:false) — otherwise a key whose
+    // traffic is entirely gate/breaker-rejected shows "zero requests" (support-mesh 2026-07-08).
     try {
-      const { saveCallLog } = await import("@/lib/usageDb");
-      saveCallLog({
-        id: undefined,
-        method: "POST",
-        path: clientRawRequest?.endpoint || "/v1/chat/completions",
+      const { recordRejectedRequestUsage } = await import("./rejectedRequestUsage");
+      await recordRejectedRequestUsage({
         status: gate.status,
         model,
         requestedModel: body?.model || modelStr,
         provider,
-        connectionId: undefined,
-        duration: Date.now() - (telemetry?.startTime || Date.now()),
-        tokens: {},
+        endpoint: clientRawRequest?.endpoint,
         error: `[${gate.status}] Pipeline gate rejected`,
         comboName: isCombo ? comboName : null,
         comboStepId: isCombo ? (runtimeOptions?.comboStepId ?? null) : null,
         comboExecutionKey: isCombo ? (runtimeOptions?.comboExecutionKey ?? null) : null,
+        apiKeyId: apiKeyInfo?.id ?? null,
+        apiKeyName: apiKeyInfo?.name ?? null,
         correlationId: runtimeOptions?.correlationId ?? null,
-      }).catch(() => {});
+        startTime: telemetry?.startTime,
+      });
     } catch {}
     return gate;
   }
diff --git a/src/sse/handlers/chatHelpers.ts b/src/sse/handlers/chatHelpers.ts
index 87eb47a389..603ac78cd6 100644
--- a/src/sse/handlers/chatHelpers.ts
+++ b/src/sse/handlers/chatHelpers.ts
@@ -204,10 +204,20 @@ export async function resolveModelOrError(
 
     try {
       const virtualCombo = await createBuiltinAutoCombo(modelStr, suffix);
+      const poolSize = virtualCombo.candidatePool?.length || 0;
       log.info(
         "AUTO",
-        `"auto" provider → built-in virtual combo "${modelStr}" (${virtualCombo.candidatePool?.length || 0} candidates)`
+        `"auto" provider → built-in virtual combo "${modelStr}" (${poolSize} candidates)`
       );
+      // #6458: fail fast instead of leaking a silent 15s upstream timeout when
+      // the category/tier filter (e.g. auto/coding:pro, auto/reasoning) matches
+      // zero connected candidates. An empty virtual combo has no targets to
+      // dispatch to, so downstream combo routing stalls on an empty set.
+      if (poolSize === 0) {
+        const msg = `No connected providers match '${modelStr}'. Connect a provider whose models satisfy this category/tier, or use a different auto combo.`;
+        log.warn("AUTO", msg, { model: modelStr });
+        return { error: errorResponse(HTTP_STATUS.SERVICE_UNAVAILABLE, msg) };
+      }
       return { combo: virtualCombo, provider: "auto", model: suffix };
     } catch (err) {
       log.warn("CHAT", `Failed to create built-in auto combo "${modelStr}"`, { err });
@@ -577,6 +587,12 @@ export function handleNoCredentials(
       return modelCooldownResponse({
         model: cooldownModel,
         retryAfter: credentials.retryAfter,
+        retryAfterAt:
+          typeof credentials.retryAfter === "string" ? credentials.retryAfter : null,
+        credentialsCoolingCount:
+          typeof credentials.connectionsCount === "number"
+            ? credentials.connectionsCount
+            : null,
       });
     }
 
diff --git a/src/sse/handlers/rejectedRequestUsage.ts b/src/sse/handlers/rejectedRequestUsage.ts
new file mode 100644
index 0000000000..7626e83e81
--- /dev/null
+++ b/src/sse/handlers/rejectedRequestUsage.ts
@@ -0,0 +1,98 @@
+/**
+ * Records a request that was rejected BEFORE reaching handleChatCore — i.e. a
+ * pipeline-gate rejection (provider circuit breaker OPEN / model cooldown) or a
+ * combo whose targets were all exhausted. These paths short-circuit in
+ * `chat.ts` and used to write only a `call_logs` row via `saveCallLog`, which
+ * kept them visible in /dashboard/logs but left them absent from `usage_history`
+ * — the table `getApiKeyUsageRows` reads. The effect was an API key whose
+ * traffic was entirely gate-rejected showing "zero requests" despite real
+ * usage (support-mesh escalation, 2026-07-08).
+ *
+ * This helper writes BOTH:
+ *   1. the `call_logs` row (unchanged dashboard/logs visibility), and
+ *   2. a `usage_history` row attributed to the api key with `success: false`,
+ *      mirroring `persistFailureUsage` in the post-executor failure path,
+ * so rejected traffic is counted per key just like executor-level failures.
+ *
+ * Best-effort: both writes swallow their own errors — logging a rejection must
+ * never turn into a second failure on the response path.
+ */
+import { saveCallLog, saveRequestUsage } from "@/lib/usageDb";
+
+export interface RejectedRequestUsageInput {
+  status: number;
+  model: string;
+  requestedModel?: string;
+  provider: string;
+  endpoint?: string | null;
+  error?: string | null;
+  comboName?: string | null;
+  comboStepId?: string | null;
+  comboExecutionKey?: string | null;
+  correlationId?: string | null;
+  apiKeyId?: string | null;
+  apiKeyName?: string | null;
+  connectionId?: string | null;
+  /** When the request started, for the duration/latency columns. */
+  startTime?: number;
+}
+
+export async function recordRejectedRequestUsage(input: RejectedRequestUsageInput): Promise<void> {
+  const {
+    status,
+    model,
+    requestedModel,
+    provider,
+    endpoint,
+    error,
+    comboName = null,
+    comboStepId = null,
+    comboExecutionKey = null,
+    correlationId = null,
+    apiKeyId = null,
+    apiKeyName = null,
+    connectionId = undefined,
+    startTime,
+  } = input;
+
+  const now = Date.now();
+  const duration = typeof startTime === "number" ? now - startTime : 0;
+
+  // 1. call_logs — preserves /dashboard/logs visibility (unchanged behavior).
+  saveCallLog({
+    id: undefined,
+    method: "POST",
+    path: endpoint || "/v1/chat/completions",
+    status,
+    model,
+    requestedModel: requestedModel || model,
+    provider,
+    connectionId,
+    duration,
+    tokens: {},
+    error: error || null,
+    comboName,
+    comboStepId,
+    comboExecutionKey,
+    apiKeyId,
+    apiKeyName,
+    correlationId,
+  }).catch(() => {});
+
+  // 2. usage_history — so the per-api-key usage counter reflects rejected
+  //    traffic (success:false), matching persistFailureUsage semantics.
+  await saveRequestUsage({
+    provider,
+    model,
+    connectionId: connectionId ?? null,
+    apiKeyId,
+    apiKeyName,
+    tokens: {},
+    serviceTier: "standard",
+    status: String(status),
+    success: false,
+    latencyMs: duration,
+    comboStrategy: comboName || null,
+    endpoint: endpoint || "/v1/chat/completions",
+  }).catch(() => {});
+}
diff --git a/src/sse/services/auth.ts b/src/sse/services/auth.ts
index 3e002a1dfc..1d3b3f31a4 100644
--- a/src/sse/services/auth.ts
+++ b/src/sse/services/auth.ts
@@ -1377,6 +1377,7 @@ export async function getProviderCredentials(
           lastErrorCode: allBlockedByModelCooldown ? 429 : earliestConn?.errorCode || null,
           cooldownScope: allBlockedByModelCooldown ? "model" : "connection",
           cooldownModel: allBlockedByModelCooldown ? requestedModel : null,
+          connectionsCount: connections.length,
         };
       }
       const syntheticFallback = await maybeSyntheticNoAuthFallback(
@@ -1476,7 +1477,13 @@ export async function getProviderCredentials(
 
     const orderedConnections = withQuota;
 
-    const strategy = settings.fallbackStrategy || "fill-first";
+    const providerStrategyOverrides = (settings.providerStrategies || {}) as Record<
+      string,
+      { fallbackStrategy?: string; stickyRoundRobinLimit?: number }
+    >;
+    const providerOverride = providerStrategyOverrides[resolvedId] || {};
+    const strategy =
+      providerOverride.fallbackStrategy || settings.fallbackStrategy || "fill-first";
 
     let connection;
     const affinityConnection = await selectSessionAffinityConnection(
@@ -1497,7 +1504,11 @@ export async function getProviderCredentials(
     if (connection) {
       // Session affinity selected a connection before global sticky routing.
     } else if (strategy === "round-robin") {
-      const stickyLimit = toNumber((settings as Record<string, unknown>).stickyRoundRobinLimit, 3);
+      const stickyLimit = toNumber(
+        providerOverride.stickyRoundRobinLimit ??
+          (settings as Record<string, unknown>).stickyRoundRobinLimit,
+        3
+      );
 
       // If excluding account(s) (fallback scenario), skip sticky logic and go straight to LRU.
       // This prevents same-model retries from getting stuck on a failed account.
diff --git a/src/sse/services/model.ts b/src/sse/services/model.ts
index a587d6a556..9c8bbfe134 100644
--- a/src/sse/services/model.ts
+++ b/src/sse/services/model.ts
@@ -85,6 +85,22 @@ async function lookupCustomModelMeta(
   }
 }
 
+/**
+ * When a custom provider node is matched by its raw internal `node.id` (e.g. a combo
+ * step addressing `<connId>/...` — see #2778), `parsed.model` was never split on the
+ * node's own `prefix`, unlike the alias-addressing path where `parseModel` already
+ * strips it. If the caller naively concatenates `owned_by` (the node's prefix, as
+ * listed by /api/models) with the raw model id, the resulting model string carries a
+ * redundant leading `${node.prefix}/` segment that the upstream provider does not
+ * recognize, causing a 400. Strip it so `<connId>/<prefix>/<rawModelId>` normalizes to
+ * the same `<rawModelId>` the bare alias form resolves to (#6772).
+ */
+function stripRedundantNodePrefix(model: string, nodePrefix: unknown): string {
+  if (typeof nodePrefix !== "string" || !nodePrefix) return model;
+  const redundant = `${nodePrefix}/`;
+  return model.startsWith(redundant) ? model.slice(redundant.length) : model;
+}
+
 /**
  * Get full model info (parse or resolve)
  */
@@ -133,13 +149,17 @@ export async function getModelInfo(modelStr) {
         (node) => node.prefix === prefixToCheck || node.id === prefixToCheck
       );
       if (matchedOpenAI) {
+        const normalizedModel = stripRedundantNodePrefix(
+          parsed.model as string,
+          matchedOpenAI.prefix
+        );
         const { apiFormat, targetFormat } = await lookupCustomModelMeta(
           matchedOpenAI.id as string,
-          parsed.model as string
+          normalizedModel
         );
         return {
           provider: matchedOpenAI.id,
-          model: parsed.model,
+          model: normalizedModel,
           extendedContext,
           ...(apiFormat && { apiFormat }),
           ...(targetFormat && { targetFormat }),
@@ -152,13 +172,17 @@ export async function getModelInfo(modelStr) {
         (node) => node.prefix === prefixToCheck || node.id === prefixToCheck
       );
       if (matchedAnthropic) {
+        const normalizedModel = stripRedundantNodePrefix(
+          parsed.model as string,
+          matchedAnthropic.prefix
+        );
         const { apiFormat, targetFormat } = await lookupCustomModelMeta(
           matchedAnthropic.id as string,
-          parsed.model as string
+          normalizedModel
         );
         return {
           provider: matchedAnthropic.id,
-          model: parsed.model,
+          model: normalizedModel,
           extendedContext,
           ...(apiFormat && { apiFormat }),
           ...(targetFormat && { targetFormat }),
diff --git a/src/sse/services/tokenRefresh.ts b/src/sse/services/tokenRefresh.ts
index ab51be2742..05585ae301 100755
--- a/src/sse/services/tokenRefresh.ts
+++ b/src/sse/services/tokenRefresh.ts
@@ -119,6 +119,24 @@ export async function updateProviderCredentials(connectionId: string, newCredent
 
     if (newCredentials.accessToken) {
       updates.accessToken = newCredentials.accessToken;
+      // #6352: a successful refresh proves the connection is reachable and its
+      // refresh_token is valid again — clear any stale auth-failure state
+      // (testStatus/lastError*) left over from a prior expired/invalid refresh
+      // token or an upstream 401/403. Without this, a genuinely successful
+      // rotating-refresh (e.g. Codex/OpenAI) persisted the new access/refresh
+      // token while leaving the dashboard showing "Auth Failed" forever,
+      // because the error metadata was never reset here — only the health-check
+      // sweep (tokenHealthCheck.ts::checkConnection) did this clearing, so any
+      // OTHER caller of updateProviderCredentials (the manual refresh route,
+      // the reactive per-request refresh in chat.ts) looked like it "didn't
+      // pick up" the refreshed token. Explicit `newCredentials.testStatus`
+      // below still wins for callers that need a specific terminal state.
+      updates.testStatus = "active";
+      updates.lastError = null;
+      updates.lastErrorAt = null;
+      updates.lastErrorType = null;
+      updates.lastErrorSource = null;
+      updates.errorCode = null;
     }
     if (newCredentials.refreshToken) {
       updates.refreshToken = newCredentials.refreshToken;
diff --git a/src/sse/utils/backpressure.ts b/src/sse/utils/backpressure.ts
new file mode 100644
index 0000000000..f5b56f19d5
--- /dev/null
+++ b/src/sse/utils/backpressure.ts
@@ -0,0 +1,67 @@
+import { getActiveSessionCount } from "@omniroute/open-sse/services/sessionManager.ts";
+
+/**
+ * Connection back-pressure for SSE / streaming endpoints.
+ *
+ * Caps in-flight requests to prevent memory exhaustion.  Reads the live
+ * session count from `sessionManager` — the same source the health endpoint
+ * uses to report `activeConnections`.
+ *
+ * Set `OMNI_MAX_CONCURRENT_CONNECTIONS` to a positive integer to enable.
+ * Default is 0 (disabled) so existing deployments are unaffected until
+ * an operator explicitly opts in.
+ */
+
+type CapacityOk = { shouldReject: false };
+type CapacityExceeded = { shouldReject: true; response: Response };
+export type CapacityResult = CapacityOk | CapacityExceeded;
+
+/**
+ * Pure capacity evaluator — given an active count and a cap, returns the
+ * appropriate result.  Cap ≤ 0 means disabled (never reject).
+ *
+ * Exported for unit testing without mocking any module boundaries.
+ */
+export function evalCapacity(active: number, cap: number): CapacityResult {
+  if (cap <= 0 || active < cap) {
+    return { shouldReject: false };
+  }
+  const retryAfter = Math.max(1, Math.ceil((active / cap) * 30));
+  return {
+    shouldReject: true,
+    response: new Response(
+      JSON.stringify({
+        error: {
+          message: `Server busy — ${active} active connections (limit ${cap}). Retry after ${retryAfter}s.`,
+          type: "rate_limit",
+          retry_after: retryAfter,
+        },
+      }),
+      {
+        status: 429,
+        headers: {
+          "Content-Type": "application/json",
+          "Retry-After": String(retryAfter),
+          "X-RateLimit-Limit": String(cap),
+          "X-RateLimit-Remaining": "0",
+        },
+      }
+    ),
+  };
+}
+
+/** Read cap from env on every call so tests can mutate process.env freely. */
+function readCap(): number {
+  const raw = parseInt(process.env.OMNI_MAX_CONCURRENT_CONNECTIONS ?? "0", 10);
+  return Number.isFinite(raw) && raw > 0 ? raw : 0;
+}
+
+/**
+ * Check whether the server is over its configured connection cap.
+ *
+ * Returns `{ shouldReject: true, response }` when at limit, or
+ * `{ shouldReject: false }` when a slot is free (or the cap is disabled).
+ */
+export function checkConnectionCapacity(): CapacityResult {
+  return evalCapacity(getActiveSessionCount(), readCap());
+}
diff --git a/src/types/provider.ts b/src/types/provider.ts
index 051b1d780c..cad416b762 100644
--- a/src/types/provider.ts
+++ b/src/types/provider.ts
@@ -5,5 +5,7 @@ export interface ModelCooldownErrorPayload {
     code: "model_cooldown";
     model?: string;
     reset_seconds: number;
+    retry_after?: string;
+    credentials_cooling?: number;
   };
 }
diff --git a/src/types/sqljs.d.ts b/src/types/sqljs.d.ts
index b44a03b362..51ff2bf978 100644
--- a/src/types/sqljs.d.ts
+++ b/src/types/sqljs.d.ts
@@ -1,6 +1,6 @@
 declare module "sql.js" {
   export interface SqlJsStatement {
-    bind(values: unknown[]): void;
+    bind(values: unknown[] | Record<string, unknown>): void;
     step(): boolean;
     getAsObject(): Record<string, unknown>;
     free(): void;
diff --git a/stryker.conf.json b/stryker.conf.json
index 943b03b491..f944f3c27d 100644
--- a/stryker.conf.json
+++ b/stryker.conf.json
@@ -1,14 +1,14 @@
 {
   "$schema": "https://stryker-mutator.io/schemas/stryker-schema.json",
   "_comment": [
-    "Mutation testing for the ~8 critical modules (Task 11 \u2014 Fase 7).",
-    "NIGHTLY ONLY \u2014 DO NOT run on every PR. Mutation testing is expensive:",
+    "Mutation testing for the ~8 critical modules (Task 11 — Fase 7).",
+    "NIGHTLY ONLY — DO NOT run on every PR. Mutation testing is expensive:",
     "  - Each mutant requires a full test suite execution.",
-    "  - The 8 modules produce ~200\u2013500 mutants; est. 30\u201390 min per run.",
+    "  - The 8 modules produce ~200–500 mutants; est. 30–90 min per run.",
     "  - Wired to the nightly CI workflow (.github/workflows/nightly-mutation.yml),",
     "    NOT to the 'lint' / 'quality-gate' PR jobs.",
     "",
-    "TEST RUNNER \u2014 @stryker-mutator/tap-runner (NOT vitest):",
+    "TEST RUNNER — @stryker-mutator/tap-runner (NOT vitest):",
     "  The 8 critical modules are covered by node:test files in tests/unit/",
     "  (run via `node --import tsx --test`), NOT by vitest. The vitest config",
     "  only includes a small set of .test.tsx + open-sse/**/__tests__ files, so",
@@ -22,18 +22,18 @@
     "  npm install --save-dev @stryker-mutator/core @stryker-mutator/tap-runner",
     "",
     "Run manually:",
-    "  npm run test:mutation                       # full run (slow \u2014 nightly budget)",
+    "  npm run test:mutation                       # full run (slow — nightly budget)",
     "  npx stryker run --dryRunOnly                 # validate the baseline only (no mutants)",
     "  (single-module probe: temporarily narrow `mutate` + `tap.testFiles` in this file)",
     "",
-    "VALIDATED 2026-06-15: `npx stryker run --dryRunOnly` exits 0 \u2014 all 129 covering",
+    "VALIDATED 2026-06-15: `npx stryker run --dryRunOnly` exits 0 — all 129 covering",
     "test files run green in the Stryker sandbox and the perTest coverage map builds for",
     "all 8 instrumented modules (15k+ mutants). The baseline dry-run takes ~20 min with",
     "concurrency=1; the full mutation phase runs on top (advisory, capped by the workflow",
     "timeout). So the nightly produces REAL mutation scores for the 8 modules.",
     "",
-    "Mutation score per module \u2192 quality-baseline.json key 'mutationScore.<module>'",
-    "Direction: up (score can only improve; ratchet blocks drops \u2014 wired in a later INT phase)."
+    "Mutation score per module → quality-baseline.json key 'mutationScore.<module>'",
+    "Direction: up (score can only improve; ratchet blocks drops — wired in a later INT phase)."
   ],
   "packageManager": "npm",
   "incremental": true,
@@ -60,6 +60,7 @@
       "tests/unit/auth-terminal-status.test.ts",
       "tests/unit/authz/discovery-routes-local-only.test.ts",
       "tests/unit/authz/route-guard-local-prefix.test.ts",
+      "tests/unit/authz/route-guard-skills-collect.test.ts",
       "tests/unit/authz/route-guard-version-get-exemption.test.ts",
       "tests/unit/authz/routeGuard.test.ts",
       "tests/unit/auto-combo-context-advertising.test.ts",
@@ -105,23 +106,29 @@
       "tests/unit/claude-passthrough-stream-boolean.test.ts",
       "tests/unit/claude-passthrough-thinking-2454.test.ts",
       "tests/unit/cli-simulate.test.ts",
+      "tests/unit/cliproxyapi-model-mapping-dispatch.test.ts",
       "tests/unit/cline-response-envelope.test.ts",
+      "tests/unit/cliproxyapi-model-mapping-dispatch.test.ts",
       "tests/unit/clinepass-provider.test.ts",
+      "tests/unit/cliproxyapi-model-mapping-dispatch.test.ts",
       "tests/unit/codex-failover.test.ts",
+      "tests/unit/codex-quota-selection-hydration.test.ts",
       "tests/unit/codex-session-affinity-reset-aware-5903.test.ts",
       "tests/unit/codex-stream-false.test.ts",
       "tests/unit/collect-metrics-module-coverage.test.ts",
       "tests/unit/combo-499-abort.test.ts",
       "tests/unit/combo-account-allowlist-3266.test.ts",
       "tests/unit/combo-auto-candidate-expansion.test.ts",
+      "tests/unit/combo-breaker-429.test.ts",
       "tests/unit/combo-cache-invalidation.test.ts",
       "tests/unit/combo-config.test.ts",
       "tests/unit/combo-context-relay.test.ts",
+      "tests/unit/combo-diagnostics-trace.test.ts",
       "tests/unit/combo-headroom-strategy.test.ts",
-      "tests/unit/serial/combo-health-autopilot.test.ts",
       "tests/unit/combo-health-dashboard.test.ts",
       "tests/unit/combo-health-route.test.ts",
       "tests/unit/combo-hedging.test.ts",
+      "tests/unit/combo-lockout-quota-reset-6863.test.ts",
       "tests/unit/combo-max-depth-config.test.ts",
       "tests/unit/combo-model-lockout-honors-reset-1308.test.ts",
       "tests/unit/combo-omnimodel-tag-stripping.test.ts",
@@ -135,7 +142,10 @@
       "tests/unit/combo-quota-share-cooldown-wait.test.ts",
       "tests/unit/combo-quota-soft-penalty.test.ts",
       "tests/unit/combo-round-robin-streaming-lock-3811.test.ts",
+      "tests/unit/combo-roundrobin-compat-fallback-6238.test.ts",
       "tests/unit/combo-routing-engine.test.ts",
+      "tests/unit/combo-rr-fallback-advance-948.test.ts",
+      "tests/unit/combo-rr-sticky-9router.test.ts",
       "tests/unit/combo-scoring-inspector.test.ts",
       "tests/unit/combo-selected-connection-success.test.ts",
       "tests/unit/combo-sessionless-pin-3825.test.ts",
@@ -166,30 +176,38 @@
       "tests/unit/gemini-web-missing-browser-3516.test.ts",
       "tests/unit/grok-cli-oauth.test.ts",
       "tests/unit/guardrails-api-3496.test.ts",
+      "tests/unit/headroom-codex-quota-snapshot-6379.test.ts",
       "tests/unit/headroom-proxy-lifecycle.test.ts",
+      "tests/unit/idempotency-fusion-collision.test.ts",
+      "tests/unit/issue-6343-v0-web-alias-collision.test.ts",
+      "tests/unit/issue-6638-ollama-quota.test.ts",
+      "tests/unit/issue-6686-quota-preflight-coverage.test.ts",
       "tests/unit/livews-forward-backoff-4604.test.ts",
       "tests/unit/management-auth-hardening.test.ts",
       "tests/unit/mark-account-unavailable-numeric-epoch-guard.test.ts",
+      "tests/unit/masked-200-exhaustion-fallback-6427.test.ts",
       "tests/unit/memory-embedding-remote.test.ts",
       "tests/unit/memory-embedding-transformers.test.ts",
       "tests/unit/middleware-header-strip-5849.test.ts",
+      "tests/unit/middleware-hooks-error-sanitization.test.ts",
       "tests/unit/model-cooldowns-route-auth.test.ts",
       "tests/unit/model-cooldowns-route.test.ts",
       "tests/unit/model-lockout-decay.test.ts",
       "tests/unit/model-lockout-max-cooldown.test.ts",
       "tests/unit/no-memory-header.test.ts",
       "tests/unit/non-streaming-sse-terminal-typescan-4459.test.ts",
+      "tests/unit/nvidia-passthrough-models-6773.test.ts",
       "tests/unit/oauth-providers-config.test.ts",
       "tests/unit/oauth-redirect-uri-mismatch.test.ts",
       "tests/unit/observability-fase04.test.ts",
       "tests/unit/observability-payloads.test.ts",
+      "tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts",
       "tests/unit/openapi-security-tiers.test.ts",
       "tests/unit/persist-429-cooldown-account-fallback.test.ts",
       "tests/unit/plan3-p0.test.ts",
       "tests/unit/plugin-sandbox-permissions.test.ts",
       "tests/unit/plugins-route-error-sanitization.test.ts",
       "tests/unit/provider-error-rules.test.ts",
-      "tests/unit/serial/provider-health-autopilot.test.ts",
       "tests/unit/provider-health-matrix.test.ts",
       "tests/unit/provider-request-failure-pipeline.test.ts",
       "tests/unit/public-client-ids-3493.test.ts",
@@ -200,15 +218,23 @@
       "tests/unit/quota-policy-generalization.test.ts",
       "tests/unit/quota-pool-log-route.test.ts",
       "tests/unit/quota-streaming-consumption-usd.test.ts",
+      "tests/unit/qwen-web-content-array-serialization.test.ts",
       "tests/unit/rate-limit-enhanced.test.ts",
       "tests/unit/rate-limit-manager.test.ts",
       "tests/unit/rate-limit-queue-timeout-lockout.test.ts",
       "tests/unit/responses-handler.test.ts",
+      "tests/unit/rotation-config-omniroute.test.ts",
       "tests/unit/route-explainability.test.ts",
+      "tests/unit/route-guard-middleware-local-only.test.ts",
       "tests/unit/route-guard-plugins-local-only.test.ts",
       "tests/unit/route-guard-private-lan.test.ts",
       "tests/unit/route-guard-provider-login-local-only.test.ts",
       "tests/unit/router-strategies.test.ts",
+      "tests/unit/rule12-error-sanitization-sweep.test.ts",
+      "tests/unit/serial/combo-health-autopilot.test.ts",
+      "tests/unit/serial/combo-quota-share-cooldown-wait-timing.test.ts",
+      "tests/unit/serial/combo-strategy-fallbacks-half-open-timing.test.ts",
+      "tests/unit/serial/provider-health-autopilot.test.ts",
       "tests/unit/service-combo-metrics.test.ts",
       "tests/unit/services-branch-hardening.test.ts",
       "tests/unit/services/bifrost-route-guard.test.ts",
@@ -226,6 +252,7 @@
       "tests/unit/token-refresh-service.test.ts",
       "tests/unit/tools-filter-anthropic-format.test.ts",
       "tests/unit/tproxy-route.test.ts",
+      "tests/unit/trae-publiccred.test.ts",
       "tests/unit/types-barrel-model-cooldown.test.ts",
       "tests/unit/upstream-retry-hints-toggle.test.ts",
       "tests/unit/usage-service-hardening.test.ts",
@@ -245,7 +272,7 @@
     ]
   },
   "_mutate_godfiles_excluded_comment": [
-    "2026-06-18 (Onda 2 budget): chatCore.ts + combo.ts \u2014 the two god-files \u2014 were REMOVED",
+    "2026-06-18 (Onda 2 budget): chatCore.ts + combo.ts — the two god-files — were REMOVED",
     "from `mutate`. They dominated ~2/3 of the ~15k mutants; the full 8-module run TIMED OUT",
     "at the 180min nightly cap (run 27705123780: 16:47:33 -> killed 19:47:48 = exactly 180min;",
     "the prior 120min scheduled run also timed out). #4078 made concurrency safe but the",
@@ -265,23 +292,23 @@
     "comboContextCache/idempotency/passthroughHelpers/responseHeaders/sanitization/upstreamTimeouts).",
     "A follow-up then added DEDICATED unit tests for 6 more leaves (tests/unit/chatcore-headers,",
     "-log-truncation, -memory-extraction, -non-streaming-sse, -passthrough-tool-names,",
-    "-executor-helpers \u2014 wired into tap.testFiles above) and added those leaves as batch h",
+    "-executor-helpers — wired into tap.testFiles above) and added those leaves as batch h",
     "(headers/logTruncation/memoryExtraction/nonStreamingSse/passthroughToolNames/executorHelpers).",
-    "A later follow-up added dedicated tests (NO mock.module \u2014 unavailable under the tap-runner; used",
+    "A later follow-up added dedicated tests (NO mock.module — unavailable under the tap-runner; used",
     "fetch-override + crafted inputs + temp-DATA_DIR) for telemetryHelpers (both fns, all branches) and",
     "memorySkillsInjection (getSkillsProviderForFormat fully + injectMemoryAndSkills guards/empty-DB",
     "path) and added them as batch i.",
     "",
     "The FINAL chatCore leaf, semanticCache.ts, was added to batch i once its cache-HIT block had a",
     "fixture: chatcore-semantic-cache now SEEDS the real cache via setCachedResponse (the in-memory",
-    "store getCachedResponse checks first \u2014 no mock.module needed) under the exact signature",
+    "store getCachedResponse checks first — no mock.module needed) under the exact signature",
     "checkSemanticCache rebuilds, so the HIT branch runs end-to-end (status 200 / 'semantic' / 'HIT' /",
     "the stream + content-type ternaries / the cost fallback / the side-effect calls all get killed).",
     "ALL 15 chatCore leaves are now mutated.",
     "",
     "STILL EXCLUDED (follow-ups, NOT in `mutate` yet):",
     "  - combo.ts + chatCore.ts barrels: their handleComboChat/handleChatCore CORES were not",
-    "    split (out of scope \u2014 Fase 3 ChatCoreContext refactor). The barrels are now thin-ish",
+    "    split (out of scope — Fase 3 ChatCoreContext refactor). The barrels are now thin-ish",
     "    but still large; keep excluded until the cores are split.",
     "See project memory: Quality Gate v2 / Fase 9 (project-combo-split)."
   ],
@@ -365,11 +392,11 @@
     "would break the required all-green baseline dry-run (e.g. body-timeout-integration,",
     "heap-pressure, sse-heartbeat-integration, *-stream-readiness, chatcore-memory-pressure).",
     "It is enumerated (not a broad glob) so the Stryker dry-run stays tractable for the",
-    "nightly budget \u2014 a glob over the full ~1300-file unit suite would make the per-test",
+    "nightly budget — a glob over the full ~1300-file unit suite would make the per-test",
     "dry-run take hours. coverageAnalysis:perTest then narrows which files run per mutant.",
     "Regenerate the base union after adding/renaming covering tests, then re-prune flaky ones:",
     "  grep -rlE \"circuitBreaker|publicCreds|accountFallback|routeGuard|services/auth|chatCore|services/combo|utils/error|public-client|account-fallback|route-guard|circuit-breaker\" tests/unit --include=\"*.test.ts\" | sort -u"
   ],
   "dryRunTimeoutMinutes": 30,
-  "_concurrency_comment": "concurrency=4 (was 1): the covering node:test files used to share SQLite/module state via the default DATA_DIR (~/.omniroute), so running them concurrently in the Stryker sandbox caused cross-file races that failed the all-green baseline. tap.nodeArgs now imports ./tests/_setup/isolateDataDir.ts, which gives each spawned test process its own temp DATA_DIR \u2014 eliminating the shared on-disk DB, so concurrency>1 is deterministic. A/B verified 2026-06-17: dry-run at concurrency=4 fails WITHOUT the isolation import (account-fallback-service tap exit 9) and passes WITH it. Raise further only if the runner has spare cores."
+  "_concurrency_comment": "concurrency=4 (was 1): the covering node:test files used to share SQLite/module state via the default DATA_DIR (~/.omniroute), so running them concurrently in the Stryker sandbox caused cross-file races that failed the all-green baseline. tap.nodeArgs now imports ./tests/_setup/isolateDataDir.ts, which gives each spawned test process its own temp DATA_DIR — eliminating the shared on-disk DB, so concurrency>1 is deterministic. A/B verified 2026-06-17: dry-run at concurrency=4 fails WITHOUT the isolation import (account-fallback-service tap exit 9) and passes WITH it. Raise further only if the runner has spare cores."
 }
diff --git a/tests/boundary/gemini-double-escaping.live.test.ts b/tests/boundary/gemini-double-escaping.live.test.ts
new file mode 100644
index 0000000000..4eff040f76
--- /dev/null
+++ b/tests/boundary/gemini-double-escaping.live.test.ts
@@ -0,0 +1,518 @@
+/**
+ * Direct Gemini tests: verify no double-escaping in tool call arguments.
+ *
+ * Calls Gemini through OmniRoute via both Chat Completions and Responses API,
+ * comparing streaming vs non-streaming paths. The goal is to verify that
+ * tool call arguments are valid JSON throughout the pipeline.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const OMNIROUTE_URL = `${process.env.OMNIROUTE_URL}/v1`;
+const AUTH = `Bearer ${process.env.OMNIROUTE_API_KEY || ""}`;
+
+const skip = !(process.env.OMNIROUTE_API_KEY && process.env.OMNIROUTE_URL)
+  ? "OMNIROUTE_API_KEY or OMNIROUTE_URL not set — skipping live boundary test"
+  : undefined;
+
+// Chat Completions format tool definition
+const CC_WRITE_TOOL = {
+  type: "function",
+  function: {
+    name: "write",
+    description: "Write content to a file at the specified path",
+    parameters: {
+      type: "object",
+      properties: {
+        path: { type: "string", description: "File path" },
+        content: { type: "string", description: "File content" },
+      },
+      required: ["path", "content"],
+    },
+    strict: true,
+  },
+};
+
+// Responses API format tool definition (flat structure)
+const RESP_WRITE_TOOL = {
+  type: "function",
+  name: "write",
+  description: "Write content to a file at the specified path",
+  parameters: {
+    type: "object",
+    properties: {
+      path: { type: "string", description: "File path" },
+      content: { type: "string", description: "File content" },
+    },
+    required: ["path", "content"],
+  },
+  strict: true,
+};
+
+interface SseEvent {
+  event: string | null;
+  data: Record<string, unknown> | null;
+}
+
+async function fetchStream(url: string, body: Record<string, unknown>): Promise<SseEvent[]> {
+  const response = await fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: AUTH,
+    },
+    body: JSON.stringify(body),
+  });
+
+  if (!response.ok) {
+    throw new Error(`HTTP ${response.status}: ${await response.text()}`);
+  }
+
+  const reader = response.body!.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  const events: SseEvent[] = [];
+
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    buffer += decoder.decode(value, { stream: true });
+
+    const lines = buffer.split("\n");
+    buffer = lines.pop() || "";
+    let currentEvent: string | null = null;
+
+    for (const line of lines) {
+      if (line.startsWith("event: ")) {
+        currentEvent = line.slice(7);
+      } else if (line.startsWith("data: ")) {
+        const dataStr = line.slice(6);
+        try {
+          events.push({ event: currentEvent, data: JSON.parse(dataStr) });
+        } catch {
+          events.push({ event: currentEvent, data: null });
+        }
+      }
+    }
+  }
+
+  return events;
+}
+
+async function fetchJson(
+  url: string,
+  body: Record<string, unknown>
+): Promise<Record<string, unknown>> {
+  const response = await fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: AUTH,
+    },
+    body: JSON.stringify(body),
+  });
+
+  if (!response.ok) {
+    throw new Error(`HTTP ${response.status}: ${await response.text()}`);
+  }
+
+  return (await response.json()) as Record<string, unknown>;
+}
+
+function verifyNoDoubleEscaping(content: string): void {
+  // Check for actual newlines (0x0A) - proper for parsed content
+  const hasNewlines = content.includes("\n");
+  assert.ok(hasNewlines, "content should have actual newlines (0x0A)");
+
+  // Check for literal backslash-n (double-escaping indicator)
+  // A proper \\n appears as two characters: 0x5C 0x6E
+  const literalBSN = content.match(/\\n/g);
+  if (literalBSN) {
+    // If we find \\n, they must only appear as part of valid escape sequences,
+    // not as actual literal backslash-n contaminating the output
+    const cleanContent = content.replace(/\\"/g, "__escaped_quote__");
+    const escapedNInContent = cleanContent.match(/\\n/g);
+    assert.equal(
+      escapedNInContent,
+      null,
+      `no literal backslash-n in content (found ${literalBSN.length} occurrences)`
+    );
+  }
+
+  // Verify newlines are actual 0x0A bytes
+  for (let i = 0; i < content.length; i++) {
+    if (content[i] === "\n") {
+      assert.equal(content.charCodeAt(i), 0x0a, `byte at pos ${i} should be 0x0A`);
+    }
+  }
+
+  // Re-parse round-trip: JSON.stringify then JSON.parse must restore original
+  const roundtripped = JSON.parse(JSON.stringify(content));
+  assert.equal(roundtripped, content, "JSON round-trip must preserve content exactly");
+}
+
+interface ToolCallOutput {
+  type: string;
+  name: string;
+  arguments: string;
+}
+
+interface ChatToolCall {
+  function: { name: string; arguments: string };
+}
+
+function findToolCallOutput(
+  output: Record<string, unknown>[],
+  name: string
+): ToolCallOutput | null {
+  const found = output.find(
+    (item) =>
+      typeof item.type === "string" &&
+      item.type === "function_call" &&
+      typeof item.name === "string" &&
+      item.name === name
+  );
+  return found ? (found as unknown as ToolCallOutput) : null;
+}
+
+function findChatToolCall(
+  message: Record<string, unknown> | null | undefined,
+  name: string
+): ChatToolCall | null {
+  if (!message?.tool_calls || !Array.isArray(message.tool_calls)) return null;
+  const found = (message.tool_calls as Record<string, unknown>[]).find(
+    (tc) =>
+      tc.function &&
+      typeof tc.function === "object" &&
+      (tc.function as Record<string, unknown>).name === name
+  );
+  return found && typeof found.function === "object" ? (found as unknown as ChatToolCall) : null;
+}
+
+// ============================================================
+// 1. Chat Completions API - Non-streaming
+// ============================================================
+test(
+  "Chat Completions non-stream: Gemini tool call args are valid JSON with proper newlines",
+  { skip },
+  async () => {
+    const body = {
+      model: "gemini/gemma-4-31b-it",
+      messages: [
+        {
+          role: "user",
+          content: [
+            {
+              type: "text",
+              text: 'Write a file /tmp/cc_ns.txt with Python code:\ndef hello():\n    print("hello")\n    for i in range(3):\n        print(i)\n\nCall the write tool.',
+            },
+          ],
+        },
+      ],
+      tools: [CC_WRITE_TOOL],
+      temperature: 0.1,
+      stream: false,
+    };
+
+    const response = await fetchJson(`${OMNIROUTE_URL}/chat/completions`, body);
+    assert.ok(
+      Array.isArray((response as Record<string, unknown>).choices) &&
+        (response as Record<string, unknown>).choices.length > 0,
+      "should have choices"
+    );
+
+    const choices = (response as Record<string, unknown>).choices as Record<string, unknown>[];
+    const toolCall = findChatToolCall(
+      choices[0]?.message as Record<string, unknown> | undefined,
+      "write"
+    );
+    assert.ok(toolCall, "should have write tool call");
+
+    const args = JSON.parse(toolCall.function.arguments);
+    assert.equal(typeof args.content, "string");
+
+    verifyNoDoubleEscaping(args.content);
+  }
+);
+
+// ============================================================
+// 2. Chat Completions API - Streaming
+// ============================================================
+test(
+  "Chat Completions stream: Gemini tool call args are valid JSON with proper newlines",
+  { skip },
+  async () => {
+    const body = {
+      model: "gemini/gemma-4-31b-it",
+      messages: [
+        {
+          role: "user",
+          content: [
+            {
+              type: "text",
+              text: "Write a file /tmp/cc_s.txt with content:\nline A: foo\nline B: bar\nline C: baz\nUse the write tool.",
+            },
+          ],
+        },
+      ],
+      tools: [CC_WRITE_TOOL],
+      temperature: 0.1,
+      stream: true,
+    };
+
+    const events = await fetchStream(`${OMNIROUTE_URL}/chat/completions`, body);
+
+    // Collect tool call arguments from delta chunks
+    let fullArgs = "";
+    for (const event of events) {
+      if (!event.data?.choices?.[0]?.delta?.tool_calls) continue;
+      for (const tc of event.data.choices[0].delta.tool_calls) {
+        if (tc.function?.name === "write" && tc.function?.arguments) {
+          fullArgs += tc.function.arguments;
+        }
+      }
+    }
+
+    assert.ok(fullArgs.length > 0, "should have accumulated tool call arguments");
+
+    // The accumulated args must be valid JSON
+    const args = JSON.parse(fullArgs);
+    assert.equal(typeof args.content, "string");
+
+    verifyNoDoubleEscaping(args.content);
+  }
+);
+
+// ============================================================
+// 3. Responses API - Non-streaming
+// ============================================================
+test(
+  "Responses API non-stream: Gemini tool call args are valid JSON with proper newlines",
+  { skip },
+  async () => {
+    const body = {
+      model: "gemini/gemma-4-31b-it",
+      input:
+        "Write a file /tmp/resp_ns.txt with:\nstep 1: init\nstep 2: process\nstep 3: cleanup\nUse the write tool.",
+      tools: [RESP_WRITE_TOOL],
+      temperature: 0.1,
+      max_output_tokens: 4096,
+      stream: false,
+    };
+
+    const response = await fetchJson(`${OMNIROUTE_URL}/responses`, body);
+
+    assert.equal((response as Record<string, unknown>).status, "completed");
+    const output = ((response as Record<string, unknown>).output ?? []) as Record<
+      string,
+      unknown
+    >[];
+    const toolCall = findToolCallOutput(output, "write");
+    assert.ok(toolCall, "should have write tool call");
+
+    const args = JSON.parse(toolCall.arguments);
+    assert.equal(typeof args.content, "string");
+
+    verifyNoDoubleEscaping(args.content);
+  }
+);
+
+// ============================================================
+// 4. Responses API - Streaming
+// ============================================================
+test(
+  "Responses API stream: Gemini tool call args are valid JSON with proper newlines",
+  { skip },
+  async () => {
+    const body = {
+      model: "gemini/gemma-4-31b-it",
+      input: "Write a file /tmp/resp_s.txt with:\nApple\nBanana\nCherry\nUse the write tool.",
+      tools: [RESP_WRITE_TOOL],
+      temperature: 0.1,
+      max_output_tokens: 4096,
+      stream: true,
+    };
+
+    const events = await fetchStream(`${OMNIROUTE_URL}/responses`, body);
+
+    // Accumulate function_call_arguments.delta then parse final from output_item.done
+    let doneArgs: string | null = null;
+    for (const event of events) {
+      if (
+        event.event === "response.output_item.done" &&
+        event.data?.item?.type === "function_call"
+      ) {
+        doneArgs = event.data.item.arguments;
+      }
+    }
+
+    assert.ok(doneArgs, "should have function call arguments from output_item.done");
+
+    const args = JSON.parse(doneArgs!);
+    assert.equal(typeof args.content, "string");
+
+    verifyNoDoubleEscaping(args.content);
+  }
+);
+
+// ============================================================
+// 5. Compare same prompt through both APIs
+// ============================================================
+test(
+  "Chat Completions and Responses API produce same tool call args for identical prompt",
+  { skip },
+  async () => {
+    const prompt =
+      "Write a file /tmp/compare.txt with:\nline1: start\nline2: middle\nline3: end\nUse the write tool.";
+
+    // Non-streaming Chat Completions
+    const ccBody = {
+      model: "gemini/gemma-4-31b-it",
+      messages: [{ role: "user", content: [{ type: "text", text: prompt }] }],
+      tools: [CC_WRITE_TOOL],
+      temperature: 0.1,
+      stream: false,
+    };
+    const ccResp = await fetchJson(`${OMNIROUTE_URL}/chat/completions`, ccBody);
+    const ccChoices = (ccResp as Record<string, unknown>).choices as
+      Record<string, unknown>[] | undefined;
+    const ccToolCall = findChatToolCall(
+      ccChoices?.[0]?.message as Record<string, unknown> | undefined,
+      "write"
+    );
+    assert.ok(ccToolCall, "Chat Completions should have write tool call");
+    const ccArgs = JSON.parse(ccToolCall.function.arguments);
+
+    // Non-streaming Responses API
+    const respBody = {
+      model: "gemini/gemma-4-31b-it",
+      input: prompt,
+      tools: [RESP_WRITE_TOOL],
+      temperature: 0.1,
+      max_output_tokens: 4096,
+      stream: false,
+    };
+    const respResp = await fetchJson(`${OMNIROUTE_URL}/responses`, respBody);
+    const respOutput = ((respResp as Record<string, unknown>).output ?? []) as Record<
+      string,
+      unknown
+    >[];
+    const respToolCall = findToolCallOutput(respOutput, "write");
+    assert.ok(respToolCall, "Responses API should have write tool call");
+    const respArgs = JSON.parse(respToolCall.arguments);
+
+    // Both must have valid content with actual newlines
+    assert.equal(typeof ccArgs.content, "string");
+    assert.equal(typeof respArgs.content, "string");
+
+    verifyNoDoubleEscaping(ccArgs.content);
+    verifyNoDoubleEscaping(respArgs.content);
+
+    // Both should contain newlines (content may differ slightly due to model non-determinism)
+    assert.ok(ccArgs.content.includes("\n"), "Chat Completions content has newlines");
+    assert.ok(respArgs.content.includes("\n"), "Responses API content has newlines");
+  }
+);
+
+// ============================================================
+// 6. Round-trip: Chat Completions args -> Responses API args
+// ============================================================
+test("Chat Completions args survive round-trip through Responses API", { skip }, async () => {
+  // Get args via Chat Completions
+  const ccBody = {
+    model: "gemini/gemma-4-31b-it",
+    messages: [
+      {
+        role: "user",
+        content: [
+          {
+            type: "text",
+            text: 'Write file /tmp/rt.txt with:\ndef run():\n    return "ok"\n',
+          },
+        ],
+      },
+    ],
+    tools: [CC_WRITE_TOOL],
+    temperature: 0.1,
+    stream: false,
+  };
+  const ccResp = await fetchJson(`${OMNIROUTE_URL}/chat/completions`, ccBody);
+  const ccChoices = (ccResp as Record<string, unknown>).choices as
+    Record<string, unknown>[] | undefined;
+  const ccToolCall = findChatToolCall(
+    ccChoices?.[0]?.message as Record<string, unknown> | undefined,
+    "write"
+  );
+  assert.ok(ccToolCall, "Chat Completions should have write tool call");
+  const ccArgs = JSON.parse(ccToolCall.function.arguments);
+  assert.equal(typeof ccArgs.content, "string");
+  const originalContent = ccArgs.content;
+
+  // Feed the Chat Completions args through the OpenAI -> Responses translator
+  // by simulating what OpenClaw does: receiving tool call, extracting args
+  const { openaiToOpenAIResponsesResponse } =
+    await import("../../open-sse/translator/response/openai-responses.ts");
+  const { initState } = await import("../../open-sse/translator/index.ts");
+  const { FORMATS } = await import("../../open-sse/translator/formats.ts");
+
+  const state = initState(FORMATS.OPENAI_RESPONSES);
+  const events: Record<string, unknown>[] = [];
+
+  // Simulate a Chat Completions stream with the tool call
+  const ccChunk = {
+    id: "chatcmpl-rt",
+    model: "gemini/gemma-4-31b-it",
+    choices: [
+      {
+        index: 0,
+        delta: {
+          tool_calls: [
+            {
+              index: 0,
+              id: "call_rt",
+              type: "function",
+              function: {
+                name: "write",
+                arguments: JSON.stringify(ccArgs),
+              },
+            },
+          ],
+        },
+        finish_reason: null,
+      },
+    ],
+  };
+
+  const flushChunk = {
+    id: "chatcmpl-rt",
+    model: "gemini/gemma-4-31b-it",
+    choices: [{ index: 0, delta: {}, finish_reason: "tool_calls" }],
+  };
+
+  const r1 = openaiToOpenAIResponsesResponse(ccChunk, state) || [];
+  const r2 = openaiToOpenAIResponsesResponse(flushChunk, state) || [];
+  events.push(...r1, ...r2);
+
+  // Extract the final arguments from the completed response
+  const completedEvent = events.find(
+    (e) => (e as Record<string, unknown>).event === "response.completed"
+  );
+  assert.ok(completedEvent, "should have response.completed");
+
+  const completedData = completedEvent as Record<string, unknown>;
+  const responseData = completedData.data as Record<string, unknown> | undefined;
+  const respData = responseData?.response as Record<string, unknown> | undefined;
+  const output = (respData?.output ?? []) as Record<string, unknown>[];
+  const respFc = findToolCallOutput(output, "write");
+  assert.ok(respFc, "should have write in completed output");
+
+  const respArgs = JSON.parse(respFc.arguments);
+  assert.equal(
+    respArgs.content,
+    originalContent,
+    "content must survive round-trip without corruption"
+  );
+
+  // Verify no double-escaping
+  verifyNoDoubleEscaping(respArgs.content);
+});
diff --git a/tests/boundary/gemini-midstream-503-e2e.live.test.ts b/tests/boundary/gemini-midstream-503-e2e.live.test.ts
new file mode 100644
index 0000000000..53599383b0
--- /dev/null
+++ b/tests/boundary/gemini-midstream-503-e2e.live.test.ts
@@ -0,0 +1,128 @@
+/**
+ * E2E boundary test: Responses API mid-stream 503 error handling.
+ *
+ * Sends a streaming Responses API request through a Gemini provider and
+ * verifies that if the upstream errors mid-stream, the `response.completed`
+ * event carries `status: "failed"` with an error object, rather than
+ * silently emitting `status: "completed"` or aborting without a terminal event.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const OMNIROUTE_URL = `${process.env.OMNIROUTE_URL}/v1`;
+const AUTH = `Bearer ${process.env.OMNIROUTE_API_KEY || ""}`;
+
+const skip = !(process.env.OMNIROUTE_API_KEY && process.env.OMNIROUTE_URL)
+  ? "OMNIROUTE_API_KEY or OMNIROUTE_URL not set — skipping live boundary test"
+  : undefined;
+
+interface SseEvent {
+  event: string | null;
+  data: Record<string, unknown> | null;
+}
+
+async function fetchStream(
+  url: string,
+  body: Record<string, unknown>
+): Promise<{ events: SseEvent[]; status: number }> {
+  const response = await fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: AUTH,
+    },
+    body: JSON.stringify(body),
+  });
+
+  const status = response.status;
+  if (!response.ok) {
+    return { events: [], status };
+  }
+
+  const reader = response.body!.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  const events: SseEvent[] = [];
+
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    buffer += decoder.decode(value, { stream: true });
+
+    const lines = buffer.split("\n");
+    buffer = lines.pop() || "";
+    let currentEvent: string | null = null;
+
+    for (const line of lines) {
+      if (line.startsWith("event: ")) {
+        currentEvent = line.slice(7);
+      } else if (line.startsWith("data: ")) {
+        const dataStr = line.slice(6);
+        try {
+          events.push({ event: currentEvent, data: JSON.parse(dataStr) });
+        } catch {
+          events.push({ event: currentEvent, data: null });
+        }
+      }
+    }
+  }
+
+  return { events, status };
+}
+
+test(
+  "Responses API streaming with Gemini handles mid-stream 503 gracefully",
+  { skip },
+  async () => {
+    // Send a short prompt through a Gemini model via Responses API (streaming).
+    // If Gemini hits a mid-stream 503 (which is non-deterministic), the fix
+    // ensures response.completed carries status="failed" and an error object.
+    // If the request succeeds normally, we verify the standard completion shape.
+    const { events, status } = await fetchStream(`${OMNIROUTE_URL}/responses`, {
+      model: "gemini/gemini-2.0-flash",
+      input: "Say 'hello' and nothing else.",
+      stream: true,
+      max_output_tokens: 50,
+      temperature: 0,
+    });
+
+    // Even on error we should get a 200 with SSE events (mid-stream error).
+    assert.equal(status, 200, "should get HTTP 200 with SSE stream");
+
+    // Find the response.completed event
+    const completedEvent = events.find((e) => e.event === "response.completed");
+    assert.ok(completedEvent, "should emit response.completed event");
+    assert.ok(completedEvent.data, "response.completed should have data");
+
+    const response = completedEvent.data as Record<string, unknown>;
+    const respObj = response.response as Record<string, unknown> | undefined;
+
+    assert.ok(respObj, "response.completed.data.response should exist");
+
+    const respStatus = respObj.status as string;
+    const respError = respObj.error;
+
+    if (respStatus === "failed") {
+      // Mid-stream error path — the fix under test
+      assert.ok(respError, "failed response should have error object");
+      const err = respError as Record<string, unknown>;
+      assert.ok(
+        typeof err.code === "string" || typeof err.code === "number",
+        "error should have code"
+      );
+      assert.ok(
+        typeof err.message === "string" && err.message.length > 0,
+        "error should have message"
+      );
+      console.log(`[PASS] Mid-stream 503 detected: code=${err.code}, message="${err.message}"`);
+    } else {
+      // Normal success path — verify the standard shape
+      assert.equal(respStatus, "completed", "normal response should have status=completed");
+      assert.equal(respError, null, "normal response should have error=null");
+      assert.ok(Array.isArray(respObj.output), "response should have output array");
+      console.log("[PASS] Normal completion (no mid-stream error)");
+    }
+
+    console.log(`Total SSE events received: ${events.length}`);
+  }
+);
diff --git a/tests/boundary/gemma4-multiturn.live.test.ts b/tests/boundary/gemma4-multiturn.live.test.ts
new file mode 100644
index 0000000000..c44acc8b9e
--- /dev/null
+++ b/tests/boundary/gemma4-multiturn.live.test.ts
@@ -0,0 +1,395 @@
+/**
+ * Multi-turn investigation: Does accumulated context cause Gemma4 to
+ * start generating literal \\n in tool call arguments?
+ *
+ * Simulates a multi-turn conversation where the model keeps seeing
+ * tool results and continues with more tool calls.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const BASE = process.env.OMNIROUTE_TEST_BASE || "http://localhost:20128/v1";
+const AUTH = process.env.OMNIROUTE_TEST_BEARER
+    ? `Bearer ${process.env.OMNIROUTE_TEST_BEARER}`
+    : "";
+const COOKIE =
+  process.env.OMNIROUTE_TEST_COOKIE || "";
+
+const MODEL = "gemini/gemma-4-26b-a4b-it";
+
+const skip =
+  process.env.RUN_BOUNDARY_LIVE === "1"
+    ? undefined
+    : "RUN_BOUNDARY_LIVE!=1 — skipping live boundary test";
+
+interface Message {
+  role: "user" | "assistant" | "developer" | "system";
+  content: { type: string; text?: string }[];
+}
+
+interface ToolDef {
+  type: "function";
+  name: string;
+  description: string;
+  parameters: {
+    type: "object";
+    properties: Record<string, { type: string; description?: string }>;
+    required: string[];
+  };
+  strict: true;
+}
+
+interface ResponseOutputItem {
+  type: string;
+  name: string;
+  arguments: string;
+  call_id?: string;
+}
+
+interface ResponseBody {
+  output?: ResponseOutputItem[];
+}
+
+interface ToolArgs {
+  path?: string;
+  content?: string;
+  command?: string;
+}
+
+function contentText(text: string): { type: string; text: string } {
+  return { type: "input_text", text };
+}
+
+async function doNonStreaming(messages: Message[], tools: ToolDef[]): Promise<ResponseBody> {
+  const body = {
+    model: MODEL,
+    input: messages,
+    tools,
+    temperature: 0.1,
+    max_output_tokens: 4096,
+    stream: false,
+  };
+
+  const r = await fetch(`${BASE}/responses`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Cookie: COOKIE,
+      Authorization: AUTH,
+    },
+    body: JSON.stringify(body),
+  });
+
+  const data = (await r.json()) as ResponseBody;
+  return data;
+}
+
+async function analyzeTools(
+  content: string,
+  filesSoFar: number
+): Promise<{ ok: boolean; details: string }> {
+  const messages: Message[] = [{ role: "user", content: [contentText(content)] }];
+  const tools: ToolDef[] = [
+    {
+      type: "function",
+      name: "write",
+      description: "Write content to a file at the specified path",
+      parameters: {
+        type: "object",
+        properties: {
+          path: { type: "string", description: "File path" },
+          content: { type: "string", description: "File content" },
+        },
+        required: ["path", "content"],
+      },
+      strict: true,
+    },
+    {
+      type: "function",
+      name: "exec",
+      description: "Execute a shell command",
+      parameters: {
+        type: "object",
+        properties: {
+          command: { type: "string", description: "Command to execute" },
+        },
+        required: ["command"],
+      },
+      strict: true,
+    },
+  ];
+
+  let turn = 0;
+  let allOk = true;
+  const details: string[] = [];
+
+  while (turn < 5) {
+    turn++;
+    const response = await doNonStreaming(messages, tools);
+
+    if (!response.output || !Array.isArray(response.output)) {
+      details.push(`Turn ${turn}: No output`);
+      break;
+    }
+
+    const toolCalls = response.output.filter((item) => item.type === "function_call");
+
+    if (toolCalls.length === 0) {
+      details.push(`Turn ${turn}: No tool calls (text response)`);
+      break;
+    }
+
+    // Analyze each tool call
+    for (const tc of toolCalls) {
+      let args: ToolArgs;
+      try {
+        args = JSON.parse(tc.arguments);
+      } catch {
+        details.push(`Turn ${turn} ${tc.name}: Invalid JSON arguments`);
+        allOk = false;
+        continue;
+      }
+
+      if (tc.name === "write") {
+        const content = args.content || "";
+        // Check for literal backslash-n in the PARSED content
+        let literalBSN = 0;
+        for (let i = 0; i < content.length - 1; i++) {
+          if (content[i] === "\\" && content[i + 1] === "n") {
+            literalBSN++;
+          }
+        }
+
+        const realNewlines = (content.match(/\n/g) || []).length;
+
+        if (literalBSN > 0) {
+          allOk = false;
+          details.push(
+            `Turn ${turn} write(${args.path}): ${literalBSN} literal BSN, ${realNewlines} real NLs! ` +
+              `Content start: ${JSON.stringify(content.slice(0, 100))}`
+          );
+        } else {
+          details.push(
+            `Turn ${turn} write(${args.path}): OK (${realNewlines} newlines, ${content.length} bytes)`
+          );
+        }
+      } else if (tc.name === "exec") {
+        const cmd = args.command || "";
+        details.push(
+          `Turn ${turn} exec: ${cmd.length} chars, starts with: ${JSON.stringify(cmd.slice(0, 60))}`
+        );
+      }
+    }
+
+    // Add tool results
+    const toolResults: Message[] = [];
+    for (const tc of toolCalls) {
+      let args: ToolArgs;
+      try {
+        args = JSON.parse(tc.arguments);
+      } catch {
+        continue;
+      }
+
+      const fn = tc.name === "write" ? "write" : "exec";
+
+      if (fn === "write") {
+        filesSoFar++;
+        toolResults.push({
+          role: "assistant",
+          content: [
+            {
+              type: "tool_use",
+              id: tc.call_id || `call_${turn}`,
+              name: tc.name,
+              input: args,
+            },
+          ],
+        });
+        toolResults.push({
+          role: "user",
+          content: [
+            {
+              type: "tool_result",
+              tool_use_id: tc.call_id || `call_${turn}`,
+              content: `Successfully wrote ${(args.content || "").length} bytes to ${args.path}`,
+            },
+          ],
+        });
+      } else {
+        toolResults.push({
+          role: "assistant",
+          content: [
+            {
+              type: "tool_use",
+              id: tc.call_id || `call_${turn}`,
+              name: tc.name,
+              input: args,
+            },
+          ],
+        });
+        toolResults.push({
+          role: "user",
+          content: [
+            {
+              type: "tool_result",
+              tool_use_id: tc.call_id || `call_${turn}`,
+              content: "(completed with exit code 0)",
+            },
+          ],
+        });
+      }
+    }
+
+    // Keep tools for next turn
+    if (response.output) {
+      const responseItems = response.output.filter((item) => item.type === "function_call");
+
+      // Build next conversation
+      const newMessages: Message[] = [
+        ...messages,
+        ...responseItems.map((ri) => ({
+          role: "assistant" as const,
+          content: [
+            {
+              type: "tool_use",
+              id: ri.call_id || `call_${turn}`,
+              name: ri.name,
+              input: JSON.parse(ri.arguments),
+            },
+          ],
+        })),
+        ...toolResults.filter((tr) => tr.role === "user"),
+      ];
+      messages.length = 0;
+      messages.push(...newMessages);
+    }
+  }
+
+  return { ok: allOk, details: details.join("\n") };
+}
+
+test("Gemma4 multi-turn: write Python in multiple rounds", { skip }, async () => {
+  const prompt = `Do the following steps in order:
+1. Create a Python script at /tmp/mt_data.py that writes a JSON file with timestamp, 3 random numbers, and a greeting.
+2. Run the script and show output.
+3. Create a summary script at /tmp/mt_summary.py that reads the JSON, calculates sum/average, writes a new JSON.
+4. Run the summary script and show output.
+5. Read and display both JSON files.
+
+Use write and exec tools as needed.`;
+
+  const result = await analyzeTools(prompt, 0);
+  console.log("=== Multi-turn Result ===");
+  console.log(result.details);
+  console.log("=== Overall:", result.ok ? "PASS" : "FAIL");
+});
+
+test("Gemma4 multi-turn: just write lots of files", { skip }, async () => {
+  // Pure write tool calls to stress the content encoding
+  const messages: Message[] = [
+    {
+      role: "user",
+      content: [
+        contentText(
+          "Write a file /tmp/mt_a.py with a Python function that computes factorial:\n" +
+            "```python\ndef factorial(n):\n    if n <= 1:\n        return 1\n    return n * factorial(n-1)\n```"
+        ),
+      ],
+    },
+  ];
+
+  const tools: ToolDef[] = [
+    {
+      type: "function",
+      name: "write",
+      description: "Write content to a file",
+      parameters: {
+        type: "object",
+        properties: {
+          path: { type: "string" },
+          content: { type: "string" },
+        },
+        required: ["path", "content"],
+      },
+      strict: true,
+    },
+  ];
+
+  let turn = 0;
+  let allOk = true;
+  const failures: string[] = [];
+
+  while (turn < 8) {
+    turn++;
+    const response = await doNonStreaming(messages, tools);
+    const toolCalls = (response.output || []).filter((item) => item.type === "function_call");
+
+    if (toolCalls.length === 0) break;
+
+    for (const tc of toolCalls) {
+      let args: ToolArgs;
+      try {
+        args = JSON.parse(tc.arguments);
+      } catch {
+        continue;
+      }
+      const content = args.content || "";
+      let literalBSN = 0;
+      for (let i = 0; i < content.length - 1; i++) {
+        if (content[i] === "\\" && content[i + 1] === "n") literalBSN++;
+      }
+      if (literalBSN > 0) {
+        allOk = false;
+        failures.push(
+          `Turn ${turn}: ${literalBSN} literal BSN in ${args.path}. ` +
+            `Content start: ${JSON.stringify(content.slice(0, 120))}`
+        );
+      } else {
+        console.log(
+          `Turn ${turn} ${args.path}: OK (${(content.match(/\n/g) || []).length} NLs, ${content.length}B)`
+        );
+      }
+    }
+
+    // Build next turn: simulate the user asking for another file
+    const fileLetters = ["b", "c", "d", "e", "f", "g", "h", "i"];
+    const topics = [
+      "recursive fibonacci",
+      "binary search",
+      "quick sort",
+      "linked list class",
+      "JSON parser",
+      "HTTP client class",
+      "CSV reader",
+    ];
+
+    if (turn <= topics.length) {
+      const topic = topics[turn - 1] || "hello world";
+      messages.push({
+        role: "assistant",
+        content: toolCalls.map((tc) => ({
+          type: "tool_use",
+          id: tc.call_id || `call_${turn}`,
+          name: tc.name,
+          input: JSON.parse(tc.arguments),
+        })),
+      });
+      messages.push({
+        role: "user",
+        content: [
+          contentText(
+            `Write a file /tmp/mt_${fileLetters[turn - 1] || turn}.py that implements ${topic}`
+          ),
+        ],
+      });
+    }
+  }
+
+  console.log("=== Pure Write Multi-turn ===");
+  if (failures.length > 0) {
+    console.log("FAILURES:");
+    for (const f of failures) console.log("  " + f);
+  }
+  console.log("Overall:", allOk ? "PASS" : "FAIL");
+});
diff --git a/tests/boundary/gemma4-newline-investigation.live.test.ts b/tests/boundary/gemma4-newline-investigation.live.test.ts
new file mode 100644
index 0000000000..d3d8675bf2
--- /dev/null
+++ b/tests/boundary/gemma4-newline-investigation.live.test.ts
@@ -0,0 +1,482 @@
+/**
+ * Investigation: Gemma4 tool call newline escaping behavior.
+ *
+ * Systematically tests different prompt patterns and content types to
+ * characterize when Gemma4 emits literal \\n (backslash-n) vs actual
+ * newlines (0x0A) in tool call JSON arguments.
+ *
+ * Tests hit the LIVE OmniRoute API at the configured OMNIROUTE_TEST_BASE instance.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const BASE = process.env.OMNIROUTE_TEST_BASE || "http://localhost:20128/v1";
+const AUTH = process.env.OMNIROUTE_TEST_BEARER
+    ? `Bearer ${process.env.OMNIROUTE_TEST_BEARER}`
+    : "";
+const COOKIE =
+  process.env.OMNIROUTE_TEST_COOKIE || "";
+
+const MODEL = "gemini/gemma-4-26b-a4b-it";
+
+const skip =
+  process.env.RUN_BOUNDARY_LIVE === "1"
+    ? undefined
+    : "RUN_BOUNDARY_LIVE!=1 — skipping live boundary test";
+
+interface SseEvent {
+  event: string | null;
+  data: Record<string, unknown> | null;
+}
+
+async function sendResponsesApiStream(body: Record<string, unknown>): Promise<SseEvent[]> {
+  const response = await fetch(`${BASE}/responses`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Cookie: COOKIE,
+      Authorization: AUTH,
+    },
+    body: JSON.stringify(body),
+  });
+
+  if (!response.ok) {
+    throw new Error(`HTTP ${response.status}: ${await response.text()}`);
+  }
+
+  const reader = response.body!.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  const events: SseEvent[] = [];
+
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    buffer += decoder.decode(value, { stream: true });
+
+    const lines = buffer.split("\n");
+    buffer = lines.pop() || "";
+
+    let currentEvent: string | null = null;
+
+    for (const line of lines) {
+      if (line.startsWith("event: ")) {
+        currentEvent = line.slice(7);
+      } else if (line.startsWith("data: ")) {
+        const dataStr = line.slice(6);
+        try {
+          events.push({
+            event: currentEvent,
+            data: JSON.parse(dataStr),
+          });
+        } catch {
+          events.push({ event: currentEvent, data: null });
+        }
+      }
+    }
+  }
+
+  return events;
+}
+
+interface ToolCallResult {
+  name: string;
+  rawArguments: string;
+  parsedArgs: Record<string, unknown>;
+  hasLiteralBackslashN: boolean;
+  literalBSNPositions: { position: number; context: string }[];
+}
+
+async function getToolCalls(
+  prompt: string,
+  tools: Record<string, unknown>[],
+  includeContent?: string
+): Promise<ToolCallResult[]> {
+  const body: Record<string, unknown> = {
+    model: MODEL,
+    input: [
+      {
+        role: "user",
+        content: [
+          {
+            type: "input_text",
+            text: includeContent ? `${prompt}\n\nContent to write:\n${includeContent}` : prompt,
+          },
+        ],
+      },
+    ],
+    tools,
+    temperature: 0.1,
+    max_output_tokens: 4096,
+    stream: true,
+  };
+
+  const events = await sendResponsesApiStream(body);
+
+  const writeEvents = events.filter((e) => {
+    const item = e.data?.item as { type?: string } | undefined;
+    return e.event === "response.output_item.done" && item?.type === "function_call";
+  });
+
+  const results: ToolCallResult[] = [];
+
+  for (const evt of writeEvents) {
+    const item = evt.data?.item as { arguments: string; name: string };
+    const rawArgs = item.arguments;
+    let parsedArgs: Record<string, unknown>;
+    try {
+      parsedArgs = JSON.parse(rawArgs);
+    } catch {
+      parsedArgs = {};
+    }
+
+    const bsnPositions: { position: number; context: string }[] = [];
+    for (let i = 0; i < rawArgs.length - 1; i++) {
+      if (rawArgs[i] === "\\" && rawArgs[i + 1] === "n") {
+        const start = Math.max(0, i - 10);
+        const end = Math.min(rawArgs.length, i + 12);
+        bsnPositions.push({
+          position: i,
+          context: JSON.stringify(rawArgs.slice(start, end)),
+        });
+      }
+    }
+
+    let hasLiteralBSN = bsnPositions.length > 0;
+
+    // Also check the parsed content for literal \n
+    if (parsedArgs.content && typeof parsedArgs.content === "string") {
+      const contentStr = parsedArgs.content as string;
+      for (let i = 0; i < contentStr.length - 1; i++) {
+        if (contentStr[i] === "\\" && contentStr[i + 1] === "n") {
+          hasLiteralBSN = true;
+          const start = Math.max(0, i - 10);
+          const end = Math.min(contentStr.length, i + 12);
+          bsnPositions.push({
+            position: i,
+            context: `[parsed] ${JSON.stringify(contentStr.slice(start, end))}`,
+          });
+        }
+      }
+    }
+
+    results.push({
+      name: item.name,
+      rawArguments: rawArgs,
+      parsedArgs,
+      hasLiteralBackslashN: hasLiteralBSN,
+      literalBSNPositions: bsnPositions,
+    });
+  }
+
+  return results;
+}
+
+const WRITE_TOOL = {
+  type: "function",
+  name: "write",
+  description: "Write content to a file at the specified path",
+  parameters: {
+    type: "object",
+    properties: {
+      path: { type: "string", description: "File path" },
+      content: { type: "string", description: "File content" },
+    },
+    required: ["path", "content"],
+  },
+  strict: true,
+};
+
+const EXEC_TOOL = {
+  type: "function",
+  name: "exec",
+  description: "Execute a shell command",
+  parameters: {
+    type: "object",
+    properties: {
+      command: { type: "string", description: "Command to execute" },
+    },
+    required: ["command"],
+  },
+  strict: true,
+};
+
+const WRITE_AND_EXEC_TOOLS = [WRITE_TOOL, EXEC_TOOL];
+
+// ── Tests ──────────────────────────────────────────────────────────────────
+
+test("Gemma4: plain text (hello/world)", { skip }, async () => {
+  const results = await getToolCalls(
+    "Write a file /tmp/test1.txt with content: hello\\nworld\\ntest",
+    WRITE_AND_EXEC_TOOLS
+  );
+
+  for (const r of results) {
+    console.log(`[${r.name}] hasLiteralBSN=${r.hasLiteralBackslashN}`);
+    if (r.literalBSNPositions.length > 0) {
+      console.log(`  positions:`, r.literalBSNPositions);
+    }
+  }
+});
+
+test("Gemma4: short bash script", { skip }, async () => {
+  const bashContent = ["#!/bin/bash", "echo 'Hello World'", "ls -la /tmp", 'echo "Done"'].join(
+    "\n"
+  );
+
+  const results = await getToolCalls(
+    "Write a bash script at /tmp/test2.sh and then run it",
+    WRITE_AND_EXEC_TOOLS,
+    bashContent
+  );
+
+  for (const r of results) {
+    console.log(`[${r.name}] hasLiteralBSN=${r.hasLiteralBackslashN}`);
+    if (r.literalBSNPositions.length > 0) {
+      console.log(`  positions:`, r.literalBSNPositions);
+    }
+  }
+});
+
+test("Gemma4: Python code (the suspected trigger)", { skip }, async () => {
+  const pythonContent = [
+    "import json",
+    "import random",
+    "",
+    "data = {",
+    '    "numbers": [random.randint(1, 100) for _ in range(5)]',
+    "}",
+    "",
+    "with open('/tmp/test3.json', 'w') as f:",
+    "    json.dump(data, f, indent=2)",
+    "",
+    'print("Done")',
+    "",
+  ].join("\n");
+
+  const results = await getToolCalls(
+    "Write a Python script at /tmp/test3.py and run it",
+    WRITE_AND_EXEC_TOOLS,
+    pythonContent
+  );
+
+  for (const r of results) {
+    console.log(`[${r.name}] hasLiteralBSN=${r.hasLiteralBackslashN}`);
+    if (r.literalBSNPositions.length > 0) {
+      console.log(`  positions:`, r.literalBSNPositions);
+    }
+  }
+});
+
+test("Gemma4: Python with colon patterns (theoretical trigger: `:\\n    `)", { skip }, async () => {
+  // Minimal content that exercises the colon-newline-indent pattern
+  const pythonContent = [
+    "def foo():",
+    "    pass",
+    "",
+    "class Bar:",
+    "    def __init__(self):",
+    "        pass",
+    "",
+    "if True:",
+    "    print('yes')",
+    "",
+    "for i in range(3):",
+    "    print(i)",
+    "",
+    "while False:",
+    "    break",
+  ].join("\n");
+
+  const results = await getToolCalls(
+    "Write a Python script at /tmp/test4.py and run it",
+    WRITE_AND_EXEC_TOOLS,
+    pythonContent
+  );
+
+  for (const r of results) {
+    console.log(`[${r.name}] hasLiteralBSN=${r.hasLiteralBackslashN}`);
+    if (r.literalBSNPositions.length > 0) {
+      console.log(`  positions:`, r.literalBSNPositions);
+    }
+  }
+});
+
+test("Gemma4: Just exec command (heredoc style)", { skip }, async () => {
+  const results = await getToolCalls(
+    "Write and run: use cat with heredoc to create /tmp/test5.txt with content hello world and then cat it",
+    WRITE_AND_EXEC_TOOLS
+  );
+
+  for (const r of results) {
+    console.log(`[${r.name}] hasLiteralBSN=${r.hasLiteralBackslashN}`);
+    if (r.literalBSNPositions.length > 0) {
+      console.log(`  positions:`, r.literalBSNPositions);
+    }
+  }
+});
+
+test("Gemma4: Mixed code (JS + CSS)", { skip }, async () => {
+  const mixedContent = [
+    "function greet(name) {",
+    "  return `Hello, ${name}!`;",
+    "}",
+    "",
+    "const styles = {",
+    "  container: {",
+    '    display: "flex",',
+    '    justifyContent: "center",',
+    "  },",
+    "};",
+    "",
+    "/* CSS */",
+    ".container {",
+    "  max-width: 1200px;",
+    "  margin: 0 auto;",
+    "  padding: 20px;",
+    "}",
+    "",
+    "export default greet;",
+  ].join("\n");
+
+  const results = await getToolCalls(
+    "Write a JavaScript/CSS module at /tmp/test6.js",
+    WRITE_AND_EXEC_TOOLS,
+    mixedContent
+  );
+
+  for (const r of results) {
+    console.log(`[${r.name}] hasLiteralBSN=${r.hasLiteralBackslashN}`);
+    if (r.literalBSNPositions.length > 0) {
+      console.log(`  positions:`, r.literalBSNPositions);
+    }
+  }
+});
+
+test("Gemma4: Simple YAML config", { skip }, async () => {
+  const yamlContent = [
+    "server:",
+    "  host: 0.0.0.0",
+    "  port: 8080",
+    "  workers: 4",
+    "",
+    "database:",
+    "  url: postgres://localhost:5432/db",
+    "  pool:",
+    "    min: 2",
+    "    max: 10",
+    "",
+    "logging:",
+    '  level: "info"',
+    "  format: json",
+  ].join("\n");
+
+  const results = await getToolCalls(
+    "Write a YAML config file at /tmp/config.yaml",
+    WRITE_AND_EXEC_TOOLS,
+    yamlContent
+  );
+
+  for (const r of results) {
+    console.log(`[${r.name}] hasLiteralBSN=${r.hasLiteralBackslashN}`);
+    if (r.literalBSNPositions.length > 0) {
+      console.log(`  positions:`, r.literalBSNPositions);
+    }
+  }
+});
+
+test("Gemma4: Model-generated content (no prompt content)", { skip }, async () => {
+  // Let the model come up with its own multi-line content
+  const results = await getToolCalls(
+    "Write a Python script to the file /tmp/test7.py that generates fibonacci numbers up to 100 and saves them to a JSON file. Use the write tool.",
+    WRITE_AND_EXEC_TOOLS
+  );
+
+  for (const r of results) {
+    console.log(`[${r.name}] hasLiteralBSN=${r.hasLiteralBackslashN}`);
+    if (r.literalBSNPositions.length > 0) {
+      console.log(`  positions:`, r.literalBSNPositions);
+    }
+  }
+});
+
+test("Gemma4: Short single-line content", { skip }, async () => {
+  const results = await getToolCalls(
+    "Write a file /tmp/test8.txt with content 'just one line'",
+    WRITE_AND_EXEC_TOOLS
+  );
+
+  for (const r of results) {
+    console.log(`[${r.name}] hasLiteralBSN=${r.hasLiteralBackslashN}`);
+  }
+});
+
+test("Gemma4: Many short lines (10 simple lines)", { skip }, async () => {
+  const lines = Array.from({ length: 10 }, (_, i) => `Line ${i + 1}: test`).join("\n");
+  const results = await getToolCalls(
+    "Write a file /tmp/test9.txt with these lines",
+    WRITE_AND_EXEC_TOOLS,
+    lines
+  );
+
+  for (const r of results) {
+    console.log(`[${r.name}] hasLiteralBSN=${r.hasLiteralBackslashN}`);
+    if (r.literalBSNPositions.length > 0) {
+      console.log(`  positions:`, r.literalBSNPositions);
+    }
+  }
+});
+
+test("Gemma4: Content with JSON-like syntax (potential confusion)", { skip }, async () => {
+  const jsonContent = JSON.stringify(
+    {
+      name: "test",
+      value: 42,
+      items: [1, 2, 3],
+      config: {
+        enabled: true,
+        options: ["a", "b"],
+      },
+    },
+    null,
+    2
+  );
+
+  const results = await getToolCalls(
+    "Write a JSON data file at /tmp/test10.json",
+    WRITE_AND_EXEC_TOOLS,
+    jsonContent
+  );
+
+  for (const r of results) {
+    console.log(`[${r.name}] hasLiteralBSN=${r.hasLiteralBackslashN}`);
+    if (r.literalBSNPositions.length > 0) {
+      console.log(`  positions:`, r.literalBSNPositions);
+    }
+  }
+});
+
+test("Gemma4: Template literal content (JS with ${})", { skip }, async () => {
+  const templateContent = [
+    "const name = 'world';",
+    "const greeting = `Hello, ${name}!`;",
+    "const multi = `",
+    "  Line 1",
+    "  Line 2",
+    "  Line 3",
+    "`;",
+  ].join("\n");
+
+  const results = await getToolCalls(
+    "Write a JavaScript file at /tmp/test11.js with template literals",
+    WRITE_AND_EXEC_TOOLS,
+    templateContent
+  );
+
+  for (const r of results) {
+    console.log(`[${r.name}] hasLiteralBSN=${r.hasLiteralBackslashN}`);
+    if (r.literalBSNPositions.length > 0) {
+      console.log(`  positions:`, r.literalBSNPositions);
+    }
+  }
+});
diff --git a/tests/boundary/openclaw-omniroute-tool-boundary.live.test.ts b/tests/boundary/openclaw-omniroute-tool-boundary.live.test.ts
new file mode 100644
index 0000000000..744ec4a09e
--- /dev/null
+++ b/tests/boundary/openclaw-omniroute-tool-boundary.live.test.ts
@@ -0,0 +1,711 @@
+/**
+ * Boundary test: OpenClaw ↔ OmniRoute tool calling pipeline.
+ *
+ * Tests the critical boundary where OpenClaw sends Responses API requests
+ * through OmniRoute and receives tool call responses. Focuses on verifying
+ * that tool call arguments (especially multiline content like file writes)
+ * survive the round-trip without corruption.
+ *
+ * These tests call the LIVE OmniRoute API at the configured OMNIROUTE_TEST_BASE instance.
+ * Prerequisites: valid auth token (from INITIAL_PASSWORD) and access to the
+ * remote OmniRoute instance.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const BASE = process.env.OMNIROUTE_TEST_BASE || "http://localhost:20128/v1";
+const AUTH = process.env.OMNIROUTE_TEST_BEARER
+    ? `Bearer ${process.env.OMNIROUTE_TEST_BEARER}`
+    : "";
+
+// Cookie obtained via INITIAL_PASSWORD login
+const COOKIE =
+  process.env.OMNIROUTE_TEST_COOKIE || "";
+
+// Only the tests that call the live remote OmniRoute API need this gate — the
+// pure parsing/stopReason-simulation tests at the bottom of the file run locally.
+const skip =
+  process.env.RUN_BOUNDARY_LIVE === "1"
+    ? undefined
+    : "RUN_BOUNDARY_LIVE!=1 — skipping live boundary test";
+
+interface SseEvent {
+  event: string | null;
+  data: Record<string, unknown> | null;
+}
+
+interface ResponseFunctionCallItem {
+  type: string;
+  name?: string;
+  arguments?: string;
+  call_id?: string;
+}
+
+interface ResponsesJsonBody {
+  status?: string;
+  output?: ResponseFunctionCallItem[];
+}
+
+function eventItem(e: SseEvent): ResponseFunctionCallItem | undefined {
+  return e.data?.item as ResponseFunctionCallItem | undefined;
+}
+
+async function sendResponsesApiStream(body: Record<string, unknown>): Promise<SseEvent[]> {
+  const response = await fetch(`${BASE}/responses`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Cookie: COOKIE,
+      Authorization: AUTH,
+    },
+    body: JSON.stringify(body),
+  });
+
+  if (!response.ok) {
+    throw new Error(`HTTP ${response.status}: ${await response.text()}`);
+  }
+
+  const reader = response.body!.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  const events: SseEvent[] = [];
+
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    buffer += decoder.decode(value, { stream: true });
+
+    const lines = buffer.split("\n");
+    buffer = lines.pop() || "";
+
+    let currentEvent: string | null = null;
+
+    for (const line of lines) {
+      if (line.startsWith("event: ")) {
+        currentEvent = line.slice(7);
+      } else if (line.startsWith("data: ")) {
+        const dataStr = line.slice(6);
+        try {
+          events.push({
+            event: currentEvent,
+            data: JSON.parse(dataStr),
+          });
+        } catch {
+          events.push({ event: currentEvent, data: null });
+        }
+      }
+    }
+  }
+
+  return events;
+}
+
+async function sendResponsesApiJson(
+  body: Record<string, unknown>
+): Promise<Record<string, unknown>> {
+  const response = await fetch(`${BASE}/responses`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Cookie: COOKIE,
+      Authorization: AUTH,
+    },
+    body: JSON.stringify({ ...body, stream: false }),
+  });
+
+  if (!response.ok) {
+    throw new Error(`HTTP ${response.status}: ${await response.text()}`);
+  }
+
+  return (await response.json()) as Record<string, unknown>;
+}
+
+test("OmniRoute boundary: tool call arguments with newlines survive Responses API (non-streaming)", { skip }, async () => {
+  const body = {
+    model: "gemini/gemma-4-26b-a4b-it",
+    input: [
+      {
+        role: "user",
+        content: [
+          {
+            type: "input_text",
+            text: "Write a file /tmp/test_boundary.txt with content:\nhello\nworld\ntest",
+          },
+        ],
+      },
+    ],
+    tools: [
+      {
+        type: "function",
+        name: "write",
+        description: "Write content to a file at the specified path",
+        parameters: {
+          type: "object",
+          properties: {
+            path: { type: "string", description: "File path" },
+            content: { type: "string", description: "File content" },
+          },
+          required: ["path", "content"],
+        },
+        strict: true,
+      },
+    ],
+    temperature: 0.1,
+    max_output_tokens: 4096,
+  };
+
+  const response = (await sendResponsesApiJson(body)) as ResponsesJsonBody;
+
+  assert.equal(response.status, "completed");
+  assert.ok(Array.isArray(response.output), "should have output array");
+
+  const toolCalls = (response.output || []).filter((item) => item.type === "function_call");
+
+  assert.ok(toolCalls.length > 0, "should have at least one function_call");
+  assert.equal(toolCalls[0].name, "write");
+
+  const args = JSON.parse(toolCalls[0].arguments || "{}");
+  assert.equal(typeof args.content, "string", "content should be a string");
+  assert.ok(args.content.includes("\n"), "content should have actual newlines (0x0A)");
+
+  // Verify no literal backslash-n contamination
+  const literalBSN = (args.content as string).match(/\\n/g);
+  assert.equal(literalBSN, null, "no literal backslash-n in content");
+
+  // Verify newlines are actual 0x0A bytes
+  for (let i = 0; i < args.content.length; i++) {
+    if (args.content[i] === "\n") {
+      assert.equal(
+        args.content.charCodeAt(i),
+        0x0a,
+        `byte at position ${i} should be 0x0A not 0x5C 0x6E`
+      );
+    }
+  }
+});
+
+test("OmniRoute boundary: tool call arguments with newlines survive Responses API (streaming)", { skip }, async () => {
+  const body = {
+    model: "gemini/gemma-4-26b-a4b-it",
+    input: [
+      {
+        role: "user",
+        content: [
+          {
+            type: "input_text",
+            text: "Write a file /tmp/test_stream.txt with content:\nline A\nline B\nline C\nusing the write tool",
+          },
+        ],
+      },
+    ],
+    tools: [
+      {
+        type: "function",
+        name: "write",
+        description: "Write content to a file",
+        parameters: {
+          type: "object",
+          properties: {
+            path: { type: "string" },
+            content: { type: "string" },
+          },
+          required: ["path", "content"],
+        },
+        strict: true,
+      },
+    ],
+    temperature: 0.1,
+    max_output_tokens: 4096,
+    stream: true,
+  };
+
+  const events = await sendResponsesApiStream(body);
+
+  // Find the function call output_item.done event
+  const doneEvent = events.find(
+    (e) => e.event === "response.output_item.done" && eventItem(e)?.type === "function_call"
+  );
+  assert.ok(doneEvent, "should have output_item.done for function_call");
+
+  const item = eventItem(doneEvent as SseEvent) as ResponseFunctionCallItem;
+  assert.equal(item.name, "write");
+
+  const args = JSON.parse(item.arguments || "{}");
+  assert.equal(typeof args.content, "string", "content should be a string");
+  assert.ok(args.content.includes("\n"), "content should have actual newlines");
+
+  // Check completed event
+  const completed = events.find((e) => e.event === "response.completed");
+  assert.ok(completed, "should have response.completed event");
+  const completedResponse = completed?.data?.response as ResponsesJsonBody | undefined;
+  const outputItems = completedResponse?.output || [];
+  const completedFc = outputItems.find((item) => item.type === "function_call");
+  assert.ok(completedFc, "completed output should have function_call");
+
+  const completedArgs = JSON.parse(completedFc?.arguments || "{}");
+  assert.equal(completedArgs.content, args.content, "completed arguments should match done event");
+});
+
+test("OmniRoute boundary: exec tool call arguments survive Responses API", { skip }, async () => {
+  const body = {
+    model: "gemini/gemma-4-26b-a4b-it",
+    input: [
+      {
+        role: "user",
+        content: [
+          {
+            type: "input_text",
+            text: "Run: echo hello world",
+          },
+        ],
+      },
+    ],
+    tools: [
+      {
+        type: "function",
+        name: "exec",
+        description: "Execute a shell command",
+        parameters: {
+          type: "object",
+          properties: {
+            command: { type: "string", description: "The command to execute" },
+          },
+          required: ["command"],
+        },
+        strict: true,
+      },
+    ],
+    temperature: 0.1,
+    max_output_tokens: 4096,
+    stream: true,
+  };
+
+  const events = await sendResponsesApiStream(body);
+
+  const doneEvent = events.find(
+    (e) => e.event === "response.output_item.done" && eventItem(e)?.type === "function_call"
+  );
+  assert.ok(doneEvent, "should have function_call");
+
+  const item = eventItem(doneEvent as SseEvent) as ResponseFunctionCallItem;
+  assert.equal(item.name, "exec");
+  assert.ok(item.call_id, "should have call_id");
+
+  const args = JSON.parse(item.arguments || "{}");
+  assert.equal(typeof args.command, "string");
+  assert.ok(args.command.length > 0, "command should not be empty");
+
+  // Completed event
+  const completed = events.find((e) => e.event === "response.completed");
+  assert.ok(completed, "should have response.completed");
+});
+
+test("OmniRoute boundary: parallel tool calls survive Responses API", { skip }, async () => {
+  const body = {
+    model: "gemini/gemma-4-26b-a4b-it",
+    input: [
+      {
+        role: "user",
+        content: [
+          {
+            type: "input_text",
+            text: "Write a file /tmp/parallel_a.txt with content 'aaa' AND write a file /tmp/parallel_b.txt with content 'bbb'",
+          },
+        ],
+      },
+    ],
+    tools: [
+      {
+        type: "function",
+        name: "write",
+        description: "Write content to a file",
+        parameters: {
+          type: "object",
+          properties: {
+            path: { type: "string" },
+            content: { type: "string" },
+          },
+          required: ["path", "content"],
+        },
+        strict: true,
+      },
+    ],
+    temperature: 0.1,
+    max_output_tokens: 4096,
+    stream: true,
+  };
+
+  const events = await sendResponsesApiStream(body);
+
+  const doneEvents = events.filter(
+    (e) => e.event === "response.output_item.done" && eventItem(e)?.type === "function_call"
+  );
+
+  assert.ok(doneEvents.length >= 1, "should have at least one function_call");
+
+  // Check each has valid args
+  for (const evt of doneEvents) {
+    const args = JSON.parse(eventItem(evt)?.arguments || "{}");
+    assert.ok(args.path || args.command, "each tool call should have arguments");
+  }
+
+  // Verify completed output matches
+  const completed = events.find((e) => e.event === "response.completed");
+  assert.ok(completed, "should have response.completed");
+  const completedResponse = completed?.data?.response as ResponsesJsonBody | undefined;
+  const outputFcs = (completedResponse?.output || []).filter(
+    (item) => item.type === "function_call"
+  );
+  assert.equal(outputFcs.length, doneEvents.length, "completed output should match count");
+});
+
+test("OmniRoute boundary: tool call through default combo (fill-first)", { skip }, async () => {
+  const body = {
+    model: "default",
+    input: [
+      {
+        role: "user",
+        content: [
+          {
+            type: "input_text",
+            text: "Run: echo 'combo test' > /tmp/combo_test.txt",
+          },
+        ],
+      },
+    ],
+    tools: [
+      {
+        type: "function",
+        name: "exec",
+        description: "Execute a shell command",
+        parameters: {
+          type: "object",
+          properties: {
+            command: { type: "string" },
+          },
+          required: ["command"],
+        },
+        strict: true,
+      },
+    ],
+    temperature: 0.1,
+    max_output_tokens: 4096,
+    stream: true,
+  };
+
+  const events = await sendResponsesApiStream(body);
+
+  const doneEvent = events.find(
+    (e) => e.event === "response.output_item.done" && eventItem(e)?.type === "function_call"
+  );
+  assert.ok(doneEvent, "should have function_call through default combo");
+
+  const args = JSON.parse(eventItem(doneEvent as SseEvent)?.arguments || "{}");
+  assert.equal(typeof args.command, "string");
+  assert.ok(args.command.length > 0);
+});
+
+test("OmniRoute boundary: multi-line Python code survives tool call arguments", { skip }, async () => {
+  const pythonCode = [
+    "import json",
+    "import random",
+    "",
+    "data = {",
+    '    "numbers": [random.randint(1, 100) for _ in range(5)]',
+    "}",
+    "",
+    "with open('/tmp/boundary_test.json', 'w') as f:",
+    "    json.dump(data, f, indent=2)",
+    "",
+    'print("Done")',
+    "",
+  ].join("\n");
+
+  const body = {
+    model: "gemini/gemma-4-26b-a4b-it",
+    input: [
+      {
+        role: "user",
+        content: [
+          {
+            type: "input_text",
+            text: `Write a Python script at /tmp/boundary_test.py that generates random numbers and saves to JSON, then run it.
+
+Script content:
+${pythonCode}`,
+          },
+        ],
+      },
+    ],
+    tools: [
+      {
+        type: "function",
+        name: "write",
+        description: "Write content to a file",
+        parameters: {
+          type: "object",
+          properties: {
+            path: { type: "string" },
+            content: { type: "string" },
+          },
+          required: ["path", "content"],
+        },
+        strict: true,
+      },
+      {
+        type: "function",
+        name: "exec",
+        description: "Execute a shell command",
+        parameters: {
+          type: "object",
+          properties: {
+            command: { type: "string" },
+          },
+          required: ["command"],
+        },
+        strict: true,
+      },
+    ],
+    temperature: 0.1,
+    max_output_tokens: 4096,
+    stream: true,
+  };
+
+  const events = await sendResponsesApiStream(body);
+
+  const writeDoneEvent = events.find(
+    (e) => e.event === "response.output_item.done" && eventItem(e)?.name === "write"
+  );
+
+  if (writeDoneEvent) {
+    const args = JSON.parse(eventItem(writeDoneEvent)?.arguments || "{}");
+    assert.equal(typeof args.content, "string");
+    assert.ok(args.content.includes("\n"), "Python code should have newlines");
+
+    // CRITICAL CHECK: Python code with `:\n    ` pattern should not have literal backslash-n
+    const colonBackslashN = args.content.match(/:\\n/g);
+    const colonNewline = args.content.match(/: *\n/g);
+
+    // If the model uses the colon-newline-indent pattern, it should be actual newline
+    if (colonNewline && colonNewline.length > 0) {
+      // This section has proper newlines - good
+    }
+    if (colonBackslashN && colonBackslashN.length > 0) {
+      console.log(
+        `WARNING: Found ${colonBackslashN.length} literal backslash-n after colon patterns`
+      );
+      console.log("  This indicates Gemma4 model is generating malformed content");
+    }
+
+    // The test: content should NOT have literal backslash-n in critical positions
+    // (the model may still have this bug, so we document rather than hard-fail)
+    const hasLiteralBSNAfterColon = (args.content as string).includes(":\\n");
+    if (hasLiteralBSNAfterColon) {
+      console.log("NOTE: Gemma4 model generated literal backslash-n after colon - known model bug");
+    }
+  }
+
+  // At minimum, we should have at least one function_call event
+  const anyDone = events.find(
+    (e) => e.event === "response.output_item.done" && eventItem(e)?.type === "function_call"
+  );
+  assert.ok(anyDone, "should have at least one function_call");
+});
+
+test("OmniRoute boundary: model responds with proper JSON args when given clear tool defs", { skip }, async () => {
+  // Test that the model can correctly produce tool calls with simple args
+  const body = {
+    model: "gemini/gemma-4-26b-a4b-it",
+    input: [
+      {
+        role: "user",
+        content: [
+          {
+            type: "input_text",
+            text: "What is 2+2? Use the calculator tool.",
+          },
+        ],
+      },
+    ],
+    tools: [
+      {
+        type: "function",
+        name: "calculate",
+        description: "Calculate a math expression",
+        parameters: {
+          type: "object",
+          properties: {
+            expression: {
+              type: "string",
+              description: "The math expression to evaluate",
+            },
+          },
+          required: ["expression"],
+        },
+        strict: true,
+      },
+    ],
+    temperature: 0.1,
+    max_output_tokens: 4096,
+    stream: true,
+  };
+
+  const events = await sendResponsesApiStream(body);
+
+  const doneEvent = events.find(
+    (e) => e.event === "response.output_item.done" && eventItem(e)?.type === "function_call"
+  );
+
+  if (doneEvent) {
+    const rawArguments = eventItem(doneEvent)?.arguments || "{}";
+    const args = JSON.parse(rawArguments);
+    assert.equal(typeof args.expression, "string");
+    assert.ok(args.expression.includes("2+2") || args.expression.includes("2 + 2"));
+
+    // Verify the arguments JSON is valid
+    assert.doesNotThrow(() => {
+      JSON.parse(rawArguments);
+    });
+  }
+});
+
+test("OpenClaw boundary: processResponsesStream correctly parses tool call args with newlines", () => {
+  // Simulate what OpenClaw's processResponsesStream does with tool call args
+  // This tests the parsing logic without requiring the full OpenClaw build
+
+  function stringifyJsonLike(value: unknown, fallback = ""): string {
+    if (typeof value === "string") return value;
+    if (value && typeof value === "object") return JSON.stringify(value);
+    if (typeof value === "number" || typeof value === "boolean") return String(value);
+    return fallback;
+  }
+
+  function parseStreamingJson(partialJson: string | undefined): Record<string, unknown> {
+    if (!partialJson || partialJson.trim() === "") return {};
+    try {
+      return JSON.parse(partialJson);
+    } catch {
+      return {};
+    }
+  }
+
+  // Simulate item.arguments from a response.output_item.done event
+  const itemArguments = JSON.stringify({
+    path: "/tmp/test.txt",
+    content: "hello\nworld\nline3\n",
+  });
+
+  // OpenClaw step 1: stringifyJsonLike
+  const strArgs = stringifyJsonLike(itemArguments, "{}");
+  assert.equal(typeof strArgs, "string");
+
+  // OpenClaw step 2: parseStreamingJson
+  const parsed = parseStreamingJson(strArgs);
+  assert.ok(parsed.content, "should have content key");
+  assert.equal(typeof parsed.content, "string");
+
+  // Verify ACTUAL newlines in the content
+  const content = parsed.content as string;
+  assert.ok(content.includes("\n"), "content should have actual newlines");
+  assert.equal(content, "hello\nworld\nline3\n");
+
+  // Count: should have exactly 3 newlines (after each line), zero literal backslash-n
+  const newlineCount = (content.match(/\n/g) || []).length;
+  const literalBSNCount = (content.match(/\\n/g) || []).length;
+  assert.equal(newlineCount, 3, "should have 3 actual newlines");
+  assert.equal(literalBSNCount, 0, "should have 0 literal backslash-n");
+
+  // Verify byte-level: each newline should be 0x0A
+  for (let i = 0; i < content.length; i++) {
+    if (content[i] === "\n") {
+      assert.equal(content.charCodeAt(i), 0x0a);
+    }
+    // No position should have \ + n in sequence
+    if (content[i] === "\\" && i + 1 < content.length && content[i + 1] === "n") {
+      assert.fail(`found literal backslash-n at position ${i}`);
+    }
+  }
+});
+
+test("OpenClaw boundary: processResponsesStream detects tool calls and promotes stopReason", () => {
+  // Simulate the output.content array and stopReason promotion logic
+  const output: {
+    content: { type: string; name?: string; arguments?: unknown }[];
+    stopReason?: string;
+  } = {
+    content: [],
+    stopReason: undefined,
+  };
+
+  // Simulate toolcall_start handler
+  const item = {
+    type: "function_call" as const,
+    call_id: "call_test_1",
+    name: "write",
+    arguments: JSON.stringify({ path: "/tmp/t.txt", content: "hello\nworld\n" }),
+  };
+
+  const block = {
+    type: "toolCall" as const,
+    id: `${item.call_id}|fc_test`,
+    name: item.name,
+    arguments: JSON.parse(item.arguments),
+    partialJson: item.arguments,
+  };
+  output.content.push(block);
+
+  // Simulate response.completed handler
+  function mapResponsesStopReason(status: string | undefined): string {
+    if (status === "completed") return "stop";
+    if (status === "in_progress") return "ongoing";
+    return status || "stop";
+  }
+
+  output.stopReason = mapResponsesStopReason("completed");
+  assert.equal(output.stopReason, "stop");
+
+  // Promote stopReason if there are tool calls
+  if (output.content.some((b) => b.type === "toolCall") && output.stopReason === "stop") {
+    output.stopReason = "toolUse";
+  }
+
+  assert.equal(output.stopReason, "toolUse");
+  assert.equal(output.content.length, 1);
+  assert.equal(output.content[0].type, "toolCall");
+  assert.equal(output.content[0].name, "write");
+
+  const toolArgs = output.content[0].arguments as Record<string, string>;
+  assert.equal(toolArgs.content, "hello\nworld\n");
+  assert.ok(toolArgs.content.includes("\n"), "tool call content has newlines");
+});
+
+test("OpenClaw boundary: stringifyJsonLike preserves strings as-is (no double JSON.stringify)", () => {
+  // This tests that OpenClaw's stringifyJsonLike does NOT double-encode
+  function stringifyJsonLike(value: unknown, fallback = ""): string {
+    if (typeof value === "string") return value;
+    if (value && typeof value === "object") return JSON.stringify(value);
+    if (typeof value === "number" || typeof value === "boolean") return String(value);
+    return fallback;
+  }
+
+  // Case 1: item.arguments is already a JSON string (typical case)
+  const argsStr = JSON.stringify({ path: "/tmp/t.txt", content: "hello\nworld\n" });
+  const result1 = stringifyJsonLike(argsStr, "{}");
+  // Should return as-is (no double encoding)
+  assert.equal(result1, argsStr);
+  const parsed = JSON.parse(result1);
+  assert.equal(parsed.content, "hello\nworld\n");
+
+  // Case 2: item.arguments is somehow an object (edge case)
+  const argsObj = { path: "/tmp/t.txt", content: "hello\nworld\n" };
+  const result2 = stringifyJsonLike(argsObj, "{}");
+  // Should JSON.stringify it
+  assert.equal(typeof result2, "string");
+  const parsed2 = JSON.parse(result2);
+  assert.equal(parsed2.content, "hello\nworld\n");
+
+  // Case 3: malformed edge case - undefined
+  assert.equal(stringifyJsonLike(undefined, "{}"), "{}");
+  assert.equal(stringifyJsonLike(null, "{}"), "{}");
+  assert.equal(stringifyJsonLike(42, "{}"), "42");
+});
diff --git a/tests/integration/api-keys.test.ts b/tests/integration/api-keys.test.ts
index cf6dd31698..1c4b6337d2 100644
--- a/tests/integration/api-keys.test.ts
+++ b/tests/integration/api-keys.test.ts
@@ -278,10 +278,15 @@ test("POST /api/keys triggers cloud sync when cloud mode is enabled", async () =
       })
     );
     const body = (await response.json()) as any;
-    const syncPayload = JSON.parse(calls[0].options.body);
 
     assert.equal(response.status, 201);
     assert.equal(body.name, "Cloud Synced Key");
+
+    // #6570: cloud sync is fire-and-forget so it no longer blocks the
+    // response — give the background task a moment to run before asserting
+    // it happened.
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    const syncPayload = JSON.parse(calls[0].options.body);
     assert.equal(calls.length, 1);
     assert.match(String(calls[0].url), /^http:\/\/cloud\.example\/sync\//);
     assert.ok(Array.isArray(syncPayload.providers));
@@ -348,8 +353,13 @@ test("POST /api/keys still succeeds when cloud sync fails after creation", async
 
     assert.equal(response.status, 201);
     assert.equal(body.name, "Cloud Failure Tolerated");
-    assert.equal(syncAttempts, 1);
     assert.equal(stored?.name, "Cloud Failure Tolerated");
+
+    // #6570: cloud sync is fire-and-forget so it no longer blocks the
+    // response — give the background task a moment to run before asserting
+    // the (failed) sync attempt happened and was tolerated.
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    assert.equal(syncAttempts, 1);
   } finally {
     globalThis.fetch = originalFetch;
   }
diff --git a/tests/integration/chat-pipeline.test.ts b/tests/integration/chat-pipeline.test.ts
index 659752b13d..152a21a0ee 100644
--- a/tests/integration/chat-pipeline.test.ts
+++ b/tests/integration/chat-pipeline.test.ts
@@ -698,7 +698,7 @@ test("chat pipeline applies Codex CLI fingerprint to OAuth responses requests",
   assert.equal(call.headers.Version, getCodexClientVersion());
   assert.equal(call.headers["Openai-Beta"], "responses=experimental");
   assert.equal(call.headers["X-Codex-Beta-Features"], "responses_websockets");
-  assert.equal(call.headers["User-Agent"], "codex-cli/0.142.0 (Windows 10.0.26200; x64)");
+  assert.equal(call.headers["User-Agent"], "codex-cli/0.144.1 (Windows 10.0.26200; x64)");
   assert.equal(call.headers["x-codex-window-id"], "conv_codex_fingerprint:0");
   assert.ok(call.headers["x-client-request-id"], "expected Codex request id header");
   assert.ok(call.headers["x-codex-turn-metadata"], "expected Codex turn metadata header");
diff --git a/tests/integration/cli-settings-letta.test.ts b/tests/integration/cli-settings-letta.test.ts
new file mode 100644
index 0000000000..881e8a32bf
--- /dev/null
+++ b/tests/integration/cli-settings-letta.test.ts
@@ -0,0 +1,196 @@
+/**
+ * Integration tests for /api/cli-tools/letta-settings
+ *
+ * Letta configures OmniRoute as its "lmstudio" provider (localModelDiscovery:
+ * openai-compatible auto-discovers models from /v1/models). The route shells
+ * out to `which letta` to detect the CLI install, so it is classified
+ * local-only in routeGuard.ts (Hard Rules #15 + #17) AND guarded by
+ * requireCliToolsAuth() like every other cli-tools route
+ * (tests/unit/cli-tools-auth-hardening.test.ts).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-letta-settings-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = "test-api-key-secret-letta";
+process.env.JWT_SECRET = "test-jwt-secret-letta";
+
+const core = await import("../../src/lib/db/core.ts");
+const localDb = await import("../../src/lib/localDb.ts");
+
+const { GET, POST, DELETE } = await import(
+  "../../src/app/api/cli-tools/letta-settings/route.ts"
+);
+
+let tmpHome: string;
+let origHome: string | undefined;
+
+function getAuthPath() {
+  return path.join(tmpHome, ".letta", "lc-local-backend", "providers", "auth.json");
+}
+
+function req(init?: RequestInit) {
+  return new Request("http://localhost/api/cli-tools/letta-settings", init);
+}
+
+async function resetStorage() {
+  delete process.env.INITIAL_PASSWORD;
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+async function enableAuth() {
+  process.env.INITIAL_PASSWORD = "test-bootstrap";
+  await localDb.updateSettings({ requireLogin: true, password: "" });
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "letta-settings-home-"));
+  origHome = process.env.HOME;
+  process.env.HOME = tmpHome;
+});
+
+test.afterEach(() => {
+  process.env.HOME = origHome;
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+
+// ── Test 1: GET without auth → 401 ──────────────────────────────────────────
+
+test("letta-settings GET: returns 401 when auth required and no token", async () => {
+  await enableAuth();
+  const res = await GET(req());
+  assert.equal(res.status, 401, `Expected 401, got ${res.status}`);
+});
+
+// ── Test 2: GET → 200 installed:false when the letta CLI is absent ──────────
+
+test("letta-settings GET: returns 200 installed:false when Letta CLI is absent", async () => {
+  const res = await GET(req());
+  assert.equal(res.status, 200, `Expected 200, got ${res.status}`);
+  const body = await res.json();
+  assert.equal(body.installed, false);
+  assert.equal(body.config, null);
+});
+
+// ── Test 3: GET → detects "installed" via an existing ~/.letta dir ──────────
+
+test("letta-settings GET: treats an existing ~/.letta directory as installed", async () => {
+  fs.mkdirSync(path.join(tmpHome, ".letta"), { recursive: true });
+  const res = await GET(req());
+  assert.equal(res.status, 200);
+  const body = await res.json();
+  assert.equal(body.installed, true);
+  assert.equal(body.hasOmniRoute, false);
+});
+
+// ── Test 4: POST with invalid body → 400 ─────────────────────────────────────
+
+test("letta-settings POST: 400 when baseUrl is missing", async () => {
+  const res = await POST(
+    req({
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ apiKey: "sk-test" }),
+    })
+  );
+  assert.equal(res.status, 400, `Expected 400, got ${res.status}`);
+  const body = await res.json();
+  assert.ok(body.error !== undefined);
+});
+
+// ── Test 5: POST with valid body → writes the lmstudio provider to auth.json ─
+
+test("letta-settings POST: writes the lmstudio provider entry for a fresh install", async () => {
+  const res = await POST(
+    req({
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ baseUrl: "http://localhost:20128", apiKey: "sk-test-letta" }),
+    })
+  );
+  assert.equal(res.status, 200, `Expected 200, got ${res.status}`);
+  const body = await res.json();
+  assert.equal(body.success, true);
+
+  const authPath = getAuthPath();
+  assert.ok(fs.existsSync(authPath), "auth.json must be written");
+  const authFile = JSON.parse(fs.readFileSync(authPath, "utf-8"));
+  assert.equal(authFile.providers.lmstudio.base_url, "http://localhost:20128/v1");
+  assert.equal(authFile.providers.lmstudio.auth.key, "sk-test-letta");
+});
+
+// ── Test 6: POST refuses to overwrite an existing non-OmniRoute lmstudio config ──
+
+test("letta-settings POST: 409 when lmstudio is already configured for real LM Studio", async () => {
+  const providersDir = path.join(tmpHome, ".letta", "lc-local-backend", "providers");
+  fs.mkdirSync(providersDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(providersDir, "auth.json"),
+    JSON.stringify({
+      version: 1,
+      providers: { lmstudio: { base_url: "http://localhost:1234/v1" } },
+    })
+  );
+
+  const res = await POST(
+    req({
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ baseUrl: "http://localhost:20128", apiKey: "sk-test-letta" }),
+    })
+  );
+  assert.equal(res.status, 409, `Expected 409, got ${res.status}`);
+  const body = await res.json();
+  assert.equal(body.conflict, true);
+});
+
+// ── Test 7: DELETE → removes the OmniRoute lmstudio config ──────────────────
+
+test("letta-settings DELETE: removes the lmstudio provider written by POST", async () => {
+  await POST(
+    req({
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ baseUrl: "http://localhost:20128", apiKey: "sk-test-letta" }),
+    })
+  );
+
+  const res = await DELETE(req({ method: "DELETE" }));
+  assert.equal(res.status, 200, `Expected 200, got ${res.status}`);
+  const body = await res.json();
+  assert.equal(body.success, true);
+
+  const authFile = JSON.parse(fs.readFileSync(getAuthPath(), "utf-8"));
+  assert.ok(!authFile.providers.lmstudio, "lmstudio provider must be removed");
+});
+
+// ── Test 8: Error sanitization (Hard Rule #12) ───────────────────────────────
+
+test("letta-settings: error responses do not leak stack traces", async () => {
+  const badReq = req({
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: "{ bad json }",
+  });
+  const res = await POST(badReq);
+  const bodyStr = JSON.stringify(await res.json());
+  assert.ok(
+    !bodyStr.match(/\s+at\s+\/[^\s]/),
+    "Error response must not contain absolute-path stack traces"
+  );
+});
+
+test.after(async () => {
+  await resetStorage();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  delete process.env.DATA_DIR;
+  delete process.env.API_KEY_SECRET;
+  delete process.env.JWT_SECRET;
+});
diff --git a/tests/integration/cli-settings-omp.test.ts b/tests/integration/cli-settings-omp.test.ts
new file mode 100644
index 0000000000..54ae67f3a1
--- /dev/null
+++ b/tests/integration/cli-settings-omp.test.ts
@@ -0,0 +1,197 @@
+/**
+ * Integration tests for /api/cli-tools/omp-settings
+ *
+ * Oh My Pi (omp) reads its own local sqlite DB (~/.omp/agent/agent.db,
+ * created by the omp CLI itself) via src/lib/db/omp.ts, plus a
+ * ~/.omp/agent/models.yml file for provider/model discovery config. The route
+ * shells out to `which omp` to detect the CLI install, so it is classified
+ * local-only in routeGuard.ts (Hard Rules #15 + #17) AND guarded by
+ * requireCliToolsAuth() like every other cli-tools route
+ * (tests/unit/cli-tools-auth-hardening.test.ts).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import Database from "better-sqlite3";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-omp-settings-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = "test-api-key-secret-omp";
+process.env.JWT_SECRET = "test-jwt-secret-omp";
+
+const core = await import("../../src/lib/db/core.ts");
+const localDb = await import("../../src/lib/localDb.ts");
+
+const { GET, POST, DELETE } = await import("../../src/app/api/cli-tools/omp-settings/route.ts");
+
+let tmpHome: string;
+let origHome: string | undefined;
+
+function getOmpDir() {
+  return path.join(tmpHome, ".omp", "agent");
+}
+
+function req(init?: RequestInit) {
+  return new Request("http://localhost/api/cli-tools/omp-settings", init);
+}
+
+/** Simulate the omp CLI having already created its sqlite DB + schema. */
+function seedOmpDb() {
+  const dbPath = path.join(getOmpDir(), "agent.db");
+  fs.mkdirSync(path.dirname(dbPath), { recursive: true });
+  const db = new Database(dbPath);
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS auth_credentials (
+      provider TEXT NOT NULL,
+      credential_type TEXT NOT NULL,
+      data TEXT,
+      disabled_cause TEXT,
+      identity_key TEXT,
+      created_at INTEGER,
+      updated_at INTEGER
+    )
+  `);
+  db.close();
+}
+
+async function resetStorage() {
+  delete process.env.INITIAL_PASSWORD;
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+async function enableAuth() {
+  process.env.INITIAL_PASSWORD = "test-bootstrap";
+  await localDb.updateSettings({ requireLogin: true, password: "" });
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "omp-settings-home-"));
+  origHome = process.env.HOME;
+  process.env.HOME = tmpHome;
+});
+
+test.afterEach(() => {
+  process.env.HOME = origHome;
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+
+// ── Test 1: GET without auth → 401 ──────────────────────────────────────────
+
+test("omp-settings GET: returns 401 when auth required and no token", async () => {
+  await enableAuth();
+  const res = await GET(req());
+  assert.equal(res.status, 401, `Expected 401, got ${res.status}`);
+});
+
+// ── Test 2: GET → 200 with installed:false when omp is not present ──────────
+
+test("omp-settings GET: returns 200 installed:false when omp CLI and DB are both absent", async () => {
+  const res = await GET(req());
+  assert.equal(res.status, 200, `Expected 200, got ${res.status}`);
+  const body = await res.json();
+  assert.equal(body.installed, false);
+  assert.equal(body.config, null);
+});
+
+// ── Test 3: GET → detects "installed" via the DB file even without the binary on PATH ──
+
+test("omp-settings GET: treats an existing agent.db as installed", async () => {
+  seedOmpDb();
+  const res = await GET(req());
+  assert.equal(res.status, 200);
+  const body = await res.json();
+  assert.equal(body.installed, true);
+  assert.equal(body.hasOmniRoute, false);
+});
+
+// ── Test 4: POST with invalid body → 400 ─────────────────────────────────────
+
+test("omp-settings POST: 400 when baseUrl is missing", async () => {
+  const res = await POST(
+    req({
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ apiKey: "sk-test" }),
+    })
+  );
+  assert.equal(res.status, 400, `Expected 400, got ${res.status}`);
+  const body = await res.json();
+  assert.ok(body.error !== undefined);
+});
+
+// ── Test 5: POST with valid body → writes models.yml + persists credentials ──
+
+test("omp-settings POST: writes models.yml and persists credentials for a seeded DB", async () => {
+  seedOmpDb();
+
+  const res = await POST(
+    req({
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ baseUrl: "http://localhost:20128", apiKey: "sk-test-omp" }),
+    })
+  );
+  assert.equal(res.status, 200, `Expected 200, got ${res.status}`);
+  const body = await res.json();
+  assert.equal(body.success, true);
+
+  const modelsYmlPath = path.join(getOmpDir(), "models.yml");
+  assert.ok(fs.existsSync(modelsYmlPath), "models.yml must be written");
+  const content = fs.readFileSync(modelsYmlPath, "utf-8");
+  assert.ok(content.includes("http://localhost:20128/v1"), "models.yml must contain the base URL");
+
+  const getRes = await GET(req());
+  const getBody = await getRes.json();
+  assert.equal(getBody.hasOmniRoute, true);
+});
+
+// ── Test 6: DELETE → removes OmniRoute provider entry ────────────────────────
+
+test("omp-settings DELETE: removes the OmniRoute provider from models.yml and credentials", async () => {
+  seedOmpDb();
+  await POST(
+    req({
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ baseUrl: "http://localhost:20128", apiKey: "sk-test-omp" }),
+    })
+  );
+
+  const res = await DELETE(req({ method: "DELETE" }));
+  assert.equal(res.status, 200, `Expected 200, got ${res.status}`);
+  const body = await res.json();
+  assert.equal(body.success, true);
+
+  const getRes = await GET(req());
+  const getBody = await getRes.json();
+  assert.equal(getBody.hasOmniRoute, false);
+});
+
+// ── Test 7: Error sanitization (Hard Rule #12) ───────────────────────────────
+
+test("omp-settings: error responses do not leak stack traces", async () => {
+  const badReq = req({
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: "{ bad json }",
+  });
+  const res = await POST(badReq);
+  const bodyStr = JSON.stringify(await res.json());
+  assert.ok(
+    !bodyStr.match(/\s+at\s+\/[^\s]/),
+    "Error response must not contain absolute-path stack traces"
+  );
+});
+
+test.after(async () => {
+  await resetStorage();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  delete process.env.DATA_DIR;
+  delete process.env.API_KEY_SECRET;
+  delete process.env.JWT_SECRET;
+});
diff --git a/tests/integration/gemini-tool-call-escaping.test.ts b/tests/integration/gemini-tool-call-escaping.test.ts
new file mode 100644
index 0000000000..ceba577ed1
--- /dev/null
+++ b/tests/integration/gemini-tool-call-escaping.test.ts
@@ -0,0 +1,140 @@
+/**
+ * tests/integration/gemini-tool-call-escaping.test.ts
+ *
+ * Live integration tests verifying tool call argument escaping through
+ * the Chat Completions endpoint, the Responses API endpoint, and the
+ * OmniRoute combo routing engine — both streaming and non-streaming.
+ *
+ * Gemma4 models emit literal 0x0A bytes in functionCall.args string values.
+ * OmniRoute's translator must escape these into valid JSON \n sequences.
+ *
+ * Environment:
+ *   OMNIROUTE_API_KEY  — required (else tests skip)
+ *   OMNIROUTE_URL      — defaults to http://localhost:3000
+ *   TEST_DELAY_MS      — delay between tests, defaults to 5000
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  skip,
+  MODEL,
+  ensureTestEnvironment,
+  DELAY_BETWEEN_REQUESTS_MS,
+  ToolCall,
+  ChatResponse,
+  ResponsesToolCall,
+  ResponsesResponse,
+  TOOL_DEFINITION,
+  extractToolCalls,
+  extractToolCallsFromResponses,
+  validateToolCallArguments,
+  sendToolCallChatRequest,
+  sendStreamingToolCallChatRequest,
+  sendToolCallResponsesRequest,
+  sendStreamingToolCallResponsesRequest,
+} from "./liveGeminiShared.ts";
+
+const DIRECT_MODEL = "gemini/gemma-4-31b-it";
+
+const TOOL_CALL_PROMPT =
+  "Use write_file to create /tmp/test.py with Python code that has a function with " +
+  "a for loop that prints hello 5 times. Include proper indentation.";
+
+test.before(async () => {
+  await ensureTestEnvironment();
+});
+
+// ── Gemini Direct Model — Chat Completions ────────────────────────────────
+
+test("gemini direct: tool call arguments are valid JSON", { skip }, async () => {
+  const data = await sendToolCallChatRequest(DIRECT_MODEL, TOOL_CALL_PROMPT);
+  const toolCalls = extractToolCalls(data);
+  validateToolCallArguments(toolCalls);
+  console.log(`  [OK] gemini direct: ${toolCalls.length} tool calls, model=${data.model}`);
+});
+
+test("gemini direct: streaming tool call produces valid JSON", { skip }, async () => {
+  const data = await sendStreamingToolCallChatRequest(DIRECT_MODEL, TOOL_CALL_PROMPT);
+  const toolCalls = extractToolCalls(data);
+  if (toolCalls.length === 0) {
+    console.log("  [skip] gemini direct streaming: model did not produce a tool call");
+    return;
+  }
+  validateToolCallArguments(toolCalls);
+  console.log(
+    `  [OK] gemini direct streaming: ${toolCalls.length} tool calls, finish=${data.choices[0].finish_reason}`
+  );
+});
+
+// ── Gemini Direct Model — Responses API ───────────────────────────────────
+
+test("gemini direct: responses tool call arguments are valid JSON", { skip }, async () => {
+  const data = await sendToolCallResponsesRequest(DIRECT_MODEL, TOOL_CALL_PROMPT);
+  const toolCalls = extractToolCallsFromResponses(data);
+  if (toolCalls.length === 0) {
+    console.log("  [skip] gemini direct responses: no tool call in response");
+    return;
+  }
+  validateToolCallArguments(toolCalls);
+  console.log(
+    `  [OK] gemini direct responses: ${toolCalls.length} tool calls, model=${data.model}`
+  );
+});
+
+test("gemini direct: streaming responses tool call produces valid JSON", { skip }, async () => {
+  const toolCalls = await sendStreamingToolCallResponsesRequest(DIRECT_MODEL, TOOL_CALL_PROMPT);
+  if (toolCalls.length === 0) {
+    console.log("  [skip] gemini direct streaming responses: model did not produce a tool call");
+    return;
+  }
+  validateToolCallArguments(toolCalls);
+  console.log(`  [OK] gemini direct streaming responses: ${toolCalls.length} tool calls`);
+});
+
+// ── OmniRoute Combo — Chat Completions ────────────────────────────────────
+
+test("omniroute combo: tool call arguments are valid JSON", { skip }, async () => {
+  const data = await sendToolCallChatRequest(MODEL, TOOL_CALL_PROMPT);
+  const toolCalls = extractToolCalls(data);
+  validateToolCallArguments(toolCalls);
+  console.log(`  [OK] omniroute combo: ${toolCalls.length} tool calls, model=${data.model}`);
+});
+
+test("omniroute combo: streaming tool call produces valid JSON", { skip }, async () => {
+  const data = await sendStreamingToolCallChatRequest(MODEL, TOOL_CALL_PROMPT);
+  const toolCalls = extractToolCalls(data);
+  if (toolCalls.length === 0) {
+    console.log("  [skip] omniroute combo streaming: model did not produce a tool call");
+    return;
+  }
+  validateToolCallArguments(toolCalls);
+  console.log(
+    `  [OK] omniroute combo streaming: ${toolCalls.length} tool calls, finish=${data.choices[0].finish_reason}`
+  );
+});
+
+// ── OmniRoute Combo — Responses API ───────────────────────────────────────
+
+test("omniroute combo: responses tool call arguments are valid JSON", { skip }, async () => {
+  const data = await sendToolCallResponsesRequest(MODEL, TOOL_CALL_PROMPT);
+  const toolCalls = extractToolCallsFromResponses(data);
+  if (toolCalls.length === 0) {
+    console.log("  [skip] omniroute combo responses: no tool call in response");
+    return;
+  }
+  validateToolCallArguments(toolCalls);
+  console.log(
+    `  [OK] omniroute combo responses: ${toolCalls.length} tool calls, model=${data.model}`
+  );
+});
+
+test("omniroute combo: streaming responses tool call produces valid JSON", { skip }, async () => {
+  const toolCalls = await sendStreamingToolCallResponsesRequest(MODEL, TOOL_CALL_PROMPT);
+  if (toolCalls.length === 0) {
+    console.log("  [skip] omniroute combo streaming responses: model did not produce a tool call");
+    return;
+  }
+  validateToolCallArguments(toolCalls);
+  console.log(`  [OK] omniroute combo streaming responses: ${toolCalls.length} tool calls`);
+});
diff --git a/tests/integration/liveGeminiShared.ts b/tests/integration/liveGeminiShared.ts
index 133b3e9299..f91b285242 100644
--- a/tests/integration/liveGeminiShared.ts
+++ b/tests/integration/liveGeminiShared.ts
@@ -44,7 +44,7 @@ async function apiFetch(path: string, options: RequestInit = {}): Promise<Respon
     headers: {
       Authorization: `Bearer ${API_KEY}`,
       "Content-Type": "application/json",
-      ...(options.headers || {}),
+      ...options.headers,
     },
   });
 }
@@ -57,7 +57,8 @@ async function ensureGeminiProvider(): Promise<boolean> {
     const connections = data.connections || data;
     const geminiActive = Array.isArray(connections)
       ? connections.find(
-          (c: any) => c.provider === "gemini" && c.isActive && c.testStatus !== "expired"
+          (c: Record<string, unknown>) =>
+            c.provider === "gemini" && c.isActive && c.testStatus !== "expired"
         )
       : null;
 
@@ -68,7 +69,7 @@ async function ensureGeminiProvider(): Promise<boolean> {
 
     // Check if gemini exists but is expired — try to reactivate via DB
     const geminiExpired = Array.isArray(connections)
-      ? connections.find((c: any) => c.provider === "gemini" && c.isActive)
+      ? connections.find((c: Record<string, unknown>) => c.provider === "gemini" && c.isActive)
       : null;
 
     if (geminiExpired) {
@@ -143,7 +144,9 @@ async function ensureDefaultCombo(): Promise<void> {
     if (!res.ok) return;
     const data = await res.json();
     const combos = data.combos || data;
-    const existing = Array.isArray(combos) ? combos.find((c: any) => c.name === "default") : null;
+    const existing = Array.isArray(combos)
+      ? combos.find((c: Record<string, unknown>) => c.name === "default")
+      : null;
 
     if (existing) {
       console.log(
@@ -539,6 +542,405 @@ export async function readSSEStream(response: Response): Promise<StreamResult> {
   return { fullContent, finishReason, totalTokens };
 }
 
+// --------------------------------------------------------------------------
+// Tool Call Testing Helpers (Chat Completions + Responses API)
+// --------------------------------------------------------------------------
+
+export interface ToolCall {
+  id: string;
+  type: string;
+  function: {
+    name: string;
+    arguments: string;
+  };
+}
+
+export interface ResponsesToolCall {
+  id: string;
+  type: "function_call";
+  call_id: string;
+  name: string;
+  arguments: string;
+}
+
+export interface ChatResponse {
+  choices: Choice[];
+  model: string;
+}
+
+interface Choice {
+  finish_reason: string;
+  message: {
+    role: string;
+    content: string | null;
+    tool_calls?: ToolCall[];
+  };
+}
+
+export interface ResponsesResponse {
+  id: string;
+  object: string;
+  status: string;
+  model: string;
+  output: Array<{
+    id: string;
+    type: string;
+    role?: string;
+    content?: Array<{ type: string; text?: string; annotations?: unknown[] }>;
+    call_id?: string;
+    name?: string;
+    arguments?: string;
+  }>;
+  usage?: {
+    input_tokens: number;
+    output_tokens: number;
+    total_tokens: number;
+  };
+}
+
+export const TOOL_DEFINITION = {
+  type: "function" as const,
+  function: {
+    name: "write_file",
+    description: "Write content to a file",
+    parameters: {
+      type: "object" as const,
+      properties: {
+        path: { type: "string" as const, description: "File path" },
+        content: { type: "string" as const, description: "File content" },
+      },
+      required: ["path", "content"],
+    },
+    strict: true,
+  },
+};
+
+export function extractToolCalls(data: ChatResponse): ToolCall[] {
+  for (const choice of data.choices) {
+    if (choice.finish_reason === "tool_calls" && choice.message.tool_calls?.length) {
+      return choice.message.tool_calls;
+    }
+  }
+  return [];
+}
+
+export function extractToolCallsFromResponses(data: ResponsesResponse): ResponsesToolCall[] {
+  const results: ResponsesToolCall[] = [];
+  for (const item of data.output) {
+    if (item.type === "function_call" && item.arguments) {
+      results.push({
+        id: item.id,
+        type: "function_call",
+        call_id: item.call_id || item.id,
+        name: item.name || "",
+        arguments: item.arguments || "",
+      });
+    }
+  }
+  return results;
+}
+
+export function validateToolCallArguments(toolCalls: ToolCall[] | ResponsesToolCall[]): void {
+  assert.ok(toolCalls.length > 0, "expected at least one tool call");
+
+  for (const tc of toolCalls) {
+    const rawArgs = "function" in tc ? tc.function.arguments : tc.arguments;
+
+    let parsed: Record<string, unknown>;
+    try {
+      parsed = JSON.parse(rawArgs);
+    } catch (e) {
+      assert.fail(
+        `tool call arguments are NOT valid JSON: ${e}\n` +
+          `arguments repr: ${JSON.stringify(rawArgs)}\n` +
+          `arguments first 500 chars: ${rawArgs.slice(0, 500)}`
+      );
+      return;
+    }
+
+    assert.ok(typeof parsed === "object", "arguments must parse to an object");
+    assert.ok(typeof parsed.content === "string", "content must be a string");
+    assert.ok(typeof parsed.path === "string", "path must be a string");
+
+    const content = parsed.content as string;
+
+    if (content.includes("for ") || content.includes("def ")) {
+      assert.ok(content.includes("\n"), "multi-line code should contain actual newline characters");
+    }
+
+    const doubleEscaped = rawArgs.includes(String.raw`\\n`);
+    assert.ok(
+      !doubleEscaped,
+      String.raw`arguments should NOT contain double-escaped \\n sequences`
+    );
+
+    const reSerialized = JSON.stringify(parsed);
+    assert.doesNotThrow(() => JSON.parse(reSerialized), "re-serialized args should be valid JSON");
+  }
+}
+
+export async function sendToolCallChatRequest(
+  model: string,
+  prompt: string
+): Promise<ChatResponse> {
+  const res = await fetch(`${BASE_URL}/v1/chat/completions`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${API_KEY}`,
+    },
+    body: JSON.stringify({
+      model,
+      messages: [{ role: "user", content: prompt }],
+      tools: [TOOL_DEFINITION],
+      temperature: 0.1,
+      stream: false,
+      max_tokens: 4096,
+    }),
+    signal: AbortSignal.timeout(90_000),
+  });
+
+  assert.equal(res.status, 200, `HTTP ${res.status}`);
+  const data = (await res.json()) as ChatResponse;
+  assert.ok(data.choices?.length > 0, "expected at least one choice");
+  return data;
+}
+
+export async function sendStreamingToolCallChatRequest(
+  model: string,
+  prompt: string
+): Promise<ChatResponse> {
+  const res = await fetch(`${BASE_URL}/v1/chat/completions`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${API_KEY}`,
+    },
+    body: JSON.stringify({
+      model,
+      messages: [{ role: "user", content: prompt }],
+      tools: [TOOL_DEFINITION],
+      temperature: 0.1,
+      stream: true,
+      max_tokens: 4096,
+    }),
+    signal: AbortSignal.timeout(120_000),
+  });
+
+  assert.equal(res.status, 200, `HTTP ${res.status}`);
+
+  const reader = res.body!.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  const toolCallDeltas: Map<string, { id: string; name: string; arguments: string }> = new Map();
+  let finalFinishReason = "";
+  let finalModel = "";
+
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+
+    buffer += decoder.decode(value, { stream: true });
+    const lines = buffer.split("\n");
+    buffer = lines.pop() || "";
+
+    for (const line of lines) {
+      if (!line.startsWith("data: ")) continue;
+      const data = line.slice(6).trim();
+      if (data === "[DONE]") continue;
+
+      try {
+        const parsed = JSON.parse(data) as Record<string, unknown>;
+        const choices = (parsed.choices ?? []) as Array<Record<string, unknown>>;
+        const choice = choices[0];
+
+        if (choice?.finish_reason) {
+          finalFinishReason = choice.finish_reason as string;
+        }
+        if (parsed.model && !finalModel) {
+          finalModel = parsed.model as string;
+        }
+
+        const delta = choice?.delta as Record<string, unknown> | undefined;
+        const tcDeltas = delta?.tool_calls as Array<Record<string, unknown>> | undefined;
+        if (tcDeltas) {
+          for (const tcd of tcDeltas) {
+            const idx = tcd.index as number;
+            const id = tcd.id as string | undefined;
+            const fn = tcd.function as Record<string, unknown> | undefined;
+
+            if (!toolCallDeltas.has(String(idx))) {
+              toolCallDeltas.set(String(idx), { id: id ?? "", name: "", arguments: "" });
+            }
+            const entry = toolCallDeltas.get(String(idx))!;
+            if (id) entry.id = id;
+            if (fn?.name) entry.name = fn.name as string;
+            if (fn?.arguments) entry.arguments += fn.arguments as string;
+          }
+        }
+      } catch {
+        // skip malformed chunks
+      }
+    }
+  }
+
+  const toolCalls: ToolCall[] = [];
+  for (const [, delta] of toolCallDeltas) {
+    toolCalls.push({
+      id: delta.id,
+      type: "function",
+      function: { name: delta.name, arguments: delta.arguments },
+    });
+  }
+
+  return {
+    model: finalModel,
+    choices: [
+      {
+        finish_reason: finalFinishReason,
+        message: {
+          role: "assistant",
+          content: null,
+          tool_calls: toolCalls.length > 0 ? toolCalls : undefined,
+        },
+      },
+    ],
+  };
+}
+
+export async function sendToolCallResponsesRequest(
+  model: string,
+  prompt: string
+): Promise<ResponsesResponse> {
+  const res = await fetch(`${BASE_URL}/v1/responses`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${API_KEY}`,
+    },
+    body: JSON.stringify({
+      model,
+      input: prompt,
+      tools: [
+        {
+          type: "function",
+          name: TOOL_DEFINITION.function.name,
+          description: TOOL_DEFINITION.function.description,
+          parameters: TOOL_DEFINITION.function.parameters,
+          strict: TOOL_DEFINITION.function.strict,
+        },
+      ],
+      temperature: 0.1,
+      stream: false,
+      max_output_tokens: 4096,
+    }),
+    signal: AbortSignal.timeout(90_000),
+  });
+
+  assert.equal(res.status, 200, `HTTP ${res.status}`);
+  const data = (await res.json()) as ResponsesResponse;
+  return data;
+}
+
+export async function sendStreamingToolCallResponsesRequest(
+  model: string,
+  prompt: string
+): Promise<ResponsesToolCall[]> {
+  const res = await fetch(`${BASE_URL}/v1/responses`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${API_KEY}`,
+    },
+    body: JSON.stringify({
+      model,
+      input: prompt,
+      tools: [
+        {
+          type: "function",
+          name: TOOL_DEFINITION.function.name,
+          description: TOOL_DEFINITION.function.description,
+          parameters: TOOL_DEFINITION.function.parameters,
+          strict: TOOL_DEFINITION.function.strict,
+        },
+      ],
+      temperature: 0.1,
+      stream: true,
+      max_output_tokens: 4096,
+    }),
+    signal: AbortSignal.timeout(120_000),
+  });
+
+  assert.equal(res.status, 200, `HTTP ${res.status}`);
+
+  const reader = res.body!.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  const toolCallMap = new Map<
+    string,
+    { id: string; call_id: string; name: string; arguments: string }
+  >();
+
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    buffer += decoder.decode(value, { stream: true });
+    const lines = buffer.split("\n");
+    buffer = lines.pop() || "";
+
+    for (const line of lines) {
+      if (!line.startsWith("data: ")) continue;
+      const data = line.slice(6).trim();
+      if (data === "[DONE]") continue;
+
+      try {
+        const parsed = JSON.parse(data) as Record<string, unknown>;
+        const eventType = parsed.type as string;
+
+        if (eventType === "response.output_item.added") {
+          const item = parsed.item as Record<string, unknown> | undefined;
+          if (item?.type === "function_call") {
+            const itemId = item.id as string;
+            const callId = (item.call_id as string) || itemId;
+            const name = (item.name as string) || "";
+            toolCallMap.set(itemId, { id: itemId, call_id: callId, name, arguments: "" });
+          }
+        } else if (eventType === "response.function_call_arguments.delta") {
+          const itemId = parsed.item_id as string;
+          const delta = parsed.delta as string;
+          if (!toolCallMap.has(itemId)) {
+            toolCallMap.set(itemId, { id: itemId, call_id: itemId, name: "", arguments: "" });
+          }
+          const entry = toolCallMap.get(itemId)!;
+          entry.arguments += delta;
+        } else if (eventType === "response.function_call_arguments.done") {
+          const itemId = parsed.item_id as string;
+          const args = parsed.arguments as string;
+          if (!toolCallMap.has(itemId)) {
+            toolCallMap.set(itemId, { id: itemId, call_id: itemId, name: "", arguments: "" });
+          }
+          const entry = toolCallMap.get(itemId)!;
+          entry.arguments = args;
+        }
+      } catch {
+        // skip malformed chunks
+      }
+    }
+  }
+
+  const toolCalls: ResponsesToolCall[] = [];
+  for (const [, tc] of toolCallMap) {
+    toolCalls.push({
+      id: tc.id,
+      type: "function_call",
+      call_id: tc.call_id,
+      name: tc.name,
+      arguments: tc.arguments,
+    });
+  }
+  return toolCalls;
+}
+
 // --------------------------------------------------------------------------
 // Shared helper
 // --------------------------------------------------------------------------
@@ -810,7 +1212,7 @@ export const CASE_BUILDERS = [
                   "Add-on Pack",
                 ]),
                 quantity: randomInt(1, 5),
-                price: parseFloat((Math.random() * 200 + 5).toFixed(2)),
+                price: Number.parseFloat((Math.random() * 200 + 5).toFixed(2)),
               })),
               total: 0,
               shipping: {
diff --git a/tests/integration/monitoring-health-cache.test.ts b/tests/integration/monitoring-health-cache.test.ts
new file mode 100644
index 0000000000..61a918609b
--- /dev/null
+++ b/tests/integration/monitoring-health-cache.test.ts
@@ -0,0 +1,63 @@
+/**
+ * Integration test for the short-TTL cache on GET /api/monitoring/health.
+ *
+ * Health is a frequently-polled endpoint; rebuilding it every request (DB reads
+ * + status aggregation across subsystems) is wasteful under rapid polling. The
+ * route caches the payload for HEALTH_PAYLOAD_TTL_MS (1s) and invalidates it on
+ * DELETE (circuit-breaker reset). We assert the behavior via the payload's
+ * `timestamp` field, which is stamped at build time: identical timestamp ⇒ the
+ * cached payload was served; a fresh timestamp ⇒ it was rebuilt.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-health-cache-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.REQUIRE_API_KEY = "false";
+process.env.JWT_SECRET = "test-health-cache-secret";
+
+await import("../../src/lib/db/core.ts");
+const { GET, DELETE } = await import("../../src/app/api/monitoring/health/route.ts");
+
+async function healthTimestamp(): Promise<string> {
+  const res = await GET();
+  const body = (await res.json()) as { timestamp?: string };
+  assert.ok(body.timestamp, "health payload should carry a timestamp");
+  return body.timestamp as string;
+}
+
+test("GET within the TTL serves the cached payload (identical timestamp)", async () => {
+  const t1 = await healthTimestamp();
+  const t2 = await healthTimestamp();
+  assert.equal(t2, t1, "a second GET within the TTL must return the cached payload");
+});
+
+test("cache expires after the TTL — a fresh payload is built", async () => {
+  const t1 = await healthTimestamp();
+  await new Promise((r) => setTimeout(r, 1100)); // TTL is 1000ms
+  const t2 = await healthTimestamp();
+  assert.notEqual(t2, t1, "after the 1s TTL the payload must be rebuilt");
+});
+
+test("DELETE (circuit-breaker reset) invalidates the cache immediately", async () => {
+  const { SignJWT } = await import("jose");
+  const authToken = await new SignJWT({ authenticated: true })
+    .setProtectedHeader({ alg: "HS256" })
+    .setExpirationTime("30d")
+    .sign(new TextEncoder().encode(process.env.JWT_SECRET as string));
+
+  const t1 = await healthTimestamp(); // populate cache
+  const delRes = await DELETE(
+    new Request("http://localhost/api/monitoring/health", {
+      method: "DELETE",
+      headers: { cookie: `auth_token=${authToken}` },
+    }),
+  );
+  assert.ok(delRes.status < 400, `DELETE should succeed, got ${delRes.status}`);
+  await new Promise((r) => setTimeout(r, 5)); // ensure the clock advances past ms precision
+  const t2 = await healthTimestamp();
+  assert.notEqual(t2, t1, "a GET right after DELETE must rebuild (cache invalidated)");
+});
diff --git a/tests/integration/presets-dashboard-auth.test.ts b/tests/integration/presets-dashboard-auth.test.ts
new file mode 100644
index 0000000000..36499c64d9
--- /dev/null
+++ b/tests/integration/presets-dashboard-auth.test.ts
@@ -0,0 +1,52 @@
+/**
+ * Integration test for dashboard-session auth on GET /api/playground/presets.
+ *
+ * The Playground page (dashboard) calls this route with a cookie/session and NO
+ * API key. Under REQUIRE_API_KEY=true that previously 401'd the authenticated
+ * dashboard, because checkAuth only accepted an API key. The fix also accepts a
+ * valid management/dashboard session (requireManagementAuth) as an alternative.
+ *
+ * We forge a real `auth_token` JWT (same shape the login route signs) so the
+ * dashboard-session path is exercised end-to-end against the real route handler.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-presets-auth-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.REQUIRE_API_KEY = "true"; // the scenario where the dashboard used to 401
+process.env.INITIAL_PASSWORD = "test-dashboard-password"; // makes login/auth required
+process.env.JWT_SECRET = "test-presets-auth-secret";
+
+await import("../../src/lib/db/core.ts");
+const { GET } = await import("../../src/app/api/playground/presets/route.ts");
+
+const BASE = "http://localhost/api/playground/presets";
+
+async function dashboardCookie(): Promise<string> {
+  const { SignJWT } = await import("jose");
+  const token = await new SignJWT({ authenticated: true })
+    .setProtectedHeader({ alg: "HS256" })
+    .setExpirationTime("30d")
+    .sign(new TextEncoder().encode(process.env.JWT_SECRET as string));
+  return `auth_token=${token}`;
+}
+
+test("REQUIRE_API_KEY=true: a valid dashboard session (no API key) is accepted — regression, was 401", async () => {
+  const res = await GET(new Request(BASE, { headers: { cookie: await dashboardCookie() } }));
+  assert.notEqual(res.status, 401, "an authenticated dashboard session must not be rejected");
+  assert.equal(res.status, 200);
+});
+
+test("REQUIRE_API_KEY=true: no session and no API key -> 401 (guard still enforces)", async () => {
+  const res = await GET(new Request(BASE));
+  assert.equal(res.status, 401);
+});
+
+test("REQUIRE_API_KEY=true: a tampered/invalid session token -> 401", async () => {
+  const res = await GET(new Request(BASE, { headers: { cookie: "auth_token=not.a.valid.jwt" } }));
+  assert.equal(res.status, 401);
+});
diff --git a/tests/integration/test-model-compression-off-6240.test.ts b/tests/integration/test-model-compression-off-6240.test.ts
new file mode 100644
index 0000000000..b5ad8ce857
--- /dev/null
+++ b/tests/integration/test-model-compression-off-6240.test.ts
@@ -0,0 +1,157 @@
+// #6240 — the dashboard "Test model" action must be a clean connection test: it must NOT carry
+// the operator's globally-enabled Output Styles system-prompt injection (e.g. "Ultra terse").
+//
+// Root cause: Phase 4A of handleChatCore (open-sse/handlers/chatCore.ts) injects the Output
+// Styles system message whenever the operator's global `compression.enabled` flag is on,
+// completely independent of the per-request `x-omniroute-compression` header/mode. The internal
+// "Test model" request builder (src/lib/api/modelTestRunner.ts::buildInternalChatRequest) never
+// sent that header, so a globally-enabled output style always leaked into test-model calls.
+//
+// This test locks the *chatCore* half of the fix directly: with Output Styles globally enabled,
+// a request carrying `x-omniroute-compression: off` must NOT get the styles system message
+// injected, while an otherwise-identical request without the header still does (so we're
+// actually testing the new gate, not something else disabling output styles).
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-testmodel-compression-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.REQUIRE_API_KEY = "false";
+process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "test-testmodel-compression-secret";
+
+const core = await import("../../src/lib/db/core.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const readCacheDb = await import("../../src/lib/db/readCache.ts");
+const compressionDb = await import("../../src/lib/db/compression.ts");
+const { handleChatCore } = await import("../../open-sse/handlers/chatCore.ts");
+const { resetAllCircuitBreakers } = await import("../../src/shared/utils/circuitBreaker.ts");
+
+const originalFetch = globalThis.fetch;
+
+async function resetStorage() {
+  globalThis.fetch = originalFetch;
+  resetAllCircuitBreakers();
+  readCacheDb.invalidateDbCache();
+  await new Promise((resolve) => setTimeout(resolve, 20));
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(async () => {
+  globalThis.fetch = originalFetch;
+  core.closeDbInstance();
+  try {
+    fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  } catch {
+    // best-effort cleanup
+  }
+});
+
+async function runChatCore(opts: {
+  provider: string;
+  model: string;
+  connectionId: string;
+  headers: Headers;
+}) {
+  let capturedBody: { messages?: Array<{ role?: string; content?: string }> } | null = null;
+  globalThis.fetch = async (_url: string | URL | Request, init?: RequestInit) => {
+    if (init?.body) {
+      capturedBody = JSON.parse(init.body as string) as typeof capturedBody;
+    }
+    return new Response(
+      JSON.stringify({
+        choices: [{ message: { role: "assistant", content: "ok" } }],
+        usage: { prompt_tokens: 10, completion_tokens: 5, total_tokens: 15 },
+      }),
+      { status: 200, headers: { "content-type": "application/json" } }
+    );
+  };
+
+  try {
+    const result = await handleChatCore({
+      body: {
+        model: opts.model,
+        stream: false,
+        messages: [{ role: "user", content: "ping" }],
+      },
+      modelInfo: { provider: opts.provider, model: opts.model },
+      credentials: { apiKey: "test-key" },
+      log: { debug: () => {}, info: () => {}, warn: () => {}, error: () => {} },
+      clientRawRequest: { endpoint: "/v1/chat/completions", headers: opts.headers },
+      connectionId: opts.connectionId,
+      onCredentialsRefreshed: () => {},
+      onRequestSuccess: () => {},
+      onStreamFailure: () => {},
+      onDisconnect: () => {},
+      userAgent: "test-agent",
+      comboName: null,
+    });
+    assert.ok(result.success, "Request should succeed");
+    return capturedBody;
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+}
+
+test("chatCore: x-omniroute-compression: off suppresses Output Styles injection even with the operator's global style enabled (#6240)", async () => {
+  const provider = "openai";
+  const model = "gpt-4";
+
+  await compressionDb.updateCompressionSettings({
+    enabled: true,
+    defaultMode: "off",
+    autoTriggerTokens: 0,
+    cavemanOutputMode: {
+      enabled: true,
+      intensity: "full",
+      autoClarity: true,
+    },
+  });
+
+  const connection = await providersDb.createProviderConnection({
+    provider,
+    apiKey: "test-key",
+    isActive: true,
+  });
+
+  // Sanity check: WITHOUT the opt-out header, the globally-enabled style still injects (proves
+  // the fixture actually exercises Output Styles, so the assertion below is meaningful).
+  const withoutOptOut = await runChatCore({
+    provider,
+    model,
+    connectionId: connection.id,
+    headers: new Headers(),
+  });
+  const plainFirstMessage = withoutOptOut?.messages?.[0];
+  assert.equal(plainFirstMessage?.role, "system");
+  assert.match(plainFirstMessage?.content ?? "", /OmniRoute Output Styles/);
+
+  // The "Test model" connection test sends x-omniroute-compression: off — must be clean.
+  const testModelBody = await runChatCore({
+    provider,
+    model,
+    connectionId: connection.id,
+    headers: new Headers({ "x-omniroute-compression": "off" }),
+  });
+  const testModelFirstMessage = testModelBody?.messages?.[0];
+  assert.ok(
+    !testModelFirstMessage || testModelFirstMessage.role !== "system",
+    "Test-model request (compression:off) must not receive an injected Output Styles system message"
+  );
+  const anyMessageHasMarker = (testModelBody?.messages ?? []).some((m) =>
+    (m?.content ?? "").includes("OmniRoute Output Styles")
+  );
+  assert.equal(
+    anyMessageHasMarker,
+    false,
+    "No message in the compression:off request should carry the Output Styles marker"
+  );
+});
diff --git a/tests/manual/gemini.http b/tests/manual/gemini.http
index f11d72c1fc..b9c88fbd76 100644
--- a/tests/manual/gemini.http
+++ b/tests/manual/gemini.http
@@ -2,7 +2,7 @@
 # @name OpenAI Response - Test streaming response
 POST {{omniroute-address}}/v1/responses
 Authorization: Bearer {{OMNIROUTE_API_KEY}}
-Content-Type: text/event-stream
+Content-Type: application/json
 
 {
   "model": "gemini/gemma-4-31b-it",
@@ -25,7 +25,7 @@ Content-Type: text/event-stream
 # @name Gemini Response - Test streaming response
 POST https://generativelanguage.googleapis.com/v1beta/models/gemma-4-31b-it:streamGenerateContent?alt=sse
 x-goog-api-key: {{GEMINI_API_KEY}}
-Content-Type: text/event-stream
+Content-Type: application/json
 
 {
   "model": "gemma-4-31b-it",
@@ -41,6 +41,26 @@ Content-Type: text/event-stream
   ]
 }
 
+###
+# @name Gemini Response - Test streaming response - 26B
+POST https://generativelanguage.googleapis.com/v1beta/models/gemma-4-26b-a4b-it:streamGenerateContent?alt=sse
+x-goog-api-key: {{GEMINI_API_KEY}}
+Content-Type: application/json
+
+{
+  "model": "gemma-4-26b-a4b-it",
+  "contents": [
+    {
+      "role": "user",
+      "parts": [
+        {
+          "text": "Ansver 1+1 only."
+        }
+      ]
+    }
+  ]
+}
+
 ###
 # @name OpenAI Response - Test non-streaming response
 POST {{omniroute-address}}/v1/responses
@@ -84,6 +104,26 @@ Content-Type: application/json
   ]
 }
 
+###
+# @name Gemini Response - Test non-streaming response - 26B
+POST https://generativelanguage.googleapis.com/v1beta/models/gemma-4-26b-a4b-it:generateContent
+x-goog-api-key: {{GEMINI_API_KEY}}
+Content-Type: application/json
+
+{
+  "model": "gemma-4-26b-a4b-it",
+  "contents": [
+    {
+      "role": "user",
+      "parts": [
+        {
+          "text": "Ansver 1+1 only."
+        }
+      ]
+    }
+  ]
+}
+
 ###
 # @name Tool history via OmniRoute — native functionCall/functionResponse round-trip
 # Tool calls in conversation history are mapped to native Gemini functionCall parts
@@ -207,6 +247,7 @@ Content-Type: application/json
     }
   ]
 }
+
 ###
 # @name Tool history via OmniRoute — thinking model
 # Same as native test above but with a thinking model (gemini-2.5-flash)
@@ -239,7 +280,6 @@ Content-Type: application/json
     {
       "role": "tool",
       "tool_call_id": "call_abc123",
-      "content": "{\"temperature\": 22, \"conditions\": \"Sunny\", \"humidity\": 45}"
     },
     {
       "role": "assistant",
diff --git a/tests/manual/image-generation.http b/tests/manual/image-generation.http
index 5fc1645fd3..755245527c 100644
--- a/tests/manual/image-generation.http
+++ b/tests/manual/image-generation.http
@@ -59,7 +59,7 @@ Authorization: Bearer {{OMNIROUTE_API_KEY}}
 Content-Type: application/json
 
 {
-  "model": "codex/gpt-5.4",
+  "model": "codex/gpt-5.6-sol",
   "prompt": "A happy red kitten, highly detailed fur, studio lighting",
   "n": 1,
   "size": "1024x1024",
@@ -90,4 +90,4 @@ Content-Type: application/json
   "stream": true
 }
 
-###
\ No newline at end of file
+###
diff --git a/tests/snapshots/provider/translate-path.json b/tests/snapshots/provider/translate-path.json
index d48688140e..ec208cafd1 100644
--- a/tests/snapshots/provider/translate-path.json
+++ b/tests/snapshots/provider/translate-path.json
@@ -28,7 +28,7 @@
       "apiKey": {
         "Accept": "text/event-stream",
         "Content-Type": "application/json",
-        "User-Agent": "claude-cli/2.1.195 (external, sdk-cli)",
+        "User-Agent": "claude-cli/2.1.207 (external, sdk-cli)",
         "X-Stainless-Arch": "<ARCH>",
         "X-Stainless-Lang": "js",
         "X-Stainless-OS": "MacOS",
@@ -47,7 +47,7 @@
       "nonStream": {
         "Accept": "application/json",
         "Content-Type": "application/json",
-        "User-Agent": "claude-cli/2.1.195 (external, sdk-cli)",
+        "User-Agent": "claude-cli/2.1.207 (external, sdk-cli)",
         "X-Stainless-Arch": "<ARCH>",
         "X-Stainless-Lang": "js",
         "X-Stainless-OS": "MacOS",
@@ -66,7 +66,7 @@
       "oauth": {
         "Accept": "text/event-stream",
         "Content-Type": "application/json",
-        "User-Agent": "claude-cli/2.1.195 (external, sdk-cli)",
+        "User-Agent": "claude-cli/2.1.207 (external, sdk-cli)",
         "X-Stainless-Arch": "<ARCH>",
         "X-Stainless-Lang": "js",
         "X-Stainless-OS": "MacOS",
@@ -713,7 +713,7 @@
         "Anthropic-Dangerous-Direct-Browser-Access": "true",
         "Anthropic-Version": "2023-06-01",
         "Content-Type": "application/json",
-        "User-Agent": "claude-cli/2.1.195 (external, cli)",
+        "User-Agent": "claude-cli/2.1.207 (external, cli)",
         "X-App": "cli",
         "X-Stainless-Arch": "<ARCH>",
         "X-Stainless-Helper-Method": "stream",
@@ -731,7 +731,7 @@
         "Anthropic-Dangerous-Direct-Browser-Access": "true",
         "Anthropic-Version": "2023-06-01",
         "Content-Type": "application/json",
-        "User-Agent": "claude-cli/2.1.195 (external, cli)",
+        "User-Agent": "claude-cli/2.1.207 (external, cli)",
         "X-App": "cli",
         "X-Stainless-Arch": "<ARCH>",
         "X-Stainless-Helper-Method": "stream",
@@ -750,7 +750,7 @@
         "Anthropic-Dangerous-Direct-Browser-Access": "true",
         "Anthropic-Version": "2023-06-01",
         "Content-Type": "application/json",
-        "User-Agent": "claude-cli/2.1.195 (external, cli)",
+        "User-Agent": "claude-cli/2.1.207 (external, cli)",
         "X-App": "cli",
         "X-Stainless-Arch": "<ARCH>",
         "X-Stainless-Helper-Method": "stream",
@@ -966,16 +966,16 @@
         "Authorization": "Bearer <TOK>",
         "Content-Type": "application/json",
         "Openai-Beta": "responses=experimental",
-        "User-Agent": "codex-cli/0.142.0 (<OS>; <ARCH>)",
-        "Version": "0.142.0",
+        "User-Agent": "codex-cli/0.144.1 (<OS>; <ARCH>)",
+        "Version": "0.144.1",
         "X-Codex-Beta-Features": "responses_websockets"
       },
       "nonStream": {
         "Authorization": "Bearer <TOK>",
         "Content-Type": "application/json",
         "Openai-Beta": "responses=experimental",
-        "User-Agent": "codex-cli/0.142.0 (<OS>; <ARCH>)",
-        "Version": "0.142.0",
+        "User-Agent": "codex-cli/0.144.1 (<OS>; <ARCH>)",
+        "Version": "0.144.1",
         "X-Codex-Beta-Features": "responses_websockets"
       },
       "oauth": {
@@ -983,8 +983,8 @@
         "Authorization": "Bearer <TOK>",
         "Content-Type": "application/json",
         "Openai-Beta": "responses=experimental",
-        "User-Agent": "codex-cli/0.142.0 (<OS>; <ARCH>)",
-        "Version": "0.142.0",
+        "User-Agent": "codex-cli/0.144.1 (<OS>; <ARCH>)",
+        "Version": "0.144.1",
         "X-Codex-Beta-Features": "responses_websockets"
       }
     },
@@ -1834,29 +1834,6 @@
       "stream": "https://opengateway.gitlawb.com/v1/gmi-cloud"
     }
   },
-  "glhf": {
-    "format": "openai",
-    "headers": {
-      "apiKey": {
-        "Accept": "text/event-stream",
-        "Authorization": "Bearer <TOK>",
-        "Content-Type": "application/json"
-      },
-      "nonStream": {
-        "Authorization": "Bearer <TOK>",
-        "Content-Type": "application/json"
-      },
-      "oauth": {
-        "Accept": "text/event-stream",
-        "Authorization": "Bearer <TOK>",
-        "Content-Type": "application/json"
-      }
-    },
-    "url": {
-      "nonStream": "https://api.laf.run/v1/chat/completions",
-      "stream": "https://api.laf.run/v1/chat/completions"
-    }
-  },
   "glm": {
     "format": "openai",
     "headers": {
@@ -2202,29 +2179,6 @@
       "stream": "https://spark-api.xf-yun.com/v1/chat/completions"
     }
   },
-  "inclusionai": {
-    "format": "openai",
-    "headers": {
-      "apiKey": {
-        "Accept": "text/event-stream",
-        "Authorization": "Bearer <TOK>",
-        "Content-Type": "application/json"
-      },
-      "nonStream": {
-        "Authorization": "Bearer <TOK>",
-        "Content-Type": "application/json"
-      },
-      "oauth": {
-        "Accept": "text/event-stream",
-        "Authorization": "Bearer <TOK>",
-        "Content-Type": "application/json"
-      }
-    },
-    "url": {
-      "nonStream": "https://api.inclusionai.tech/v1/chat/completions",
-      "stream": "https://api.inclusionai.tech/v1/chat/completions"
-    }
-  },
   "inference-net": {
     "format": "openai",
     "headers": {
@@ -2497,29 +2451,6 @@
       "stream": "https://codewhisperer.us-east-1.amazonaws.com/generateAssistantResponse"
     }
   },
-  "kluster": {
-    "format": "openai",
-    "headers": {
-      "apiKey": {
-        "Accept": "text/event-stream",
-        "Authorization": "Bearer <TOK>",
-        "Content-Type": "application/json"
-      },
-      "nonStream": {
-        "Authorization": "Bearer <TOK>",
-        "Content-Type": "application/json"
-      },
-      "oauth": {
-        "Accept": "text/event-stream",
-        "Authorization": "Bearer <TOK>",
-        "Content-Type": "application/json"
-      }
-    },
-    "url": {
-      "nonStream": "https://api.kluster.ai/v1/chat/completions",
-      "stream": "https://api.kluster.ai/v1/chat/completions"
-    }
-  },
   "lambda-ai": {
     "format": "openai",
     "headers": {
@@ -2635,6 +2566,29 @@
       "stream": "https://api.llm7.io/v1/chat/completions"
     }
   },
+  "lmarena": {
+    "format": "openai",
+    "headers": {
+      "apiKey": {
+        "Accept": "text/event-stream",
+        "Authorization": "Bearer <TOK>",
+        "Content-Type": "application/json"
+      },
+      "nonStream": {
+        "Authorization": "Bearer <TOK>",
+        "Content-Type": "application/json"
+      },
+      "oauth": {
+        "Accept": "text/event-stream",
+        "Authorization": "Bearer <TOK>",
+        "Content-Type": "application/json"
+      }
+    },
+    "url": {
+      "nonStream": "https://arena.ai/nextjs-api/stream/create-evaluation",
+      "stream": "https://arena.ai/nextjs-api/stream/create-evaluation"
+    }
+  },
   "longcat": {
     "format": "openai",
     "headers": {
@@ -3291,6 +3245,29 @@
       "stream": "https://openrouter.ai/api/v1/chat/completions"
     }
   },
+  "openvecta": {
+    "format": "openai",
+    "headers": {
+      "apiKey": {
+        "Accept": "text/event-stream",
+        "Authorization": "Bearer <TOK>",
+        "Content-Type": "application/json"
+      },
+      "nonStream": {
+        "Authorization": "Bearer <TOK>",
+        "Content-Type": "application/json"
+      },
+      "oauth": {
+        "Accept": "text/event-stream",
+        "Authorization": "Bearer <TOK>",
+        "Content-Type": "application/json"
+      }
+    },
+    "url": {
+      "nonStream": "https://api.openvecta.com/v1/chat/completions",
+      "stream": "https://api.openvecta.com/v1/chat/completions"
+    }
+  },
   "orcarouter": {
     "format": "openai",
     "headers": {
@@ -3775,8 +3752,8 @@
       }
     },
     "url": {
-      "nonStream": "https://api.sensenova.cn/v1/chat/completions",
-      "stream": "https://api.sensenova.cn/v1/chat/completions"
+      "nonStream": "https://token.sensenova.cn/v1/chat/completions",
+      "stream": "https://token.sensenova.cn/v1/chat/completions"
     }
   },
   "siliconflow": {
@@ -4521,6 +4498,29 @@
       "stream": "https://api.z.ai/api/anthropic/v1/messages?beta=true"
     }
   },
+  "zai-web": {
+    "format": "openai",
+    "headers": {
+      "apiKey": {
+        "Accept": "text/event-stream",
+        "Authorization": "Bearer <TOK>",
+        "Content-Type": "application/json"
+      },
+      "nonStream": {
+        "Authorization": "Bearer <TOK>",
+        "Content-Type": "application/json"
+      },
+      "oauth": {
+        "Accept": "text/event-stream",
+        "Authorization": "Bearer <TOK>",
+        "Content-Type": "application/json"
+      }
+    },
+    "url": {
+      "nonStream": "https://chat.z.ai",
+      "stream": "https://chat.z.ai"
+    }
+  },
   "zed-hosted": {
     "format": "openai",
     "headers": {
diff --git a/tests/unit/account-fallback-service.test.ts b/tests/unit/account-fallback-service.test.ts
index 02fd6ed006..768f21f231 100644
--- a/tests/unit/account-fallback-service.test.ts
+++ b/tests/unit/account-fallback-service.test.ts
@@ -202,11 +202,11 @@ test("checkFallbackError preserves OAuth 429 exhausted-credit semantics", () =>
   assert.equal(result.cooldownMs, COOLDOWN_MS.paymentRequired ?? 3600 * 1000);
 });
 
-test("checkFallbackError keeps API-key 429 quota text on the status-based resilience path", () => {
+test("#6638: checkFallbackError classifies API-key 429 explicit quota text as quota_exhausted", () => {
   const result = checkFallbackError(429, "quota exceeded", 0, null, "openai", null, makeProfile());
 
   assert.equal(result.shouldFallback, true);
-  assert.equal(result.reason, RateLimitReason.RATE_LIMIT_EXCEEDED);
+  assert.equal(result.reason, RateLimitReason.QUOTA_EXHAUSTED);
   assert.equal(result.cooldownMs, 125);
 });
 
@@ -844,7 +844,7 @@ test("checkFallbackError routes API-key 429 'try again tomorrow' through resilie
   assert.equal(result.cooldownMs, 125);
 });
 
-test("checkFallbackError routes API-key 429 'daily quota' text through resilience cooldown", () => {
+test("#6638: checkFallbackError routes API-key 429 'daily quota' text as quota_exhausted", () => {
   const result = checkFallbackError(
     429,
     "You have exceeded your daily quota",
@@ -855,8 +855,8 @@ test("checkFallbackError routes API-key 429 'daily quota' text through resilienc
     makeProfile()
   );
   assert.equal(result.shouldFallback, true);
-  assert.equal(result.dailyQuotaExhausted, undefined);
-  assert.equal(result.cooldownMs, 125);
+  assert.equal(result.dailyQuotaExhausted, true);
+  assert.equal(result.reason, RateLimitReason.QUOTA_EXHAUSTED);
 });
 
 test("checkFallbackError preserves OAuth 429 daily quota semantics", () => {
diff --git a/tests/unit/agent-bridge-dns-route-validation.test.ts b/tests/unit/agent-bridge-dns-route-validation.test.ts
new file mode 100644
index 0000000000..5b0cff8712
--- /dev/null
+++ b/tests/unit/agent-bridge-dns-route-validation.test.ts
@@ -0,0 +1,60 @@
+/**
+ * Unit tests: POST /api/tools/agent-bridge/agents/[id]/dns — unknown-agent 404 guard.
+ *
+ * Before this fix, an unknown `id` fell through straight into `addDNSEntry`/
+ * `removeDNSEntry`, which silently resolved the legacy Antigravity default hosts
+ * instead of rejecting the request. The route now validates `id` against
+ * `ALL_TARGETS` first and returns 404 for unknown agents — verified here without
+ * touching /etc/hosts (the 404 short-circuits before any DNS call).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const dnsRoute = await import(
+  "../../src/app/api/tools/agent-bridge/agents/[id]/dns/route.ts"
+);
+
+function makeRequest(body: unknown): Request {
+  return new Request("http://127.0.0.1/api/tools/agent-bridge/agents/x/dns", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+test("POST .../[id]/dns: unknown agent id returns 404 before any DNS call", async () => {
+  const res = await dnsRoute.POST(makeRequest({ enabled: true }), {
+    params: { id: "__nonexistent_agent__" },
+  });
+  assert.equal(res.status, 404);
+  const body = (await res.json()) as { error?: { message?: string } };
+  assert.ok(
+    JSON.stringify(body).includes("__nonexistent_agent__"),
+    "404 body should reference the unknown agent id"
+  );
+});
+
+test("POST .../[id]/dns: invalid body still returns 400 (schema validated first)", async () => {
+  const res = await dnsRoute.POST(makeRequest({ enabled: "not-a-boolean" }), {
+    params: { id: "__nonexistent_agent__" },
+  });
+  assert.equal(res.status, 400);
+});
+
+test("POST .../[id]/dns: malformed JSON body returns 400", async () => {
+  const req = new Request("http://127.0.0.1/api/tools/agent-bridge/agents/x/dns", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: "{not-json",
+  });
+  const res = await dnsRoute.POST(req, { params: { id: "cursor" } });
+  assert.equal(res.status, 400);
+});
+
+test("POST .../[id]/dns: error responses do not leak stack traces", async () => {
+  const res = await dnsRoute.POST(makeRequest({ enabled: true }), {
+    params: { id: "__nonexistent_agent__" },
+  });
+  const text = await res.text();
+  assert.ok(!text.includes("at /"), "stack trace leaked in dns route 404 response");
+});
diff --git a/tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts b/tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts
new file mode 100644
index 0000000000..16802be699
--- /dev/null
+++ b/tests/unit/agentbridge-antigravity-cert-hosts-6494.test.ts
@@ -0,0 +1,58 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { X509Certificate } from "node:crypto";
+
+import { ANTIGRAVITY_TARGET } from "../../src/mitm/targets/antigravity.ts";
+
+// #6494: AgentBridge's MITM proxy terminates TLS locally for all 4 antigravity/cloudcode
+// hosts (see `TARGET_HOSTS` in src/mitm/server.cjs), but the generated self-signed cert only
+// carried a SAN entry for the first host (`daily-cloudcode-pa.googleapis.com`) — so the other
+// 3 hosts served a cert whose CN/SAN didn't match, breaking interception for them
+// (`curl -k https://cloudcode-pa.googleapis.com/` showed `CN=daily-cloudcode-pa.googleapis.com`).
+//
+// `ANTIGRAVITY_TARGET.hosts` is the single authoritative host list for antigravity — this test
+// drives directly off it so it can never silently drift from the real registry.
+const EXPECTED_HOSTS = ANTIGRAVITY_TARGET.hosts;
+
+test("ANTIGRAVITY_TARGET.hosts covers all 4 known antigravity/cloudcode-pa hosts", () => {
+  assert.deepEqual(
+    [...EXPECTED_HOSTS].sort(),
+    [
+      "autopush-cloudcode-pa.sandbox.googleapis.com",
+      "cloudcode-pa.googleapis.com",
+      "daily-cloudcode-pa.googleapis.com",
+      "daily-cloudcode-pa.sandbox.googleapis.com",
+    ].sort()
+  );
+});
+
+test("generateCert() issues a cert whose SAN list covers all 4 antigravity hosts", async (t) => {
+  // Isolate DATA_DIR so this test never touches (or reuses) a real ~/.omniroute cert.
+  const tmpDataDir = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-mitm-cert-6494-"));
+  const previousDataDir = process.env.DATA_DIR;
+  process.env.DATA_DIR = tmpDataDir;
+
+  t.after(() => {
+    if (previousDataDir === undefined) delete process.env.DATA_DIR;
+    else process.env.DATA_DIR = previousDataDir;
+    fs.rmSync(tmpDataDir, { recursive: true, force: true });
+  });
+
+  // Fresh module instance so it re-reads process.env.DATA_DIR via resolveMitmDataDir().
+  const { generateCert } = await import(`../../src/mitm/cert/generate.ts?t=${Date.now()}`);
+  const { cert: certPath } = await generateCert();
+
+  const pem = fs.readFileSync(certPath, "utf-8");
+  const cert = new X509Certificate(pem);
+  const san = cert.subjectAltName ?? "";
+
+  for (const host of EXPECTED_HOSTS) {
+    assert.ok(
+      san.includes(host),
+      `expected generated cert SAN to include "${host}" — got: ${san}`
+    );
+  }
+});
diff --git a/tests/unit/agentbridge-mitm-router-key-6403.test.ts b/tests/unit/agentbridge-mitm-router-key-6403.test.ts
new file mode 100644
index 0000000000..593ce713ba
--- /dev/null
+++ b/tests/unit/agentbridge-mitm-router-key-6403.test.ts
@@ -0,0 +1,81 @@
+/**
+ * Regression test for #6403 — AgentBridge MITM startup failure:
+ *   "MITM server failed to start: no API key was provided
+ *   (ROUTER_API_KEY is required). Set a router API key in OmniRoute and retry."
+ *
+ * Root cause: `resolveRouterApiKey()` (src/app/api/tools/agent-bridge/server/route.ts)
+ * only checked an explicit `apiKey` request field — never sent by the AgentBridge
+ * UI, since `AgentBridgeServerActionSchema` has no `apiKey` field — and the
+ * `ROUTER_API_KEY` process env var, which is unset unless an operator manually
+ * exports it before launching OmniRoute. On a normal built-from-source install
+ * neither is ever set, so `startMitm()` always received `""` even though
+ * OmniRoute already had a usable API key sitting in its own DB. The fix falls
+ * back to `pickApiKeyForInternalUse()` — the same DB-backed selector already
+ * used by the combo-health-check / cloud-sync-verify internal probes — so
+ * AgentBridge reuses an existing OmniRoute key instead of hard-failing.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-ab-routerkey-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.DISABLE_SQLITE_AUTO_BACKUP = "true";
+process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "test-secret-for-agentbridge-6403";
+
+const core = await import("../../src/lib/db/core.ts");
+const { createApiKey } = await import("../../src/lib/db/apiKeys.ts");
+const { resolveRouterApiKey } = await import(
+  "../../src/app/api/tools/agent-bridge/server/route.ts"
+);
+
+function resetDb() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(() => {
+  resetDb();
+  delete process.env.ROUTER_API_KEY;
+});
+
+test.after(() => {
+  delete process.env.ROUTER_API_KEY;
+  try {
+    fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  } catch {
+    /* noop */
+  }
+});
+
+test("resolveRouterApiKey: explicit apiKey field always wins", async () => {
+  await createApiKey("Test Key", "machine-1");
+  const resolved = await resolveRouterApiKey("sk-explicit-override");
+  assert.equal(resolved, "sk-explicit-override");
+});
+
+test("resolveRouterApiKey: ROUTER_API_KEY env wins over DB when set", async () => {
+  process.env.ROUTER_API_KEY = "sk-from-env";
+  await createApiKey("Test Key", "machine-1");
+  const resolved = await resolveRouterApiKey("");
+  assert.equal(resolved, "sk-from-env");
+});
+
+// This is the #6403 reproduction: no explicit apiKey, no env var — but
+// OmniRoute already has a usable key in its own DB. Before the fix this
+// returned "" (empty string), which made startMitm() spawn server.cjs
+// without ROUTER_API_KEY, causing the "no API key was provided" failure.
+test("resolveRouterApiKey: falls back to an existing OmniRoute API key (#6403)", async () => {
+  const created = await createApiKey("AgentBridge Default", "machine-1");
+  const resolved = await resolveRouterApiKey("");
+  assert.equal(resolved, created.key, "must reuse the existing OmniRoute API key, not fail empty");
+  assert.notEqual(resolved, "", "must never silently resolve to an empty ROUTER_API_KEY");
+});
+
+test("resolveRouterApiKey: no explicit key, no env, no DB key -> empty (unchanged failure path)", async () => {
+  const resolved = await resolveRouterApiKey("");
+  assert.equal(resolved, "");
+});
diff --git a/tests/unit/anthropic-toolcall-args-6459.test.ts b/tests/unit/anthropic-toolcall-args-6459.test.ts
new file mode 100644
index 0000000000..0a7d02d8cb
--- /dev/null
+++ b/tests/unit/anthropic-toolcall-args-6459.test.ts
@@ -0,0 +1,161 @@
+/**
+ * Regression test for #6459: tool-call arguments render as
+ * `[object Object][object Object]` in the user-visible transcript when the
+ * upstream provider delivers the FULL `tool_calls[].function.arguments` value
+ * as an already-parsed JSON object (not a JSON-encoded string), which is what
+ * some Anthropic-shape-compatible backends do instead of following the OpenAI
+ * streaming contract.
+ *
+ * Before the fix, `appendToolCallArgumentDelta()` treated any non-string
+ * `incoming` fragment as an empty string, so the accumulated `argBuffer`
+ * never picked up the object at all — `openaiToClaudeResponse()` (the
+ * translator that builds the live /anthropic SSE stream, see
+ * `open-sse/translator/response/openai-to-claude.ts`) then emitted no
+ * `input_json_delta` for that chunk, and the client is left to coerce
+ * whatever partial data it has via string concatenation/`String(object)`,
+ * which is exactly how `[object Object]` sequences end up in the transcript.
+ *
+ * The fix: JSON.stringify() a non-string, non-null object/array fragment
+ * instead of discarding it, so the assembled `partial_json` is always valid
+ * JSON that parses back into the original structured value.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { openaiToClaudeResponse } from "../../open-sse/translator/response/openai-to-claude.ts";
+
+function createState() {
+  return { toolCalls: new Map() };
+}
+
+function flatten(items: unknown[][]) {
+  return items.flatMap((item) => item || []);
+}
+
+function assembleToolUseInput(events: Array<Record<string, unknown>>) {
+  const jsonDeltas = events.filter(
+    (e) => e?.type === "content_block_delta" && (e.delta as Record<string, unknown>)?.type === "input_json_delta"
+  );
+  const assembled = jsonDeltas
+    .map((e) => (e.delta as Record<string, unknown>).partial_json as string)
+    .join("");
+  return assembled;
+}
+
+test("#6459: tool-call arguments delivered as a structured object (not a JSON string) render as the real object, not [object Object]", () => {
+  const state = createState();
+
+  const chunk1 = openaiToClaudeResponse(
+    {
+      id: "chatcmpl-6459",
+      model: "auto/claude-opus",
+      choices: [
+        {
+          index: 0,
+          delta: {
+            tool_calls: [
+              {
+                index: 0,
+                id: "call_6459",
+                type: "function",
+                function: { name: "AskUserQuestion", arguments: "" },
+              },
+            ],
+          },
+          finish_reason: null,
+        },
+      ],
+    },
+    state
+  );
+
+  // Non-conformant upstream: the FULL arguments value arrives as an already-
+  // parsed JS object (mirroring a nested tool_use.input structure), not a
+  // JSON-encoded string fragment.
+  const chunk2 = openaiToClaudeResponse(
+    {
+      id: "chatcmpl-6459",
+      model: "auto/claude-opus",
+      choices: [
+        {
+          index: 0,
+          delta: {
+            tool_calls: [
+              {
+                index: 0,
+                function: {
+                  arguments: {
+                    questions: [
+                      { header: "Deploy target", options: [{ label: "staging" }] },
+                      { header: "Confirm rollback", options: [{ label: "yes" }, { label: "no" }] },
+                    ],
+                  },
+                },
+              },
+            ],
+          },
+          finish_reason: "tool_calls",
+        },
+      ],
+    },
+    state
+  );
+
+  const events = flatten([chunk1, chunk2]) as Array<Record<string, unknown>>;
+  const assembled = assembleToolUseInput(events);
+
+  assert.ok(assembled.length > 0, "expected at least one input_json_delta with the tool args");
+  assert.ok(
+    !assembled.includes("[object Object]"),
+    `assembled partial_json leaked a stringified-object coercion: ${assembled}`
+  );
+
+  let parsed: Record<string, unknown>;
+  try {
+    parsed = JSON.parse(assembled);
+  } catch {
+    assert.fail(`assembled partial_json is not valid JSON — arguments object was corrupted: ${assembled}`);
+  }
+
+  assert.ok(Array.isArray(parsed.questions), "questions array must survive as structured data");
+  assert.equal(parsed.questions.length, 2);
+  assert.equal((parsed.questions[0] as Record<string, unknown>).header, "Deploy target");
+  assert.equal((parsed.questions[1] as Record<string, unknown>).header, "Confirm rollback");
+});
+
+test("#6459 no-regression: a plain text-only turn still translates normally", () => {
+  const state = createState();
+
+  const chunk1 = openaiToClaudeResponse(
+    {
+      id: "chatcmpl-6459-text",
+      model: "auto/claude-opus",
+      choices: [{ index: 0, delta: { role: "assistant" }, finish_reason: null }],
+    },
+    state
+  );
+  const chunk2 = openaiToClaudeResponse(
+    {
+      id: "chatcmpl-6459-text",
+      model: "auto/claude-opus",
+      choices: [{ index: 0, delta: { content: "Hello, world!" }, finish_reason: null }],
+    },
+    state
+  );
+  const chunk3 = openaiToClaudeResponse(
+    {
+      id: "chatcmpl-6459-text",
+      model: "auto/claude-opus",
+      choices: [{ index: 0, delta: {}, finish_reason: "stop" }],
+    },
+    state
+  );
+
+  const events = flatten([chunk1, chunk2, chunk3]) as Array<Record<string, unknown>>;
+  const textDeltas = events.filter(
+    (e) => e?.type === "content_block_delta" && (e.delta as Record<string, unknown>)?.type === "text_delta"
+  );
+
+  assert.equal(textDeltas.length, 1);
+  assert.equal((textDeltas[0].delta as Record<string, unknown>).text, "Hello, world!");
+});
diff --git a/tests/unit/antigravity-safetysettings-5003.test.ts b/tests/unit/antigravity-safetysettings-5003.test.ts
index 152a5eb3ff..f4cc058d15 100644
--- a/tests/unit/antigravity-safetysettings-5003.test.ts
+++ b/tests/unit/antigravity-safetysettings-5003.test.ts
@@ -3,13 +3,14 @@ import assert from "node:assert/strict";
 
 import { AntigravityExecutor } from "../../open-sse/executors/antigravity.ts";
 import { DEFAULT_SAFETY_SETTINGS } from "../../open-sse/translator/helpers/geminiHelper.ts";
+import { openaiToAntigravityRequest } from "../../open-sse/translator/request/openai-to-gemini.ts";
 
 // Regression for #5003: the Antigravity (Google Cloud Code) request builder explicitly set
 // `safetySettings: undefined`, which `JSON.stringify` drops entirely. With no safetySettings
 // reaching Cloud Code, Google applies its server-side safety defaults that false-flag benign
 // technical prompts as `prohibited_content` (HTTP 200 with a blocked body that combo failover
-// treats as terminal). The native Gemini paths all default to all-OFF
-// (DEFAULT_SAFETY_SETTINGS); Antigravity must match for parity.
+// treats as terminal). Antigravity still needs explicit all-OFF safety settings,
+// but Cloud Code rejects HARM_CATEGORY_CIVIC_INTEGRITY on the v1internal endpoint.
 
 test("transformRequest defaults safetySettings to all-OFF when none supplied (#5003)", async () => {
   const executor = new AntigravityExecutor();
@@ -26,17 +27,21 @@ test("transformRequest defaults safetySettings to all-OFF when none supplied (#5
 
   if (result instanceof Response) throw new Error("Unexpected Response from transformRequest");
   const innerRequest = result.request as Record<string, unknown>;
+  const antigravitySafetySettings = DEFAULT_SAFETY_SETTINGS.filter(
+    (setting) => setting.category !== "HARM_CATEGORY_CIVIC_INTEGRITY"
+  );
   assert.deepEqual(
     innerRequest.safetySettings,
-    DEFAULT_SAFETY_SETTINGS,
-    "safetySettings must default to all-OFF for parity with native Gemini paths"
+    antigravitySafetySettings,
+    "safetySettings must default to all-OFF entries accepted by Cloud Code"
   );
 });
 
-test("transformRequest honors a caller-supplied safetySettings (#5003)", async () => {
+test("transformRequest honors caller-supplied safetySettings accepted by Cloud Code (#5003)", async () => {
   const executor = new AntigravityExecutor();
   const callerSafety = [
     { category: "HARM_CATEGORY_HATE_SPEECH", threshold: "BLOCK_MEDIUM_AND_ABOVE" },
+    { category: "HARM_CATEGORY_CIVIC_INTEGRITY", threshold: "OFF" },
   ];
   const body = {
     request: {
@@ -54,7 +59,34 @@ test("transformRequest honors a caller-supplied safetySettings (#5003)", async (
   const innerRequest = result.request as Record<string, unknown>;
   assert.deepEqual(
     innerRequest.safetySettings,
-    callerSafety,
-    "a caller-supplied safetySettings must not be clobbered"
+    [{ category: "HARM_CATEGORY_HATE_SPEECH", threshold: "BLOCK_MEDIUM_AND_ABOVE" }],
+    "caller-supplied safetySettings should preserve accepted entries and drop rejected ones"
   );
 });
+
+test("OpenAI Antigravity translation preserves caller-supplied safetySettings (#5003)", async () => {
+  const executor = new AntigravityExecutor();
+  const callerSafety = [
+    { category: "HARM_CATEGORY_HATE_SPEECH", threshold: "BLOCK_MEDIUM_AND_ABOVE" },
+    { category: "HARM_CATEGORY_CIVIC_INTEGRITY", threshold: "OFF" },
+  ];
+  const translated = openaiToAntigravityRequest(
+    "gemini-2.5-flash",
+    {
+      messages: [{ role: "user", content: "hi" }],
+      safetySettings: callerSafety,
+    },
+    true,
+    { projectId: "project-1" }
+  );
+
+  const result = await executor.transformRequest("antigravity/gemini-2.5-flash", translated, true, {
+    projectId: "project-1",
+  });
+
+  if (result instanceof Response) throw new Error("Unexpected Response from transformRequest");
+  const innerRequest = result.request as Record<string, unknown>;
+  assert.deepEqual(innerRequest.safetySettings, [
+    { category: "HARM_CATEGORY_HATE_SPEECH", threshold: "BLOCK_MEDIUM_AND_ABOVE" },
+  ]);
+});
diff --git a/tests/unit/antigravity-tool-cloak-server-side-invocations.test.ts b/tests/unit/antigravity-tool-cloak-server-side-invocations.test.ts
new file mode 100644
index 0000000000..1bcb0834d0
--- /dev/null
+++ b/tests/unit/antigravity-tool-cloak-server-side-invocations.test.ts
@@ -0,0 +1,61 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { openaiToAntigravityRequest } from "../../open-sse/translator/request/openai-to-gemini.ts";
+import { cloakAntigravityToolPayload } from "../../open-sse/config/toolCloaking.ts";
+
+test("Antigravity payload sets include_server_side_tool_invocations when built-in-shaped decoy tools are injected (#6914)", () => {
+  const body = {
+    model: "gemini-pro-agent",
+    messages: [{ role: "user", content: "list files in the repo" }],
+    tools: [
+      {
+        type: "function",
+        function: {
+          name: "bash",
+          description: "run a shell command",
+          parameters: { type: "object", properties: { cmd: { type: "string" } } },
+        },
+      },
+    ],
+  };
+  const envelope = openaiToAntigravityRequest("gemini-pro-agent", body, false, {
+    projectId: "test-project",
+  });
+  const { body: cloaked } = cloakAntigravityToolPayload(envelope as Record<string, unknown>);
+  const serialized = JSON.stringify(cloaked);
+  const BUILTIN_SHAPED_DECOY_NAMES = [
+    "search_web",
+    "browser_subagent",
+    "read_url_content",
+    "generate_image",
+  ];
+  const injectedBuiltinShapedDecoys = BUILTIN_SHAPED_DECOY_NAMES.filter((name) =>
+    serialized.includes(`"${name}"`)
+  );
+  const hasOptInFlag =
+    serialized.includes("include_server_side_tool_invocations") ||
+    serialized.includes("includeServerSideToolInvocations");
+
+  assert.notDeepEqual(injectedBuiltinShapedDecoys, [], "expected decoy tools to be injected");
+  assert.equal(
+    hasOptInFlag,
+    true,
+    "expected the includeServerSideToolInvocations opt-in flag to be set alongside decoy tools"
+  );
+});
+
+test("Antigravity payload does not set the opt-in flag when no decoys are injected", () => {
+  const body = {
+    model: "gemini-pro-agent",
+    messages: [{ role: "user", content: "hello" }],
+  };
+  const envelope = openaiToAntigravityRequest("gemini-pro-agent", body, false, {
+    projectId: "test-project",
+  });
+  const { body: cloaked } = cloakAntigravityToolPayload(envelope as Record<string, unknown>);
+  const serialized = JSON.stringify(cloaked);
+  const hasOptInFlag =
+    serialized.includes("include_server_side_tool_invocations") ||
+    serialized.includes("includeServerSideToolInvocations");
+  assert.equal(hasOptInFlag, false, "flag should not be set when no tools/decoys are present");
+});
diff --git a/tests/unit/antigravity-weekly-quota-4017.test.ts b/tests/unit/antigravity-weekly-quota-4017.test.ts
new file mode 100644
index 0000000000..894246f1b9
--- /dev/null
+++ b/tests/unit/antigravity-weekly-quota-4017.test.ts
@@ -0,0 +1,240 @@
+/**
+ * #4017 — Antigravity weekly-quota widget.
+ *
+ * Antigravity enforces both a 5-hour window (already surfaced per-model via
+ * `retrieveUserQuota`) and a separate weekly window that only appears in the
+ * `retrieveUserQuotaSummary` RPC, grouped by model family ("Gemini Models",
+ * "Claude and GPT models") rather than by individual modelId. This guards:
+ *  1. The pure parser (`parseAntigravityWeeklyQuotas`) against the documented
+ *     bucket shape (bucketId/displayName/remainingFraction/resetTime, window
+ *     inferred from bucketId+displayName text — there is no explicit type field).
+ *  2. The end-to-end wiring: `getUsageForProvider()` merges the weekly group
+ *     quotas alongside the existing per-model 5h quotas without clobbering them.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-ag-weekly-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = "test-ag-weekly-secret";
+
+const core = await import("../../src/lib/db/core.ts");
+const { parseAntigravityWeeklyQuotas } = await import(
+  "../../open-sse/services/usage/antigravityWeeklyQuota.ts"
+);
+// Load usage.ts up-front (its index.ts proxyFetch patch runs at module eval) before mocks.
+const usageModule = await import("../../open-sse/services/usage.ts");
+const { getUsageForProvider } = usageModule;
+
+const originalFetch = globalThis.fetch;
+
+test.after(() => {
+  globalThis.fetch = originalFetch;
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+const RESET_IN_3_DAYS = new Date(Date.now() + 3 * 24 * 60 * 60 * 1000).toISOString();
+const RESET_IN_2_HOURS = new Date(Date.now() + 2 * 60 * 60 * 1000).toISOString();
+
+function requestUrl(input: RequestInfo | URL): string {
+  if (typeof input === "string") return input;
+  if (input instanceof URL) return input.toString();
+  return input.url;
+}
+
+interface UsageResult {
+  quotas: Record<string, { remainingPercentage?: number; resetAt: string | null; unlimited: boolean; quotaSource?: string }>;
+}
+
+test("parseAntigravityWeeklyQuotas extracts the weekly bucket per model-family group", () => {
+  const summary = {
+    groups: [
+      {
+        displayName: "Gemini Models",
+        buckets: [
+          {
+            bucketId: "gemini-5h",
+            displayName: "5 Hour Quota",
+            remainingFraction: 0.4,
+            resetTime: RESET_IN_2_HOURS,
+          },
+          {
+            bucketId: "gemini-weekly",
+            displayName: "Weekly Quota",
+            remainingFraction: 0.75,
+            resetTime: RESET_IN_3_DAYS,
+          },
+        ],
+      },
+      {
+        displayName: "Claude and GPT models",
+        buckets: [
+          {
+            bucketId: "claude-gpt-weekly",
+            displayName: "Weekly Quota",
+            remainingFraction: 0.1,
+            resetTime: RESET_IN_3_DAYS,
+          },
+        ],
+      },
+    ],
+  };
+
+  const quotas = parseAntigravityWeeklyQuotas(summary);
+
+  assert.ok(quotas.gemini_weekly, "gemini weekly bucket extracted");
+  assert.equal(quotas.gemini_weekly.remainingPercentage, 75);
+  assert.equal(quotas.gemini_weekly.resetAt, RESET_IN_3_DAYS);
+  assert.equal(quotas.gemini_weekly.unlimited, false);
+
+  assert.ok(quotas.claude_gpt_weekly, "claude/gpt weekly bucket extracted");
+  assert.equal(quotas.claude_gpt_weekly.remainingPercentage, 10);
+
+  // The 5h bucket in the same group must NOT be picked up as "weekly" —
+  // only one entry per group, and it must be the one whose text says "weekly".
+  assert.equal(Object.keys(quotas).length, 2);
+});
+
+test("parseAntigravityWeeklyQuotas tolerates the quotaSummary-nested envelope", () => {
+  const summary = {
+    quotaSummary: {
+      groups: [
+        {
+          displayName: "Gemini Models",
+          buckets: [
+            { bucketId: "weekly", displayName: "Weekly", remainingFraction: 0.5, resetTime: RESET_IN_3_DAYS },
+          ],
+        },
+      ],
+    },
+  };
+
+  const quotas = parseAntigravityWeeklyQuotas(summary);
+  assert.ok(quotas.gemini_weekly);
+  assert.equal(quotas.gemini_weekly.remainingPercentage, 50);
+});
+
+test("parseAntigravityWeeklyQuotas returns {} for missing/malformed data (best-effort)", () => {
+  assert.deepEqual(parseAntigravityWeeklyQuotas(null), {});
+  assert.deepEqual(parseAntigravityWeeklyQuotas(undefined), {});
+  assert.deepEqual(parseAntigravityWeeklyQuotas({}), {});
+  assert.deepEqual(parseAntigravityWeeklyQuotas({ groups: [{ displayName: "Gemini Models" }] }), {});
+});
+
+test("getUsageForProvider(antigravity) merges weekly group quotas alongside per-model 5h quotas", async () => {
+  core.resetDbInstance();
+
+  globalThis.fetch = (async (input: RequestInfo | URL) => {
+    const url = requestUrl(input);
+
+    if (url.includes("retrieveUserQuotaSummary")) {
+      return {
+        ok: true,
+        json: async () => ({
+          groups: [
+            {
+              displayName: "Gemini Models",
+              buckets: [
+                {
+                  bucketId: "gemini-weekly",
+                  displayName: "Weekly Quota",
+                  remainingFraction: 0.6,
+                  resetTime: RESET_IN_3_DAYS,
+                },
+              ],
+            },
+          ],
+        }),
+      } as Response;
+    }
+
+    if (url.includes("retrieveUserQuota")) {
+      return {
+        ok: true,
+        json: async () => ({
+          buckets: [
+            {
+              modelId: "gemini-3.5-flash-high",
+              remainingFraction: 0.4,
+              resetTime: RESET_IN_2_HOURS,
+            },
+          ],
+        }),
+      } as Response;
+    }
+
+    // fetchAvailableModels
+    return {
+      ok: true,
+      json: async () => ({
+        models: {
+          "gemini-3.5-flash-high": {
+            quotaInfo: { remainingFraction: 1.0, resetTime: RESET_IN_2_HOURS },
+          },
+        },
+      }),
+    } as Response;
+  }) as typeof fetch;
+
+  const connection = {
+    id: "conn-weekly-1",
+    provider: "antigravity",
+    accessToken: "fake-token-weekly-unique",
+    providerSpecificData: {},
+    projectId: "test-project",
+  };
+
+  const result = await getUsageForProvider(connection, { forceRefresh: true });
+  assert.ok(result && "quotas" in result, "should return quotas");
+  const quotas = (result as UsageResult).quotas;
+
+  // Existing per-model 5h quota is untouched.
+  assert.ok(quotas["gemini-3.5-flash-high"], "per-model 5h quota still present");
+  assert.equal(quotas["gemini-3.5-flash-high"].quotaSource, "retrieveUserQuota");
+
+  // New weekly group quota is merged in alongside it.
+  assert.ok(quotas.gemini_weekly, "weekly group quota merged in");
+  assert.equal(quotas.gemini_weekly.remainingPercentage, 60);
+  assert.equal(quotas.gemini_weekly.resetAt, RESET_IN_3_DAYS);
+});
+
+test("getUsageForProvider(antigravity) is unaffected when retrieveUserQuotaSummary is unavailable", async () => {
+  core.resetDbInstance();
+
+  globalThis.fetch = (async (input: RequestInfo | URL) => {
+    const url = requestUrl(input);
+    if (url.includes("retrieveUserQuotaSummary")) {
+      return { ok: false, status: 404, json: async () => ({}) } as Response;
+    }
+    if (url.includes("retrieveUserQuota")) {
+      return { ok: false, status: 404, json: async () => ({}) } as Response;
+    }
+    return {
+      ok: true,
+      json: async () => ({
+        models: {
+          "gemini-3.5-flash-high": {
+            quotaInfo: { remainingFraction: 1.0, resetTime: RESET_IN_2_HOURS },
+          },
+        },
+      }),
+    } as Response;
+  }) as typeof fetch;
+
+  const connection = {
+    id: "conn-weekly-2",
+    provider: "antigravity",
+    accessToken: "fake-token-weekly-unavailable",
+    providerSpecificData: {},
+    projectId: "test-project",
+  };
+
+  const result = await getUsageForProvider(connection, { forceRefresh: true });
+  const quotas = (result as UsageResult).quotas;
+  assert.ok(quotas["gemini-3.5-flash-high"], "per-model quota still present without weekly data");
+  assert.equal(quotas.gemini_weekly, undefined, "no weekly key when the RPC is unavailable");
+});
diff --git a/tests/unit/api-keys-create-no-hang-6570.test.ts b/tests/unit/api-keys-create-no-hang-6570.test.ts
new file mode 100644
index 0000000000..7ba196ea48
--- /dev/null
+++ b/tests/unit/api-keys-create-no-hang-6570.test.ts
@@ -0,0 +1,105 @@
+// Regression test for #6570 — POST /api/keys hung 20-90s+ on a fresh install.
+//
+// Root cause: `cloudEnabled` defaults to `true` (src/lib/db/settings.ts) for any
+// install that has never persisted a settings row (i.e. a fresh install). The
+// POST /api/keys handler unconditionally `await`ed `syncKeysToCloudIfEnabled()`
+// after creating the key, which — when cloud sync is enabled — calls
+// `syncToCloud()` and performs a real outbound `fetch()` to `CLOUD_URL`. On a
+// fresh/offline install (or any environment where the Cloud endpoint is slow or
+// unreachable), that fetch call blocks the HTTP response until it resolves or
+// times out, unlike sibling routes such as `POST /api/keys/:id/regenerate` and
+// `GET /api/combos`, which never touch this cloud-sync side effect at all.
+//
+// This test stubs `globalThis.fetch` to hang forever (never settles) and
+// asserts the route still responds promptly — i.e. the handler must not await
+// the cloud-sync side effect in the request path.
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { makeManagementSessionRequest } from "../helpers/managementSession.ts";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-api-keys-nohang-6570-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = "test-api-key-secret-6570";
+process.env.CLOUD_URL = "http://cloud.example";
+
+const core = await import("../../src/lib/db/core.ts");
+const apiKeysDb = await import("../../src/lib/db/apiKeys.ts");
+const localDb = await import("../../src/lib/localDb.ts");
+const listRoute = await import("../../src/app/api/keys/route.ts");
+
+async function resetStorage() {
+  delete process.env.INITIAL_PASSWORD;
+  core.resetDbInstance();
+  apiKeysDb.resetApiKeyState();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+async function enableManagementAuth() {
+  process.env.INITIAL_PASSWORD = "bootstrap-password";
+  await localDb.updateSettings({ requireLogin: true, password: "" });
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(async () => {
+  await resetStorage();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  core.resetDbInstance();
+});
+
+test("POST /api/keys responds promptly even when the Cloud-sync fetch hangs forever (#6570)", async () => {
+  await enableManagementAuth();
+  // cloudEnabled defaults to true on a fresh install (no settings row yet) —
+  // simulate that "fresh install" condition explicitly for clarity/documentation.
+  const settings = await localDb.getSettings();
+  assert.equal(settings.cloudEnabled, true, "cloudEnabled should default to true pre-fix");
+
+  const originalFetch = globalThis.fetch;
+  // Simulate a slow/unreachable Cloud endpoint: a fetch() that never settles.
+  let fetchWasCalled = false;
+  globalThis.fetch = (() => {
+    fetchWasCalled = true;
+    return new Promise(() => {
+      /* never resolves — simulates a hung/unreachable outbound network call */
+    });
+  }) as typeof fetch;
+
+  try {
+    const start = Date.now();
+    const response = await Promise.race([
+      listRoute.POST(
+        await makeManagementSessionRequest("http://localhost/api/keys", {
+          method: "POST",
+          body: { name: "Fresh Install Key" },
+        })
+      ),
+      new Promise((_, reject) =>
+        setTimeout(() => reject(new Error("POST /api/keys did not respond within 2s")), 2000)
+      ),
+    ]);
+    const elapsedMs = Date.now() - start;
+
+    const body = (await (response as Response).json()) as { key: string };
+    assert.equal((response as Response).status, 201);
+    assert.match(body.key, /^sk-[a-z0-9-]+/i);
+    assert.ok(
+      elapsedMs < 2000,
+      `expected POST /api/keys to resolve well under 2s even with a hung Cloud fetch, took ${elapsedMs}ms`
+    );
+
+    // The cloud-sync side effect is fire-and-forget: give the still-pending
+    // background task a chance to start (it never resolves, by design) before
+    // asserting it was actually invoked — this proves the fix didn't just
+    // remove the sync call outright.
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    assert.ok(fetchWasCalled, "expected the stubbed Cloud-sync fetch to have been invoked");
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
diff --git a/tests/unit/api-malformed-json-400.test.ts b/tests/unit/api-malformed-json-400.test.ts
new file mode 100644
index 0000000000..1b0cce21c1
--- /dev/null
+++ b/tests/unit/api-malformed-json-400.test.ts
@@ -0,0 +1,173 @@
+/**
+ * Regression tests: mutating API routes must return 400 (not 500) on a malformed
+ * JSON request body.
+ *
+ * Before the fix, both handlers called `await request.json()` on a raw body:
+ *   - PUT /api/plugins/[name]/config had no try/catch → unhandled 500.
+ *   - POST /api/model-combo-mappings parsed inside the outer try whose catch
+ *     returns a generic 500.
+ * A malformed body must instead surface as a clean 400 with the standard error
+ * envelope, while a well-formed body keeps its existing behavior.
+ *
+ * DB/auth setup mirrors tests/unit/agentSkills-routes.test.ts: a temp DATA_DIR
+ * with no configured password means requireManagementAuth() is a no-op (auth is
+ * not required), so the handlers run unauthenticated. DB handles are released in
+ * test.after (resetDbInstance) per CLAUDE.md — unreleased SQLite handles hang the
+ * Node test runner.
+ */
+
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+// ── DB / auth setup ─────────────────────────────────────────────────────────
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-malformed-json-400-"));
+const ORIGINAL_DATA_DIR = process.env.DATA_DIR;
+const ORIGINAL_API_KEY_SECRET = process.env.API_KEY_SECRET;
+const ORIGINAL_INITIAL_PASSWORD = process.env.INITIAL_PASSWORD;
+
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = process.env.API_KEY_SECRET ?? "malformed-json-400-test-secret";
+delete process.env.INITIAL_PASSWORD; // ensure auth is NOT required
+
+// Import DB first (order matters — sets DATA_DIR before localDb loads)
+const core = await import("../../src/lib/db/core.ts");
+const combosDb = await import("../../src/lib/db/combos.ts");
+
+// Import routes AFTER env vars are set
+const pluginConfigRoute = await import("../../src/app/api/plugins/[name]/config/route.ts");
+const modelComboRoute = await import("../../src/app/api/model-combo-mappings/route.ts");
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+
+/** Build a POST/PUT Request that CLAIMS to be JSON but carries a non-JSON body. */
+function malformedJsonRequest(url: string, method = "POST"): Request {
+  return new Request(url, {
+    method,
+    headers: { "content-type": "application/json" },
+    body: "not-json",
+  });
+}
+
+/** Build a POST/PUT Request with a well-formed JSON body. */
+function jsonRequest(url: string, body: unknown, method = "POST"): Request {
+  return new Request(url, {
+    method,
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+// ── Lifecycle ─────────────────────────────────────────────────────────────────
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+
+  if (ORIGINAL_DATA_DIR === undefined) delete process.env.DATA_DIR;
+  else process.env.DATA_DIR = ORIGINAL_DATA_DIR;
+
+  if (ORIGINAL_API_KEY_SECRET === undefined) delete process.env.API_KEY_SECRET;
+  else process.env.API_KEY_SECRET = ORIGINAL_API_KEY_SECRET;
+
+  if (ORIGINAL_INITIAL_PASSWORD === undefined) delete process.env.INITIAL_PASSWORD;
+  else process.env.INITIAL_PASSWORD = ORIGINAL_INITIAL_PASSWORD;
+});
+
+// ═════════════════════════════════════════════════════════════════════════════
+// PUT /api/plugins/[name]/config
+// ═════════════════════════════════════════════════════════════════════════════
+
+test("PUT /api/plugins/[name]/config — malformed JSON body returns 400 (was 500)", async () => {
+  const req = malformedJsonRequest("http://localhost/api/plugins/demo/config", "PUT");
+  const res = await pluginConfigRoute.PUT(req, {
+    params: Promise.resolve({ name: "demo" }),
+  });
+
+  assert.equal(res.status, 400, "malformed JSON must yield 400, not an unhandled 500");
+  const body = (await res.json()) as { error?: { message?: string } };
+  assert.ok(body.error, "response must carry a structured error envelope");
+  assert.equal(typeof body.error.message, "string");
+  // Hard rule #12: no stack trace leaked in the error message.
+  assert.ok(!body.error.message?.includes("at /"), "error message must not leak a stack trace");
+});
+
+test("PUT /api/plugins/[name]/config — valid body does NOT 400 on parse (404 for unknown plugin)", async () => {
+  // Well-formed body against a plugin that does not exist: the handler must get
+  // PAST body parsing/validation and reach the not-found branch (404) — proving
+  // the happy path is unregressed.
+  const req = jsonRequest(
+    "http://localhost/api/plugins/does-not-exist/config",
+    { config: { foo: "bar" } },
+    "PUT"
+  );
+  const res = await pluginConfigRoute.PUT(req, {
+    params: Promise.resolve({ name: "does-not-exist" }),
+  });
+
+  assert.notEqual(res.status, 400, "a well-formed body must not be rejected as invalid JSON");
+  assert.equal(res.status, 404, "unknown plugin should surface as 404, past the parse guard");
+});
+
+// ═════════════════════════════════════════════════════════════════════════════
+// POST /api/model-combo-mappings
+// ═════════════════════════════════════════════════════════════════════════════
+
+test("POST /api/model-combo-mappings — malformed JSON body returns 400 (was 500)", async () => {
+  const req = malformedJsonRequest("http://localhost/api/model-combo-mappings");
+  const res = await modelComboRoute.POST(req);
+
+  assert.equal(res.status, 400, "malformed JSON must yield 400, not a generic 500");
+  const body = (await res.json()) as {
+    error?: {
+      message?: string;
+      details?: Array<{ field: string; message: string }>;
+    };
+  };
+  // Uses the canonical validatedJsonBody envelope.
+  assert.equal(body.error?.message, "Invalid request");
+  assert.deepEqual(body.error?.details, [{ field: "body", message: "Invalid JSON body" }]);
+});
+
+test("POST /api/model-combo-mappings — well-formed body succeeds (201), no parse regression", async () => {
+  // Seed a real combo so the mapping's FK (combo_id → combos.id) is satisfied.
+  await combosDb.createCombo({
+    id: "combo-under-test",
+    name: "combo-under-test",
+  });
+
+  const req = jsonRequest("http://localhost/api/model-combo-mappings", {
+    pattern: "gpt-4*",
+    comboId: "combo-under-test",
+  });
+  const res = await modelComboRoute.POST(req);
+
+  assert.equal(res.status, 201, "a valid body must still create the mapping (201)");
+  const body = (await res.json()) as {
+    mapping?: { pattern?: string; comboId?: string };
+  };
+  assert.equal(body.mapping?.pattern, "gpt-4*");
+  assert.equal(body.mapping?.comboId, "combo-under-test");
+});
+
+test("POST /api/model-combo-mappings — well-formed but invalid body still returns 400", async () => {
+  // Empty pattern fails the Zod schema — same 400 envelope as the malformed path.
+  const req = jsonRequest("http://localhost/api/model-combo-mappings", {
+    pattern: "",
+    comboId: "combo-x",
+  });
+  const res = await modelComboRoute.POST(req);
+
+  assert.equal(res.status, 400);
+  const body = (await res.json()) as {
+    error?: { message?: string; details?: Array<{ field: string }> };
+  };
+  assert.equal(body.error?.message, "Invalid request");
+  assert.ok(
+    body.error?.details?.some((d) => d.field === "pattern"),
+    "validation failure should name the offending field"
+  );
+});
diff --git a/tests/unit/api-manager-page-static.test.ts b/tests/unit/api-manager-page-static.test.ts
index 3dfb7f9c57..c6939027eb 100644
--- a/tests/unit/api-manager-page-static.test.ts
+++ b/tests/unit/api-manager-page-static.test.ts
@@ -61,14 +61,28 @@ test("permissions modal switch buttons declare button type", () => {
     selfServiceBlock.match(/<button\s+type="button"\s+role="switch"/g) ?? []
   ).length;
 
-  // Self-service Visibility block has 5 switches: own-usage visibility,
-  // shared-account quota visibility, disable-non-public-models (#3041), the
-  // per-key local usage command allowance (#4034), and the API-key provider
-  // quota-policy bypass scope (#5731).
+  // Self-service Visibility block has 4 inline switches: own-usage visibility,
+  // shared-account quota visibility, disable-non-public-models (#3041), and the
+  // per-key local usage command allowance (#4034). The API-key provider
+  // quota-policy bypass scope (#5731) and the Chaos Mode access scope (#6728)
+  // were extracted into dedicated toggle components (asserted below).
   // The invariant is that every switch declares type="button"
   // (typedSwitchButtonCount === switchButtonCount) to avoid implicit submit.
-  assert.equal(switchButtonCount, 5);
-  assert.equal(typedSwitchButtonCount, 5);
+  assert.equal(switchButtonCount, 4);
+  assert.equal(typedSwitchButtonCount, 4);
+
+  // The extracted toggle components keep the same invariant.
+  for (const rel of [
+    "src/app/(dashboard)/dashboard/api-manager/components/BypassProviderQuotaToggle.tsx",
+    "src/app/(dashboard)/dashboard/api-manager/components/ChaosModeAccessToggle.tsx",
+  ]) {
+    const componentSource = fs.readFileSync(path.join(repoRoot, rel), "utf8");
+    const compSwitches = (componentSource.match(/role="switch"/g) ?? []).length;
+    const compTyped = (componentSource.match(/<button\s+type="button"\s+role="switch"/g) ?? [])
+      .length;
+    assert.ok(compSwitches >= 1, `${rel} must render a switch`);
+    assert.equal(compTyped, compSwitches, `${rel}: every switch declares type="button"`);
+  }
 });
 
 test("permissions modal exposes Claude Code default wildcard model", () => {
diff --git a/tests/unit/api-models-hide-paid-6328.test.ts b/tests/unit/api-models-hide-paid-6328.test.ts
new file mode 100644
index 0000000000..a0e060843c
--- /dev/null
+++ b/tests/unit/api-models-hide-paid-6328.test.ts
@@ -0,0 +1,58 @@
+/**
+ * #6328 (follow-up to #6495) — the dashboard `/api/models` endpoint must also
+ * REMOVE paid models when `hidePaidModels` is on (the public `/v1/models`
+ * catalog already did via #6495). `openai` has no curated free roster, so its
+ * chat models are paid-tier and must disappear when the toggle is on.
+ * Rule #18 regression guard for the added filter in src/app/api/models/route.ts.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-api-models-hidepaid-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const settingsDb = await import("../../src/lib/db/settings.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const modelsRoute = await import("../../src/app/api/models/route.ts");
+
+async function fetchModels(): Promise<Array<{ provider: string; model: string }>> {
+  const res = await modelsRoute.GET(new Request("http://localhost/api/models?all=true"));
+  const body = (await res.json()) as { models: Array<{ provider: string; model: string }> };
+  return body.models;
+}
+
+test.after(() => {
+  core.resetDbInstance();
+  try {
+    fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  } catch {
+    /* best-effort */
+  }
+});
+
+test("#6328 /api/models removes paid models when hidePaidModels is on", async () => {
+  await providersDb.createProviderConnection({
+    provider: "openai",
+    authType: "apikey",
+    name: "openai-main",
+    apiKey: "sk-test",
+    isActive: true,
+  });
+
+  const hasPaidOpenAi = (list: Array<{ provider: string; model: string }>) =>
+    list.some((m) => m.provider === "openai" && /^gpt-/.test(m.model));
+
+  await settingsDb.updateSettings({ hidePaidModels: false });
+  assert.equal(hasPaidOpenAi(await fetchModels()), true, "paid OpenAI models visible when toggle is off");
+
+  await settingsDb.updateSettings({ hidePaidModels: true });
+  assert.equal(
+    hasPaidOpenAi(await fetchModels()),
+    false,
+    "paid OpenAI models must be removed when hidePaidModels is on (#6328)"
+  );
+});
diff --git a/tests/unit/api-routes-lib.test.ts b/tests/unit/api-routes-lib.test.ts
new file mode 100644
index 0000000000..29c0abce49
--- /dev/null
+++ b/tests/unit/api-routes-lib.test.ts
@@ -0,0 +1,33 @@
+/**
+ * Shared API route collector — locks path normalization used by openapi + docs gates.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import path from "node:path";
+import {
+  collectApiRouteFiles,
+  collectApiRouteUrlPaths,
+  toApiUrlPath,
+} from "../../scripts/check/lib/apiRoutes.mjs";
+
+test("toApiUrlPath maps [id] and [...slug] to OpenAPI-style braces", () => {
+  const apiRoot = path.join("C:", "repo", "src", "app", "api");
+  assert.equal(
+    toApiUrlPath(path.join(apiRoot, "providers", "[id]", "models"), apiRoot).replace(/\\/g, "/"),
+    "/api/providers/{id}/models"
+  );
+  assert.equal(
+    toApiUrlPath(path.join(apiRoot, "files", "[...path]"), apiRoot).replace(/\\/g, "/"),
+    "/api/files/{path}"
+  );
+});
+
+test("live repo has route files and matching URL paths", () => {
+  const files = collectApiRouteFiles();
+  const urls = collectApiRouteUrlPaths();
+  assert.ok(files.size > 50, `expected many route files, got ${files.size}`);
+  assert.ok(urls.length > 50, `expected many url paths, got ${urls.length}`);
+  assert.equal(files.size, urls.length, "each route file should yield one URL path");
+  assert.ok([...files].every((f) => f.startsWith("src/app/api/") && /route\.tsx?$/.test(f)));
+  assert.ok(urls.every((u) => u.startsWith("/api")));
+});
diff --git a/tests/unit/api/free-proxies-list-route.test.ts b/tests/unit/api/free-proxies-list-route.test.ts
new file mode 100644
index 0000000000..334148de5b
--- /dev/null
+++ b/tests/unit/api/free-proxies-list-route.test.ts
@@ -0,0 +1,104 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import type { FreeProxyItem } from "@/lib/freeProxyProviders/types";
+import { makeManagementSessionRequest } from "../../helpers/managementSession.ts";
+
+// DATA_DIR must be set before the DB core module evaluates its singleton.
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-free-list-route-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../../src/lib/db/core.ts");
+const freeProxiesDb = await import("../../../src/lib/db/freeProxies.ts");
+const settingsDb = await import("../../../src/lib/db/settings.ts");
+const listRoute = await import("../../../src/app/api/settings/free-proxies/route.ts");
+
+const ORIGINAL_INITIAL_PASSWORD = process.env.INITIAL_PASSWORD;
+
+async function reset() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+function make(host: string, quality: number, latency: number): FreeProxyItem {
+  return {
+    source: "1proxy",
+    host,
+    port: 8080,
+    type: "http",
+    countryCode: "US",
+    qualityScore: quality,
+    latencyMs: latency,
+    anonymity: "elite",
+    lastValidated: "2026-01-01T00:00:00.000Z",
+  };
+}
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  if (ORIGINAL_INITIAL_PASSWORD === undefined) delete process.env.INITIAL_PASSWORD;
+  else process.env.INITIAL_PASSWORD = ORIGINAL_INITIAL_PASSWORD;
+});
+
+test("GET returns the full contract { proxies, total, hasMore, stats, syncErrors }", async () => {
+  await reset();
+  await freeProxiesDb.upsertFreeProxy(make("alpha.example", 90, 100));
+  await freeProxiesDb.upsertFreeProxy(make("bravo.example", 40, 300));
+
+  const res = await listRoute.GET(
+    await makeManagementSessionRequest("http://localhost/api/settings/free-proxies?sortBy=quality")
+  );
+  assert.equal(res.status, 200);
+  const body = await res.json();
+  assert.equal(body.success, true);
+
+  const { proxies, total, stats, syncErrors } = body.data;
+  assert.equal(total, 2);
+  assert.equal(proxies.length, 2);
+  assert.equal(stats.total, 2);
+  assert.deepEqual(syncErrors, {});
+  // quality sort → first item is the highest score.
+  assert.equal(proxies[0].qualityScore, 90);
+});
+
+test("GET search param filters the returned proxies and total", async () => {
+  await reset();
+  await freeProxiesDb.upsertFreeProxy(make("alpha.example", 90, 100));
+  await freeProxiesDb.upsertFreeProxy(make("bravo.example", 40, 300));
+
+  const res = await listRoute.GET(
+    await makeManagementSessionRequest("http://localhost/api/settings/free-proxies?search=alph")
+  );
+  const body = await res.json();
+  assert.equal(body.data.total, 1);
+  assert.equal(body.data.proxies[0].host, "alpha.example");
+});
+
+test("GET surfaces syncErrors when a source previously failed", async () => {
+  await reset();
+  await freeProxiesDb.recordFreeProxySyncErrors("proxifly", ["HTTP 429 from upstream"]);
+
+  const res = await listRoute.GET(
+    await makeManagementSessionRequest("http://localhost/api/settings/free-proxies")
+  );
+  const body = await res.json();
+  assert.deepEqual(body.data.syncErrors, { proxifly: ["HTTP 429 from upstream"] });
+});
+
+test("GET requires management auth", async () => {
+  await reset();
+  // A fresh DB has no configured password, so a loopback/unauthenticated
+  // request is treated as the pre-setup bootstrap path and allowed through
+  // (see `isAuthRequired` in src/shared/utils/apiAuth.ts). Configure a
+  // password + requireLogin so this test actually exercises the auth gate,
+  // matching the pattern used by tests/unit/api/settings-audit.test.ts.
+  process.env.INITIAL_PASSWORD = "free-proxies-list-route-test-password";
+  await settingsDb.updateSettings({ requireLogin: true });
+
+  const res = await listRoute.GET(new Request("http://localhost/api/settings/free-proxies"));
+  assert.equal(res.status, 401);
+});
diff --git a/tests/unit/api/free-proxies-route.test.ts b/tests/unit/api/free-proxies-route.test.ts
new file mode 100644
index 0000000000..77f3c034ee
--- /dev/null
+++ b/tests/unit/api/free-proxies-route.test.ts
@@ -0,0 +1,107 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { makeManagementSessionRequest } from "../../helpers/managementSession.ts";
+
+// DATA_DIR must be set before the DB core module evaluates its singleton.
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-free-api-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.DISABLE_SQLITE_AUTO_BACKUP = "true";
+
+const core = await import("../../../src/lib/db/core.ts");
+const freeProxiesDb = await import("../../../src/lib/db/freeProxies.ts");
+const settingsDb = await import("../../../src/lib/db/settings.ts");
+const listRoute = await import("../../../src/app/api/settings/free-proxies/route.ts");
+
+const ORIGINAL_INITIAL_PASSWORD = process.env.INITIAL_PASSWORD;
+
+async function resetStorage() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  if (ORIGINAL_INITIAL_PASSWORD === undefined) delete process.env.INITIAL_PASSWORD;
+  else process.env.INITIAL_PASSWORD = ORIGINAL_INITIAL_PASSWORD;
+});
+
+function seed(host: string, quality: number, latency: number) {
+  return freeProxiesDb.upsertFreeProxy({
+    source: "1proxy",
+    host,
+    port: 8080,
+    type: "http",
+    countryCode: "US",
+    qualityScore: quality,
+    latencyMs: latency,
+    anonymity: "elite",
+    lastValidated: "2026-01-01T00:00:00.000Z",
+  });
+}
+
+test("GET returns the full { proxies, total, hasMore, stats, syncErrors } shape", async () => {
+  await seed("alpha.example", 90, 100);
+  await seed("bravo.example", 40, 300);
+
+  const res = await listRoute.GET(
+    await makeManagementSessionRequest("http://localhost/api/settings/free-proxies")
+  );
+  assert.equal(res.status, 200);
+  const body = (await res.json()) as {
+    success: boolean;
+    data: {
+      proxies: unknown[];
+      total: number;
+      hasMore: boolean;
+      stats: { total: number; inPool: number; bySource: Array<{ source: string; count: number }> };
+      syncErrors: Record<string, string[]>;
+    };
+  };
+  assert.equal(body.success, true);
+  assert.equal(body.data.total, 2);
+  assert.equal(body.data.proxies.length, 2);
+  assert.equal(body.data.hasMore, false);
+  assert.equal(body.data.stats.total, 2);
+  assert.deepEqual(body.data.syncErrors, {});
+});
+
+test("GET search + limit via query params is reflected in the response", async () => {
+  await seed("alpha.example", 90, 100);
+  await seed("bravo.example", 40, 300);
+
+  const res = await listRoute.GET(
+    await makeManagementSessionRequest(
+      "http://localhost/api/settings/free-proxies?search=alph&limit=1"
+    )
+  );
+  assert.equal(res.status, 200);
+  const body = (await res.json()) as {
+    data: { proxies: unknown[]; total: number; hasMore: boolean };
+  };
+  assert.equal(body.data.total, 1);
+  assert.equal(body.data.proxies.length, 1);
+  assert.equal((body.data.proxies[0] as { host: string }).host, "alpha.example");
+  assert.equal(body.data.hasMore, false);
+});
+
+test("GET rejects an unauthenticated request with 401", async () => {
+  // A fresh DB has no configured password, so a loopback/unauthenticated
+  // request is treated as the pre-setup bootstrap path and allowed through
+  // (see `isAuthRequired` in src/shared/utils/apiAuth.ts). Configure a
+  // password + requireLogin so this test actually exercises the auth gate,
+  // matching the pattern used by tests/unit/api/settings-audit.test.ts.
+  process.env.INITIAL_PASSWORD = "free-proxies-route-test-password";
+  await settingsDb.updateSettings({ requireLogin: true });
+
+  const res = await listRoute.GET(new Request("http://localhost/api/settings/free-proxies"));
+  assert.equal(res.status, 401);
+});
diff --git a/tests/unit/api/proxies-repair-relay.test.ts b/tests/unit/api/proxies-repair-relay.test.ts
new file mode 100644
index 0000000000..39d89ab6c4
--- /dev/null
+++ b/tests/unit/api/proxies-repair-relay.test.ts
@@ -0,0 +1,130 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { encrypt } from "@/lib/db/encryption";
+import { makeManagementSessionRequest } from "../../helpers/managementSession.ts";
+
+// DATA_DIR must be set before the DB core module evaluates its singleton. The
+// management session helper also requires JWT_SECRET, set per-test.
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-repair-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+const ORIGINAL_KEY = process.env.STORAGE_ENCRYPTION_KEY;
+process.env.STORAGE_ENCRYPTION_KEY = "test-repair-encryption-key";
+
+const core = await import("../../../src/lib/db/core.ts");
+const proxiesDb = await import("../../../src/lib/db/proxies.ts");
+const repairRelayRoute =
+  await import("../../../src/app/api/settings/proxies/[id]/repair-relay/route.ts");
+
+async function resetStorage() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  if (ORIGINAL_KEY === undefined) delete process.env.STORAGE_ENCRYPTION_KEY;
+  else process.env.STORAGE_ENCRYPTION_KEY = ORIGINAL_KEY;
+});
+
+async function createProxy(type: string, notes: string): Promise<string> {
+  const created = await proxiesDb.createProxy({
+    name: `proxy-${type}`,
+    type,
+    host: "proxy.example",
+    port: 443,
+    notes,
+    source: "dashboard-custom",
+  });
+  return created.id;
+}
+
+async function createRelay(notes: string): Promise<string> {
+  return createProxy("vercel", notes);
+}
+
+test("returns 404 when the proxy does not exist", async () => {
+  const res = await repairRelayRoute.POST(
+    await makeManagementSessionRequest("http://localhost/api/settings/proxies/nope/repair-relay", {
+      method: "POST",
+    }),
+    { params: Promise.resolve({ id: "nope" }) }
+  );
+  assert.equal(res.status, 404);
+});
+
+test("returns 400 when the proxy is not a relay type", async () => {
+  const id = await createProxy("http", JSON.stringify({}));
+  const res = await repairRelayRoute.POST(
+    await makeManagementSessionRequest(`http://localhost/api/settings/proxies/${id}/repair-relay`, {
+      method: "POST",
+    }),
+    { params: Promise.resolve({ id }) }
+  );
+  assert.equal(res.status, 400);
+});
+
+test("returns 404 when the proxy does not exist", async () => {
+  const res = await repairRelayRoute.POST(
+    await makeManagementSessionRequest("http://localhost/api/settings/proxies/nope/repair-relay", {
+      method: "POST",
+    }),
+    { params: Promise.resolve({ id: "nope" }) }
+  );
+  assert.equal(res.status, 404);
+});
+
+test('mode "noop" when plaintext relayAuth already present', async () => {
+  const id = await createRelay(JSON.stringify({ relayAuth: "plain-token" }));
+  const res = await repairRelayRoute.POST(
+    await makeManagementSessionRequest(`http://localhost/api/settings/proxies/${id}/repair-relay`, {
+      method: "POST",
+    }),
+    { params: Promise.resolve({ id }) }
+  );
+  assert.equal(res.status, 200);
+  const body = await res.json();
+  assert.deepEqual(body, { repaired: false, mode: "noop" });
+});
+
+test('mode "recovered" re-derives plaintext from the encrypted blob', async () => {
+  const enc = encrypt("recoverable-token");
+  const id = await createRelay(JSON.stringify({ relayAuthEnc: enc }));
+  const res = await repairRelayRoute.POST(
+    await makeManagementSessionRequest(`http://localhost/api/settings/proxies/${id}/repair-relay`, {
+      method: "POST",
+    }),
+    { params: Promise.resolve({ id }) }
+  );
+  assert.equal(res.status, 200);
+  const body = await res.json();
+  assert.deepEqual(body, { repaired: true, mode: "recovered" });
+
+  const updated = await proxiesDb.getProxyById(id, { includeSecrets: true });
+  const parsed = JSON.parse(updated?.notes ?? "{}");
+  assert.equal(parsed.relayAuth, "recoverable-token");
+});
+
+test('mode "redeploy" (409) when no recoverable auth exists', async () => {
+  const id = await createRelay(JSON.stringify({}));
+  const res = await repairRelayRoute.POST(
+    await makeManagementSessionRequest(`http://localhost/api/settings/proxies/${id}/repair-relay`, {
+      method: "POST",
+    }),
+    { params: Promise.resolve({ id }) }
+  );
+  assert.equal(res.status, 409);
+  const body = await res.json();
+  assert.ok(
+    typeof body.error?.message === "string" && /redeploy/i.test(body.error.message),
+    `409 must explain redeploy; got ${JSON.stringify(body)}`
+  );
+});
diff --git a/tests/unit/api/root-catchall-json-404.test.ts b/tests/unit/api/root-catchall-json-404.test.ts
new file mode 100644
index 0000000000..c909660987
--- /dev/null
+++ b/tests/unit/api/root-catchall-json-404.test.ts
@@ -0,0 +1,82 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+/**
+ * Regression: issue #6405 follow-up — unknown root-level paths (/anthropic/*,
+ * /openai/*, /metrics, /debug, /.env) previously fell through to the Next.js
+ * app-router `not-found.tsx`, which returned the dashboard HTML shell (~200 KB)
+ * to CLI/SDK callers. next.config.mjs now rewrites those prefixes under /api/*
+ * so they hit `/api/[...omnirouteApiCatchAll]` (#6424) — this suite verifies
+ * that catch-all still responds with a JSON not_found body for those rewritten
+ * paths (path assertion mirrors the URL the handler sees post-rewrite).
+ */
+
+const catchAll = await import(
+  "../../../src/app/api/[...omnirouteApiCatchAll]/route.ts"
+);
+
+function makeReq(pathname: string, method = "GET"): Request {
+  return new Request(`http://localhost:20128${pathname}`, { method });
+}
+
+test("api catchall returns JSON 404 for rewritten /anthropic/v1/messages POST", async () => {
+  // Post-rewrite path the handler sees: /api/anthropic/v1/messages
+  const res = await catchAll.POST(makeReq("/api/anthropic/v1/messages", "POST"));
+  assert.equal(res.status, 404);
+  const ct = res.headers.get("content-type") || "";
+  assert.ok(ct.includes("application/json"), `expected JSON content-type, got: ${ct}`);
+  const body = (await res.json()) as {
+    error: { type: string; message: string; code?: string; path?: string };
+  };
+  assert.equal(body.error.type, "not_found");
+  assert.equal(body.error.path, "/api/anthropic/v1/messages");
+  assert.match(body.error.message, /Unknown API route/);
+});
+
+test("api catchall returns JSON 404 for rewritten /openai/v1/chat/completions", async () => {
+  const res = await catchAll.POST(makeReq("/api/openai/v1/chat/completions", "POST"));
+  assert.equal(res.status, 404);
+  const body = (await res.json()) as { error: { type: string; path?: string } };
+  assert.equal(body.error.type, "not_found");
+  assert.equal(body.error.path, "/api/openai/v1/chat/completions");
+});
+
+test("api catchall returns JSON 404 for rewritten /metrics", async () => {
+  const res = await catchAll.GET(makeReq("/api/metrics"));
+  assert.equal(res.status, 404);
+  const ct = res.headers.get("content-type") || "";
+  assert.ok(ct.includes("application/json"), `expected JSON content-type, got: ${ct}`);
+  const body = (await res.json()) as { error: { type: string; path?: string } };
+  assert.equal(body.error.type, "not_found");
+});
+
+test("api catchall returns JSON 404 for rewritten /debug and /.env", async () => {
+  for (const p of ["/api/debug", "/api/.env"] as const) {
+    const res = await catchAll.GET(makeReq(p));
+    assert.equal(res.status, 404, `${p} status`);
+    assert.ok(
+      (res.headers.get("content-type") || "").includes("application/json"),
+      `${p} content-type`,
+    );
+    const body = (await res.json()) as { error: { type: string } };
+    assert.equal(body.error.type, "not_found", `${p} error.type`);
+  }
+});
+
+test("api catchall returns JSON 404 for unknown /v1beta/* via nested api catch-all", async () => {
+  // /v1beta/foo rewrites to /api/v1beta/foo; since no v1beta-specific
+  // catch-all exists, Next.js falls through to /api/[...omnirouteApiCatchAll].
+  const res = await catchAll.GET(makeReq("/api/v1beta/nonexistent"));
+  assert.equal(res.status, 404);
+  const body = (await res.json()) as { error: { type: string; path?: string } };
+  assert.equal(body.error.type, "not_found");
+  assert.equal(body.error.path, "/api/v1beta/nonexistent");
+});
+
+test("api catchall OPTIONS preflight exposes CORS headers for rewritten paths", async () => {
+  const res = await catchAll.OPTIONS();
+  assert.ok(
+    res.headers.get("access-control-allow-methods"),
+    "OPTIONS must expose CORS methods header",
+  );
+});
diff --git a/tests/unit/auggie-win32-spawn-6304.test.ts b/tests/unit/auggie-win32-spawn-6304.test.ts
new file mode 100644
index 0000000000..bf0f1f0bc0
--- /dev/null
+++ b/tests/unit/auggie-win32-spawn-6304.test.ts
@@ -0,0 +1,56 @@
+/**
+ * Regression test for #6304 — Auggie (Augment CLI) provider always fails on
+ * Windows with `spawn EINVAL`.
+ *
+ * Root cause: resolveAuggieBin() falls back to "auggie.cmd" (the global-npm
+ * bin shim) on win32. Since Node's CVE-2024-27980 fix (Node >=18.20.2/
+ * 20.12.2/21.7.3), `spawn()` refuses `.cmd`/`.bat` targets without
+ * `shell: true`, throwing `spawn EINVAL`.
+ *
+ * Both auggie spawn sites build their options via the shared
+ * buildAuggieSpawnOptions() helper, so asserting on that helper's output
+ * covers spawnAuggie() (non-streaming path) and the inline spawn in
+ * runStreaming() alike.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { buildAuggieSpawnOptions } = await import("@omniroute/open-sse/executors/auggie");
+
+/** Temporarily override process.platform for the duration of `fn`. */
+function withPlatform<T>(platform: string, fn: () => T): T {
+  const original = Object.getOwnPropertyDescriptor(process, "platform")!;
+  Object.defineProperty(process, "platform", { value: platform, configurable: true });
+  try {
+    return fn();
+  } finally {
+    Object.defineProperty(process, "platform", original);
+  }
+}
+
+test("buildAuggieSpawnOptions sets shell:true on win32 (fixes spawn EINVAL)", () => {
+  const options = withPlatform("win32", () => buildAuggieSpawnOptions(["pipe", "pipe", "pipe"]));
+  assert.equal(
+    options.shell,
+    true,
+    "spawn() must use shell:true on win32 or launching auggie.cmd throws EINVAL " +
+      "(Node CVE-2024-27980 fix)"
+  );
+});
+
+test("buildAuggieSpawnOptions leaves shell falsy on posix platforms", () => {
+  for (const platform of ["linux", "darwin"]) {
+    const options = withPlatform(platform, () => buildAuggieSpawnOptions(["pipe", "pipe", "pipe"]));
+    assert.ok(
+      !options.shell,
+      `spawn() should not need shell interpretation on ${platform}`
+    );
+  }
+});
+
+test("buildAuggieSpawnOptions forwards the requested stdio and process.env", () => {
+  const options = withPlatform("linux", () => buildAuggieSpawnOptions(["pipe", "pipe", "pipe"]));
+  assert.deepEqual(options.stdio, ["pipe", "pipe", "pipe"]);
+  assert.equal(options.env, process.env);
+});
diff --git a/tests/unit/authz/classify.test.ts b/tests/unit/authz/classify.test.ts
index f091bb2bf9..734109ce02 100644
--- a/tests/unit/authz/classify.test.ts
+++ b/tests/unit/authz/classify.test.ts
@@ -135,6 +135,12 @@ const cases: Case[] = [
     method: "GET",
     expectedClass: "PUBLIC",
   },
+  {
+    name: "/api/health/ping is PUBLIC",
+    path: "/api/health/ping",
+    method: "GET",
+    expectedClass: "PUBLIC",
+  },
   {
     name: "/api/cloud/auth POST is PUBLIC",
     path: "/api/cloud/auth",
diff --git a/tests/unit/authz/client-api-policy.test.ts b/tests/unit/authz/client-api-policy.test.ts
index fb8c5e41d1..081ab50e43 100644
--- a/tests/unit/authz/client-api-policy.test.ts
+++ b/tests/unit/authz/client-api-policy.test.ts
@@ -51,12 +51,30 @@ async function loadPolicy() {
 }
 
 function ctx(headers: Headers, method = "POST", normalizedPath = "/api/v1/chat/completions") {
+  const pathOnly = normalizedPath.split("?")[0];
   return {
     request: { method, headers, url: `http://localhost${normalizedPath}` },
     classification: {
       routeClass: "CLIENT_API" as const,
       reason: "client_api_v1" as const,
-      normalizedPath,
+      normalizedPath: pathOnly,
+    },
+    requestId: "req_test",
+  };
+}
+
+function relativeUrlCtx(
+  headers: Headers,
+  method = "POST",
+  normalizedPath = "/api/v1/chat/completions"
+) {
+  const pathOnly = normalizedPath.split("?")[0];
+  return {
+    request: { method, headers, url: normalizedPath },
+    classification: {
+      routeClass: "CLIENT_API" as const,
+      reason: "client_api_v1" as const,
+      normalizedPath: pathOnly,
     },
     requestId: "req_test",
   };
@@ -82,6 +100,28 @@ test("clientApiPolicy: missing bearer is rejected with 401", async () => {
   }
 });
 
+test("clientApiPolicy: websocket descriptor handshake can reach the route handler", async () => {
+  const policy = await loadPolicy();
+  const out = await policy.evaluate(ctx(new Headers(), "GET", "/api/v1/ws?handshake=1"));
+
+  assert.equal(out.allow, true);
+  if (out.allow) {
+    assert.equal(out.subject.kind, "anonymous");
+    assert.equal(out.subject.id, "ws-handshake");
+  }
+});
+
+test("clientApiPolicy: websocket descriptor handshake accepts relative request URLs", async () => {
+  const policy = await loadPolicy();
+  const out = await policy.evaluate(relativeUrlCtx(new Headers(), "GET", "/api/v1/ws?handshake=1"));
+
+  assert.equal(out.allow, true);
+  if (out.allow) {
+    assert.equal(out.subject.kind, "anonymous");
+    assert.equal(out.subject.id, "ws-handshake");
+  }
+});
+
 test("clientApiPolicy: REQUIRE_API_KEY DB feature flag override rejects anonymous", async () => {
   process.env.REQUIRE_API_KEY = "false";
   featureFlagsDb.setFeatureFlagOverride("REQUIRE_API_KEY", "true");
diff --git a/tests/unit/authz/pipeline.test.ts b/tests/unit/authz/pipeline.test.ts
index 2b43287911..34703f270e 100644
--- a/tests/unit/authz/pipeline.test.ts
+++ b/tests/unit/authz/pipeline.test.ts
@@ -66,6 +66,7 @@ test.beforeEach(() => {
 });
 
 test.after(() => {
+  core.resetDbInstance();
   fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
   if (ORIGINAL_JWT === undefined) delete process.env.JWT_SECRET;
   else process.env.JWT_SECRET = ORIGINAL_JWT;
@@ -564,3 +565,38 @@ test("runAuthzPipeline refreshes dashboard JWTs near expiry", async () => {
   assert.equal(response.status, 200);
   assert.match(response.headers.get("set-cookie") || "", /auth_token=/);
 });
+
+test("runAuthzPipeline clears stale dashboard JWTs without error-stack noise", async () => {
+  await forceAuthRequired();
+  const oldSecret = new TextEncoder().encode("old-dashboard-jwt-secret");
+  const staleToken = await new SignJWT({ authenticated: true })
+    .setProtectedHeader({ alg: "HS256" })
+    .setExpirationTime("1h")
+    .sign(oldSecret);
+
+  const errorCalls: unknown[][] = [];
+  const originalError = console.error;
+  const originalWarn = console.warn;
+  console.error = (...args: unknown[]) => {
+    errorCalls.push(args);
+  };
+  console.warn = () => {};
+
+  try {
+    const response = await pipeline.runAuthzPipeline(
+      request("http://localhost/dashboard", {
+        headers: { cookie: `auth_token=${staleToken}` },
+      }),
+      { enforce: true }
+    );
+
+    assert.equal(response.status, 307);
+    const setCookie = response.headers.get("set-cookie") || "";
+    assert.match(setCookie, /auth_token=/);
+    assert.match(setCookie, /Max-Age=0|Expires=/i);
+    assert.equal(errorCalls.length, 0);
+  } finally {
+    console.error = originalError;
+    console.warn = originalWarn;
+  }
+});
diff --git a/tests/unit/authz/route-guard-skills-collect.test.ts b/tests/unit/authz/route-guard-skills-collect.test.ts
new file mode 100644
index 0000000000..795fc3f59e
--- /dev/null
+++ b/tests/unit/authz/route-guard-skills-collect.test.ts
@@ -0,0 +1,51 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  isLocalOnlyPath,
+  isLocalOnlyBypassableByManageScope,
+} from "../../../src/server/authz/routeGuard.ts";
+import { SPAWN_CAPABLE_ROUTE_ROOTS } from "../../../scripts/check/check-route-guard-membership.ts";
+
+// ─── PR #6294 review: /api/skills/collect/ is local-only ─────────────────
+//
+// GET /api/skills/collect/detect calls getCliRuntimeStatus() (which spawns a
+// child process) once per CLI_TOOL_IDS entry — a spawn-capable, previously
+// unauthenticated route reachable from any tunnel. Must be loopback-enforced
+// BEFORE any auth check (Hard Rules #15 + #17), the same as every other
+// spawn-capable prefix.
+
+test("isLocalOnlyPath: /api/skills/collect/ prefix is local-only (Hard Rules #15/#17)", () => {
+  assert.equal(isLocalOnlyPath("/api/skills/collect/detect"), true);
+  assert.equal(isLocalOnlyPath("/api/skills/collect/install"), true);
+  assert.equal(isLocalOnlyPath("/api/skills/collect/"), true);
+});
+
+test("isLocalOnlyPath: the rest of /api/skills/ stays remote-reachable (no over-broadening)", () => {
+  // Only the spawn-capable collect/* subtree is loopback-locked. The rest of the
+  // skills surface (registry install, marketplace, skillssh) already gates on
+  // requireManagementAuth() and must remain reachable remotely.
+  assert.equal(isLocalOnlyPath("/api/skills"), false);
+  assert.equal(isLocalOnlyPath("/api/skills/install"), false);
+  assert.equal(isLocalOnlyPath("/api/skills/marketplace/install"), false);
+});
+
+test("isLocalOnlyBypassableByManageScope: /api/skills/collect/ is NOT bypassable (defence in depth)", () => {
+  // Even if a DB row tried to whitelist /api/skills/collect/ via the manage-scope
+  // bypass list, the runtime predicate must reject it because the prefix is in
+  // SPAWN_CAPABLE_PREFIXES (src/shared/constants/spawnCapablePrefixes.ts).
+  assert.equal(isLocalOnlyPath("/api/skills/collect/detect"), true);
+  assert.equal(isLocalOnlyBypassableByManageScope("/api/skills/collect/detect"), false);
+});
+
+test("SPAWN_CAPABLE_ROUTE_ROOTS includes src/app/api/skills/collect (route-guard-membership gate)", () => {
+  // Regression guard for the "gate's scanned-roots list doesn't include this new
+  // directory" gap found during PR #6294 review — check:route-guard-membership
+  // must actually enumerate the new detect/install route.ts files, not silently
+  // report "0 new gaps" because the directory was never in scope.
+  assert.ok(
+    SPAWN_CAPABLE_ROUTE_ROOTS.includes("src/app/api/skills/collect"),
+    `Expected SPAWN_CAPABLE_ROUTE_ROOTS to include "src/app/api/skills/collect", got: ${JSON.stringify(
+      SPAWN_CAPABLE_ROUTE_ROOTS
+    )}`
+  );
+});
diff --git a/tests/unit/authz/spawn-capable-prefixes-client-safe.test.ts b/tests/unit/authz/spawn-capable-prefixes-client-safe.test.ts
index aeeb98bbdf..7c64ca0f6c 100644
--- a/tests/unit/authz/spawn-capable-prefixes-client-safe.test.ts
+++ b/tests/unit/authz/spawn-capable-prefixes-client-safe.test.ts
@@ -77,6 +77,7 @@ test("SPAWN_CAPABLE_PREFIXES is defined in the server-free constants leaf with t
     "/api/tools/traffic-inspector/",
     "/api/plugins/",
     "/api/local/",
+    "/api/skills/collect/",
     "/api/headroom/start",
     "/api/headroom/stop",
   ]) {
@@ -85,5 +86,5 @@ test("SPAWN_CAPABLE_PREFIXES is defined in the server-free constants leaf with t
       `SPAWN_CAPABLE_PREFIXES lost the spawn-capable prefix "${prefix}" during extraction`
     );
   }
-  assert.equal(SPAWN_CAPABLE_PREFIXES.length, 8);
+  assert.equal(SPAWN_CAPABLE_PREFIXES.length, 9);
 });
diff --git a/tests/unit/auto-combo-budget-fallback-3470.test.ts b/tests/unit/auto-combo-budget-fallback-3470.test.ts
new file mode 100644
index 0000000000..89271e8988
--- /dev/null
+++ b/tests/unit/auto-combo-budget-fallback-3470.test.ts
@@ -0,0 +1,161 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  BudgetExceededError,
+  selectProvider,
+} from "../../open-sse/services/autoCombo/engine.ts";
+import {
+  parseRequestBudgetFallback,
+  resolveRequestAutoControls,
+} from "../../open-sse/services/autoCombo/requestControls.ts";
+import { getSelfHealingManager } from "../../open-sse/services/autoCombo/selfHealing.ts";
+import { DEFAULT_WEIGHTS } from "../../open-sse/services/autoCombo/scoring.ts";
+
+// #3470 — Auto-combo transparency + budget controls: `budgetFallback: "strict"`
+// must refuse to select (instead of silently overspending) when EVERY candidate
+// exceeds the configured `budgetCap`.
+
+const healer = getSelfHealingManager();
+const originalRandom = Math.random;
+
+function resetHealer() {
+  healer.exclusions.clear();
+  healer.incidentMode = false;
+}
+
+const baseConfig = {
+  id: "auto-main",
+  name: "Auto Main Budget Strict",
+  type: "auto" as const,
+  candidatePool: [],
+  weights: DEFAULT_WEIGHTS,
+  explorationRate: 0,
+};
+
+const overBudgetCandidates = [
+  {
+    provider: "premium",
+    model: "gpt-4o",
+    quotaRemaining: 99,
+    quotaTotal: 100,
+    circuitBreakerState: "CLOSED",
+    costPer1MTokens: 12000,
+    p95LatencyMs: 100,
+    latencyStdDev: 10,
+    errorRate: 0.01,
+    accountTier: "ultra",
+    quotaResetIntervalSecs: 60,
+  },
+  {
+    provider: "cheap",
+    model: "gpt-4o-mini",
+    quotaRemaining: 60,
+    quotaTotal: 100,
+    circuitBreakerState: "CLOSED",
+    costPer1MTokens: 100,
+    p95LatencyMs: 900,
+    latencyStdDev: 50,
+    errorRate: 0.02,
+    accountTier: "free",
+    quotaResetIntervalSecs: 86400,
+  },
+];
+
+test.beforeEach(() => {
+  resetHealer();
+  Math.random = originalRandom;
+});
+
+test.afterEach(() => {
+  resetHealer();
+  Math.random = originalRandom;
+});
+
+test("selectProvider throws BudgetExceededError when budgetFallback='strict' and every candidate exceeds budgetCap", () => {
+  assert.throws(
+    () =>
+      selectProvider(
+        { ...baseConfig, budgetCap: 0.001, budgetFallback: "strict" },
+        overBudgetCandidates,
+        "default"
+      ),
+    BudgetExceededError
+  );
+});
+
+test("BudgetExceededError message reports the cap and the cheapest candidate's cost, no stack leak", () => {
+  try {
+    selectProvider(
+      { ...baseConfig, budgetCap: 0.001, budgetFallback: "strict" },
+      overBudgetCandidates,
+      "default"
+    );
+    assert.fail("expected selectProvider to throw");
+  } catch (err) {
+    assert.ok(err instanceof BudgetExceededError);
+    assert.match(err.message, /budget cap of \$0\.0010/);
+    assert.ok(!err.message.includes("at /"));
+  }
+});
+
+test("selectProvider still falls back to cheapest when budgetFallback is 'cheapest' (default/legacy)", () => {
+  const result = selectProvider(
+    { ...baseConfig, budgetCap: 0.001, budgetFallback: "cheapest" },
+    overBudgetCandidates,
+    "default"
+  );
+  assert.equal(result.provider, "cheap");
+});
+
+test("selectProvider defaults to cheapest fallback when budgetFallback is unset (backward compatible)", () => {
+  const result = selectProvider({ ...baseConfig, budgetCap: 0.001 }, overBudgetCandidates, "default");
+  assert.equal(result.provider, "cheap");
+});
+
+test("selectProvider with strict fallback still picks a within-budget candidate normally", () => {
+  const result = selectProvider(
+    { ...baseConfig, budgetCap: 1, budgetFallback: "strict" },
+    overBudgetCandidates,
+    "default"
+  );
+  assert.equal(result.provider, "cheap");
+});
+
+test("parseRequestBudgetFallback: accepts 'strict' and its aliases", () => {
+  assert.equal(parseRequestBudgetFallback("strict"), "strict");
+  assert.equal(parseRequestBudgetFallback("BLOCK"), "strict");
+  assert.equal(parseRequestBudgetFallback(" hard "), "strict");
+});
+
+test("parseRequestBudgetFallback: accepts 'cheapest' and its aliases", () => {
+  assert.equal(parseRequestBudgetFallback("cheapest"), "cheapest");
+  assert.equal(parseRequestBudgetFallback("Cheapest-Viable"), "cheapest");
+  assert.equal(parseRequestBudgetFallback("soft"), "cheapest");
+});
+
+test("parseRequestBudgetFallback: ignores unknown/empty/non-string values", () => {
+  assert.equal(parseRequestBudgetFallback("garbage"), undefined);
+  assert.equal(parseRequestBudgetFallback(""), undefined);
+  assert.equal(parseRequestBudgetFallback(null), undefined);
+  assert.equal(parseRequestBudgetFallback(42), undefined);
+});
+
+test("resolveRequestAutoControls: aggregates mode/budget/budgetFallback headers, omitting unset ones", () => {
+  const headers = new Headers({
+    "x-omniroute-mode": "fast",
+    "x-omniroute-budget": "0.05",
+    "x-omniroute-budget-fallback": "strict",
+  });
+  const controls = resolveRequestAutoControls(headers);
+  assert.deepEqual(controls, {
+    mode: "fast",
+    budgetCap: 0.05,
+    budgetFallback: "strict",
+  });
+});
+
+test("resolveRequestAutoControls: returns an empty object when no auto-combo headers are present", () => {
+  const controls = resolveRequestAutoControls(new Headers());
+  assert.deepEqual(controls, {});
+});
diff --git a/tests/unit/auto-empty-pool-fastfail-6458.test.ts b/tests/unit/auto-empty-pool-fastfail-6458.test.ts
new file mode 100644
index 0000000000..4db304bab9
--- /dev/null
+++ b/tests/unit/auto-empty-pool-fastfail-6458.test.ts
@@ -0,0 +1,31 @@
+/**
+ * #6458 — an `auto/*` category/tier combo that matches ZERO connected
+ * candidates must fail fast with a clear 503, instead of building an empty
+ * virtual combo whose downstream routing stalls on a silent ~15s upstream
+ * timeout. Regression guard (Rule #18).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-auto-empty-pool-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const { resolveModelOrError } = await import("../../src/sse/handlers/chatHelpers.ts");
+
+test.beforeEach(() => core.resetDbInstance());
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("#6458 empty auto-combo pool returns a 503 instead of an empty combo", async () => {
+  // No provider connections seeded → any auto category resolves to an empty pool.
+  const result = await resolveModelOrError("auto/coding:pro", { messages: [{ role: "user", content: "hi" }] });
+  assert.ok(result.error, "expected an error result, not a combo");
+  assert.equal(result.error.status, 503, "empty auto pool must fail fast with 503");
+  assert.equal(result.combo, undefined, "must not return a combo for an empty pool");
+});
diff --git a/tests/unit/autoCombo/paid-tier-auto-id-6328.test.ts b/tests/unit/autoCombo/paid-tier-auto-id-6328.test.ts
new file mode 100644
index 0000000000..972fb2ec7b
--- /dev/null
+++ b/tests/unit/autoCombo/paid-tier-auto-id-6328.test.ts
@@ -0,0 +1,38 @@
+/**
+ * #6328 (follow-up to #6495 / #6512) — regression guard for
+ * `isPaidTierAutoId`, which lets `/v1/models` REMOVE (not just hide) paid-tier
+ * `auto/*` ids when the operator opts into `hidePaidModels`.
+ */
+import { test } from "vitest";
+import assert from "node:assert/strict";
+
+import { isPaidTierAutoId } from "../../../open-sse/services/autoCombo/builtinCatalog.ts";
+
+test("flat auto/pro-* variants are paid-tier", () => {
+  assert.equal(isPaidTierAutoId("auto/pro-coding"), true);
+  assert.equal(isPaidTierAutoId("auto/pro-reasoning"), true);
+  assert.equal(isPaidTierAutoId("auto/pro-fast"), true);
+});
+
+test("suffix auto/<category>:pro variants are paid-tier", () => {
+  assert.equal(isPaidTierAutoId("auto/coding:pro"), true);
+  assert.equal(isPaidTierAutoId("auto/reasoning:pro"), true);
+});
+
+test("non-pro auto/* ids are NOT paid-tier (kept in advertised catalog)", () => {
+  assert.equal(isPaidTierAutoId("auto/coding"), false);
+  assert.equal(isPaidTierAutoId("auto/coding:free"), false);
+  assert.equal(isPaidTierAutoId("auto/coding:fast"), false);
+  assert.equal(isPaidTierAutoId("auto/best-coding"), false);
+  assert.equal(isPaidTierAutoId("auto/best-free"), false);
+  assert.equal(isPaidTierAutoId("auto/vision"), false);
+});
+
+test("non-auto ids and malformed input return false (guard)", () => {
+  assert.equal(isPaidTierAutoId("openai/gpt-4o"), false);
+  assert.equal(isPaidTierAutoId(""), false);
+  assert.equal(isPaidTierAutoId("auto/"), false);
+  // Argument is typed `string` at the call sites, but the guard tolerates junk.
+  assert.equal(isPaidTierAutoId(undefined as unknown as string), false);
+  assert.equal(isPaidTierAutoId(null as unknown as string), false);
+});
diff --git a/tests/unit/backpressure.test.ts b/tests/unit/backpressure.test.ts
new file mode 100644
index 0000000000..14ed4fe098
--- /dev/null
+++ b/tests/unit/backpressure.test.ts
@@ -0,0 +1,109 @@
+import { test, beforeEach } from "node:test";
+import assert from "node:assert/strict";
+import { evalCapacity } from "../../src/sse/utils/backpressure.ts";
+import type { CapacityResult } from "../../src/sse/utils/backpressure.ts";
+
+// ---------------------------------------------------------------------------
+// evalCapacity — pure function, no mocking required
+// ---------------------------------------------------------------------------
+
+beforeEach(() => {
+  delete process.env.OMNI_MAX_CONCURRENT_CONNECTIONS;
+});
+
+test("backpressure: cap=0 never rejects regardless of active count", () => {
+  const r: CapacityResult = evalCapacity(9999, 0);
+  assert.equal(r.shouldReject, false);
+});
+
+test("backpressure: negative cap never rejects", () => {
+  assert.equal(evalCapacity(100, -1).shouldReject, false);
+});
+
+test("backpressure: passes when active is zero", () => {
+  assert.equal(evalCapacity(0, 10).shouldReject, false);
+});
+
+test("backpressure: passes when active is below cap", () => {
+  assert.equal(evalCapacity(5, 10).shouldReject, false);
+});
+
+test("backpressure: passes when active is exactly cap minus one", () => {
+  assert.equal(evalCapacity(9, 10).shouldReject, false);
+});
+
+test("backpressure: rejects when active equals cap", () => {
+  const r = evalCapacity(10, 10);
+  assert.equal(r.shouldReject, true);
+});
+
+test("backpressure: rejects when active exceeds cap", () => {
+  assert.equal(evalCapacity(100, 10).shouldReject, true);
+});
+
+test("backpressure: rejection returns HTTP 429", async () => {
+  const r = evalCapacity(10, 10);
+  assert.equal(r.shouldReject, true);
+  if (!r.shouldReject) throw new Error("unreachable");
+  assert.equal(r.response.status, 429);
+});
+
+test("backpressure: rejection includes Retry-After header >= 1", async () => {
+  const r = evalCapacity(10, 10);
+  assert.equal(r.shouldReject, true);
+  if (!r.shouldReject) throw new Error("unreachable");
+  const val = Number(r.response.headers.get("Retry-After"));
+  assert.ok(val >= 1, `Retry-After must be >= 1, got ${val}`);
+});
+
+test("backpressure: X-RateLimit-Limit matches the cap", async () => {
+  const r = evalCapacity(7, 5);
+  assert.equal(r.shouldReject, true);
+  if (!r.shouldReject) throw new Error("unreachable");
+  assert.equal(r.response.headers.get("X-RateLimit-Limit"), "5");
+  assert.equal(r.response.headers.get("X-RateLimit-Remaining"), "0");
+});
+
+test("backpressure: rejection body is valid JSON with error.type=rate_limit", async () => {
+  const r = evalCapacity(3, 3);
+  assert.equal(r.shouldReject, true);
+  if (!r.shouldReject) throw new Error("unreachable");
+  const body = await r.response.json();
+  assert.equal(body?.error?.type, "rate_limit");
+  assert.ok(typeof body.error.message === "string");
+  assert.ok(typeof body.error.retry_after === "number");
+});
+
+test("backpressure: rejection message contains active and limit counts", async () => {
+  const r = evalCapacity(8, 5);
+  assert.equal(r.shouldReject, true);
+  if (!r.shouldReject) throw new Error("unreachable");
+  const body = await r.response.json();
+  assert.ok(body.error.message.includes("8"), "message should reference active count");
+  assert.ok(body.error.message.includes("5"), "message should reference cap");
+});
+
+test("backpressure: retry-after formula — at cap gives ceil(1*30)=30", async () => {
+  const r = evalCapacity(10, 10);
+  assert.equal(r.shouldReject, true);
+  if (!r.shouldReject) throw new Error("unreachable");
+  assert.equal(Number(r.response.headers.get("Retry-After")), 30);
+});
+
+test("backpressure: retry-after increases proportionally under higher load", async () => {
+  const r1 = evalCapacity(10, 10); // factor 1.0 → 30s
+  const r2 = evalCapacity(20, 10); // factor 2.0 → 60s
+  assert.equal(r1.shouldReject, true);
+  assert.equal(r2.shouldReject, true);
+  if (!r1.shouldReject || !r2.shouldReject) throw new Error("unreachable");
+  const ra1 = Number(r1.response.headers.get("Retry-After"));
+  const ra2 = Number(r2.response.headers.get("Retry-After"));
+  assert.ok(ra2 > ra1, `retry-after should grow with load factor (${ra1} → ${ra2})`);
+});
+
+test("backpressure: Content-Type is application/json", async () => {
+  const r = evalCapacity(5, 5);
+  assert.equal(r.shouldReject, true);
+  if (!r.shouldReject) throw new Error("unreachable");
+  assert.ok(r.response.headers.get("Content-Type")?.includes("application/json"));
+});
diff --git a/tests/unit/bailian-coding-plan-provider.test.ts b/tests/unit/bailian-coding-plan-provider.test.ts
index 2492071a86..2dcbe63e55 100644
--- a/tests/unit/bailian-coding-plan-provider.test.ts
+++ b/tests/unit/bailian-coding-plan-provider.test.ts
@@ -293,13 +293,26 @@ test("getStaticModelsForProvider returns undefined for non-static providers", ()
 });
 
 test("getStaticModelsForProvider returns local image catalogs for image-only providers", () => {
-  const models = getStaticModelsForProvider("xai");
+  // nanobanana has IMAGE_PROVIDERS rows but no chat registry models — specialty
+  // must still surface them. Chat+image providers (xai/lmarena/openai) keep
+  // image models exclusively in IMAGE_PROVIDERS (not the chat specialty list).
+  const models = getStaticModelsForProvider("nanobanana");
 
-  assert.ok(models, "xAI should expose local image models");
-  assert.deepEqual(
-    models.map((model) => model.id),
-    ["grok-imagine-image-quality", "grok-imagine-image"]
-  );
+  assert.ok(models, "nanobanana should expose local image models");
+  assert.ok(models.length >= 1);
+  assert.ok(models.every((m) => m.supportedEndpoints?.includes("images")));
+});
+
+test("getStaticModelsForProvider does not dump IMAGE_PROVIDERS into chat specialty", () => {
+  for (const provider of ["lmarena", "openai", "xai"]) {
+    const models = getStaticModelsForProvider(provider) || [];
+    assert.ok(
+      !models.some((m) => m.supportedEndpoints?.includes("images")),
+      `${provider} chat specialty must not include image-only models`
+    );
+  }
+  const lmarena = getStaticModelsForProvider("lmarena") || [];
+  assert.ok(!lmarena.some((m) => String(m.id).includes("flux")));
 });
 
 test("getStaticModelsForProvider returns models for other static providers", () => {
diff --git a/tests/unit/bootstrap-env.test.ts b/tests/unit/bootstrap-env.test.ts
index 45d2911776..204ceea672 100644
--- a/tests/unit/bootstrap-env.test.ts
+++ b/tests/unit/bootstrap-env.test.ts
@@ -120,6 +120,30 @@ test("bootstrapEnv fails closed when existing database cannot be inspected", ()
   });
 });
 
+test("bootstrapEnv ignores blank process.env values that would override persisted secrets (#6824)", () => {
+  withTempEnv(({ dataDir }) => {
+    process.env.DATA_DIR = dataDir;
+    fs.mkdirSync(dataDir, { recursive: true });
+
+    // Persisted secrets in server.env
+    fs.writeFileSync(
+      path.join(dataDir, "server.env"),
+      "STORAGE_ENCRYPTION_KEY=persisted-key\nJWT_SECRET=persisted-jwt\n",
+      "utf8"
+    );
+
+    // Simulate Docker `-e STORAGE_ENCRYPTION_KEY=` — sets an empty string
+    process.env.STORAGE_ENCRYPTION_KEY = "";
+    process.env.JWT_SECRET = "";
+
+    const env = bootstrapEnv({ quiet: true });
+
+    // Empty process.env values must NOT override persisted secrets
+    assert.equal(env.STORAGE_ENCRYPTION_KEY, "persisted-key");
+    assert.equal(env.JWT_SECRET, "persisted-jwt");
+  });
+});
+
 test("bootstrapEnv ignores blank dataDirOverride values", () => {
   withTempEnv(({ dataDir }) => {
     process.env.DATA_DIR = dataDir;
diff --git a/tests/unit/build/assemble-standalone.test.ts b/tests/unit/build/assemble-standalone.test.ts
index a5c039ed13..9fefa5890e 100644
--- a/tests/unit/build/assemble-standalone.test.ts
+++ b/tests/unit/build/assemble-standalone.test.ts
@@ -159,3 +159,28 @@ test("the TPROXY addon source is skipped gracefully when it was not built (non-L
   );
   fs.rmSync(tmp, { recursive: true, force: true });
 });
+
+// Regression guard (#deploy 2026-07-11): server-ws.mjs gained an import of
+// head-response-guard.cjs without a matching EXTRA_MODULE_ENTRIES entry, so every
+// build:release bundle crashed at boot with ERR_MODULE_NOT_FOUND. This test derives
+// the requirement from the source itself: EVERY relative import in
+// standalone-server-ws.mjs must be shipped into the bundle by the extra-module sync.
+test("every relative import of standalone-server-ws.mjs is shipped into the bundle", async () => {
+  const repoRoot = path.resolve(new URL(".", import.meta.url).pathname, "../../..");
+  const serverWsSrc = fs.readFileSync(
+    path.join(repoRoot, "scripts/dev/standalone-server-ws.mjs"),
+    "utf8"
+  );
+  const relImports = [...serverWsSrc.matchAll(/from\s+"\.\/([^"]+)"/g)].map((m) => m[1]);
+  assert.ok(relImports.length > 0, "server-ws.mjs has relative imports to check");
+
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "assemble-serverws-"));
+  await syncStandaloneExtraModules(repoRoot, fs.promises, { log() {} }, tmp);
+  for (const imp of relImports) {
+    assert.ok(
+      fs.existsSync(path.join(tmp, imp)),
+      `server-ws.mjs imports ./${imp} but EXTRA_MODULE_ENTRIES does not ship it — the bundle would crash at boot (ERR_MODULE_NOT_FOUND)`
+    );
+  }
+  fs.rmSync(tmp, { recursive: true, force: true });
+});
diff --git a/tests/unit/build/check-complexity-rule-count.test.ts b/tests/unit/build/check-complexity-rule-count.test.ts
new file mode 100644
index 0000000000..8d155bb9f0
--- /dev/null
+++ b/tests/unit/build/check-complexity-rule-count.test.ts
@@ -0,0 +1,30 @@
+/**
+ * Locks that complexity vs cognitive counts stay isolated when sharing one ESLint report.
+ * Existence reason: merging tree walks must NOT change either ratchet baseline semantics.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import {
+  countCognitiveViolations,
+  countComplexityViolations,
+} from "../../../scripts/check/complexityEslintReport.mjs";
+
+test("countComplexityViolations ignores cognitive-complexity messages", () => {
+  const report = [
+    {
+      messages: [
+        { ruleId: "complexity" },
+        { ruleId: "max-lines-per-function" },
+        { ruleId: "sonarjs/cognitive-complexity" },
+        { ruleId: "sonarjs/cognitive-complexity" },
+      ],
+    },
+  ];
+  assert.equal(countComplexityViolations(report), 2);
+  assert.equal(countCognitiveViolations(report), 2);
+});
+
+test("empty report → 0 for both counters", () => {
+  assert.equal(countComplexityViolations([]), 0);
+  assert.equal(countCognitiveViolations([]), 0);
+});
diff --git a/tests/unit/build/electron-release-latest-yml.repro.test.ts b/tests/unit/build/electron-release-latest-yml.repro.test.ts
new file mode 100644
index 0000000000..2aca6cbd02
--- /dev/null
+++ b/tests/unit/build/electron-release-latest-yml.repro.test.ts
@@ -0,0 +1,78 @@
+// Repro probe for issue #6766: "Auto-update failed: Cannot find latest.yml in the
+// latest release artifacts".
+//
+// electron-updater (used by electron/main.js via autoUpdater) fetches
+// latest.yml / latest-mac.yml / latest-linux.yml from the GitHub Release assets
+// to discover + verify the newest version. electron-builder generates those
+// files alongside the installers in electron/dist-electron/, but the release
+// workflow's "Collect installers" step only copies platform installer
+// extensions (*.exe, *.dmg, *.AppImage, *.deb) into release-assets/ — never
+// the *.yml manifests — so they never reach the GitHub Release, and
+// electron-updater fails with exactly the reported error.
+//
+// This test statically inspects .github/workflows/electron-release.yml and
+// proves the "Collect installers" step stages the yml manifests, and
+// that the "Create Release" files: list references them too.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const WORKFLOW_PATH = path.resolve(
+  __dirname,
+  "../../../.github/workflows/electron-release.yml"
+);
+
+function readWorkflow(): string {
+  return fs.readFileSync(WORKFLOW_PATH, "utf8");
+}
+
+function extractStep(yaml: string, stepName: string): string {
+  const stepHeaderRe = new RegExp(`- name: ${stepName}\\n([\\s\\S]*?)(?=\\n\\s{6}- name:|\\n  [a-zA-Z_-]+:\\n)`);
+  const m = yaml.match(stepHeaderRe);
+  assert.ok(m, `could not locate step "${stepName}" in ${WORKFLOW_PATH}`);
+  return m![1];
+}
+
+test("electron-release.yml: 'Collect installers' step stages latest*.yml manifests for electron-updater", () => {
+  const yaml = readWorkflow();
+  const collectStep = extractStep(yaml, "Collect installers");
+
+  // electron-builder writes latest.yml (win), latest-mac.yml, latest-linux.yml
+  // next to the installers in electron/dist-electron/. Without staging them
+  // into release-assets/, the GitHub Release never gets latest.yml and
+  // electron-updater's autoUpdater fails with:
+  //   "Cannot find latest.yml in the latest release artifacts"
+  const stagesYmlManifests =
+    /\*\.yml/.test(collectStep) || /latest.*\.yml/.test(collectStep);
+
+  assert.ok(
+    stagesYmlManifests,
+    "BUG REPRODUCED: 'Collect installers' step does not copy *.yml (latest.yml / " +
+      "latest-mac.yml / latest-linux.yml) from electron/dist-electron/ into " +
+      "release-assets/, so electron-updater cannot find latest.yml in the " +
+      "published GitHub Release (issue #6766).\n\nActual step body:\n" +
+      collectStep
+  );
+});
+
+test("electron-release.yml: 'Create Release' files: list publishes the *.yml update manifests", () => {
+  const yaml = readWorkflow();
+  const createReleaseIdx = yaml.indexOf("name: Create Release");
+  assert.ok(createReleaseIdx !== -1, "could not locate 'Create Release' step");
+  const filesBlockIdx = yaml.indexOf("files: |", createReleaseIdx);
+  assert.ok(filesBlockIdx !== -1, "could not locate files: block in 'Create Release' step");
+  const nextStepOrEnvIdx = yaml.indexOf("\n        env:", filesBlockIdx);
+  const filesBlock = yaml.slice(filesBlockIdx, nextStepOrEnvIdx === -1 ? undefined : nextStepOrEnvIdx);
+
+  assert.ok(
+    /release-assets\/\*\.yml/.test(filesBlock),
+    "BUG REPRODUCED: 'Create Release' files: glob list does not include " +
+      "release-assets/*.yml, so even if the manifests were staged they would " +
+      "not be attached to the GitHub Release (issue #6766).\n\nActual files: block:\n" +
+      filesBlock
+  );
+});
diff --git a/tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts b/tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts
new file mode 100644
index 0000000000..ab382c6a83
--- /dev/null
+++ b/tests/unit/build/mcp-bundle-no-eager-ioredis.test.ts
@@ -0,0 +1,67 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+// #6559 — `omniroute --mcp` crashed at Node ESM link time with
+// ERR_MODULE_NOT_FOUND for 'ioredis'.
+//
+// Root cause: src/shared/utils/rateLimiter.ts had a top-level static
+// `import Redis from "ioredis"`. esbuild's `--packages=external` bundling of
+// the MCP server (scripts/build/prepublish.ts Step 8.5) hoists that into a
+// real top-level ESM import in the bundled output, even though rateLimiter.ts
+// is only ever reached via a dynamic `await import(...)` several call-sites
+// deep. `ioredis` is not guaranteed to ship in the MCP-only bundle's
+// node_modules, so the eager import can crash at link time before any
+// `--mcp` startup code runs.
+//
+// This test reproduces the exact bundling step used at publish time and
+// asserts the compiled output never contains a top-level static `ioredis`
+// import — it must stay a lazy `await import("ioredis")`, matching the
+// established soft-dependency pattern in src/lib/quota/redisQuotaStore.ts.
+
+const repoRoot = process.cwd();
+
+test("MCP server bundle has no top-level static import of ioredis", () => {
+  const outDir = mkdtempSync(join(tmpdir(), "mcp-bundle-ioredis-"));
+  const outFile = join(outDir, "server.js");
+
+  try {
+    execFileSync(
+      "npx",
+      [
+        "esbuild",
+        "open-sse/mcp-server/server.ts",
+        "--bundle",
+        "--platform=node",
+        "--packages=external",
+        "--format=esm",
+        `--outfile=${outFile}`,
+      ],
+      { cwd: repoRoot, stdio: "pipe" }
+    );
+
+    const bundled = readFileSync(outFile, "utf8");
+
+    // A static/hoisted ESM import resolves at module-link time and would
+    // crash the MCP server before startup if ioredis isn't in dist/node_modules.
+    assert.doesNotMatch(
+      bundled,
+      /^import\s+.*["']ioredis["'];?\s*$/m,
+      "MCP bundle must not eagerly (statically) import 'ioredis' at the top level — " +
+        "it must stay a lazy `await import(\"ioredis\")` (see src/lib/quota/redisQuotaStore.ts)"
+    );
+
+    // The lazy dynamic import from redisQuotaStore.ts must still be present —
+    // proves the assertion above isn't vacuously true (e.g. ioredis missing entirely).
+    assert.match(
+      bundled,
+      /await import\(\s*["']ioredis["']\s*\)/,
+      "expected the existing lazy dynamic import of ioredis to remain in the bundle"
+    );
+  } finally {
+    rmSync(outDir, { recursive: true, force: true });
+  }
+});
diff --git a/tests/unit/case-collision-6584.test.ts b/tests/unit/case-collision-6584.test.ts
new file mode 100644
index 0000000000..b3c3931785
--- /dev/null
+++ b/tests/unit/case-collision-6584.test.ts
@@ -0,0 +1,78 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+// Regression guard for issue #6584: webpack (OMNIROUTE_USE_TURBOPACK=0) build breaks on
+// case-insensitive filesystems (macOS APFS default, Windows) because two source
+// files in the same directory differ only by casing:
+//   src/app/(dashboard)/dashboard/playground/components/ReasoningControls.tsx
+//   src/app/(dashboard)/dashboard/playground/components/reasoningControls.ts
+// On a case-sensitive FS (Linux, this sandbox) both files resolve fine, so this
+// test does not literally reproduce the webpack warning/build error. Instead it
+// encodes the same-directory case-collision root cause as a filesystem-level
+// invariant check that fails deterministically on ANY OS: two distinct files
+// whose relative path is identical after lower-casing (stem, ignoring extension,
+// since extensionless imports are what collide) must not coexist in the same
+// directory tree.
+
+const ROOT = path.resolve(__dirname, "..", "..");
+const SCAN_DIRS = ["src", "open-sse"];
+const EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx"]);
+const IGNORE_DIR_NAMES = new Set(["node_modules", ".next", "dist", "build", ".git"]);
+
+function walk(dir: string, out: string[]): void {
+  const entries = fs.readdirSync(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (IGNORE_DIR_NAMES.has(entry.name)) continue;
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      walk(full, out);
+    } else if (EXTENSIONS.has(path.extname(entry.name))) {
+      out.push(full);
+    }
+  }
+}
+
+test("#6584: no two source files in the same directory differ only by casing", () => {
+  const files: string[] = [];
+  for (const d of SCAN_DIRS) {
+    const abs = path.join(ROOT, d);
+    if (fs.existsSync(abs)) walk(abs, files);
+  }
+
+  // Group by (directory, lower-cased basename WITHOUT extension). Extensionless
+  // imports (e.g. `from "./reasoningControls"`) are resolved by webpack/Node's
+  // module resolver trying several extensions; on a case-insensitive filesystem
+  // that resolution collapses "ReasoningControls.tsx" and "reasoningControls.ts"
+  // into the same candidate, so the stem — not the full filename — is what must
+  // stay unique per directory regardless of extension.
+  const byDirLowerStem = new Map<string, string[]>();
+  for (const f of files) {
+    const dir = path.dirname(f);
+    const ext = path.extname(f);
+    const stem = path.basename(f, ext);
+    const lowerStem = stem.toLowerCase();
+    const key = `${dir}::${lowerStem}`;
+    const arr = byDirLowerStem.get(key) ?? [];
+    arr.push(f);
+    byDirLowerStem.set(key, arr);
+  }
+
+  const collisions: string[][] = [];
+  for (const arr of byDirLowerStem.values()) {
+    const distinctStems = new Set(arr.map((f) => path.basename(f, path.extname(f))));
+    if (distinctStems.size > 1) {
+      collisions.push(arr);
+    }
+  }
+
+  assert.deepEqual(
+    collisions,
+    [],
+    `Found case-only filename collisions (breaks webpack builds on case-insensitive filesystems): ${JSON.stringify(collisions, null, 2)}`
+  );
+});
diff --git a/tests/unit/catalog-updates-v3829-kimi-qwen.test.ts b/tests/unit/catalog-updates-v3829-kimi-qwen.test.ts
index 5e40d43196..badf1a0fe7 100644
--- a/tests/unit/catalog-updates-v3829-kimi-qwen.test.ts
+++ b/tests/unit/catalog-updates-v3829-kimi-qwen.test.ts
@@ -66,12 +66,12 @@ test("PROVIDER_MODELS_CONFIG contains a qwen-web entry (issue #3931 bug #3)", ()
   );
 });
 
-test("qwen-web PROVIDER_MODELS_CONFIG entry targets chat.qwen.ai/api/v2/models", () => {
+test("qwen-web PROVIDER_MODELS_CONFIG entry targets chat.qwen.ai/api/v2/models/", () => {
   const src = fs.readFileSync(CONFIG_FILE, "utf-8");
   assert.match(
     src,
-    /chat\.qwen\.ai\/api\/v2\/models/,
-    "qwen-web discovery URL must be https://chat.qwen.ai/api/v2/models"
+    /chat\.qwen\.ai\/api\/v2\/models\//,
+    "qwen-web discovery URL must be https://chat.qwen.ai/api/v2/models/"
   );
 });
 
diff --git a/tests/unit/changelog-fragments.test.ts b/tests/unit/changelog-fragments.test.ts
new file mode 100644
index 0000000000..6be69c0a4d
--- /dev/null
+++ b/tests/unit/changelog-fragments.test.ts
@@ -0,0 +1,184 @@
+// Guards the changelog FRAGMENTS pipeline (changelog.d/ → CHANGELOG.md), adopted
+// 2026-07-09 to kill the CHANGELOG-eat / DIRTY merge-storm cascade: a PR adds ONE new
+// file under changelog.d/<section>/ instead of editing CHANGELOG.md, so sibling PRs
+// never conflict. Covers the aggregator (scripts/release/aggregate-changelog.mjs) and
+// the fragment validation wired into the merge-integrity gate
+// (scripts/check/check-changelog-integrity.mjs::findInvalidFragments).
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const { SECTIONS, validateFragmentText, collectFragments, insertBullets, aggregate } =
+  await import("../../scripts/release/aggregate-changelog.mjs");
+const { findInvalidFragments } = await import("../../scripts/check/check-changelog-integrity.mjs");
+
+const CHANGELOG_FIXTURE = `# Changelog
+
+## [Unreleased]
+
+## [3.8.47] — TBD
+
+_Living section — bullets land here as PRs merge._
+
+### ✨ New Features
+
+- **existing feature**: already here (#1 — thanks @a)
+
+### 🐛 Bug Fixes
+
+- **fix(x):** existing fix (#2 — thanks @b)
+
+### 📝 Maintenance
+
+- chore: existing maintenance (#3)
+
+## [3.8.46] - 2026-07-04
+
+### ✨ New Features
+
+- **old feature**: shipped (#0)
+`;
+
+function makeRoot({ fragments = {} } = {}) {
+  const root = mkdtempSync(join(tmpdir(), "chfrag-"));
+  writeFileSync(join(root, "CHANGELOG.md"), CHANGELOG_FIXTURE);
+  mkdirSync(join(root, "changelog.d"), { recursive: true });
+  for (const [rel, text] of Object.entries(fragments)) {
+    const abs = join(root, "changelog.d", rel);
+    mkdirSync(join(abs, ".."), { recursive: true });
+    writeFileSync(abs, text);
+  }
+  return root;
+}
+
+test("validateFragmentText accepts a bullet and rejects garbage", () => {
+  assert.equal(validateFragmentText("- **fix:** ok (#9 — thanks @x)"), null);
+  assert.equal(validateFragmentText("- multi\n  continuation line"), null);
+  assert.match(validateFragmentText(""), /empty/);
+  assert.match(validateFragmentText("not a bullet"), /must start/);
+  assert.match(validateFragmentText("- ok\n<<<<<<< HEAD"), /conflict markers/);
+});
+
+test("collectFragments reads sections sorted and flags invalid files", () => {
+  const root = makeRoot({
+    fragments: {
+      "fixes/6700-b.md": "- fix B (#6700)",
+      "fixes/6496-a.md": "- fix A (#6496)",
+      "features/6728-chaos.md": "- feat chaos (#6728)",
+      "features/bad.md": "no bullet here",
+    },
+  });
+  const c = collectFragments(root);
+  assert.deepEqual(
+    c.fixes.map((f) => f.text),
+    ["- fix A (#6496)", "- fix B (#6700)"]
+  );
+  assert.equal(c.features.length, 1);
+  assert.equal(c.invalid.length, 1);
+  assert.match(c.invalid[0].file, /bad\.md/);
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("insertBullets appends at the END of each living section", () => {
+  const out = insertBullets(CHANGELOG_FIXTURE, {
+    features: [{ text: "- NEW feature bullet (#10)" }],
+    fixes: [{ text: "- NEW fix bullet (#11)" }],
+    maintenance: [{ text: "- NEW maintenance bullet (#12)" }],
+  });
+  const lines = out.split("\n");
+  const featIdx = lines.indexOf("- NEW feature bullet (#10)");
+  const bugHeadIdx = lines.indexOf("### 🐛 Bug Fixes");
+  const fixIdx = lines.indexOf("- NEW fix bullet (#11)");
+  const maintHeadIdx = lines.indexOf("### 📝 Maintenance");
+  const maintIdx = lines.indexOf("- NEW maintenance bullet (#12)");
+  // Each new bullet lands after its own existing bullets, before the next heading.
+  assert.ok(featIdx > lines.indexOf("- **existing feature**: already here (#1 — thanks @a)"));
+  assert.ok(featIdx < bugHeadIdx, "feature bullet must stay inside the features section");
+  assert.ok(fixIdx > bugHeadIdx && fixIdx < maintHeadIdx);
+  assert.ok(maintIdx > maintHeadIdx && maintIdx < lines.indexOf("## [3.8.46] - 2026-07-04"));
+  // Only the FIRST (living) occurrence of a heading is touched — the shipped 3.8.46
+  // section is byte-identical.
+  assert.ok(out.includes("## [3.8.46] - 2026-07-04\n\n### ✨ New Features\n\n- **old feature**: shipped (#0)"));
+  // No existing bullet lost.
+  for (const existing of ["#1 — thanks @a", "existing fix (#2", "existing maintenance (#3"]) {
+    assert.ok(out.includes(existing));
+  }
+});
+
+test("insertBullets throws when a needed heading is missing", () => {
+  const noMaint = CHANGELOG_FIXTURE.replace("### 📝 Maintenance\n\n- chore: existing maintenance (#3)\n", "");
+  assert.throws(
+    () => insertBullets(noMaint, { maintenance: [{ text: "- x" }] }),
+    /📝 Maintenance.*not found/s
+  );
+});
+
+test("aggregate dry-run touches nothing; real run writes and deletes fragments", () => {
+  const root = makeRoot({
+    fragments: { "fixes/6800-real.md": "- real aggregated fix (#6800 — thanks @c)" },
+  });
+  const dry = aggregate({ root, dryRun: true });
+  assert.equal(dry.total, 1);
+  assert.ok(!readFileSync(join(root, "CHANGELOG.md"), "utf8").includes("#6800"));
+  assert.ok(existsSync(join(root, "changelog.d/fixes/6800-real.md")));
+
+  const real = aggregate({ root });
+  assert.equal(real.total, 1);
+  const after = readFileSync(join(root, "CHANGELOG.md"), "utf8");
+  assert.ok(after.includes("- real aggregated fix (#6800 — thanks @c)"));
+  assert.ok(!existsSync(join(root, "changelog.d/fixes/6800-real.md")), "fragment must be deleted");
+
+  // Idempotence: nothing left → second run is a no-op.
+  const again = aggregate({ root });
+  assert.equal(again.total, 0);
+  assert.equal(readFileSync(join(root, "CHANGELOG.md"), "utf8"), after);
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("aggregate refuses invalid fragments loudly", () => {
+  const root = makeRoot({ fragments: { "features/oops.md": "forgot the dash" } });
+  assert.throws(() => aggregate({ root }), /invalid changelog fragments/);
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("gate findInvalidFragments: clean tree passes, bad placement/content fail", () => {
+  const clean = makeRoot({ fragments: { "maintenance/1-ok.md": "- ok (#1)" } });
+  assert.deepEqual(findInvalidFragments(clean), []);
+  rmSync(clean, { recursive: true, force: true });
+
+  const dirty = makeRoot({
+    fragments: {
+      "stray.md": "- misplaced at root",
+      "unknown-section/2-x.md": "- wrong dir",
+      "fixes/3-bad.md": "missing dash",
+    },
+  });
+  const invalid = findInvalidFragments(dirty);
+  const files = invalid.map((i) => i.file).sort();
+  assert.equal(invalid.length, 3);
+  assert.ok(files.some((f) => f.includes("stray.md")));
+  assert.ok(files.some((f) => f.includes("unknown-section")));
+  assert.ok(files.some((f) => f.includes("3-bad.md")));
+  rmSync(dirty, { recursive: true, force: true });
+});
+
+test("gate skips README.md and .gitkeep; absent changelog.d is fine", () => {
+  const root = makeRoot();
+  writeFileSync(join(root, "changelog.d/README.md"), "# docs, not a fragment");
+  mkdirSync(join(root, "changelog.d/fixes"), { recursive: true });
+  writeFileSync(join(root, "changelog.d/fixes/.gitkeep"), "");
+  assert.deepEqual(findInvalidFragments(root), []);
+  rmSync(root, { recursive: true, force: true });
+
+  const bare = mkdtempSync(join(tmpdir(), "chfrag-bare-"));
+  assert.deepEqual(findInvalidFragments(bare), []);
+  rmSync(bare, { recursive: true, force: true });
+});
+
+test("SECTIONS maps every dir to a real living-section heading in the fixture", () => {
+  for (const heading of Object.values(SECTIONS)) {
+    assert.ok(CHANGELOG_FIXTURE.includes(heading), `fixture must contain ${heading}`);
+  }
+});
diff --git a/tests/unit/chaos-api-routes.test.ts b/tests/unit/chaos-api-routes.test.ts
new file mode 100644
index 0000000000..650ad2ed59
--- /dev/null
+++ b/tests/unit/chaos-api-routes.test.ts
@@ -0,0 +1,320 @@
+/**
+ * Unit tests for the 3 Chaos Mode API routes:
+ *   - GET/PUT/DELETE /api/chaos/config       (management-session auth)
+ *   - POST           /api/chaos/run          (management-session auth)
+ *   - POST           /api/skills/collect/chaos (external Bearer-token auth)
+ *
+ * Covers auth, Zod validation, and the "Chaos Mode disabled" 400 short-circuit
+ * per Hard Rule #18 / the #6679 review checklist. Upstream model dispatch is
+ * stubbed via chaosExecutor's `chatDispatch` mock point (see chaos-executor.test.ts)
+ * so these tests never hit a real provider.
+ */
+import test, { mock } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-chaos-routes-"));
+const ORIGINAL_DATA_DIR = process.env.DATA_DIR;
+const ORIGINAL_API_KEY_SECRET = process.env.API_KEY_SECRET;
+const ORIGINAL_INITIAL_PASSWORD = process.env.INITIAL_PASSWORD;
+
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = process.env.API_KEY_SECRET ?? "chaos-routes-test-secret";
+
+const core = await import("../../src/lib/db/core.ts");
+const apiKeysDb = await import("../../src/lib/db/apiKeys.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const chaosConfig = await import("../../src/lib/chaos/chaosConfig.ts");
+const chaosExecutor = await import("../../src/lib/chaos/chaosExecutor.ts");
+
+const configRoute = await import("../../src/app/api/chaos/config/route.ts");
+const runRoute = await import("../../src/app/api/chaos/run/route.ts");
+const skillsChaosRoute = await import("../../src/app/api/skills/collect/chaos/route.ts");
+
+async function resetStorage() {
+  core.resetDbInstance();
+  apiKeysDb.resetApiKeyState();
+  // The DB is about to be wiped out from under it — drop the in-memory chaos
+  // config cache too, or getChaosConfig() keeps serving a stale value (e.g. a
+  // prior test's `enabled: true`) after resetDbInstance() below.
+  chaosConfig.invalidateChaosConfigCache();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+  delete process.env.INITIAL_PASSWORD;
+}
+
+function makeRequest(method: string, url: string, body?: unknown, headers: Record<string, string> = {}) {
+  return new Request(url, {
+    method,
+    headers: {
+      ...(body !== undefined ? { "content-type": "application/json" } : {}),
+      ...headers,
+    },
+    body: body !== undefined ? JSON.stringify(body) : undefined,
+  });
+}
+
+function jsonResponse(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.afterEach(() => {
+  mock.restoreAll();
+});
+
+test.after(() => {
+  core.resetDbInstance();
+  apiKeysDb.resetApiKeyState();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+
+  if (ORIGINAL_DATA_DIR === undefined) {
+    delete process.env.DATA_DIR;
+  } else {
+    process.env.DATA_DIR = ORIGINAL_DATA_DIR;
+  }
+  if (ORIGINAL_API_KEY_SECRET === undefined) {
+    delete process.env.API_KEY_SECRET;
+  } else {
+    process.env.API_KEY_SECRET = ORIGINAL_API_KEY_SECRET;
+  }
+  if (ORIGINAL_INITIAL_PASSWORD === undefined) {
+    delete process.env.INITIAL_PASSWORD;
+  } else {
+    process.env.INITIAL_PASSWORD = ORIGINAL_INITIAL_PASSWORD;
+  }
+});
+
+// ═════════════════════════════════════════════════════════════════════════════
+// GET/PUT/DELETE /api/chaos/config
+// ═════════════════════════════════════════════════════════════════════════════
+
+test("GET /api/chaos/config — requires management auth when a password is configured", async () => {
+  process.env.INITIAL_PASSWORD = "chaos-config-requires-login";
+
+  const res = await configRoute.GET(makeRequest("GET", "http://localhost/api/chaos/config"));
+  assert.ok(res.status === 401 || res.status === 403, `expected 401/403, got ${res.status}`);
+
+  const body = (await res.json()) as { error: { message: string } | string };
+  const errorMsg = typeof body.error === "string" ? body.error : body.error.message;
+  assert.ok(!errorMsg.includes("at /"), "Hard Rule #12: no stack trace exposure");
+});
+
+test("GET /api/chaos/config — returns defaults, PUT updates, DELETE resets", async () => {
+  const getRes = await configRoute.GET(makeRequest("GET", "http://localhost/api/chaos/config"));
+  assert.equal(getRes.status, 200);
+  const getBody = (await getRes.json()) as { config: typeof chaosConfig.DEFAULT_CHAOS_CONFIG };
+  // JSON.stringify drops keys whose value is `undefined` (systemPrompt), so compare
+  // against the JSON round-tripped shape rather than the raw in-memory default.
+  assert.deepEqual(
+    getBody.config,
+    JSON.parse(JSON.stringify(chaosConfig.DEFAULT_CHAOS_CONFIG))
+  );
+
+  const putRes = await configRoute.PUT(
+    makeRequest("PUT", "http://localhost/api/chaos/config", {
+      enabled: true,
+      defaultMode: "collaborative",
+      providerOverrides: [],
+      timeoutMs: 60_000,
+      maxTokens: 8192,
+    })
+  );
+  assert.equal(putRes.status, 200);
+  const putBody = (await putRes.json()) as { config: { enabled: boolean; defaultMode: string } };
+  assert.equal(putBody.config.enabled, true);
+  assert.equal(putBody.config.defaultMode, "collaborative");
+
+  const deleteRes = await configRoute.DELETE(
+    makeRequest("DELETE", "http://localhost/api/chaos/config")
+  );
+  assert.equal(deleteRes.status, 200);
+  const deleteBody = (await deleteRes.json()) as { config: typeof chaosConfig.DEFAULT_CHAOS_CONFIG };
+  // Same JSON.stringify undefined-key drop as the GET assertion above.
+  assert.deepEqual(
+    deleteBody.config,
+    JSON.parse(JSON.stringify(chaosConfig.DEFAULT_CHAOS_CONFIG))
+  );
+});
+
+test("PUT /api/chaos/config — 400 on schema validation failure", async () => {
+  const res = await configRoute.PUT(
+    makeRequest("PUT", "http://localhost/api/chaos/config", {
+      enabled: true,
+      defaultMode: "not-a-real-mode",
+    })
+  );
+  assert.equal(res.status, 400);
+});
+
+// ═════════════════════════════════════════════════════════════════════════════
+// POST /api/chaos/run
+// ═════════════════════════════════════════════════════════════════════════════
+
+test("POST /api/chaos/run — requires management auth when a password is configured", async () => {
+  process.env.INITIAL_PASSWORD = "chaos-run-requires-login";
+
+  const res = await runRoute.POST(
+    makeRequest("POST", "http://localhost/api/chaos/run", { task: "hello" })
+  );
+  assert.ok(res.status === 401 || res.status === 403, `expected 401/403, got ${res.status}`);
+});
+
+test("POST /api/chaos/run — 400 when Chaos Mode is not enabled globally", async () => {
+  const res = await runRoute.POST(
+    makeRequest("POST", "http://localhost/api/chaos/run", { task: "hello" })
+  );
+  assert.equal(res.status, 400);
+  const body = (await res.json()) as { error: { message: string } };
+  assert.match(body.error.message, /not enabled/i);
+});
+
+test("POST /api/chaos/run — 400 on invalid body (missing task)", async () => {
+  await chaosConfig.setChaosConfig({
+    enabled: true,
+    defaultMode: "parallel",
+    providerOverrides: [],
+    timeoutMs: 120_000,
+    maxTokens: 4096,
+  });
+
+  const res = await runRoute.POST(makeRequest("POST", "http://localhost/api/chaos/run", {}));
+  assert.equal(res.status, 400);
+});
+
+test("POST /api/chaos/run — 200 happy path dispatches without an Authorization header (dashboard/local mode)", async () => {
+  await chaosConfig.setChaosConfig({
+    enabled: true,
+    defaultMode: "parallel",
+    providerOverrides: [],
+    timeoutMs: 120_000,
+    maxTokens: 4096,
+  });
+  await providersDb.createProviderConnection({
+    provider: "openai",
+    authType: "apikey",
+    name: "Run Route Provider",
+    apiKey: "sk-run-route",
+    defaultModel: "gpt-4o-mini",
+  });
+
+  let capturedAuth: string | null | undefined;
+  mock.method(chaosExecutor.chatDispatch, "postChatCompletion", async (req: Request) => {
+    capturedAuth = req.headers.get("Authorization");
+    return jsonResponse({ choices: [{ message: { content: "dashboard result" } }] });
+  });
+
+  const res = await runRoute.POST(
+    makeRequest("POST", "http://localhost/api/chaos/run", { task: "Summarize" })
+  );
+  assert.equal(res.status, 200);
+  const body = (await res.json()) as { models: { status: string; content: string }[] };
+  assert.equal(body.models[0].status, "success");
+  assert.equal(body.models[0].content, "dashboard result");
+  assert.equal(capturedAuth, null);
+});
+
+// ═════════════════════════════════════════════════════════════════════════════
+// POST /api/skills/collect/chaos
+// ═════════════════════════════════════════════════════════════════════════════
+
+test("POST /api/skills/collect/chaos — 401 without an Authorization header", async () => {
+  const res = await skillsChaosRoute.POST(
+    makeRequest("POST", "http://localhost/api/skills/collect/chaos", { task: "hello" })
+  );
+  assert.equal(res.status, 401);
+});
+
+test("POST /api/skills/collect/chaos — 403 with an invalid API key", async () => {
+  const res = await skillsChaosRoute.POST(
+    makeRequest(
+      "POST",
+      "http://localhost/api/skills/collect/chaos",
+      { task: "hello" },
+      { Authorization: "Bearer sk-does-not-exist" }
+    )
+  );
+  assert.equal(res.status, 403);
+});
+
+test("POST /api/skills/collect/chaos — 403 when the API key does not have chaosModeEnabled", async () => {
+  const created = await apiKeysDb.createApiKey("No Chaos Key", "machine-chaos-01");
+
+  const res = await skillsChaosRoute.POST(
+    makeRequest(
+      "POST",
+      "http://localhost/api/skills/collect/chaos",
+      { task: "hello" },
+      { Authorization: `Bearer ${created.key}` }
+    )
+  );
+  assert.equal(res.status, 403);
+  const body = (await res.json()) as { error: { message: string } };
+  assert.match(body.error.message, /Chaos Mode is not enabled for this API key/);
+});
+
+test("POST /api/skills/collect/chaos — 400 when Chaos Mode is disabled globally even with a valid key", async () => {
+  const created = await apiKeysDb.createApiKey("Chaos Key", "machine-chaos-02");
+  await apiKeysDb.updateApiKeyPermissions(created.id, { chaosModeEnabled: true });
+  apiKeysDb.clearApiKeyCaches();
+
+  const res = await skillsChaosRoute.POST(
+    makeRequest(
+      "POST",
+      "http://localhost/api/skills/collect/chaos",
+      { task: "hello" },
+      { Authorization: `Bearer ${created.key}` }
+    )
+  );
+  assert.equal(res.status, 400);
+});
+
+test("POST /api/skills/collect/chaos — 200 happy path forwards the caller's key to the in-process dispatch", async () => {
+  await chaosConfig.setChaosConfig({
+    enabled: true,
+    defaultMode: "parallel",
+    providerOverrides: [],
+    timeoutMs: 120_000,
+    maxTokens: 4096,
+  });
+  await providersDb.createProviderConnection({
+    provider: "openai",
+    authType: "apikey",
+    name: "Skills Route Provider",
+    apiKey: "sk-skills-route",
+    defaultModel: "gpt-4o-mini",
+  });
+
+  const created = await apiKeysDb.createApiKey("Chaos Key External", "machine-chaos-03");
+  await apiKeysDb.updateApiKeyPermissions(created.id, { chaosModeEnabled: true });
+  apiKeysDb.clearApiKeyCaches();
+
+  let capturedAuth: string | null | undefined;
+  mock.method(chaosExecutor.chatDispatch, "postChatCompletion", async (req: Request) => {
+    capturedAuth = req.headers.get("Authorization");
+    return jsonResponse({ choices: [{ message: { content: "external result" } }] });
+  });
+
+  const res = await skillsChaosRoute.POST(
+    makeRequest(
+      "POST",
+      "http://localhost/api/skills/collect/chaos",
+      { task: "Summarize" },
+      { Authorization: `Bearer ${created.key}` }
+    )
+  );
+
+  assert.equal(res.status, 200);
+  const body = (await res.json()) as { models: { status: string; content: string }[] };
+  assert.equal(body.models[0].status, "success");
+  assert.equal(body.models[0].content, "external result");
+  assert.equal(capturedAuth, `Bearer ${created.key}`);
+});
diff --git a/tests/unit/chaos-config.test.ts b/tests/unit/chaos-config.test.ts
new file mode 100644
index 0000000000..3f37e7a406
--- /dev/null
+++ b/tests/unit/chaos-config.test.ts
@@ -0,0 +1,126 @@
+/**
+ * Unit tests for src/lib/chaos/chaosConfig.ts
+ *
+ * Regression coverage for #6679: the original PR queried `SELECT/INSERT/DELETE
+ * ... FROM settings ...` against a table that was never created in this schema
+ * (only `key_value` exists) — every read silently fell back to
+ * DEFAULT_CHAOS_CONFIG and every write/reset threw at runtime. This module now
+ * routes persistence through src/lib/db/settings.ts::getSettings/updateSettings
+ * (the `key_value` table, namespace 'settings'), matching the repo convention
+ * (CLAUDE.md → Database: never write raw SQL outside src/lib/db/).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-chaos-config-"));
+const ORIGINAL_DATA_DIR = process.env.DATA_DIR;
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const chaosConfig = await import("../../src/lib/chaos/chaosConfig.ts");
+
+async function resetStorage() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  if (ORIGINAL_DATA_DIR === undefined) {
+    delete process.env.DATA_DIR;
+  } else {
+    process.env.DATA_DIR = ORIGINAL_DATA_DIR;
+  }
+});
+
+test("getChaosConfig returns DEFAULT_CHAOS_CONFIG when nothing is persisted yet", async () => {
+  const config = await chaosConfig.getChaosConfig();
+  assert.deepEqual(config, chaosConfig.DEFAULT_CHAOS_CONFIG);
+});
+
+test("setChaosConfig persists via the settings store and getChaosConfig reads it back", async () => {
+  const settingsDb = await import("../../src/lib/db/settings.ts");
+
+  const written = await chaosConfig.setChaosConfig({
+    enabled: true,
+    defaultMode: "collaborative",
+    providerOverrides: [{ providerId: "openai", modelId: "gpt-4o", enabled: true }],
+    systemPrompt: "Custom prompt",
+    timeoutMs: 60_000,
+    maxTokens: 8192,
+  });
+
+  assert.equal(written.enabled, true);
+  assert.equal(written.defaultMode, "collaborative");
+
+  const readBack = await chaosConfig.getChaosConfig();
+  assert.deepEqual(readBack, written);
+
+  // Confirms the write actually lands in key_value (namespace 'settings'), not a
+  // nonexistent `settings` table (the bug this fix replaces).
+  const rawSettings = await settingsDb.getSettings();
+  assert.equal((rawSettings as Record<string, unknown>).chaosModeConfig !== undefined, true);
+});
+
+test("setChaosConfig rejects invalid config (Zod parse, not raw SQL failure)", async () => {
+  const invalidConfig = {
+    enabled: true,
+    defaultMode: "not-a-real-mode",
+    providerOverrides: [],
+    timeoutMs: 60_000,
+    maxTokens: 4096,
+  } as unknown as Awaited<ReturnType<typeof chaosConfig.getChaosConfig>>;
+
+  await assert.rejects(() => chaosConfig.setChaosConfig(invalidConfig));
+});
+
+test("resetChaosConfig clears the stored config back to defaults", async () => {
+  await chaosConfig.setChaosConfig({
+    enabled: true,
+    defaultMode: "parallel",
+    providerOverrides: [],
+    timeoutMs: 90_000,
+    maxTokens: 2048,
+  });
+  assert.equal((await chaosConfig.getChaosConfig()).enabled, true);
+
+  const reset = await chaosConfig.resetChaosConfig();
+  assert.deepEqual(reset, chaosConfig.DEFAULT_CHAOS_CONFIG);
+  assert.deepEqual(await chaosConfig.getChaosConfig(), chaosConfig.DEFAULT_CHAOS_CONFIG);
+});
+
+test("getChaosConfig falls back to defaults when the stored payload fails schema validation", async () => {
+  const settingsDb = await import("../../src/lib/db/settings.ts");
+
+  await settingsDb.updateSettings({
+    chaosModeConfig: { enabled: "not-a-boolean", defaultMode: "parallel" },
+  });
+
+  const config = await chaosConfig.getChaosConfig();
+  assert.deepEqual(config, chaosConfig.DEFAULT_CHAOS_CONFIG);
+});
+
+test("in-memory cache is invalidated on write so config updates are visible immediately", async () => {
+  const first = await chaosConfig.getChaosConfig();
+  assert.equal(first.enabled, false);
+
+  await chaosConfig.setChaosConfig({
+    enabled: true,
+    defaultMode: "parallel",
+    providerOverrides: [],
+    timeoutMs: 120_000,
+    maxTokens: 4096,
+  });
+
+  const second = await chaosConfig.getChaosConfig();
+  assert.equal(second.enabled, true);
+});
diff --git a/tests/unit/chaos-executor.test.ts b/tests/unit/chaos-executor.test.ts
new file mode 100644
index 0000000000..b67bf0bad5
--- /dev/null
+++ b/tests/unit/chaos-executor.test.ts
@@ -0,0 +1,243 @@
+/**
+ * Unit tests for src/lib/chaos/chaosExecutor.ts
+ *
+ * Regression coverage for #6679: the original PR dispatched to models via a real
+ * network fetch() to `${OMNIROUTE_INTERNAL_URL || "http://localhost:30129"}` —
+ * 30129 is the author's personal dev port, not the project's default port 20128,
+ * so Chaos Mode silently failed on any standard install. This now dispatches
+ * in-process via the established synthetic-Request/route-handler pattern (see
+ * src/lib/batches/dispatch.ts, src/lib/evals/runtime.ts) — no network hop, no
+ * port dependency. `chatDispatch.postChatCompletion` is mocked here (same
+ * technique tests/unit/batch-processor.test.ts uses for dispatch.ts) so these
+ * tests never hit a real upstream provider.
+ */
+import test, { mock } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-chaos-executor-"));
+const ORIGINAL_DATA_DIR = process.env.DATA_DIR;
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const chaosConfig = await import("../../src/lib/chaos/chaosConfig.ts");
+const chaosExecutor = await import("../../src/lib/chaos/chaosExecutor.ts");
+
+async function resetStorage() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.afterEach(() => {
+  mock.restoreAll();
+});
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  if (ORIGINAL_DATA_DIR === undefined) {
+    delete process.env.DATA_DIR;
+  } else {
+    process.env.DATA_DIR = ORIGINAL_DATA_DIR;
+  }
+});
+
+function jsonResponse(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+test("executeChaosRun throws when no active provider connections exist", async () => {
+  await assert.rejects(
+    () => chaosExecutor.executeChaosRun({ task: "hello" }),
+    /No active provider connections found/
+  );
+});
+
+test("executeChaosRun dispatches in-process (no fetch/network call) and returns per-provider results", async () => {
+  await providersDb.createProviderConnection({
+    provider: "openai",
+    authType: "apikey",
+    name: "Test OpenAI",
+    apiKey: "sk-test-openai",
+    defaultModel: "gpt-4o-mini",
+  });
+
+  let capturedRequest: Request | null = null;
+  mock.method(chaosExecutor.chatDispatch, "postChatCompletion", async (req: Request) => {
+    capturedRequest = req;
+    return jsonResponse({ choices: [{ message: { content: "hello from openai" } }] });
+  });
+
+  const result = await chaosExecutor.executeChaosRun({ task: "Summarize this repo" });
+
+  assert.equal(result.mode, "parallel");
+  assert.equal(result.totalProviders, 1);
+  assert.equal(result.models.length, 1);
+  assert.equal(result.models[0].status, "success");
+  assert.equal(result.models[0].content, "hello from openai");
+
+  assert.ok(capturedRequest, "postChatCompletion should have been invoked in-process");
+  assert.equal(
+    (capturedRequest as unknown as Request).url,
+    "http://localhost/api/v1/chat/completions"
+  );
+});
+
+test("executeChaosRun forwards the caller's apiKey as a Bearer Authorization header", async () => {
+  await providersDb.createProviderConnection({
+    provider: "anthropic",
+    authType: "apikey",
+    name: "Test Anthropic",
+    apiKey: "sk-test-anthropic",
+    defaultModel: "claude-3-5-sonnet",
+  });
+
+  let capturedAuth: string | null = null;
+  mock.method(chaosExecutor.chatDispatch, "postChatCompletion", async (req: Request) => {
+    capturedAuth = req.headers.get("Authorization");
+    return jsonResponse({ choices: [{ message: { content: "ok" } }] });
+  });
+
+  await chaosExecutor.executeChaosRun({ task: "task", apiKey: "sk-caller-key" });
+
+  assert.equal(capturedAuth, "Bearer sk-caller-key");
+});
+
+test("executeChaosRun omits Authorization header when no apiKey is provided (dashboard/local mode)", async () => {
+  await providersDb.createProviderConnection({
+    provider: "openai",
+    authType: "apikey",
+    name: "Test OpenAI",
+    apiKey: "sk-test-openai-2",
+    defaultModel: "gpt-4o-mini",
+  });
+
+  let capturedAuth: string | null | undefined;
+  mock.method(chaosExecutor.chatDispatch, "postChatCompletion", async (req: Request) => {
+    capturedAuth = req.headers.get("Authorization");
+    return jsonResponse({ choices: [{ message: { content: "ok" } }] });
+  });
+
+  await chaosExecutor.executeChaosRun({ task: "task" });
+
+  assert.equal(capturedAuth, null);
+});
+
+test("executeChaosRun surfaces upstream errors per-model instead of throwing", async () => {
+  await providersDb.createProviderConnection({
+    provider: "openai",
+    authType: "apikey",
+    name: "Failing OpenAI",
+    apiKey: "sk-test-failing",
+    defaultModel: "gpt-4o-mini",
+  });
+
+  mock.method(chaosExecutor.chatDispatch, "postChatCompletion", async () =>
+    jsonResponse({ error: "upstream exploded" }, 502)
+  );
+
+  const result = await chaosExecutor.executeChaosRun({ task: "task" });
+
+  assert.equal(result.models[0].status, "error");
+  assert.match(result.models[0].error ?? "", /API 502/);
+});
+
+test("executeChaosRun collaborative mode chains context between sequential model calls", async () => {
+  await providersDb.createProviderConnection({
+    provider: "openai",
+    authType: "apikey",
+    name: "Model A",
+    apiKey: "sk-test-a",
+    defaultModel: "gpt-4o-mini",
+  });
+  await providersDb.createProviderConnection({
+    provider: "anthropic",
+    authType: "apikey",
+    name: "Model B",
+    apiKey: "sk-test-b",
+    defaultModel: "claude-3-5-sonnet",
+  });
+
+  const seenUserMessages: string[] = [];
+  mock.method(chaosExecutor.chatDispatch, "postChatCompletion", async (req: Request) => {
+    const body = (await req.json()) as { messages: { role: string; content: string }[] };
+    const userMessage = body.messages.find((m) => m.role === "user");
+    seenUserMessages.push(userMessage?.content ?? "");
+    return jsonResponse({
+      choices: [{ message: { content: `reply-${seenUserMessages.length}` } }],
+    });
+  });
+
+  const result = await chaosExecutor.executeChaosRun({
+    task: "Original task",
+    mode: "collaborative",
+  });
+
+  assert.equal(result.mode, "collaborative");
+  assert.equal(result.models.length, 2);
+  assert.equal(seenUserMessages[0], "Original task");
+  assert.match(seenUserMessages[1], /Previous model's output:\nreply-1/);
+  assert.ok(result.summary && result.summary.includes("reply-2"));
+});
+
+test("executeChaosRun respects an explicit providers filter and errors when none match", async () => {
+  await providersDb.createProviderConnection({
+    provider: "openai",
+    authType: "apikey",
+    name: "Only OpenAI",
+    apiKey: "sk-test-only-openai",
+    defaultModel: "gpt-4o-mini",
+  });
+
+  mock.method(chaosExecutor.chatDispatch, "postChatCompletion", async () =>
+    jsonResponse({ choices: [{ message: { content: "ok" } }] })
+  );
+
+  await assert.rejects(
+    () => chaosExecutor.executeChaosRun({ task: "task", providers: ["anthropic"] }),
+    /None of the specified providers are active/
+  );
+
+  const result = await chaosExecutor.executeChaosRun({ task: "task", providers: ["openai"] });
+  assert.equal(result.models.length, 1);
+});
+
+test("executeChaosRun applies global config provider overrides for model resolution", async () => {
+  await providersDb.createProviderConnection({
+    provider: "openai",
+    authType: "apikey",
+    name: "Override target",
+    apiKey: "sk-test-override",
+    defaultModel: "gpt-4o-mini",
+  });
+
+  await chaosConfig.setChaosConfig({
+    enabled: true,
+    defaultMode: "parallel",
+    providerOverrides: [{ providerId: "openai", modelId: "gpt-4-turbo", enabled: true }],
+    timeoutMs: 120_000,
+    maxTokens: 4096,
+  });
+
+  let capturedModel: string | undefined;
+  mock.method(chaosExecutor.chatDispatch, "postChatCompletion", async (req: Request) => {
+    const body = (await req.json()) as { model: string };
+    capturedModel = body.model;
+    return jsonResponse({ choices: [{ message: { content: "ok" } }] });
+  });
+
+  await chaosExecutor.executeChaosRun({ task: "task" });
+
+  assert.equal(capturedModel, "gpt-4-turbo");
+});
diff --git a/tests/unit/chat-content-type-6414.test.ts b/tests/unit/chat-content-type-6414.test.ts
new file mode 100644
index 0000000000..aa49986024
--- /dev/null
+++ b/tests/unit/chat-content-type-6414.test.ts
@@ -0,0 +1,89 @@
+// #6414: POST /v1/chat/completions (and /v1/messages) must return HTTP 415
+// `unsupported_media_type` when the Content-Type header is not application/json,
+// matching OpenAI's reference API and RFC 7231 §6.5.13. Previously OmniRoute
+// silently parsed such requests as JSON via `.clone().json().catch(() => null)`
+// and let them reach the provider-lookup layer, where they surfaced as misleading
+// `model_not_found` / generic errors instead of a boundary 415.
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { requireJsonContentType } = await import(
+  "../../src/shared/middleware/requireJsonContentType.ts"
+);
+
+function makeRequest(method: string, contentType: string | null): Request {
+  const headers = new Headers();
+  if (contentType !== null) headers.set("content-type", contentType);
+  return new Request("http://localhost/v1/chat/completions", {
+    method,
+    headers,
+    body: method === "GET" || method === "HEAD" ? undefined : "{}",
+  });
+}
+
+test("returns 415 for text/plain on POST", async () => {
+  const rejection = requireJsonContentType(makeRequest("POST", "text/plain"));
+  assert.ok(rejection, "expected a rejection Response");
+  assert.equal(rejection.status, 415);
+  const body = await rejection.json();
+  assert.equal(body.error.code, "unsupported_media_type");
+  assert.equal(body.error.type, "invalid_request_error");
+});
+
+test("returns 415 when Content-Type header is missing on POST", async () => {
+  const rejection = requireJsonContentType(makeRequest("POST", null));
+  assert.ok(rejection, "missing content-type must be rejected");
+  assert.equal(rejection.status, 415);
+});
+
+test("returns 415 for application/x-www-form-urlencoded on POST", async () => {
+  const rejection = requireJsonContentType(
+    makeRequest("POST", "application/x-www-form-urlencoded")
+  );
+  assert.ok(rejection);
+  assert.equal(rejection.status, 415);
+});
+
+test("admits application/json", () => {
+  assert.equal(requireJsonContentType(makeRequest("POST", "application/json")), null);
+});
+
+test("admits application/json with charset suffix", () => {
+  assert.equal(
+    requireJsonContentType(makeRequest("POST", "application/json; charset=utf-8")),
+    null
+  );
+});
+
+test("admits Application/JSON (case-insensitive)", () => {
+  assert.equal(requireJsonContentType(makeRequest("POST", "Application/JSON")), null);
+});
+
+test("admits application/json with leading whitespace", () => {
+  assert.equal(requireJsonContentType(makeRequest("POST", "  application/json")), null);
+});
+
+test("does not touch GET requests (no body → nothing to reject)", () => {
+  assert.equal(requireJsonContentType(makeRequest("GET", "text/plain")), null);
+});
+
+test("does not touch OPTIONS preflight", () => {
+  assert.equal(requireJsonContentType(makeRequest("OPTIONS", null)), null);
+});
+
+test("guards PUT and PATCH the same as POST", () => {
+  const putRejection = requireJsonContentType(makeRequest("PUT", "text/plain"));
+  assert.ok(putRejection);
+  assert.equal(putRejection.status, 415);
+
+  const patchRejection = requireJsonContentType(makeRequest("PATCH", "text/plain"));
+  assert.ok(patchRejection);
+  assert.equal(patchRejection.status, 415);
+});
+
+test("rejection carries CORS + JSON headers", () => {
+  const rejection = requireJsonContentType(makeRequest("POST", "text/plain"));
+  assert.ok(rejection);
+  assert.equal(rejection.headers.get("Content-Type"), "application/json");
+  assert.ok(rejection.headers.get("Access-Control-Allow-Methods"));
+});
diff --git a/tests/unit/chat-context-relay.test.ts b/tests/unit/chat-context-relay.test.ts
index a5c0d1f5a2..e9c766a699 100644
--- a/tests/unit/chat-context-relay.test.ts
+++ b/tests/unit/chat-context-relay.test.ts
@@ -9,7 +9,7 @@ const { BaseExecutor, buildRequest, combosDb, handleChat, resetStorage, waitFor,
 const providersDb = await import("../../src/lib/db/providers.ts");
 const handoffDb = await import("../../src/lib/db/contextHandoffs.ts");
 
-function buildResponsesResponse(text = "ok", model = "gpt-5.4") {
+function buildResponsesResponse(text = "ok", model = "gpt-5.6-sol") {
   return new Response(
     JSON.stringify({
       id: "resp_context_relay",
@@ -112,7 +112,7 @@ test("handleChat generates and injects context-relay handoffs across Codex accou
       handoffThreshold: 0.85,
       maxMessagesForSummary: 12,
     },
-    models: ["codex/gpt-5.4"],
+    models: ["codex/gpt-5.6-sol"],
   });
 
   const upstreamBodies = [];
@@ -142,12 +142,12 @@ test("handleChat generates and injects context-relay handoffs across Codex accou
           taskProgress: "Runtime and UI are wired; tests are next",
           activeEntities: ["open-sse/services/combo.ts", "src/sse/handlers/chat.ts"],
         }),
-        "gpt-5.4"
+        "gpt-5.6-sol"
       );
     }
 
     upstreamBodies.push({ body, serializedBody });
-    return buildResponsesResponse("relay-success", "gpt-5.4");
+    return buildResponsesResponse("relay-success", "gpt-5.6-sol");
   };
 
   const firstResponse = await handleChat(
@@ -226,7 +226,7 @@ test("handleChat injects context-relay handoffs during live failover for Respons
       handoffThreshold: 0.85,
       maxMessagesForSummary: 12,
     },
-    models: ["codex/gpt-5.4"],
+    models: ["codex/gpt-5.6-sol"],
   });
 
   const upstreamBodies = [];
@@ -255,7 +255,7 @@ test("handleChat injects context-relay handoffs during live failover for Respons
           taskProgress: "Continue after the first account is exhausted",
           activeEntities: ["src/sse/handlers/chat.ts", "open-sse/services/contextHandoff.ts"],
         }),
-        "gpt-5.4"
+        "gpt-5.6-sol"
       );
     }
 
@@ -271,7 +271,7 @@ test("handleChat injects context-relay handoffs during live failover for Respons
       }
     }
 
-    return buildResponsesResponse("relay-success", "gpt-5.4");
+    return buildResponsesResponse("relay-success", "gpt-5.6-sol");
   };
 
   const firstResponse = await handleChat(
@@ -331,9 +331,7 @@ test("handleChat injects context-relay handoffs during live failover for Respons
   assert.equal(secondResponse.status, 200);
 
   const relayedSecondaryCall = upstreamBodies.find(
-    (call) =>
-      call.authHeader === "Bearer token-b" &&
-      typeof call.body.instructions === "string"
+    (call) => call.authHeader === "Bearer token-b" && typeof call.body.instructions === "string"
   );
 
   assert.ok(relayedSecondaryCall, "secondary account should receive a request after primary 429");
diff --git a/tests/unit/chat-messages-validation-6402.test.ts b/tests/unit/chat-messages-validation-6402.test.ts
new file mode 100644
index 0000000000..4b58f5d4ec
--- /dev/null
+++ b/tests/unit/chat-messages-validation-6402.test.ts
@@ -0,0 +1,124 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { createChatPipelineHarness } from "../integration/_chatPipelineHarness.ts";
+
+// Regression tests for #6402 — schema-invalid `messages` fields fell through
+// the existing empty-array guard and reached model resolution, where an
+// unresolvable model surfaced as a misleading 404 `model_not_found` from
+// chatHelpers.ts (`No active credentials for provider: <p>`).
+//
+// The guard at src/sse/handlers/chat.ts now rejects three additional cases with
+// a clear OmniRoute-level 400 before any routing or upstream call:
+//   - present-but-null messages
+//   - present-but-non-array messages (number, string, object)
+//   - missing messages when the Responses-API `input` discriminator is also
+//     absent.
+
+const harness = await createChatPipelineHarness("chat-messages-validation-6402");
+const { handleChat, buildRequest, resetStorage, seedConnection } = harness;
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(async () => {
+  await harness.cleanup();
+});
+
+test("#6402: messages: null is rejected with a clear 400 before model resolution", async () => {
+  await seedConnection("anthropic", { apiKey: "sk-ant" });
+
+  let upstreamCalled = false;
+  globalThis.fetch = async () => {
+    upstreamCalled = true;
+    return new Response("{}", { status: 200, headers: { "content-type": "application/json" } });
+  };
+
+  const response = await handleChat(
+    buildRequest({
+      body: {
+        model: "anthropic/claude-haiku-4-5",
+        messages: null,
+      },
+    })
+  );
+
+  assert.equal(response.status, 400, "null messages must be a 400, not a 404 model_not_found");
+  const body = (await response.json()) as { error?: { message?: string } };
+  assert.match(body.error?.message ?? "", /messages.*Expected array/i);
+  assert.equal(upstreamCalled, false, "must not forward a null-messages request upstream");
+});
+
+test("#6402: messages: <number> is rejected with a clear 400 before model resolution", async () => {
+  await seedConnection("anthropic", { apiKey: "sk-ant" });
+
+  let upstreamCalled = false;
+  globalThis.fetch = async () => {
+    upstreamCalled = true;
+    return new Response("{}", { status: 200, headers: { "content-type": "application/json" } });
+  };
+
+  const response = await handleChat(
+    buildRequest({
+      body: {
+        model: "anthropic/claude-haiku-4-5",
+        messages: 123 as unknown as [],
+      },
+    })
+  );
+
+  assert.equal(response.status, 400, "non-array messages must be a 400, not a 404 model_not_found");
+  const body = (await response.json()) as { error?: { message?: string } };
+  assert.match(body.error?.message ?? "", /messages.*Expected array/i);
+  assert.equal(upstreamCalled, false, "must not forward a non-array-messages request upstream");
+});
+
+test("#6402: missing messages (and no Responses-API input) is rejected with a clear 400", async () => {
+  await seedConnection("anthropic", { apiKey: "sk-ant" });
+
+  let upstreamCalled = false;
+  globalThis.fetch = async () => {
+    upstreamCalled = true;
+    return new Response("{}", { status: 200, headers: { "content-type": "application/json" } });
+  };
+
+  const response = await handleChat(
+    buildRequest({
+      body: {
+        model: "anthropic/claude-haiku-4-5",
+      },
+    })
+  );
+
+  assert.equal(response.status, 400, "missing messages must be a 400, not a 404 model_not_found");
+  const body = (await response.json()) as { error?: { message?: string } };
+  assert.match(body.error?.message ?? "", /messages.*Expected array/i);
+  assert.equal(upstreamCalled, false, "must not forward a missing-messages request upstream");
+});
+
+test("#6402: Responses-API input passes the guard (messages discriminator preserved)", async () => {
+  await seedConnection("openai", { apiKey: "sk-openai" });
+
+  const response = await handleChat(
+    buildRequest({
+      url: "http://localhost/v1/responses",
+      body: {
+        model: "openai/gpt-4.1",
+        input: [{ role: "user", content: "Hello" }],
+      },
+    })
+  );
+
+  // The guard must not fire for Responses-API requests; whatever downstream
+  // status this produces (200, 404, etc.), it MUST NOT be the guard's
+  // "messages: Expected array" 400.
+  if (response.status === 400) {
+    const body = (await response.json()) as { error?: { message?: string } };
+    assert.doesNotMatch(
+      body.error?.message ?? "",
+      /messages.*Expected array/i,
+      "Responses-API request must not be caught by the messages guard"
+    );
+  }
+});
diff --git a/tests/unit/chat-rejects-image-only-model.test.ts b/tests/unit/chat-rejects-image-only-model.test.ts
new file mode 100644
index 0000000000..a485544290
--- /dev/null
+++ b/tests/unit/chat-rejects-image-only-model.test.ts
@@ -0,0 +1,93 @@
+// #6457: /v1/chat/completions must reject image-only models with a clear 400 pointing
+// callers at /v1/images/generations, instead of forwarding to a chat upstream that
+// returns a confusing raw provider 400 (HuggingFace: "not a chat model").
+//
+// Discriminator: getImageModelEntry(modelStr) — non-null only for models registered
+// in open-sse/config/imageRegistry.ts. Chat-only models (openai/gpt-4o etc.) return
+// null and pass the guard unchanged.
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { createChatPipelineHarness } from "../integration/_chatPipelineHarness.ts";
+
+const harness = await createChatPipelineHarness("chat-rejects-image-only-model");
+const { buildRequest, handleChat, resetStorage } = harness as {
+  buildRequest: (opts: { body: unknown }) => Request;
+  handleChat: (req: Request) => Promise<Response>;
+  resetStorage: () => void | Promise<void>;
+};
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(() => {
+  harness.cleanup?.();
+});
+
+test("POST /v1/chat/completions with a HuggingFace image model returns 400 + generations hint (#6457)", async () => {
+  const request = buildRequest({
+    body: {
+      model: "huggingface/stabilityai/stable-diffusion-xl-base-1.0",
+      messages: [{ role: "user", content: "draw a cat" }],
+    },
+  });
+
+  const originalFetch = globalThis.fetch;
+  let fetchCalls = 0;
+  globalThis.fetch = async (...args: Parameters<typeof originalFetch>) => {
+    fetchCalls++;
+    return originalFetch(...args);
+  };
+
+  try {
+    const res = await handleChat(request);
+    assert.equal(res.status, 400, "must reject with 400 before dispatch");
+    const body = (await res.json()) as { error?: { message?: string } };
+    const msg = body?.error?.message || JSON.stringify(body);
+    assert.match(msg, /image-generation model/i);
+    assert.match(msg, /\/v1\/images\/generations/);
+    assert.equal(fetchCalls, 0, "must not dispatch upstream for an image-only model");
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("POST /v1/chat/completions with a chat model still reaches routing (guard is invisible)", async () => {
+  const request = buildRequest({
+    body: {
+      model: "openai/gpt-4o",
+      messages: [{ role: "user", content: "hi" }],
+    },
+  });
+
+  const res = await handleChat(request);
+  // The guard must not fire on a chat model — the response is whatever downstream
+  // routing produces (typically a credentials/connection error in the harness).
+  // The critical assertion is: it is NOT the image-guard 400.
+  if (res.status === 400) {
+    const body = (await res.json()) as { error?: { message?: string } };
+    const msg = body?.error?.message || JSON.stringify(body);
+    assert.doesNotMatch(msg, /image-generation model/i, "chat model must not trip the image guard");
+  }
+});
+
+test("POST /v1/chat/completions allows a model registered for both chat and image generation", async () => {
+  const request = buildRequest({
+    body: {
+      model: "codex/gpt-5.6-sol",
+      messages: [{ role: "user", content: "hi" }],
+    },
+  });
+
+  const res = await handleChat(request);
+  if (res.status === 400) {
+    const body = (await res.json()) as { error?: { message?: string } };
+    const msg = body?.error?.message || JSON.stringify(body);
+    assert.doesNotMatch(
+      msg,
+      /image-generation model/i,
+      "a model present in the chat catalog must not trip the image-only guard"
+    );
+  }
+});
diff --git a/tests/unit/chat-route-coverage.test.ts b/tests/unit/chat-route-coverage.test.ts
index 6accc32901..e249e5247a 100644
--- a/tests/unit/chat-route-coverage.test.ts
+++ b/tests/unit/chat-route-coverage.test.ts
@@ -444,7 +444,10 @@ test("handleChat uses the emergency fallback model on budget exhaustion", async
   assert.equal(seenBodies.length, 2);
   assert.equal(seenBodies[1].model, "openai/gpt-oss-120b");
   assert.equal(seenBodies[1].max_tokens, 4096);
-  assert.equal(seenBodies[1].max_completion_tokens, 4096);
+  // nvidia supports the legacy `max_tokens` field (#6912 symmetric normalization in
+  // chatCore.ts), so the redundant `max_completion_tokens` is renamed away rather than
+  // sent alongside it — only one output-token field reaches the upstream request.
+  assert.equal(seenBodies[1].max_completion_tokens, undefined);
   assert.equal(json.choices[0].message.content, "Emergency fallback answered");
 });
 
diff --git a/tests/unit/chatcore-extracted-modules-3821.test.ts b/tests/unit/chatcore-extracted-modules-3821.test.ts
index ab7b8d66fe..009412f98e 100644
--- a/tests/unit/chatcore-extracted-modules-3821.test.ts
+++ b/tests/unit/chatcore-extracted-modules-3821.test.ts
@@ -11,7 +11,10 @@ import test from "node:test";
 import assert from "node:assert/strict";
 
 import { sanitizeChatRequestBody } from "../../open-sse/handlers/chatCore/sanitization.ts";
-import { checkIdempotencyCache } from "../../open-sse/handlers/chatCore/idempotency.ts";
+import {
+  checkIdempotencyCache,
+  composeIdempotencyKey,
+} from "../../open-sse/handlers/chatCore/idempotency.ts";
 import { FORMATS } from "../../open-sse/translator/formats.ts";
 import { saveIdempotency } from "../../src/lib/idempotencyLayer.ts";
 
@@ -74,14 +77,32 @@ test("checkIdempotencyCache returns { hit:null, idempotencyKey } on a miss", asy
     log: undefined,
   });
   assert.equal(result.hit, null);
-  assert.equal(result.idempotencyKey, "idem-miss-3821");
+  // #6558: the raw header key is now namespaced by provider/model + a messages
+  // digest (composeIdempotencyKey) so fusion panel/judge sub-requests can't collide.
+  assert.equal(
+    result.idempotencyKey,
+    composeIdempotencyKey({
+      rawKey: "idem-miss-3821",
+      provider: "openai",
+      model: "gpt-4.1",
+      messages: undefined,
+    })
+  );
 });
 
 test("checkIdempotencyCache returns a hit Response reusing the same key after a save", async () => {
-  const key = "idem-hit-3821";
+  const rawKey = "idem-hit-3821";
+  // #6558: the store is keyed by the COMPOSED key, so the save site saves under the
+  // same derivation checkIdempotencyCache returns — reproduce that here.
+  const key = composeIdempotencyKey({
+    rawKey,
+    provider: "openai",
+    model: "gpt-4.1",
+    messages: undefined,
+  })!;
   saveIdempotency(key, { object: "chat.completion", choices: [], usage: {} }, 200);
 
-  const headers = new Headers({ "idempotency-key": key });
+  const headers = new Headers({ "idempotency-key": rawKey });
   const result = await checkIdempotencyCache({
     clientRawRequest: { headers },
     provider: "openai",
diff --git a/tests/unit/chatcore-telemetry-helpers.test.ts b/tests/unit/chatcore-telemetry-helpers.test.ts
index a155da8f7c..e7bc72debc 100644
--- a/tests/unit/chatcore-telemetry-helpers.test.ts
+++ b/tests/unit/chatcore-telemetry-helpers.test.ts
@@ -9,9 +9,8 @@ import path from "node:path";
 const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-telemetry-"));
 process.env.DATA_DIR = TEST_DATA_DIR;
 
-const { forwardDashboardEventToLiveWs, maybeSyncClaudeExtraUsageState } = await import(
-  "../../open-sse/handlers/chatCore/telemetryHelpers.ts"
-);
+const { forwardDashboardEventToLiveWs, maybeSyncClaudeExtraUsageState } =
+  await import("../../open-sse/handlers/chatCore/telemetryHelpers.ts");
 const core = await import("../../src/lib/db/core.ts");
 
 const originalFetch = globalThis.fetch;
@@ -48,8 +47,8 @@ test("forwardDashboardEventToLiveWs POSTs event+payload+timestamp as JSON to the
   await forwardDashboardEventToLiveWs("my-event", { foo: "bar" });
   const after = Date.now();
 
-  // Default port is 20129 when LIVE_WS_PORT is unset.
-  assert.equal(capturedUrl, "http://127.0.0.1:20129/__omniroute_event");
+  // Default port is 20132 when LIVE_WS_PORT is unset.
+  assert.equal(capturedUrl, "http://127.0.0.1:20132/__omniroute_event");
   assert.equal(capturedInit?.method, "POST");
   assert.equal(
     (capturedInit?.headers as Record<string, string>)["content-type"],
diff --git a/tests/unit/chatgpt-web-citations-escape.test.ts b/tests/unit/chatgpt-web-citations-escape.test.ts
new file mode 100644
index 0000000000..540183e959
--- /dev/null
+++ b/tests/unit/chatgpt-web-citations-escape.test.ts
@@ -0,0 +1,50 @@
+// ChatGPT-web citation link-text escaping (CodeQL js/incomplete-sanitization,
+// PR #6569 release-blocker).
+//
+// `markdownLinkText()` builds the `[text]` half of a Markdown link from an
+// untrusted citation label. It escaped `[` and `]` but NOT the backslash
+// itself, so a label ending in (or containing) a backslash produced a broken
+// link: e.g. `[Path C:\](url)` — the trailing `\` escapes the closing `]`,
+// consuming the link's bracket. The escape character must be escaped first.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { cleanChatGptText } = await import(
+  "../../open-sse/executors/chatgpt-web/citations.ts"
+);
+
+const S = ""; // marker start
+const SEP = ""; // marker separator
+const E = ""; // marker end
+
+// Build a raw `url` citation marker:  url  <label>  <url> 
+const urlMarker = (label: string, url: string) => `${S}url${SEP}${label}${SEP}${url}${E}`;
+
+test("markdownLinkText escapes a trailing backslash in the citation label", () => {
+  // Label ends in a backslash — without escaping, `[Path C:\](url)` breaks the link.
+  const text = `See ${urlMarker("Path C:\\", "https://example.com/docs")} here`;
+  const out = cleanChatGptText(text);
+  assert.equal(out, "See [Path C:\\\\](https://example.com/docs) here");
+  // The backslash must be doubled (escaped), never left bare before the `]`.
+  assert.doesNotMatch(out, /[^\\]\\\]/);
+});
+
+test("markdownLinkText escapes a backslash preceding a bracket (no bracket leak)", () => {
+  const text = urlMarker("a\\[b", "https://example.com");
+  const out = cleanChatGptText(text);
+  // `\` → `\\`, then `[` → `\[` : label renders as literal `a\[b`.
+  assert.equal(out, "[a\\\\\\[b](https://example.com)");
+});
+
+test("bracket-only labels keep their existing escaping (regression guard)", () => {
+  const text = urlMarker("a[b]c", "https://example.com");
+  const out = cleanChatGptText(text);
+  assert.equal(out, "[a\\[b\\]c](https://example.com)");
+});
+
+test("plain labels with no metacharacters pass through unchanged", () => {
+  const text = urlMarker("Plain Title", "https://example.com");
+  const out = cleanChatGptText(text);
+  assert.equal(out, "[Plain Title](https://example.com)");
+});
diff --git a/tests/unit/chatgpt-web-citations.test.ts b/tests/unit/chatgpt-web-citations.test.ts
new file mode 100644
index 0000000000..9141d2755c
--- /dev/null
+++ b/tests/unit/chatgpt-web-citations.test.ts
@@ -0,0 +1,392 @@
+// ChatGPT-web citation-marker → Markdown link rendering (#6635).
+//
+// content_references metadata (grouped_webpages, sources_footnote, webpage/url
+// mentions) is resolved into real Markdown links instead of raw ChatGPT UI
+// private-use marker tokens (citeturn0search0, entity[...], etc.).
+// These tests live in a dedicated file (chatgpt-web.test.ts is a frozen
+// god-file at the file-size cap and cannot grow) — mirrors the minimal-mock
+// pattern already used by chatgpt-web-tools-5240.test.ts.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { ChatGptWebExecutor, __resetChatGptWebCachesForTesting } = await import(
+  "../../open-sse/executors/chatgpt-web.ts"
+);
+const { __setTlsFetchOverrideForTesting } = await import(
+  "../../open-sse/services/chatgptTlsClient.ts"
+);
+
+// ─── Minimal TLS-fetch mock ──────────────────────────────────────────────────
+// Tailored to the citation flow: root/DPL, session→accessToken, sentinel→token
+// (no PoW), conv→SSE built from the caller-supplied events. Warmup GETs fall
+// through to 404, which the executor tolerates.
+
+function makeHeaders(map: Record<string, string> = {}) {
+  const h = new Headers();
+  for (const [k, v] of Object.entries(map)) h.set(k, String(v));
+  return h;
+}
+
+function sseText(events: unknown[]): string {
+  const chunks: string[] = [];
+  for (const evt of events) {
+    const { __event, ...payload } = evt as Record<string, unknown> & { __event?: string };
+    if (__event) chunks.push(`event: ${__event}\r\n`);
+    chunks.push(`data: ${JSON.stringify(payload)}\r\n\r\n`);
+  }
+  chunks.push("data: [DONE]\r\n\r\n");
+  return chunks.join("");
+}
+
+function installMockFetch({
+  conv,
+  conversationDetail,
+}: {
+  conv: { status: number; events: unknown[] };
+  conversationDetail?: { status: number; body: unknown };
+}) {
+  const calls = { urls: [] as string[], bodies: [] as unknown[], conversationDetail: 0 };
+
+  __setTlsFetchOverrideForTesting(
+    async (url: string, opts: { method?: string; body?: unknown } = {}) => {
+      const u = String(url);
+      calls.urls.push(u);
+      calls.bodies.push(opts.body);
+      const json = (body: unknown, status = 200) => ({
+        status,
+        headers: makeHeaders({ "Content-Type": "application/json" }),
+        text: JSON.stringify(body),
+        body: null,
+      });
+
+      if (
+        (u === "https://chatgpt.com/" || u === "https://chatgpt.com") &&
+        (opts.method || "GET") === "GET"
+      ) {
+        return {
+          status: 200,
+          headers: makeHeaders({ "Content-Type": "text/html" }),
+          text: '<html data-build="prod-test123"><script src="https://cdn.oaistatic.com/_next/static/chunks/main-test.js"></script></html>',
+          body: null,
+        };
+      }
+      if (u.includes("/api/auth/session")) {
+        return json({
+          accessToken: "jwt-abc",
+          expires: new Date(Date.now() + 3600_000).toISOString(),
+          user: { id: "user-1" },
+        });
+      }
+      if (u.includes("/sentinel/chat-requirements")) {
+        return json({ token: "req-token", proofofwork: { required: false } });
+      }
+      // /backend-api/conversation/<id> — detail poll used by GPT-5.5 Pro handoff.
+      if (conversationDetail) {
+        const m1 = u.match(/\/backend-api\/conversation\/([^/?#]+)$/);
+        if (m1) {
+          calls.conversationDetail++;
+          return json(conversationDetail.body, conversationDetail.status);
+        }
+      }
+      if (
+        u.endsWith("/backend-api/f/conversation") ||
+        u.endsWith("/backend-api/conversation") ||
+        /\/backend-api\/(f\/)?conversation\?/.test(u)
+      ) {
+        return {
+          status: conv.status,
+          headers: makeHeaders({ "Content-Type": "text/event-stream" }),
+          text: sseText(conv.events),
+          body: null,
+        };
+      }
+      // Warmup (/me, /conversations, /models) — tolerated.
+      return { status: 404, headers: makeHeaders(), text: "not mocked", body: null };
+    }
+  );
+
+  return {
+    calls,
+    restore() {
+      __setTlsFetchOverrideForTesting(null);
+    },
+  };
+}
+
+test("Non-streaming: resolves ChatGPT web citation markers into markdown links", async () => {
+  __resetChatGptWebCachesForTesting();
+  const urlMarker = "urlTesla";
+  const citationMarker = "citeturn0search0turn0search3";
+  const answerPrefix = `${urlMarker} FSD v14 is rolling out `;
+  const m = installMockFetch({
+    conv: {
+      status: 200,
+      events: [
+        {
+          conversation_id: "c1",
+          message: {
+            id: "m1",
+            author: { role: "assistant" },
+            content: {
+              content_type: "text",
+              parts: [`${answerPrefix}${citationMarker}`],
+            },
+            status: "finished_successfully",
+            metadata: {
+              content_references: [
+                {
+                  type: "webpage",
+                  title: "Tesla",
+                  matched_text: urlMarker,
+                  start_idx: 0,
+                  end_idx: urlMarker.length,
+                  safe_urls: ["https://www.tesla.com/en_au/support/autopilot"],
+                },
+                {
+                  type: "grouped_webpages",
+                  matched_text: citationMarker,
+                  start_idx: answerPrefix.length,
+                  end_idx: answerPrefix.length + citationMarker.length,
+                  items: [
+                    {
+                      title: "Tesla FSD v14 release notes",
+                      url: "https://www.tesla.com/support/fsd-v14?utm_source=chatgpt.com",
+                      attribution: "tesla.com",
+                    },
+                    {
+                      title: "Owner discussion",
+                      url: "https://example.com/owners/fsd-v14",
+                      attribution: "example.com",
+                    },
+                  ],
+                },
+              ],
+            },
+          },
+        },
+      ],
+    },
+  });
+  try {
+    const executor = new ChatGptWebExecutor();
+    const result = await executor.execute({
+      model: "gpt-5.5-pro-extended",
+      body: { messages: [{ role: "user", content: "latest Tesla FSD in Australia" }] },
+      stream: false,
+      credentials: { apiKey: "test" },
+      signal: AbortSignal.timeout(10_000),
+      log: null,
+    });
+
+    assert.equal(result.response.status, 200);
+    const json = await result.response.json();
+    const content = json.choices[0].message.content;
+    assert.match(
+      content,
+      /\[Tesla\]\(https:\/\/www\.tesla\.com\/en_au\/support\/autopilot\) FSD v14 is rolling out/
+    );
+    assert.match(
+      content,
+      /\[1\]\(https:\/\/www\.tesla\.com\/support\/fsd-v14\?utm_source=chatgpt\.com\)/
+    );
+    assert.match(content, /\[2\]\(https:\/\/example\.com\/owners\/fsd-v14\)/);
+    assert.doesNotMatch(content, /|||turn0search/);
+  } finally {
+    m.restore();
+  }
+});
+
+test("Streaming: buffers split ChatGPT citation markers until metadata can link them", async () => {
+  __resetChatGptWebCachesForTesting();
+  const citationMarker = "citeturn0search0turn0search3";
+  const prefix = "Tesla FSD v14 is rolling out ";
+  const m = installMockFetch({
+    conv: {
+      status: 200,
+      events: [
+        {
+          conversation_id: "c1",
+          message: {
+            id: "m1",
+            author: { role: "assistant" },
+            content: { content_type: "text", parts: [prefix] },
+            status: "in_progress",
+          },
+        },
+        {
+          conversation_id: "c1",
+          message: {
+            id: "m1",
+            author: { role: "assistant" },
+            content: { content_type: "text", parts: [prefix + "citeturn0search0"] },
+            status: "in_progress",
+          },
+        },
+        {
+          conversation_id: "c1",
+          message: {
+            id: "m1",
+            author: { role: "assistant" },
+            content: { content_type: "text", parts: [prefix + citationMarker + "."] },
+            status: "finished_successfully",
+            metadata: {
+              content_references: [
+                {
+                  type: "grouped_webpages",
+                  matched_text: citationMarker,
+                  start_idx: prefix.length,
+                  end_idx: prefix.length + citationMarker.length,
+                  items: [
+                    {
+                      title: "Tesla source",
+                      url: "https://www.tesla.com/fsd",
+                      attribution: "tesla.com",
+                    },
+                    {
+                      title: "Owners source",
+                      url: "https://example.com/owners",
+                      attribution: "example.com",
+                    },
+                  ],
+                },
+              ],
+            },
+          },
+        },
+      ],
+    },
+  });
+  try {
+    const executor = new ChatGptWebExecutor();
+    const result = await executor.execute({
+      model: "gpt-5.5-pro-extended",
+      body: {
+        messages: [{ role: "user", content: "latest Tesla FSD in Australia" }],
+        stream: true,
+      },
+      stream: true,
+      credentials: { apiKey: "test" },
+      signal: AbortSignal.timeout(10_000),
+      log: null,
+    });
+
+    assert.equal(result.response.status, 200);
+    const text = await result.response.text();
+    const content = text
+      .split("\n")
+      .filter((l) => l.startsWith("data: ") && l !== "data: [DONE]")
+      .map((l) => {
+        try {
+          return JSON.parse(l.slice(6));
+        } catch {
+          return null;
+        }
+      })
+      .filter((j) => j?.choices?.[0]?.delta?.content)
+      .map((j) => j.choices[0].delta.content)
+      .join("");
+
+    assert.equal(
+      content,
+      "Tesla FSD v14 is rolling out [1](https://www.tesla.com/fsd)[2](https://example.com/owners)."
+    );
+    assert.doesNotMatch(content, /|||turn0search/);
+  } finally {
+    m.restore();
+  }
+});
+
+test("GPT-5.5 Pro non-streaming: stream_handoff polls conversation detail for final answer", async () => {
+  __resetChatGptWebCachesForTesting();
+  const citationMarker = "citeturn0search0";
+  const m = installMockFetch({
+    conv: {
+      status: 200,
+      events: [
+        {
+          conversation_id: "conv-pro",
+          message: {
+            id: "progress-1",
+            author: { role: "assistant" },
+            content: { content_type: "text", parts: ["Working on it…"] },
+            status: "in_progress",
+          },
+        },
+        { __event: "stream_handoff", conversation_id: "conv-pro" },
+      ],
+    },
+    conversationDetail: {
+      status: 200,
+      body: {
+        mapping: {
+          thought: {
+            message: {
+              id: "thought",
+              author: { role: "assistant" },
+              content: { content_type: "thoughts", parts: ["hidden thinking"] },
+              status: "finished_successfully",
+              end_turn: true,
+              create_time: 1,
+              update_time: 1,
+            },
+          },
+          final: {
+            message: {
+              id: "final",
+              author: { role: "assistant" },
+              content: {
+                content_type: "text",
+                parts: [`👉 Final full Pro answer. ${citationMarker}`],
+              },
+              status: "finished_successfully",
+              end_turn: true,
+              create_time: 2,
+              update_time: 2,
+              metadata: {
+                content_references: [
+                  {
+                    type: "grouped_webpages",
+                    matched_text: citationMarker,
+                    start_idx: "👉 Final full Pro answer. ".length,
+                    end_idx: "👉 Final full Pro answer. ".length + citationMarker.length,
+                    items: [
+                      {
+                        title: "Polled Pro source",
+                        url: "https://example.com/pro-source",
+                        attribution: "example.com",
+                      },
+                    ],
+                  },
+                ],
+              },
+            },
+          },
+        },
+      },
+    },
+  });
+  try {
+    const executor = new ChatGptWebExecutor();
+    const result = await executor.execute({
+      model: "gpt-5.5-pro-extended",
+      body: { messages: [{ role: "user", content: "hard problem" }] },
+      stream: false,
+      credentials: { apiKey: "cookie-pro-poll" },
+      signal: AbortSignal.timeout(10_000),
+      log: null,
+    });
+
+    const json = await result.response.json();
+    assert.equal(
+      json.choices[0].message.content,
+      "👉 Final full Pro answer. [1](https://example.com/pro-source)"
+    );
+    assert.equal(m.calls.conversationDetail, 1);
+    const convIdx = m.calls.urls.findIndex((u) => u.endsWith("/backend-api/f/conversation"));
+    const sentBody = JSON.parse(m.calls.bodies[convIdx]);
+    assert.equal(sentBody.history_and_training_disabled, true);
+  } finally {
+    m.restore();
+  }
+});
diff --git a/tests/unit/chatgpt-web-handoff-resume.test.ts b/tests/unit/chatgpt-web-handoff-resume.test.ts
new file mode 100644
index 0000000000..29b549c628
--- /dev/null
+++ b/tests/unit/chatgpt-web-handoff-resume.test.ts
@@ -0,0 +1,260 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import type { TlsFetchOptions } from "../../open-sse/services/chatgptTlsClient.ts";
+
+const { ChatGptWebExecutor, __resetChatGptWebCachesForTesting } =
+  await import("../../open-sse/executors/chatgpt-web.ts");
+const { __setTlsFetchOverrideForTesting } =
+  await import("../../open-sse/services/chatgptTlsClient.ts");
+
+function makeHeaders(values: Record<string, string> = {}): Headers {
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(values)) headers.set(name, value);
+  return headers;
+}
+
+function sseText(events: unknown[]): string {
+  return `${events.map((event) => `data: ${JSON.stringify(event)}\r\n\r\n`).join("")}data: [DONE]\r\n\r\n`;
+}
+
+type ResumeRequest = {
+  body: { conversation_id?: string; offset?: number };
+  headers: Record<string, string>;
+};
+
+function installHandoffMock(
+  finalText: string,
+  options: { firstResumeStatus?: number } = {}
+): {
+  calls: { conversationDetail: number; resume: ResumeRequest[] };
+  restore: () => void;
+} {
+  const calls = {
+    conversationDetail: 0,
+    resume: [] as ResumeRequest[],
+  };
+
+  __setTlsFetchOverrideForTesting(async (url: string, request: TlsFetchOptions = {}) => {
+    const target = String(url);
+    const json = (body: unknown, status = 200) => ({
+      status,
+      headers: makeHeaders({ "Content-Type": "application/json" }),
+      text: JSON.stringify(body),
+      body: null,
+    });
+
+    if (
+      (target === "https://chatgpt.com/" || target === "https://chatgpt.com") &&
+      (request.method ?? "GET") === "GET"
+    ) {
+      return {
+        status: 200,
+        headers: makeHeaders({ "Content-Type": "text/html" }),
+        text: '<html data-build="prod-test"><script src="/_next/static/chunks/main.js"></script></html>',
+        body: null,
+      };
+    }
+
+    if (target.includes("/api/auth/session")) {
+      return json({
+        accessToken: "jwt-test",
+        expires: new Date(Date.now() + 3_600_000).toISOString(),
+        user: { id: "account-test" },
+      });
+    }
+
+    if (target.includes("/sentinel/chat-requirements")) {
+      return json({ token: "requirements-token", proofofwork: { required: false } });
+    }
+
+    if (target.endsWith("/backend-api/f/conversation/resume")) {
+      const body = JSON.parse(request.body ?? "{}") as ResumeRequest["body"];
+      calls.resume.push({ body, headers: request.headers ?? {} });
+      if (options.firstResumeStatus && calls.resume.length === 1) {
+        return {
+          status: options.firstResumeStatus,
+          headers: makeHeaders({ "Content-Type": "text/plain" }),
+          text: "not ready",
+          body: null,
+        };
+      }
+      return {
+        status: 200,
+        headers: makeHeaders({ "Content-Type": "text/event-stream" }),
+        text: sseText([
+          {
+            conversation_id: "conversation-handoff",
+            message: {
+              id: "assistant-final",
+              author: { role: "assistant" },
+              content: { content_type: "text", parts: [finalText] },
+              status: "in_progress",
+            },
+          },
+          {
+            conversation_id: "conversation-handoff",
+            message: {
+              id: "assistant-final",
+              author: { role: "assistant" },
+              content: { content_type: "text", parts: [finalText] },
+              status: "finished_successfully",
+              end_turn: true,
+            },
+          },
+        ]),
+        body: null,
+      };
+    }
+
+    if (target.endsWith("/backend-api/f/conversation")) {
+      return {
+        status: 200,
+        headers: makeHeaders({ "Content-Type": "text/event-stream" }),
+        text: sseText([
+          {
+            type: "resume_conversation_token",
+            token: "resume-token",
+            conversation_id: "conversation-handoff",
+          },
+          {
+            type: "stream_handoff",
+            conversation_id: "conversation-handoff",
+            turn_exchange_id: "turn-handoff",
+            options: [
+              { type: "resume_sse_endpoint", topic_id: "conversation-turn-handoff" },
+              { type: "subscribe_ws_topic", topic_id: "conversation-turn-handoff" },
+            ],
+          },
+        ]),
+        body: null,
+      };
+    }
+
+    if (/\/backend-api\/conversation\/[^/?#]+$/.test(target)) {
+      calls.conversationDetail++;
+      return json(
+        {
+          detail: {
+            message: "You do not have access to this temporary conversation.",
+            code: "conversation_not_found",
+          },
+        },
+        404
+      );
+    }
+
+    // Browser warmup requests are non-fatal, but returning 200 keeps test logs quiet.
+    if (
+      target.includes("/backend-api/me") ||
+      target.includes("/backend-api/conversations?") ||
+      target.includes("/backend-api/models?")
+    ) {
+      return json({});
+    }
+
+    return { status: 404, headers: makeHeaders(), text: "not mocked", body: null };
+  });
+
+  return {
+    calls,
+    restore() {
+      __setTlsFetchOverrideForTesting(null);
+    },
+  };
+}
+
+test("ChatGPT Web Pro models resume Temporary Chat handoffs through native SSE", async (t) => {
+  for (const model of ["gpt-5.6-pro", "gpt-5.5-pro", "gpt-5.5-pro-extended"]) {
+    await t.test(model, async () => {
+      __resetChatGptWebCachesForTesting();
+      const expected = `RESUMED_${model}`;
+      const mock = installHandoffMock(expected);
+      try {
+        const executor = new ChatGptWebExecutor();
+        const result = await executor.execute({
+          model,
+          body: { messages: [{ role: "user", content: "hard problem" }] },
+          stream: false,
+          credentials: { apiKey: `cookie-${model}` },
+          signal: AbortSignal.timeout(20_000),
+          log: null,
+        });
+
+        assert.equal(result.response.status, 200);
+        const response = await result.response.json();
+        assert.equal(response.choices[0].message.content, expected);
+        assert.equal(mock.calls.resume.length, 1);
+        assert.deepEqual(mock.calls.resume[0].body, {
+          conversation_id: "conversation-handoff",
+          offset: 0,
+        });
+        assert.equal(mock.calls.resume[0].headers["x-conduit-token"], "resume-token");
+        assert.equal(mock.calls.conversationDetail, 0);
+      } finally {
+        mock.restore();
+      }
+    });
+  }
+});
+
+test("ChatGPT Web handoff retries the next resume offset after a 404", async () => {
+  __resetChatGptWebCachesForTesting();
+  const mock = installHandoffMock("OFFSET_ONE_OK", { firstResumeStatus: 404 });
+  try {
+    const executor = new ChatGptWebExecutor();
+    const result = await executor.execute({
+      model: "gpt-5.6-pro",
+      body: { messages: [{ role: "user", content: "hard problem" }] },
+      stream: false,
+      credentials: { apiKey: "cookie-offset" },
+      signal: AbortSignal.timeout(20_000),
+      log: null,
+    });
+
+    assert.equal(result.response.status, 200);
+    const response = await result.response.json();
+    assert.equal(response.choices[0].message.content, "OFFSET_ONE_OK");
+    assert.deepEqual(
+      mock.calls.resume.map((call) => call.body.offset),
+      [0, 1]
+    );
+    assert.equal(mock.calls.conversationDetail, 0);
+  } finally {
+    mock.restore();
+  }
+});
+
+test("ChatGPT Web streaming appends the native resumed Pro answer", async () => {
+  __resetChatGptWebCachesForTesting();
+  const mock = installHandoffMock("STREAM_RESUME_OK");
+  try {
+    const executor = new ChatGptWebExecutor();
+    const result = await executor.execute({
+      model: "gpt-5.5-pro-extended",
+      body: { messages: [{ role: "user", content: "hard problem" }], stream: true },
+      stream: true,
+      credentials: { apiKey: "cookie-stream" },
+      signal: AbortSignal.timeout(20_000),
+      log: null,
+    });
+
+    assert.equal(result.response.status, 200);
+    const responseText = await result.response.text();
+    const content = responseText
+      .split("\n")
+      .filter((line) => line.startsWith("data: ") && line !== "data: [DONE]")
+      .map((line) => JSON.parse(line.slice(6)) as Record<string, unknown>)
+      .map((event) => {
+        const choices = event.choices as Array<{ delta?: { content?: string } }> | undefined;
+        return choices?.[0]?.delta?.content ?? "";
+      })
+      .join("");
+
+    assert.equal(content, "STREAM_RESUME_OK");
+    assert.equal(mock.calls.resume.length, 1);
+    assert.equal(mock.calls.conversationDetail, 0);
+  } finally {
+    mock.restore();
+  }
+});
diff --git a/tests/unit/chatgpt-web.test.ts b/tests/unit/chatgpt-web.test.ts
index 7a206e7e5c..cc97ecd69d 100644
--- a/tests/unit/chatgpt-web.test.ts
+++ b/tests/unit/chatgpt-web.test.ts
@@ -1,6 +1,7 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 import { writeFile } from "node:fs/promises";
+import type { TlsFetchOptions } from "../../open-sse/services/chatgptTlsClient.ts";
 
 const { ChatGptWebExecutor, __derivePublicBaseUrlForTesting, __resetChatGptWebCachesForTesting } =
   await import("../../open-sse/executors/chatgpt-web.ts");
@@ -63,6 +64,49 @@ async function withEnv(overrides, fn) {
   }
 }
 
+type MockTlsConfig = {
+  status: number;
+  body?: unknown;
+  setCookie?: string;
+  error?: unknown;
+  events?: unknown[];
+};
+
+type MockFetchOptions = {
+  session?: MockTlsConfig;
+  sentinel?: MockTlsConfig;
+  conv?: MockTlsConfig;
+  dpl?: MockTlsConfig;
+  fileDownload?: MockTlsConfig;
+  attachmentDownload?: MockTlsConfig;
+  conversationDetail?: MockTlsConfig | MockTlsConfig[];
+  signedDownload?: MockTlsConfig;
+  userConfig?: MockTlsConfig;
+  onSession?: (opts: TlsFetchOptions) => void;
+  onSentinel?: (opts: TlsFetchOptions) => void;
+  onConv?: (opts: TlsFetchOptions) => void;
+  onFileDownload?: (opts: TlsFetchOptions, fileId: string) => void;
+  onAttachmentDownload?: (opts: TlsFetchOptions, fileId: string) => void;
+  onUserConfig?: (opts: TlsFetchOptions, url: string) => void;
+};
+
+type MockFetchCalls = {
+  session: number;
+  dpl: number;
+  sentinel: number;
+  conv: number;
+  fileDownload: number;
+  attachmentDownload: number;
+  conversationDetail: number;
+  signedDownload: number;
+  userConfig: number;
+  userConfigUrls: string[];
+  userConfigMethods: string[];
+  urls: string[];
+  headers: Array<Record<string, string> | undefined>;
+  bodies: Array<string | undefined>;
+};
+
 /** Dispatch the TLS-impersonating fetch by URL pathname.
  *  Default: session 200 with accessToken, sentinel 200 no PoW, conv 200 empty stream. */
 function installMockFetch({
@@ -81,8 +125,8 @@ function installMockFetch({
   onFileDownload,
   onAttachmentDownload,
   onUserConfig,
-}: any = {}) {
-  const calls = {
+}: MockFetchOptions = {}) {
+  const calls: MockFetchCalls = {
     session: 0,
     dpl: 0,
     sentinel: 0,
@@ -791,76 +835,6 @@ test("Streaming: cumulative parts are diffed into non-overlapping deltas", async
   }
 });
 
-test("GPT-5.5 Pro non-streaming: stream_handoff polls conversation detail for final answer", async () => {
-  reset();
-  const m = installMockFetch({
-    conv: {
-      status: 200,
-      events: [
-        {
-          conversation_id: "conv-pro",
-          message: {
-            id: "progress-1",
-            author: { role: "assistant" },
-            content: { content_type: "text", parts: ["Working on it…"] },
-            status: "in_progress",
-          },
-        },
-        { __event: "stream_handoff", conversation_id: "conv-pro" },
-      ],
-    },
-    conversationDetail: {
-      status: 200,
-      body: {
-        mapping: {
-          thought: {
-            message: {
-              id: "thought",
-              author: { role: "assistant" },
-              content: { content_type: "thoughts", parts: ["hidden thinking"] },
-              status: "finished_successfully",
-              end_turn: true,
-              create_time: 1,
-              update_time: 1,
-            },
-          },
-          final: {
-            message: {
-              id: "final",
-              author: { role: "assistant" },
-              content: { content_type: "text", parts: ["👉 Final full Pro answer."] },
-              status: "finished_successfully",
-              end_turn: true,
-              create_time: 2,
-              update_time: 2,
-            },
-          },
-        },
-      },
-    },
-  });
-  try {
-    const executor = new ChatGptWebExecutor();
-    const result = await executor.execute({
-      model: "gpt-5.5-pro-extended",
-      body: { messages: [{ role: "user", content: "hard problem" }] },
-      stream: false,
-      credentials: { apiKey: "cookie-pro-poll" },
-      signal: AbortSignal.timeout(10_000),
-      log: null,
-    });
-
-    const json = await result.response.json();
-    assert.equal(json.choices[0].message.content, "👉 Final full Pro answer.");
-    assert.equal(m.calls.conversationDetail, 1);
-    const convIdx = m.calls.urls.findIndex((u) => u.endsWith("/backend-api/f/conversation"));
-    const sentBody = JSON.parse(m.calls.bodies[convIdx]);
-    assert.equal(sentBody.history_and_training_disabled, true);
-  } finally {
-    m.restore();
-  }
-});
-
 test("GPT-5.5 Pro streaming: preserves interim reasoning and appends final polled answer", async () => {
   reset();
   const m = installMockFetch({
@@ -1271,21 +1245,26 @@ test("Provider registry: chatgpt-web exposes the current ChatGPT Web model catal
   assert.equal(entry.authHeader, "cookie");
 
   const ids = (entry.models || []).map((m) => m.id);
-  // Public OmniRoute ids stay in historical dot form even though ChatGPT's
-  // backend routes use dash-form slugs. Retired GPT-5/GPT-5.1 entries should
-  // stay out of this list.
+  // Retired GPT-5.4 and older entries stay out of the advertised catalog.
   assert.deepEqual(ids, [
-    "gpt-5.5-pro",
+    "gpt-5.6-pro",
+    "gpt-5.6-thinking",
     "gpt-5.5-pro-extended",
+    "gpt-5.5-pro",
     "gpt-5.5-thinking",
     "gpt-5.5",
-    "gpt-5.4-pro",
-    "gpt-5.4-thinking",
-    "gpt-5.4-thinking-mini",
-    "gpt-5.3",
-    "gpt-5.3-mini",
     "o3",
   ]);
+  assert.equal(
+    ids.some((id) => id.startsWith("gpt-5.4")),
+    false
+  );
+
+  const { MODEL_MAP } = await import("../../open-sse/executors/chatgpt-web/models.ts");
+  assert.equal(
+    Object.keys(MODEL_MAP).some((id) => id.startsWith("gpt-5.4") || id.startsWith("gpt-5-4")),
+    false
+  );
 });
 
 test("Executor MODEL_MAP: OmniRoute IDs translate to ChatGPT backend slugs", async () => {
@@ -1294,18 +1273,17 @@ test("Executor MODEL_MAP: OmniRoute IDs translate to ChatGPT backend slugs", asy
   try {
     const cases: Array<[string, string]> = [
       // Public catalog ids.
-      ["gpt-5.3", "gpt-5-3"],
+      ["gpt-5.6-pro", "gpt-5-6-pro"],
+      ["gpt-5.6-thinking", "gpt-5-6-thinking"],
       ["gpt-5.5-thinking", "gpt-5-5-thinking"],
-      ["gpt-5.4-thinking-mini", "gpt-5-4-t-mini"],
       ["gpt-5.5", "gpt-5-5"],
       ["gpt-5.5-pro", "gpt-5-5-pro"],
       ["gpt-5.5-pro-extended", "gpt-5-5-pro"],
-      ["gpt-5.4-pro", "gpt-5-4-pro"],
       ["o3", "o3"],
       // Backend dash-form slugs are still accepted for direct provider/model callers.
       ["gpt-5-3", "gpt-5-3"],
       ["gpt-5-5-thinking", "gpt-5-5-thinking"],
-      ["gpt-5-4-t-mini", "gpt-5-4-t-mini"],
+      ["gpt-5-6-pro", "gpt-5-6-pro"],
       ["gpt-5-5-pro", "gpt-5-5-pro"],
       ["gpt-5-5-pro-extended", "gpt-5-5-pro"],
     ];
@@ -1335,15 +1313,12 @@ test("MODEL_MAP drift guard: every advertised catalog id reaches ChatGPT as a ba
   const { getRegistryEntry } = await import("../../open-sse/config/providerRegistry.ts");
   const ids = (getRegistryEntry("chatgpt-web")?.models || []).map((m) => m.id);
   const expectedSlugById: Record<string, string> = {
-    "gpt-5.5-pro": "gpt-5-5-pro",
+    "gpt-5.6-pro": "gpt-5-6-pro",
+    "gpt-5.6-thinking": "gpt-5-6-thinking",
     "gpt-5.5-pro-extended": "gpt-5-5-pro",
+    "gpt-5.5-pro": "gpt-5-5-pro",
     "gpt-5.5-thinking": "gpt-5-5-thinking",
     "gpt-5.5": "gpt-5-5",
-    "gpt-5.4-pro": "gpt-5-4-pro",
-    "gpt-5.4-thinking": "gpt-5-4-thinking",
-    "gpt-5.4-thinking-mini": "gpt-5-4-t-mini",
-    "gpt-5.3": "gpt-5-3",
-    "gpt-5.3-mini": "gpt-5-3-mini",
     o3: "o3",
   };
   const m = installMockFetch();
@@ -1492,7 +1467,7 @@ test("thinking_effort: low/medium → PATCH with standard", async () => {
     try {
       const executor = new ChatGptWebExecutor();
       await executor.execute({
-        model: "gpt-5.4-thinking",
+        model: "gpt-5.6-thinking",
         body: { messages: [{ role: "user", content: "hi" }], reasoning_effort: effort },
         stream: false,
         credentials: { apiKey: `cookie-${effort}` },
@@ -1501,7 +1476,7 @@ test("thinking_effort: low/medium → PATCH with standard", async () => {
       });
       assert.equal(m.calls.userConfig, 1, `effort=${effort} should issue exactly one PATCH`);
       assert.match(m.calls.userConfigUrls[0], /thinking_effort=standard/, `${effort} → standard`);
-      assert.match(m.calls.userConfigUrls[0], /model_slug=gpt-5-4-thinking/);
+      assert.match(m.calls.userConfigUrls[0], /model_slug=gpt-5-6-thinking/);
     } finally {
       m.restore();
     }
@@ -1527,12 +1502,8 @@ test("thinking_effort: instant model never triggers PATCH even with reasoning_ef
   }
 });
 
-test("thinking_effort: bare chatgpt.com slug (e.g. gpt-5-4-t-mini) passed as model still PATCHes", async () => {
-  // Regression: the abbreviated dash-form slug "gpt-5-4-t-mini" doesn't
-  // carry the literal "thinking" substring, and isn't a key in MODEL_MAP
-  // (only its dot-form alias is), so a substring-only check would silently
-  // skip the PATCH for callers that send the chatgpt.com slug directly.
-  for (const bareSlug of ["gpt-5-4-t-mini", "gpt-5-5-thinking", "o3"]) {
+test("thinking_effort: bare chatgpt.com thinking slugs still PATCH", async () => {
+  for (const bareSlug of ["gpt-5-6-thinking", "gpt-5-5-thinking", "o3"]) {
     reset();
     const m = installMockFetch();
     try {
@@ -1585,7 +1556,7 @@ test("thinking_effort: providerSpecificData.thinkingEffort=extended overrides bo
   try {
     const executor = new ChatGptWebExecutor();
     await executor.execute({
-      model: "gpt-5.4-thinking-mini",
+      model: "gpt-5.6-thinking",
       body: {
         messages: [{ role: "user", content: "hi" }],
         reasoning_effort: "low", // would normally map to standard
@@ -1599,7 +1570,7 @@ test("thinking_effort: providerSpecificData.thinkingEffort=extended overrides bo
       log: null,
     });
     assert.equal(m.calls.userConfig, 1);
-    assert.match(m.calls.userConfigUrls[0], /model_slug=gpt-5-4-t-mini/);
+    assert.match(m.calls.userConfigUrls[0], /model_slug=gpt-5-6-thinking/);
     assert.match(m.calls.userConfigUrls[0], /thinking_effort=extended/);
   } finally {
     m.restore();
@@ -1702,12 +1673,12 @@ test("thinking_effort: PATCH failure is non-fatal — conversation request still
   }
 });
 
-test("Image registry: cgpt-web/gpt-5.3-instant routes to ChatGPT Web image handler", async () => {
+test("Image registry: cgpt-web/gpt-5.5 routes to ChatGPT Web image handler", async () => {
   const { parseImageModel, getImageProvider } =
     await import("../../open-sse/config/imageRegistry.ts");
-  const parsed = parseImageModel("cgpt-web/gpt-5.3-instant");
+  const parsed = parseImageModel("cgpt-web/gpt-5.5");
   assert.equal(parsed.provider, "chatgpt-web");
-  assert.equal(parsed.model, "gpt-5.3-instant");
+  assert.equal(parsed.model, "gpt-5.5");
   const provider = getImageProvider(parsed.provider);
   assert.equal(provider.format, "chatgpt-web");
   assert.equal(provider.authHeader, "cookie");
@@ -3050,7 +3021,11 @@ test("Image edit handler: bytes-hash match drives executor with cached conversat
       credentials: { apiKey: "test" },
       log: null,
     });
-    assert.equal(result.success, true, `expected success, got error: ${(result as any).error}`);
+    assert.equal(
+      result.success,
+      true,
+      `expected success, got error: ${(result as { error?: unknown }).error}`
+    );
     const convIdx = m.calls.urls.findIndex((u) => u.endsWith("/backend-api/f/conversation"));
     assert.ok(convIdx >= 0, "conversation request was sent");
     const sentBody = JSON.parse(m.calls.bodies[convIdx]);
@@ -3085,8 +3060,11 @@ test("Image edit handler: no cached match returns 400 (does not silently generat
       log: null,
     });
     assert.equal(result.success, false);
-    assert.equal((result as any).status, 400);
-    assert.match(String((result as any).error), /generated through this OmniRoute instance/);
+    assert.equal((result as { status?: unknown }).status, 400);
+    assert.match(
+      String((result as { error?: unknown }).error),
+      /generated through this OmniRoute instance/
+    );
     assert.equal(m.calls.session, 0, "no upstream calls were attempted");
     assert.equal(m.calls.conv, 0, "no chat-completion was attempted");
   } finally {
@@ -3109,8 +3087,8 @@ test("Image gen handler: n>4 is rejected before any upstream call", async () =>
       log: null,
     });
     assert.equal(result.success, false);
-    assert.equal((result as any).status, 400);
-    assert.match(String((result as any).error), /n=1\.\.4/);
+    assert.equal((result as { status?: unknown }).status, 400);
+    assert.match(String((result as { error?: unknown }).error), /n=1\.\.4/);
     assert.equal(m.calls.session, 0, "no session exchange was attempted");
     assert.equal(m.calls.conv, 0, "no conversation request was attempted");
   } finally {
diff --git a/tests/unit/check-db-rules-classification.test.ts b/tests/unit/check-db-rules-classification.test.ts
index dc1b901a78..ab775e30bf 100644
--- a/tests/unit/check-db-rules-classification.test.ts
+++ b/tests/unit/check-db-rules-classification.test.ts
@@ -121,7 +121,7 @@ test("INTENTIONALLY_INTERNAL is exported from check-db-rules.mjs", () => {
   assert.ok(INTENTIONALLY_INTERNAL.size > 0, "INTENTIONALLY_INTERNAL must not be empty");
 });
 
-test("INTENTIONALLY_INTERNAL contains the expected 33 audited modules", () => {
+test("INTENTIONALLY_INTERNAL contains the expected 35 audited modules", () => {
   const expected = [
     "_rowTypes",
     "accessTokens",
@@ -140,6 +140,7 @@ test("INTENTIONALLY_INTERNAL contains the expected 33 audited modules", () => {
     "healthCheck",
     "jsonMigration",
     "migrationRunner",
+    "modelCapabilityOverrides",
     "notion",
     "obsidian",
     "optimizationSettings",
@@ -147,6 +148,7 @@ test("INTENTIONALLY_INTERNAL contains the expected 33 audited modules", () => {
     "prompts",
     "providerNodeSelect",
     "providerStats",
+    "proxyLatency",
     "recovery",
     "schemaColumns",
     "secrets",
diff --git a/tests/unit/check-test-masking-selfref-6634.test.ts b/tests/unit/check-test-masking-selfref-6634.test.ts
new file mode 100644
index 0000000000..6d91a2e7c2
--- /dev/null
+++ b/tests/unit/check-test-masking-selfref-6634.test.ts
@@ -0,0 +1,84 @@
+/**
+ * Regression test for issue #6634 ("release/v3.8.47 branch not green — nightly
+ * release-green found HARD failures"). The nightly's "Test-masking
+ * (weakened-assert guard)" HARD failure was a SELF-REFERENTIAL false positive:
+ * tests/unit/check-test-masking.test.ts legitimately embeds tautology-pattern
+ * string literals (e.g. `expect(true).toBe(true);`, `assert.equal(1, 1);`) as
+ * FIXTURES to exercise countBareTautologies()/scanBareTautologies() — the same
+ * literal text that the diff-based subcheck (evaluateMasking(), fed by
+ * countTautologies()/countExtendedTautologies()) treated as "new tautologies in
+ * the file itself" because those counters are dumb regex scans of raw source
+ * text, blind to "this is inside a fixture string, not real assertion code".
+ *
+ * scanBareTautologies() already special-cases this exact file
+ * (`if (file.endsWith("check-test-masking.test.ts")) continue;` in
+ * scripts/check/check-test-masking.mjs) for precisely this reason — this test
+ * asserts evaluateMasking() now applies the same exclusion for its diff-based
+ * tautology counters, using the real base(origin/main)/head(HEAD) diff of
+ * tests/unit/check-test-masking.test.ts.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+
+import {
+  countTautologies,
+  countExtendedTautologies,
+  evaluateMasking,
+} from "../../scripts/check/check-test-masking.mjs";
+
+const FILE = "tests/unit/check-test-masking.test.ts";
+
+function git(args: string[]): string {
+  return execFileSync("git", args, { encoding: "utf8" });
+}
+
+test("#6634: check-test-masking.test.ts's own tautology fixtures must not self-flag as weakening", () => {
+  // origin/main predates the #6404 fixtures (countBareTautologies/scanBareTautologies
+  // tests) that legitimately embed tautology-pattern literals as string fixtures.
+  const baseSrc = git(["show", "origin/main:" + FILE]);
+  const headSrc = git(["show", "HEAD:" + FILE]);
+
+  const perFile = [
+    {
+      file: FILE,
+      baseAsserts: 0, // irrelevant to this assertion — only tautology counters matter
+      headAsserts: 0,
+      baseTaut: countTautologies(baseSrc),
+      headTaut: countTautologies(headSrc),
+      baseExtTaut: countExtendedTautologies(baseSrc),
+      headExtTaut: countExtendedTautologies(headSrc),
+    },
+  ];
+
+  const flags = evaluateMasking(perFile, new Set());
+
+  assert.deepEqual(
+    flags,
+    [],
+    "check-test-masking.test.ts's own literal tautology fixtures (added for #6404) must be " +
+      "excluded from the diff-based weakening check the same way scanBareTautologies() already " +
+      "excludes this file from the absolute-floor scan — otherwise the gate's own regression " +
+      "test permanently self-flags as a HARD release-green failure whenever new fixtures are added."
+  );
+});
+
+test("#6634: unrelated files still get flagged for genuinely new tautologies (guard is file-scoped, not global)", () => {
+  const perFile = [
+    {
+      file: "tests/unit/some-other-file.test.ts",
+      baseAsserts: 5,
+      headAsserts: 5,
+      baseTaut: 0,
+      headTaut: 1,
+      baseExtTaut: 0,
+      headExtTaut: 1,
+    },
+  ];
+
+  const flags = evaluateMasking(perFile, new Set());
+
+  assert.equal(flags.length, 2, "a non-fixture file must still trip both tautology signals");
+  assert.match(flags[0], /nova\(s\) 1 tautologia\(s\) assert\.ok\(true\)/);
+  assert.match(flags[1], /nova\(s\) 1 tautologia\(s\) estendida/);
+});
diff --git a/tests/unit/check-test-masking.test.ts b/tests/unit/check-test-masking.test.ts
index 662b44c792..5579bd1cf8 100644
--- a/tests/unit/check-test-masking.test.ts
+++ b/tests/unit/check-test-masking.test.ts
@@ -5,6 +5,8 @@ import {
   countTautologies,
   countSkips,
   countExtendedTautologies,
+  countBareTautologies,
+  scanBareTautologies,
   evaluateMasking,
   evaluateDeletedFiles,
   partitionDeletedRenamed,
@@ -267,6 +269,90 @@ test("countExtendedTautologies: handles whitespace variants", () => {
   assert.equal(countExtendedTautologies(src), 2);
 });
 
+// ─── #6404: bare tautologies (absolute floor scan, no PR diff needed) ───────
+
+test("countBareTautologies: detects expect(true).toBe(true)", () => {
+  const src = `expect(true).toBe(true);`;
+  assert.equal(countBareTautologies(src), 1);
+});
+
+test("countBareTautologies: detects assert.equal(1, 1) and assert.strictEqual(1, 1)", () => {
+  assert.equal(countBareTautologies(`assert.equal(1, 1);`), 1);
+  assert.equal(countBareTautologies(`assert.strictEqual(1, 1);`), 1);
+});
+
+test("countBareTautologies: does NOT count assert.ok(true) (governed separately)", () => {
+  // Unlike countExtendedTautologies, the absolute scan deliberately excludes
+  // assert.ok(true) — it has many pre-existing, verified-legitimate uses
+  // (try/catch fallbacks) across the codebase and stays on the lenient,
+  // new-occurrence-only diff subcheck instead of an always-on floor.
+  const src = `assert.ok(true);`;
+  assert.equal(countBareTautologies(src), 0);
+});
+
+test("countBareTautologies: returns 0 for real assertions", () => {
+  const src = `
+    expect(result).toBe(42);
+    assert.equal(a, b);
+    assert.ok(someCondition);
+  `;
+  assert.equal(countBareTautologies(src), 0);
+});
+
+test("scanBareTautologies: flags a file containing the #6404 pattern (RED)", () => {
+  const files = ["tests/unit/ui/playground-api-tab.test.tsx"];
+  const read = () => `
+    it("does something", async () => {
+      // If button is disabled (no model selected), test still passes
+      expect(true).toBe(true);
+    });
+  `;
+  const flags = scanBareTautologies(files, read);
+  assert.equal(flags.length, 1);
+  assert.match(flags[0], /playground-api-tab\.test\.tsx/);
+});
+
+test("scanBareTautologies: a real assertion in the same spot is clean (GREEN)", () => {
+  const files = ["tests/unit/ui/playground-api-tab.test.tsx"];
+  const read = () => `
+    it("sends SSE stream request and accumulates response", async () => {
+      const responseEditor = editors[1];
+      expect(responseEditor.value).toContain("Hello!");
+    });
+  `;
+  const flags = scanBareTautologies(files, read);
+  assert.deepEqual(flags, []);
+});
+
+test("scanBareTautologies: excludes check-test-masking.test.ts itself", () => {
+  const files = ["tests/unit/check-test-masking.test.ts"];
+  const read = () => `expect(true).toBe(true);`;
+  assert.deepEqual(scanBareTautologies(files, read), []);
+});
+
+test("scanBareTautologies: excludes sibling gate self-test files (#6634 selfref regression)", () => {
+  // The gate's own regression files (e.g. check-test-masking-selfref-6634.test.ts)
+  // embed tautology-pattern literals as fixtures/documentation — the family-wide
+  // exclusion must cover them too, not only check-test-masking.test.ts itself.
+  const files = ["tests/unit/check-test-masking-selfref-6634.test.ts"];
+  const read = () => `assert.equal(1, 1);`;
+  assert.deepEqual(scanBareTautologies(files, read), []);
+});
+
+test("scanBareTautologies: a non-family file with the pattern is still flagged (exclusion is scoped)", () => {
+  const files = ["tests/unit/some-unrelated.test.ts"];
+  const read = () => `assert.equal(1, 1);`;
+  assert.equal(scanBareTautologies(files, read).length, 1);
+});
+
+test("scanBareTautologies: skips unreadable files instead of throwing", () => {
+  const files = ["tests/unit/does-not-exist.test.ts"];
+  const read = () => {
+    throw new Error("ENOENT");
+  };
+  assert.deepEqual(scanBareTautologies(files, read), []);
+});
+
 test("evaluateMasking: new extended tautology is flagged", () => {
   const r = evaluateMasking([
     {
diff --git a/tests/unit/classify-pr-changes.test.ts b/tests/unit/classify-pr-changes.test.ts
new file mode 100644
index 0000000000..a2815786cc
--- /dev/null
+++ b/tests/unit/classify-pr-changes.test.ts
@@ -0,0 +1,69 @@
+/**
+ * tests/unit/classify-pr-changes.test.ts
+ *
+ * Locks the *existence reason* of each change flag used by ci.yml path filters:
+ * - code  → heavy static + unit/vitest (code regression surface)
+ * - docs  → docs-sync / prose only
+ * - i18n  → translation validation; pure messages must NOT force full unit
+ * - workflow → always code (CI is part of the safety net)
+ * - unknown → code (fail-safe over-run)
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { classifyPaths } from "../../scripts/quality/classify-pr-changes.mjs";
+
+test("pure docs PR → docs only (no code unit/lint bag)", () => {
+  const c = classifyPaths(["docs/architecture/QUALITY_GATES.md", "README.md"]);
+  assert.deepEqual(c, { code: false, docs: true, i18n: false, workflow: false });
+});
+
+test("openapi under docs/ → docs (contract gates live in docs-sync, not unit)", () => {
+  const c = classifyPaths(["docs/openapi.yaml"]);
+  assert.equal(c.docs, true);
+  assert.equal(c.code, false);
+});
+
+test("pure message catalog → i18n only (not full unit suite)", () => {
+  const c = classifyPaths(["src/i18n/messages/en.json", "src/i18n/messages/ko.json"]);
+  assert.deepEqual(c, { code: false, docs: false, i18n: true, workflow: false });
+});
+
+test("i18n tooling/scripts → i18n + code (tooling can break runtime paths)", () => {
+  const c = classifyPaths(["scripts/i18n/check-ui-keys-coverage.mjs"]);
+  assert.equal(c.i18n, true);
+  assert.equal(c.code, true);
+});
+
+test("src/i18n loader TS (non-messages) → i18n + code", () => {
+  const c = classifyPaths(["src/i18n/request.ts"]);
+  assert.equal(c.i18n, true);
+  assert.equal(c.code, true);
+});
+
+test("workflow change → workflow + code (gates protect the gates)", () => {
+  const c = classifyPaths([".github/workflows/ci.yml"]);
+  assert.equal(c.workflow, true);
+  assert.equal(c.code, true);
+});
+
+test("production source → code", () => {
+  const c = classifyPaths(["open-sse/handlers/chatCore.ts", "src/lib/db/core.ts"]);
+  assert.deepEqual(c, { code: true, docs: false, i18n: false, workflow: false });
+});
+
+test("mixed docs + code → both flags (jobs union their filters)", () => {
+  const c = classifyPaths(["docs/README.md", "src/lib/db/core.ts"]);
+  assert.equal(c.docs, true);
+  assert.equal(c.code, true);
+});
+
+test("unknown path → code fail-safe (never skip heavy gates by accident)", () => {
+  const c = classifyPaths(["weird/unclassified.bin"]);
+  assert.equal(c.code, true);
+});
+
+test("empty change list → all false (nothing to validate)", () => {
+  const c = classifyPaths([]);
+  assert.deepEqual(c, { code: false, docs: false, i18n: false, workflow: false });
+});
diff --git a/tests/unit/claude-codex-identity-version-sync.test.ts b/tests/unit/claude-codex-identity-version-sync.test.ts
index ecb10649df..cd64c72506 100644
--- a/tests/unit/claude-codex-identity-version-sync.test.ts
+++ b/tests/unit/claude-codex-identity-version-sync.test.ts
@@ -36,12 +36,12 @@ test("Claude CLI version constants are in lockstep across all 4 sources", () =>
   );
 });
 
-test("Claude CLI is pinned to the captured 2.1.195 release", () => {
-  assert.equal(id.CLAUDE_CODE_VERSION, "2.1.195");
+test("Claude CLI is pinned to the captured 2.1.207 release", () => {
+  assert.equal(id.CLAUDE_CODE_VERSION, "2.1.207");
 });
 
-test("Codex client is pinned to the captured 0.142.0 release", () => {
-  assert.equal(codexCfg.getCodexClientVersion(), "0.142.0");
-  assert.equal(codexCfg.getCodexUserAgent(), "codex-cli/0.142.0 (Windows 10.0.26200; x64)");
-  assert.equal(codexCfg.getCodexDefaultHeaders().Version, "0.142.0");
+test("Codex client is pinned to the captured 0.144.1 release", () => {
+  assert.equal(codexCfg.getCodexClientVersion(), "0.144.1");
+  assert.equal(codexCfg.getCodexUserAgent(), "codex-cli/0.144.1 (Windows 10.0.26200; x64)");
+  assert.equal(codexCfg.getCodexDefaultHeaders().Version, "0.144.1");
 });
diff --git a/tests/unit/claude-identity-version-sync.test.ts b/tests/unit/claude-identity-version-sync.test.ts
index 52c6ddf810..b695826fc7 100644
--- a/tests/unit/claude-identity-version-sync.test.ts
+++ b/tests/unit/claude-identity-version-sync.test.ts
@@ -2,7 +2,7 @@ import test from "node:test";
 import assert from "node:assert/strict";
 
 // Claude-Code identity version is hand-bumped in lockstep across several modules
-// (2.1.158 → .187 → .195 …). A silent partial bump makes one surface advertise a stale
+// (2.1.158 → .187 → .195 → .207 …). A silent partial bump makes one surface advertise a stale
 // `claude-cli/<version>` and can break Anthropic identity gating. This guard fails on drift.
 // (quota-share-hardening Phase 2 — gaps v3.8.42.)
 const claudeIdentity = await import("../../open-sse/executors/claudeIdentity.ts");
@@ -13,7 +13,7 @@ const glmProvider = await import("../../open-sse/config/glmProvider.ts");
 
 const CANONICAL = claudeIdentity.CLAUDE_CODE_VERSION;
 
-// "claude-cli/2.1.195 (external, sdk-cli)" → "2.1.195". String ops only — never a RegExp over
+// "claude-cli/2.1.207 (external, sdk-cli)" → "2.1.207". String ops only — never a RegExp over
 // the value, per the project's anti-ReDoS contract.
 function versionFromUserAgent(userAgent: string): string {
   const afterSlash = userAgent.split("claude-cli/")[1] ?? "";
diff --git a/tests/unit/claude-server-tool-name-preserve.test.ts b/tests/unit/claude-server-tool-name-preserve.test.ts
new file mode 100644
index 0000000000..84f41311d3
--- /dev/null
+++ b/tests/unit/claude-server-tool-name-preserve.test.ts
@@ -0,0 +1,158 @@
+/**
+ * Anthropic server (built-in) tools must keep their literal `name` in EVERY
+ * request section — tools[], message-history `tool_use` blocks, and
+ * `tool_choice` — not just in the tools array.
+ *
+ * Anthropic's server tools are identified by a versioned `type`
+ * (e.g. `web_search_20250305`) paired with a FIXED literal `name`
+ * (`web_search`, `bash`, …) that the API validates as a pair. The tools-array
+ * rewrite is already guarded by `isAnthropicServerToolType`, but the
+ * message-history and `tool_choice` rewrites were not. That asymmetry renames
+ * only the history/tool_choice reference (`web_search` → `WebSearch`) while
+ * tools[] keeps the literal `web_search`, so Anthropic rejects the request:
+ *
+ *   [400] Tool 'WebSearch' not found in provided tools
+ *
+ * Same class for the fixed Claude Code rename map: `bash_20250124` carries the
+ * literal name `bash`, which `remapToolNamesInRequest` would rewrite to `Bash`
+ * (→ `tools.0.bash_20250124.name: Input should be 'bash'`).
+ *
+ * Regression surfaced on Claude Code 2.1.x native web-search calls; same class
+ * as CLIProxyAPI #1094/#1179.
+ */
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import {
+  cloakThirdPartyToolNames,
+  remapToolNamesInRequest,
+} from "../../open-sse/services/claudeCodeToolRemapper.ts";
+
+type AnyRecord = Record<string, unknown>;
+
+describe("cloakThirdPartyToolNames — server-tool names in message history", () => {
+  it("keeps a history tool_use reference to a declared web_search server tool", () => {
+    const body: AnyRecord = {
+      tools: [{ type: "web_search_20250305", name: "web_search", max_uses: 8 }],
+      messages: [
+        {
+          role: "assistant",
+          content: [{ type: "tool_use", id: "toolu_1", name: "web_search", input: { query: "x" } }],
+        },
+      ],
+    };
+    cloakThirdPartyToolNames(body);
+    assert.equal((body.tools as AnyRecord[])[0].name, "web_search");
+    const block = ((body.messages as AnyRecord[])[0].content as AnyRecord[])[0];
+    assert.equal(block.name, "web_search");
+  });
+
+  it("keeps a tool_choice reference to a declared web_search server tool", () => {
+    const body: AnyRecord = {
+      tools: [{ type: "web_search_20250305", name: "web_search" }],
+      tool_choice: { type: "tool", name: "web_search" },
+    };
+    cloakThirdPartyToolNames(body);
+    assert.equal((body.tool_choice as AnyRecord).name, "web_search");
+  });
+
+  it("still cloaks a third-party history tool_use next to a server tool", () => {
+    const body: AnyRecord = {
+      tools: [{ type: "web_search_20250305", name: "web_search" }, { name: "mixture_of_agents" }],
+      messages: [
+        {
+          role: "assistant",
+          content: [
+            { type: "tool_use", id: "toolu_1", name: "web_search", input: {} },
+            { type: "tool_use", id: "toolu_2", name: "mixture_of_agents", input: {} },
+          ],
+        },
+      ],
+    };
+    cloakThirdPartyToolNames(body);
+    const blocks = (body.messages as AnyRecord[])[0].content as AnyRecord[];
+    assert.equal(blocks[0].name, "web_search");
+    assert.equal(blocks[1].name, "MixtureOfAgents");
+    assert.deepEqual(
+      (body.tools as AnyRecord[]).map((t) => t.name),
+      ["web_search", "MixtureOfAgents"]
+    );
+  });
+
+  it("still cloaks a snake_case history name when no server tool declares it", () => {
+    const body: AnyRecord = {
+      tools: [{ name: "web_search", input_schema: { type: "object" } }],
+      messages: [
+        {
+          role: "assistant",
+          content: [{ type: "tool_use", id: "toolu_1", name: "web_search", input: {} }],
+        },
+      ],
+    };
+    cloakThirdPartyToolNames(body);
+    // Plain custom tool named web_search (no server type) remains cloakable —
+    // symmetrically in tools[] and history.
+    assert.equal((body.tools as AnyRecord[])[0].name, "WebSearch");
+    const block = ((body.messages as AnyRecord[])[0].content as AnyRecord[])[0];
+    assert.equal(block.name, "WebSearch");
+  });
+});
+
+describe("remapToolNamesInRequest — Anthropic server tools", () => {
+  it("does not rename a bash server tool to Bash in tools[]", () => {
+    const body: AnyRecord = {
+      tools: [{ type: "bash_20250124", name: "bash" }],
+    };
+    remapToolNamesInRequest(body);
+    assert.equal((body.tools as AnyRecord[])[0].name, "bash");
+    assert.equal((body._toolNameMap as Map<string, string> | undefined)?.size ?? 0, 0);
+  });
+
+  it("does not rename history/tool_choice references to a declared bash server tool", () => {
+    const body: AnyRecord = {
+      tools: [{ type: "bash_20250124", name: "bash" }],
+      messages: [
+        {
+          role: "assistant",
+          content: [{ type: "tool_use", id: "toolu_1", name: "bash", input: { command: "ls" } }],
+        },
+      ],
+      tool_choice: { type: "tool", name: "bash" },
+    };
+    remapToolNamesInRequest(body);
+    const block = ((body.messages as AnyRecord[])[0].content as AnyRecord[])[0];
+    assert.equal(block.name, "bash");
+    assert.equal((body.tool_choice as AnyRecord).name, "bash");
+  });
+
+  it("tolerates null entries in tools[] without throwing", () => {
+    const body: AnyRecord = {
+      tools: [null, { type: "bash_20250124", name: "bash" }],
+      messages: [
+        {
+          role: "assistant",
+          content: [{ type: "tool_use", id: "toolu_1", name: "bash", input: {} }],
+        },
+      ],
+    };
+    remapToolNamesInRequest(body);
+    assert.equal((body.tools as AnyRecord[])[1].name, "bash");
+    const block = ((body.messages as AnyRecord[])[0].content as AnyRecord[])[0];
+    assert.equal(block.name, "bash");
+  });
+
+  it("still renames a plain lowercase custom bash tool to Bash", () => {
+    const body: AnyRecord = {
+      tools: [{ name: "bash", input_schema: { type: "object" } }],
+      messages: [
+        {
+          role: "assistant",
+          content: [{ type: "tool_use", id: "toolu_1", name: "bash", input: {} }],
+        },
+      ],
+    };
+    remapToolNamesInRequest(body);
+    assert.equal((body.tools as AnyRecord[])[0].name, "Bash");
+    const block = ((body.messages as AnyRecord[])[0].content as AnyRecord[])[0];
+    assert.equal(block.name, "Bash");
+  });
+});
diff --git a/tests/unit/cli-catalog-counts.test.ts b/tests/unit/cli-catalog-counts.test.ts
index e65516f228..681993eccb 100644
--- a/tests/unit/cli-catalog-counts.test.ts
+++ b/tests/unit/cli-catalog-counts.test.ts
@@ -41,8 +41,8 @@ test("CLI_TOOLS total code entries (including none) equals 24 (20 visible + 4 no
   assert.equal(codeAll.length, 24, `Expected 24 total code entries, got ${codeAll.length}`);
 });
 
-test("CLI_TOOLS total (code + agent) = 30", () => {
-  assert.equal(all.length, 30, `Expected 30 total entries, got ${all.length}`);
+test("CLI_TOOLS total (code + agent) = 32", () => {
+  assert.equal(all.length, 32, `Expected 32 total entries, got ${all.length}`);
 });
 
 test("All code-none entries have configType mitm OR are legacy excluded entries", () => {
@@ -98,7 +98,7 @@ test("The 20 visible code entries match D15 list exactly (+ crush + codewhale)",
   }
 });
 
-test("The 6 agent entries match D15 list exactly", () => {
+test("The 8 agent entries match D15 list exactly (+ omp + letta, #6318)", () => {
   const d15Agents = new Set([
     "hermes-agent",
     "openclaw",
@@ -106,6 +106,8 @@ test("The 6 agent entries match D15 list exactly", () => {
     "interpreter",
     "warp",
     "agent-deck",
+    "omp",
+    "letta",
   ]);
   const agentIds = new Set(agentAll.map((t) => t.id));
   for (const id of d15Agents) {
diff --git a/tests/unit/cli-compression-commands.test.ts b/tests/unit/cli-compression-commands.test.ts
index 3f3cafed9c..3f4072a3e0 100644
--- a/tests/unit/cli-compression-commands.test.ts
+++ b/tests/unit/cli-compression-commands.test.ts
@@ -64,7 +64,10 @@ test("compression configure envia configuração via mcp", async () => {
 
   globalThis.fetch = origFetch;
   assert.equal(capturedBody.name, "omniroute_compression_configure");
-  assert.equal(capturedBody.arguments.engine, "caveman");
+  // #6571: the configure command now sends the canonical `strategy` field the MCP
+  // tool schema (compressionConfigureInput) + handleCompressionConfigure expect,
+  // not the nonexistent `engine` key (which the non-strict schema silently stripped).
+  assert.equal(capturedBody.arguments.strategy, "caveman");
   assert.ok(capturedBody.arguments.caveman?.aggressiveness === 0.8);
 });
 
@@ -246,5 +249,7 @@ test("compression engine set falls back to PUT /api/settings/compression on MCP
   const restCall = calls.find((c) => c.url.includes("/api/settings/compression"));
   assert.ok(restCall, "should fall back to PUT /api/settings/compression");
   assert.equal(restCall?.method, "PUT");
-  assert.equal(restCall?.body?.engine, "rtk");
+  // #6571: the REST fallback now PUTs the canonical `defaultMode` field the server's
+  // strict schema accepts, not the nonexistent `engine` key (which made the PUT 400).
+  assert.equal(restCall?.body?.defaultMode, "rtk");
 });
diff --git a/tests/unit/cli-health-monitoring-route.test.ts b/tests/unit/cli-health-monitoring-route.test.ts
new file mode 100644
index 0000000000..f2168ba400
--- /dev/null
+++ b/tests/unit/cli-health-monitoring-route.test.ts
@@ -0,0 +1,76 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import http from "node:http";
+import { runHealthCommand } from "../../bin/cli/commands/health.mjs";
+
+// Regression test for GH #6677: `omniroute health` calls GET /api/health, but the
+// real server only implements GET /api/monitoring/health (plus the sub-routes
+// /api/health/degradation and /api/health/ping). This stub server mimics that
+// exact real-world shape: /api/monitoring/health responds 200 with a healthy
+// payload, everything else (including /api/health) 404s.
+//
+// Expectation once fixed: runHealthCommand() should hit /api/monitoring/health
+// and return exit code 0.
+
+let server: http.Server;
+let baseUrl: string;
+
+test.before(async () => {
+  server = http.createServer((req, res) => {
+    if (req.url === "/api/monitoring/health") {
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(
+        JSON.stringify({
+          status: "healthy",
+          version: "3.8.47",
+          uptime: 123,
+          activeConnections: 0,
+          circuitBreakers: { open: 0, halfOpen: 0, closed: 3 },
+          memoryUsage: { rss: 1000, heapUsed: 500 },
+        })
+      );
+      return;
+    }
+    // Everything else, including the legacy /api/health the CLI used to call,
+    // 404s — matching the real deployed route tree (only
+    // app/api/health/degradation and app/api/health/ping exist on disk).
+    res.writeHead(404, { "content-type": "application/json" });
+    res.end(JSON.stringify({ error: "Not Found" }));
+  });
+  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", () => resolve()));
+  const address = server.address();
+  if (address && typeof address === "object") {
+    baseUrl = `http://127.0.0.1:${address.port}`;
+  }
+  process.env.OMNIROUTE_BASE_URL = baseUrl;
+});
+
+test.after(async () => {
+  delete process.env.OMNIROUTE_BASE_URL;
+  await new Promise<void>((resolve) => server.close(() => resolve()));
+});
+
+test("GH #6677: omniroute health should succeed against a server that only implements /api/monitoring/health", async () => {
+  const originalError = console.error;
+  const originalLog = console.log;
+  const errors: string[] = [];
+  console.error = (...args: unknown[]) => {
+    errors.push(args.map(String).join(" "));
+  };
+  console.log = () => {};
+
+  let exitCode: number;
+  try {
+    exitCode = await runHealthCommand({});
+  } finally {
+    console.error = originalError;
+    console.log = originalLog;
+  }
+
+  assert.equal(
+    exitCode,
+    0,
+    `runHealthCommand() should return 0 against a live server that implements ` +
+      `/api/monitoring/health, but got exit code ${exitCode}. Captured stderr: ${errors.join(" | ")}`
+  );
+});
diff --git a/tests/unit/cli-model-config-schema.test.ts b/tests/unit/cli-model-config-schema.test.ts
index 1c1b23bf75..29b089a112 100644
--- a/tests/unit/cli-model-config-schema.test.ts
+++ b/tests/unit/cli-model-config-schema.test.ts
@@ -17,3 +17,20 @@ test("cliModelConfigSchema accepts Codex xhigh reasoning effort", () => {
     assert.equal(result.data.reasoningEffort, "xhigh");
   }
 });
+
+test("cliModelConfigSchema accepts Codex max and ultra reasoning efforts", () => {
+  for (const reasoningEffort of ["max", "ultra"] as const) {
+    const result = cliModelConfigSchema.safeParse({
+      baseUrl: "http://localhost:20128/api/v1",
+      apiKey: "sk_omniroute",
+      model: "gpt-5.6-sol",
+      reasoningEffort,
+      wireApi: "responses",
+    });
+
+    assert.equal(result.success, true, reasoningEffort);
+    if (result.success) {
+      assert.equal(result.data.reasoningEffort, reasoningEffort);
+    }
+  }
+});
diff --git a/tests/unit/cli-runtime-detection.test.ts b/tests/unit/cli-runtime-detection.test.ts
index 4306ebdf34..5c46a14161 100644
--- a/tests/unit/cli-runtime-detection.test.ts
+++ b/tests/unit/cli-runtime-detection.test.ts
@@ -9,7 +9,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
-const { getCliRuntimeStatus, CLI_TOOL_IDS } =
+const { getCliRuntimeStatus, getKnownToolPaths, CLI_TOOL_IDS } =
   await import("../../src/shared/services/cliRuntime.ts");
 
 // ─── Helpers ──────────────────────────────────────────────────
@@ -22,6 +22,29 @@ function createTempDir() {
   return fs.mkdtempSync(path.join(testRoot, "cli-test-"));
 }
 
+describe("Claude Code Windows known paths", () => {
+  it("should include the WinGet Anthropic.ClaudeCode install path", () => {
+    const localAppData = process.env.LOCALAPPDATA;
+    const expected = localAppData
+      ? path.join(
+          localAppData,
+          "Microsoft",
+          "WinGet",
+          "Packages",
+          "Anthropic.ClaudeCode_Microsoft.Winget.Source_8wekyb3d8bbwe",
+          "claude.exe"
+        )
+      : null;
+
+    if (process.platform !== "win32" || !expected) return;
+
+    assert.ok(
+      getKnownToolPaths("claude").includes(expected),
+      "Claude Code installed by WinGet should be discoverable without CLI_CLAUDE_BIN"
+    );
+  });
+});
+
 function createFile(dir, name, content) {
   const filePath = path.join(dir, name);
   fs.writeFileSync(filePath, content);
diff --git a/tests/unit/cli-serve-readiness-timeout-6321.test.ts b/tests/unit/cli-serve-readiness-timeout-6321.test.ts
new file mode 100644
index 0000000000..5ccf73587c
--- /dev/null
+++ b/tests/unit/cli-serve-readiness-timeout-6321.test.ts
@@ -0,0 +1,64 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+// #6321: `omniroute serve` printed the banner + "⏳ Starting server..." then hung
+// forever with ZERO further output whenever waitForServer() timed out (resolved
+// `false`) — `runWithSupervisor`'s `.then((up) => { if (up) {...} })` had no `else`
+// branch, so a boot that never became ready was indistinguishable from a genuine
+// infinite hang, even at APP_LOG_LEVEL=debug (stdout was also being discarded —
+// see the companion assertion on ServerSupervisor.getRecentLog()).
+
+test("reportReadinessTimeout prints a diagnostic instead of staying silent (#6321)", async () => {
+  const logs: string[] = [];
+  const origErr = console.error.bind(console);
+  console.error = (...args: unknown[]) => logs.push(args.join(" "));
+
+  try {
+    const { reportReadinessTimeout } = await import("../../bin/cli/commands/serve.mjs");
+    assert.equal(
+      typeof reportReadinessTimeout,
+      "function",
+      "serve.mjs must export a readiness-timeout diagnostic handler"
+    );
+
+    const fakeSupervisor = {
+      getRecentLog: () => ["[server] booting...", "[server] waiting on migrations"],
+    };
+    reportReadinessTimeout(20128, fakeSupervisor);
+
+    const combined = logs.join("\n");
+    assert.notEqual(combined.trim(), "", "must not silently produce zero output on a timeout");
+    assert.ok(
+      combined.includes("did not respond") || combined.toLowerCase().includes("60s"),
+      `expected a clear readiness-timeout message, got:\n${combined}`
+    );
+    assert.ok(
+      combined.includes("booting") && combined.includes("migrations"),
+      "must surface the buffered server output instead of discarding it"
+    );
+  } finally {
+    console.error = origErr;
+  }
+});
+
+test("ServerSupervisor.getRecentLog() exposes buffered output for readiness diagnostics (#6321)", async () => {
+  const { ServerSupervisor } = await import("../../bin/cli/runtime/processSupervisor.mjs");
+
+  const supervisor = new ServerSupervisor({
+    serverPath: "/fake/server.js",
+    env: {},
+    maxRestarts: 0,
+  });
+
+  assert.equal(
+    typeof supervisor.getRecentLog,
+    "function",
+    "ServerSupervisor must expose getRecentLog() so callers can surface buffered output"
+  );
+
+  // Simulate lines that arrived on the child's stdout/stderr before a readiness
+  // timeout — previously stdout was piped to "ignore" and never reached crashLog.
+  supervisor.crashLog = ["stdout: server starting", "stderr: waiting for db"];
+  const recent = supervisor.getRecentLog();
+  assert.deepEqual(recent, ["stdout: server starting", "stderr: waiting for db"]);
+});
diff --git a/tests/unit/cli-tools-schema.test.ts b/tests/unit/cli-tools-schema.test.ts
index b74e274eef..4648f448ee 100644
--- a/tests/unit/cli-tools-schema.test.ts
+++ b/tests/unit/cli-tools-schema.test.ts
@@ -1,7 +1,7 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 
-test("CLI_TOOLS registry contains all expected tools (plan 14 — 30 total + crush + codewhale)", async () => {
+test("CLI_TOOLS registry contains all expected tools (plan 14 — 32 total + crush + codewhale + omp + letta)", async () => {
   const { CLI_TOOLS } = await import("../../src/shared/constants/cliTools.ts");
   // windsurf and amp removed per plan 14 D17 (MITM backlog plan 11)
   // New entries added: roo, jcode, deepseek-tui, smelt, pi, aider, forge,
@@ -9,6 +9,7 @@ test("CLI_TOOLS registry contains all expected tools (plan 14 — 30 total + cru
   // crush added — ported from upstream decolua/9router#1233
   // codewhale added 2026-07-02 as a dual entry alongside deepseek-tui
   //   (CodeWhale is the actively-maintained successor to DeepSeek TUI).
+  // omp + letta added by #6318 (agent-category CLI integrations).
   const expected = [
     "claude",
     "codex",
@@ -38,6 +39,8 @@ test("CLI_TOOLS registry contains all expected tools (plan 14 — 30 total + cru
     "goose",
     "interpreter",
     "warp",
+    "omp",
+    "letta",
     "agent-deck",
     "crush",
   ];
diff --git a/tests/unit/cli-tools.test.ts b/tests/unit/cli-tools.test.ts
index 994bc33605..5156d3d97b 100644
--- a/tests/unit/cli-tools.test.ts
+++ b/tests/unit/cli-tools.test.ts
@@ -86,12 +86,12 @@ test("CLI fingerprint preserves Codex executor User-Agent and maps legacy Copilo
     "codex",
     {
       Authorization: "Bearer token",
-      "User-Agent": "codex-cli/0.142.0 (Windows 10.0.26200; x64)",
+      "User-Agent": "codex-cli/0.144.1 (Windows 10.0.26200; x64)",
     },
     { model: "gpt-5.5", messages: [], stream: true }
   );
 
-  assert.equal(codex.headers["User-Agent"], "codex-cli/0.142.0 (Windows 10.0.26200; x64)");
+  assert.equal(codex.headers["User-Agent"], "codex-cli/0.144.1 (Windows 10.0.26200; x64)");
   assert.deepEqual(Object.keys(JSON.parse(codex.bodyString)), ["model", "stream", "messages"]);
 
   const copilot = applyFingerprint(
diff --git a/tests/unit/cli-waitForServer.test.mjs b/tests/unit/cli-waitForServer.test.mjs
index 716127057d..b58a0ce0e9 100644
--- a/tests/unit/cli-waitForServer.test.mjs
+++ b/tests/unit/cli-waitForServer.test.mjs
@@ -4,10 +4,13 @@ import net from "node:net";
 
 import { waitForServer } from "../../bin/cli/utils/pid.mjs";
 
-// #2460: waitForServer must (a) respect a 60s default timeout, (b) return
-// true when the port is listening for >= 3s even if /api/monitoring/health
-// is not yet mounted (common on Windows during slow Next.js cold start),
-// and (c) return false cleanly when nothing is listening.
+// #2460 / #6800: waitForServer must (a) respect a 60s default timeout,
+// (b) return true when the port is listening for >= 3s and health requests
+// are being fast-rejected/reset (route not yet mounted, common on Windows
+// during slow Next.js cold start), (c) return false cleanly when nothing is
+// listening, and (d) return false when the port merely accepts TCP and then
+// hangs without ever answering a request (#6800 — a still-booting/CPU-bound
+// process must NOT be reported as ready just because the socket is open).
 
 async function freePort() {
   return new Promise((resolve) => {
@@ -29,12 +32,13 @@ test("waitForServer returns false on a closed port within the given timeout (#24
   assert.ok(elapsed >= 1200 && elapsed < 4000, `elapsed ${elapsed}ms outside expected range`);
 });
 
-test("waitForServer returns true via TCP fallback when port listens but health endpoint is absent (#2460)", async () => {
+test("waitForServer returns true via TCP fallback when health requests are fast-rejected (route not yet mounted) (#2460)", async () => {
   const port = await freePort();
   const server = net.createServer((socket) => {
-    // Accept the connection but never respond — simulates a Node process
-    // that has bound the port but not yet mounted HTTP routes.
-    socket.on("data", () => {});
+    // Actively reset the connection quickly — simulates a Node process
+    // that has bound the port and is responsive, but has not yet mounted
+    // the health route (the original #2460 Windows cold-start scenario).
+    socket.destroy();
   });
   await new Promise((resolve, reject) => {
     server.once("error", reject);
@@ -48,3 +52,28 @@ test("waitForServer returns true via TCP fallback when port listens but health e
     await new Promise((resolve) => server.close(() => resolve()));
   }
 });
+
+test("waitForServer returns false when the port accepts TCP but never answers a request (#6800)", async () => {
+  const port = await freePort();
+  const server = net.createServer((socket) => {
+    // Accept the connection but never respond and never close it — a
+    // still-booting/CPU-bound process that has bound the port but cannot
+    // yet process any request. This must NOT be reported as ready.
+    socket.on("data", () => {});
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(port, "127.0.0.1", () => resolve());
+  });
+
+  try {
+    const result = await waitForServer(port, 8000);
+    assert.equal(
+      result,
+      false,
+      "expected waitForServer to NOT report ready for a TCP-open-but-never-responding socket"
+    );
+  } finally {
+    await new Promise((resolve) => server.close(() => resolve()));
+  }
+});
diff --git a/tests/unit/client-identity-profiles.test.ts b/tests/unit/client-identity-profiles.test.ts
index 119c8a7b2d..d42e250d95 100644
--- a/tests/unit/client-identity-profiles.test.ts
+++ b/tests/unit/client-identity-profiles.test.ts
@@ -17,7 +17,8 @@ const {
   getClientIdentityProfileHeaders,
   isClientIdentityProfileId,
 } = await import("../../src/shared/constants/clientIdentityProfiles.ts");
-const { isForbiddenCustomHeaderName } = await import("../../src/shared/constants/upstreamHeaders.ts");
+const { isForbiddenCustomHeaderName } =
+  await import("../../src/shared/constants/upstreamHeaders.ts");
 const { DefaultExecutor } = await import("../../open-sse/executors/default.ts");
 const core = await import("../../src/lib/db/core.ts");
 
@@ -38,11 +39,11 @@ test("getClientIdentityProfileHeaders: unknown profile id falls back to no heade
 
 test("getClientIdentityProfileHeaders: known CLI profiles expose their preset headers", () => {
   const claudeCli = getClientIdentityProfileHeaders("claude-cli");
-  assert.equal(claudeCli["User-Agent"], "claude-cli/2.1.195 (external, cli)");
+  assert.equal(claudeCli["User-Agent"], "claude-cli/2.1.207 (external, cli)");
   assert.equal(claudeCli["X-App"], "cli");
 
   const codexCli = getClientIdentityProfileHeaders("codex-cli");
-  assert.equal(codexCli["User-Agent"], "codex_cli_rs/0.136.0");
+  assert.equal(codexCli["User-Agent"], "codex_cli_rs/0.144.1");
   assert.equal(codexCli.originator, "codex_cli_rs");
 
   const geminiCli = getClientIdentityProfileHeaders("gemini-cli");
@@ -54,7 +55,7 @@ test("getClientIdentityProfileHeaders: returns a fresh mutable copy (catalog sta
   headers["User-Agent"] = "tampered";
   assert.equal(
     CLIENT_IDENTITY_PROFILES["claude-cli"].headers["User-Agent"],
-    "claude-cli/2.1.195 (external, cli)"
+    "claude-cli/2.1.207 (external, cli)"
   );
 });
 
@@ -79,7 +80,7 @@ test("a selected profile's headers land in providerSpecificData.customHeaders",
     customHeaders: { ...profileHeaders, "X-Operator-Set": "keep-me" },
   };
 
-  assert.equal(providerSpecificData.customHeaders["User-Agent"], "codex_cli_rs/0.136.0");
+  assert.equal(providerSpecificData.customHeaders["User-Agent"], "codex_cli_rs/0.144.1");
   assert.equal(providerSpecificData.customHeaders.originator, "codex_cli_rs");
   assert.equal(providerSpecificData.customHeaders["X-Operator-Set"], "keep-me");
 });
@@ -99,7 +100,7 @@ test("profile headers merged into customHeaders survive applyCustomHeaders sanit
     true
   ) as Record<string, string>;
 
-  assert.equal(headers["User-Agent"], "claude-cli/2.1.195 (external, cli)");
+  assert.equal(headers["User-Agent"], "claude-cli/2.1.207 (external, cli)");
   assert.equal(headers["X-App"], "cli");
   assert.equal(headers["Authorization"], "Bearer test-key");
 });
diff --git a/tests/unit/clinepass-provider.test.ts b/tests/unit/clinepass-provider.test.ts
index 1706e1cc56..6465752a93 100644
--- a/tests/unit/clinepass-provider.test.ts
+++ b/tests/unit/clinepass-provider.test.ts
@@ -1,34 +1,39 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 
-const { APIKEY_PROVIDERS } = await import("../../src/shared/constants/providers.ts");
+const { APIKEY_PROVIDERS, OAUTH_PROVIDERS, supportsApiKeyOnFreeProvider } =
+  await import("../../src/shared/constants/providers.ts");
+const { isManagedProviderConnectionId } = await import("../../src/lib/providers/catalog.ts");
+const { PROVIDERS: oauthFlows } = await import("../../src/lib/oauth/providers/index.ts");
 const { REGISTRY: providerRegistry } = await import("../../open-sse/config/providerRegistry.ts");
 const { unwrapClinepassEnvelope } = await import("../../open-sse/utils/clinepassEnvelope.ts");
 const { filterClinepassModels } = await import("../../open-sse/services/clinepassModels.ts");
 const { parseUpstreamError, buildErrorBody } = await import("../../open-sse/utils/error.ts");
 
-// ── Provider metadata (Zod-validated APIKEY catalog) ─────────────────────────
-test("ClinePass is registered as an API-key provider with the canonical identity", () => {
-  const cp = APIKEY_PROVIDERS.clinepass;
-  assert.ok(cp, "APIKEY_PROVIDERS.clinepass must be defined");
+// ── Provider metadata (oauth-primary catalog; single provider) ──────────────
+test("ClinePass is registered as an OAuth-primary provider with the canonical identity", () => {
+  const cp = OAUTH_PROVIDERS.clinepass;
+  assert.ok(cp, "OAUTH_PROVIDERS.clinepass must be defined (oauth-primary catalog)");
   assert.equal(cp.id, "clinepass");
-  assert.equal(cp.alias, "clinepass");
   assert.equal(cp.name, "ClinePass");
-  assert.equal(cp.website, "https://cline.bot");
-  assert.equal(
-    (cp as { notice?: { apiKeyUrl?: string } }).notice?.apiKeyUrl,
-    "https://app.cline.bot/settings/api-keys"
+  // Single provider — NO duplicate APIKEY_PROVIDERS entry. Dual-auth (OAuth sign-in
+  // + Manual API key) is rendered by the dashboard's isOAuth branch (same as
+  // cline/claude), not via FREE_APIKEY_PROVIDER_IDS (which would flip isOAuth off).
+  assert.ok(
+    !APIKEY_PROVIDERS.clinepass,
+    "clinepass must NOT be in APIKEY_PROVIDERS (single provider)"
   );
 });
 
-test("ClinePass registry entry uses OpenAI format with bearer apikey auth + Cline headers", () => {
+test("ClinePass registry entry is oauth-primary (dual-auth) with Cline headers", () => {
   const entry = providerRegistry.clinepass;
   assert.ok(entry, "providerRegistry.clinepass must be defined");
   assert.equal(entry.id, "clinepass");
   assert.equal(entry.format, "openai");
   assert.equal(entry.executor, "default");
-  assert.equal(entry.authType, "apikey");
+  assert.equal(entry.authType, "oauth");
   assert.equal(entry.authHeader, "bearer");
+  assert.ok(entry.oauth, "must carry the Cline OAuth urls (sign-in path)");
   assert.equal(entry.baseUrl, "https://api.cline.bot/api/v1/chat/completions");
   assert.equal(entry.extraHeaders?.["HTTP-Referer"], "https://cline.bot");
   assert.equal(entry.extraHeaders?.["X-Title"], "Cline");
@@ -115,3 +120,61 @@ test("parseUpstreamError unwraps clinepass envelope error without leaking a stac
   const body = buildErrorBody(502, parsed.message) as { error: { message: string } };
   assert.ok(!body.error.message.includes("at /"), "sanitized error must not include a stack frame");
 });
+
+// ── Dual-auth: clinepass accepts BOTH an API key (#5942) AND OAuth login ─────
+test("ClinePass is also in the OAuth catalog (dual-auth: API-key + OAuth login)", () => {
+  const cp = OAUTH_PROVIDERS.clinepass;
+  assert.ok(cp, "OAUTH_PROVIDERS.clinepass must be defined for the OAuth login path");
+  assert.equal(cp.id, "clinepass");
+  assert.equal(cp.name, "ClinePass");
+});
+
+test("ClinePass reuses the Cline WorkOS OAuth flow (clinepass -> cline)", () => {
+  assert.ok(oauthFlows.clinepass, "clinepass must map to an OAuth flow");
+  assert.equal(
+    oauthFlows.clinepass,
+    oauthFlows.cline,
+    "clinepass must reuse the cline OAuth flow 1:1 (same api.cline.bot host/token)"
+  );
+});
+
+test("ClinePass is a single OAuth-primary provider (no duplicate catalog entry)", () => {
+  assert.ok(OAUTH_PROVIDERS.clinepass, "OAuth catalog entry");
+  assert.ok(!APIKEY_PROVIDERS.clinepass, "no duplicate APIKEY_PROVIDERS entry");
+});
+
+// ── Dual-auth API-key admission (POST /api/providers gate) ───────────────────
+// clinepass is OAuth-primary (isOAuth=true → "Connect" opens the OAuth flow) but
+// ALSO accepts a pasted BYOK API key. The API-key path must pass the managed-
+// connection gate (isManagedProviderConnectionId) WITHOUT flipping isOAuth off.
+// That means admitting it through the dedicated DUAL_AUTH set, NOT through
+// FREE_APIKEY_PROVIDER_IDS (which would set providerSupportsPat=true → isOAuth=false
+// and break the primary Connect→OAuth routing). Regression guard for the layout.
+test("ClinePass API-key connections pass the managed gate while staying OAuth-primary", () => {
+  assert.ok(
+    isManagedProviderConnectionId("clinepass"),
+    "POST /api/providers must accept a clinepass apikey connection (dual-auth BYOK path)"
+  );
+  assert.ok(
+    !supportsApiKeyOnFreeProvider("clinepass"),
+    "clinepass must NOT be in FREE_APIKEY_PROVIDER_IDS — that would flip isOAuth false"
+  );
+});
+
+// ── Catalog ↔ registry alias consistency (routing prefix) ───────────────────
+// The dashboard sends models as `<catalogAlias>/<modelId>` (e.g. "cp/cline-pass/glm-5.2").
+// Routing resolves that prefix via ALIAS_TO_PROVIDER_ID, which is built from the REGISTRY
+// alias (generateAliasMap). If the registry alias drifts from the catalog alias, the prefix
+// won't resolve → executor falls back to PROVIDERS.openai → requests hit api.openai.com
+// with the ClinePass key → a misleading OpenAI 401. cline keeps these in sync (both "cl");
+// clinepass must too. Regression guard for the cp/cline-pass/* OpenAI-401 incident.
+test("ClinePass registry alias matches the OAUTH_PROVIDERS catalog alias (routing prefix)", () => {
+  const cp = OAUTH_PROVIDERS.clinepass;
+  assert.ok(cp?.alias, "catalog alias must be defined");
+  assert.equal(
+    providerRegistry.clinepass.alias,
+    cp.alias,
+    "registry alias must equal catalog alias so <alias>/<model> resolves to clinepass"
+  );
+  assert.equal(providerRegistry.clinepass.alias, "cp");
+});
diff --git a/tests/unit/cliproxyapi-model-mapping-dispatch.test.ts b/tests/unit/cliproxyapi-model-mapping-dispatch.test.ts
new file mode 100644
index 0000000000..1952999118
--- /dev/null
+++ b/tests/unit/cliproxyapi-model-mapping-dispatch.test.ts
@@ -0,0 +1,128 @@
+/**
+ * Regression tests for #6876 — `cliproxyapiModelMapping` was persisted by the
+ * dashboard (`upstream_proxy_config.cliproxyapi_model_mapping`) but never
+ * consulted at request-dispatch time: the mapped model never made it onto the
+ * outbound CLIProxyAPI wire request.
+ *
+ * All tests exercise REAL production functions end-to-end:
+ *   - upsertUpstreamProxyConfig (src/lib/db/upstreamProxy.ts)
+ *   - resolveExecutorWithProxy (open-sse/handlers/chatCore/executorProxy.ts)
+ *   - CliproxyapiExecutor.execute (open-sse/executors/cliproxyapi.ts)
+ * `globalThis.fetch` is stubbed only to capture the outbound wire body.
+ */
+
+import { describe, it, before, after, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const testDataDir = fs.mkdtempSync(path.join(os.tmpdir(), "omni-6876-model-mapping-"));
+process.env.DATA_DIR = testDataDir;
+
+const coreDb = await import("../../src/lib/db/core.ts");
+const upstreamProxyDb = await import("../../src/lib/db/upstreamProxy.ts");
+const { resolveExecutorWithProxy } =
+  await import("../../open-sse/handlers/chatCore/executorProxy.ts");
+const { clearUpstreamProxyConfigCache } =
+  await import("../../open-sse/handlers/chatCore/comboContextCache.ts");
+
+before(async () => {
+  await coreDb.ensureDbInitialized();
+});
+
+afterEach(() => {
+  clearUpstreamProxyConfigCache();
+});
+
+after(() => {
+  coreDb.resetDbInstance();
+  if (fs.existsSync(testDataDir)) fs.rmSync(testDataDir, { recursive: true, force: true });
+});
+
+type ExecuteInput = {
+  model: string;
+  body: unknown;
+  stream: boolean;
+  credentials: unknown;
+};
+
+type ExecutorLike = { execute: (input: ExecuteInput) => Promise<unknown> };
+
+async function captureFetchBody(fn: () => Promise<unknown>): Promise<Record<string, unknown>> {
+  let capturedBody: Record<string, unknown> | null = null;
+  const originalFetch = globalThis.fetch;
+  // @ts-expect-error test stub
+  globalThis.fetch = async (_url: string, init: RequestInit) => {
+    capturedBody = JSON.parse(init.body as string);
+    return new Response(JSON.stringify({ ok: true }), {
+      status: 200,
+      headers: { "Content-Type": "application/json" },
+    });
+  };
+  try {
+    await fn();
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+  assert.ok(capturedBody, "executor should have issued a fetch call");
+  return capturedBody as Record<string, unknown>;
+}
+
+describe("#6876 — cliproxyapiModelMapping applied at dispatch", () => {
+  it("forwards the MAPPED model to CLIProxyAPI in cliproxyapi (passthrough) mode", async () => {
+    await upstreamProxyDb.upsertUpstreamProxyConfig({
+      providerId: "anthropic-mapped-passthrough",
+      mode: "cliproxyapi",
+      enabled: true,
+      cliproxyapiModelMapping: { "claude-3-opus": "claude-3-opus-mapped" },
+    });
+
+    const executor = await resolveExecutorWithProxy(
+      "anthropic-mapped-passthrough",
+      undefined,
+      null
+    );
+    assert.equal(
+      (executor as { provider?: string }).provider,
+      "cliproxyapi",
+      "sanity: provider should route through the cliproxyapi executor"
+    );
+
+    const capturedBody = await captureFetchBody(() =>
+      (executor as ExecutorLike).execute({
+        model: "claude-3-opus",
+        body: { model: "claude-3-opus", messages: [{ role: "user", content: "hi" }] },
+        stream: false,
+        credentials: { apiKey: "test-key" },
+      })
+    );
+
+    assert.equal(
+      capturedBody.model,
+      "claude-3-opus-mapped",
+      `expected mapped model "claude-3-opus-mapped" to be forwarded upstream, got unmapped "${capturedBody.model}"`
+    );
+  });
+
+  it("does NOT remap the model when no mapping is configured (no regression)", async () => {
+    await upstreamProxyDb.upsertUpstreamProxyConfig({
+      providerId: "anthropic-no-mapping",
+      mode: "cliproxyapi",
+      enabled: true,
+    });
+
+    const executor = await resolveExecutorWithProxy("anthropic-no-mapping", undefined, null);
+
+    const capturedBody = await captureFetchBody(() =>
+      (executor as ExecutorLike).execute({
+        model: "claude-3-opus",
+        body: { model: "claude-3-opus", messages: [{ role: "user", content: "hi" }] },
+        stream: false,
+        credentials: { apiKey: "test-key" },
+      })
+    );
+
+    assert.equal(capturedBody.model, "claude-3-opus", "unmapped model must pass through unchanged");
+  });
+});
diff --git a/tests/unit/cloud-agent-cors-failclosed.test.ts b/tests/unit/cloud-agent-cors-failclosed.test.ts
new file mode 100644
index 0000000000..854178aadb
--- /dev/null
+++ b/tests/unit/cloud-agent-cors-failclosed.test.ts
@@ -0,0 +1,60 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { getCloudAgentCorsHeaders } from "../../src/lib/cloudAgent/api.ts";
+
+// The cloud-agent routes are management (cookie/session) authed, so their CORS
+// must be fail-closed. The previous `origin || "*"` reflected ANY caller's origin
+// AND paired it with Allow-Credentials: true — letting any website make
+// credentialed (cookie-bearing) requests to the management API (CSRF/exfil).
+
+const ENV_KEYS = ["CORS_ALLOW_ALL", "CORS_ALLOWED_ORIGINS", "CORS_ORIGIN"] as const;
+const snap: Record<string, string | undefined> = {};
+
+function req(origin: string | null): Request {
+  return new Request(
+    "https://gateway.local/api/cloud-agent/tasks",
+    origin ? { headers: { origin } } : undefined,
+  );
+}
+
+describe("getCloudAgentCorsHeaders — fail-closed credentialed CORS", () => {
+  beforeEach(() => {
+    for (const k of ENV_KEYS) {
+      snap[k] = process.env[k];
+      delete process.env[k];
+    }
+  });
+  afterEach(() => {
+    for (const k of ENV_KEYS) {
+      if (snap[k] === undefined) delete process.env[k];
+      else process.env[k] = snap[k];
+    }
+  });
+
+  it("allowlisted origin -> echoes it, with credentials + Vary: Origin", () => {
+    process.env.CORS_ALLOWED_ORIGINS = "https://app.example.com";
+    const h = getCloudAgentCorsHeaders(req("https://app.example.com"));
+    assert.equal(h["Access-Control-Allow-Origin"], "https://app.example.com");
+    assert.equal(h["Access-Control-Allow-Credentials"], "true");
+    assert.equal(h["Vary"], "Origin");
+  });
+
+  it("non-allowlisted origin -> NO ACAO and NO credentials (fail-closed)", () => {
+    process.env.CORS_ALLOWED_ORIGINS = "https://app.example.com";
+    const h = getCloudAgentCorsHeaders(req("https://evil.example.com"));
+    assert.equal(h["Access-Control-Allow-Origin"], undefined);
+    assert.equal(h["Access-Control-Allow-Credentials"], undefined);
+  });
+
+  it("CORS_ALLOW_ALL wildcard -> NEVER pairs Allow-Credentials with a wildcard echo", () => {
+    process.env.CORS_ALLOW_ALL = "true";
+    const h = getCloudAgentCorsHeaders(req("https://anything.example.com"));
+    assert.equal(h["Access-Control-Allow-Credentials"], undefined);
+  });
+
+  it("no Origin header (same-origin dashboard) -> no ACAO", () => {
+    process.env.CORS_ALLOWED_ORIGINS = "https://app.example.com";
+    const h = getCloudAgentCorsHeaders(req(null));
+    assert.equal(h["Access-Control-Allow-Origin"], undefined);
+  });
+});
diff --git a/tests/unit/cloudflare-ai-image-parts-6390.test.ts b/tests/unit/cloudflare-ai-image-parts-6390.test.ts
new file mode 100644
index 0000000000..1ae3847fbb
--- /dev/null
+++ b/tests/unit/cloudflare-ai-image-parts-6390.test.ts
@@ -0,0 +1,53 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { CloudflareAIExecutor } from "../../open-sse/executors/cloudflare-ai.ts";
+
+// Regression for #6390: the Workers AI /ai/v1/chat/completions endpoint only accepts a
+// plain-string `content` field. transformRequest() used to flatten every non-text content
+// part (e.g. image_url) to an empty string and silently join the rest — the image (or any
+// other non-text attachment) vanished from the outgoing request with no error surfaced to
+// the caller. transformRequest must now refuse the request instead of silently dropping data.
+test("CloudflareAIExecutor.transformRequest throws a clear error on image_url content parts (#6390)", () => {
+  const executor = new CloudflareAIExecutor();
+  const body = {
+    model: "@cf/meta/llama-3.3-70b-instruct",
+    messages: [
+      {
+        role: "user",
+        content: [
+          { type: "text", text: "describe this image" },
+          { type: "image_url", image_url: { url: "https://example.com/cat.png" } },
+        ],
+      },
+    ],
+  };
+
+  assert.throws(
+    () => executor.transformRequest("@cf/meta/llama-3.3-70b-instruct", body, false, null),
+    /does not accept image|non-text content/i
+  );
+});
+
+test("CloudflareAIExecutor.transformRequest still flattens plain text-part messages (#6390 no-regression)", () => {
+  const executor = new CloudflareAIExecutor();
+  const body = {
+    model: "@cf/meta/llama-3.3-70b-instruct",
+    messages: [
+      {
+        role: "user",
+        content: [
+          { type: "text", text: "hello " },
+          { type: "text", text: "world" },
+        ],
+      },
+      { role: "assistant", content: "plain stays plain" },
+    ],
+  };
+
+  const out = executor.transformRequest("@cf/meta/llama-3.3-70b-instruct", body, false, null);
+  const messages = out.messages as Array<{ content: unknown }>;
+
+  assert.equal(messages[0].content, "hello world");
+  assert.equal(messages[1].content, "plain stays plain");
+});
diff --git a/tests/unit/cloudflare-worker-upload-content-type-6416.test.ts b/tests/unit/cloudflare-worker-upload-content-type-6416.test.ts
new file mode 100644
index 0000000000..9840563ac2
--- /dev/null
+++ b/tests/unit/cloudflare-worker-upload-content-type-6416.test.ts
@@ -0,0 +1,99 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { Request as UndiciRequest } from "undici";
+
+import { buildCloudflareWorkerUploadRequest } from "../../src/lib/proxyRelay/cloudflareWorkerScript.ts";
+
+// Issue #6416: deploying a Cloudflare relay Worker from Dashboard → System →
+// Proxy pool → Cloudflare relay failed immediately with:
+//   "Cloudflare Worker upload failed: Content-Type must be one of:
+//    application/javascript, text/javascript, multipart/form-data"
+// even with a valid token/account (not a credential problem).
+//
+// Root cause: the upload built a native `FormData` and let `fetch` derive the
+// multipart Content-Type automatically. In production `globalThis.fetch` is
+// patched (open-sse/utils/proxyFetch.ts) with `node_modules/undici`'s own
+// fetch, whose `FormData`/`Request` classes differ from the runtime's global
+// `FormData` — a cross-realm class mismatch. Passing a native `FormData`
+// instance through undici's `Request`/`fetch` makes it fail to recognize the
+// body as FormData and serialize it as the literal string `"[object
+// FormData]"` with `Content-Type: text/plain;charset=UTF-8`, which Cloudflare
+// rejects outright. This is the same class of bug already fixed once for
+// image edits in #3273 (open-sse/handlers/imageGeneration.ts).
+
+test("RED reproduction: a native FormData body loses its shape through undici's Request/fetch", () => {
+  // This documents the underlying cross-realm bug itself (independent of our
+  // fix) — it does not touch application code, just proves the mechanism
+  // that made the original bug report reproducible on self-hosted Docker
+  // (where globalThis.fetch is always patched with this same `undici` pkg).
+  const fd = new FormData();
+  fd.append(
+    "index.js",
+    new Blob(["export default { fetch() {} };"], { type: "application/javascript" }),
+    "index.js"
+  );
+
+  const req = new UndiciRequest("https://api.cloudflare.com/client/v4/accounts/x/workers/scripts/y", {
+    method: "PUT",
+    body: fd,
+  });
+
+  // This is the exact Content-Type Cloudflare's API rejects — proves *why*
+  // relying on FormData + fetch-derived headers broke on self-hosted Docker.
+  assert.equal(req.headers.get("content-type"), "text/plain;charset=UTF-8");
+});
+
+test("buildCloudflareWorkerUploadRequest sets a Cloudflare-accepted Content-Type", () => {
+  const { headers } = buildCloudflareWorkerUploadRequest("export default { fetch() {} };", {
+    main_module: "index.js",
+    compatibility_date: "2026-03-20",
+  });
+
+  const contentType = headers["Content-Type"];
+  assert.ok(contentType, "Content-Type header must be set explicitly");
+  assert.match(contentType, /^multipart\/form-data; boundary=.+/);
+  assert.notEqual(contentType, "application/json");
+  assert.notEqual(contentType, "text/plain;charset=UTF-8");
+});
+
+test("buildCloudflareWorkerUploadRequest body is a well-formed multipart Buffer carrying both parts", () => {
+  const workerScript = "export default { fetch() { return new Response('ok'); } };";
+  const metadata = { main_module: "index.js", compatibility_date: "2026-03-20" };
+  const { headers, body } = buildCloudflareWorkerUploadRequest(workerScript, metadata);
+
+  assert.ok(Buffer.isBuffer(body), "body must be a Buffer, not a FormData instance");
+  const text = body.toString("utf8");
+  const boundary = headers["Content-Type"].split("boundary=")[1];
+
+  assert.ok(text.includes(`--${boundary}`), "body must contain the declared boundary");
+  assert.ok(
+    text.includes('Content-Disposition: form-data; name="index.js"; filename="index.js"'),
+    "body must carry the index.js script part"
+  );
+  assert.ok(
+    text.includes('Content-Disposition: form-data; name="metadata"; filename="metadata.json"'),
+    "body must carry the metadata part"
+  );
+  assert.ok(text.includes(workerScript), "body must embed the actual worker script source");
+  assert.ok(text.includes(JSON.stringify(metadata)), "body must embed the JSON metadata");
+  assert.ok(!text.includes("[object FormData]"), "body must never degrade to the FormData stringification bug");
+});
+
+test("the request undici's fetch/Request builds from our headers+body keeps the accepted Content-Type", () => {
+  // Simulates exactly what open-sse/utils/proxyFetch.ts's patchedFetch does in
+  // production (self-hosted, non-cloud): constructing a Request/fetch call
+  // via the pinned `undici` package. This is the regression guard for the
+  // actual upload path used by the cloudflare-deploy route.
+  const { headers, body } = buildCloudflareWorkerUploadRequest("export default {};", {
+    main_module: "index.js",
+  });
+
+  const req = new UndiciRequest("https://api.cloudflare.com/client/v4/accounts/x/workers/scripts/y", {
+    method: "PUT",
+    headers,
+    body,
+  });
+
+  const contentType = req.headers.get("content-type");
+  assert.ok(contentType?.startsWith("multipart/form-data; boundary="));
+});
diff --git a/tests/unit/codex-catalog-revalidation-runtime.test.ts b/tests/unit/codex-catalog-revalidation-runtime.test.ts
new file mode 100644
index 0000000000..c7d2d78665
--- /dev/null
+++ b/tests/unit/codex-catalog-revalidation-runtime.test.ts
@@ -0,0 +1,100 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-codex-revalidation-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const revalidation = await import("../../src/shared/services/codexCatalogRevalidation.ts");
+
+const originalFetch = globalThis.fetch;
+const originalEnv = {
+  OMNIROUTE_PORT: process.env.OMNIROUTE_PORT,
+  PORT: process.env.PORT,
+  DASHBOARD_PORT: process.env.DASHBOARD_PORT,
+  BASE_URL: process.env.BASE_URL,
+  NEXT_PUBLIC_BASE_URL: process.env.NEXT_PUBLIC_BASE_URL,
+  NEXT_PUBLIC_APP_URL: process.env.NEXT_PUBLIC_APP_URL,
+  OMNIROUTE_INTERNAL_SCHEME: process.env.OMNIROUTE_INTERNAL_SCHEME,
+};
+
+async function resetStorage() {
+  globalThis.fetch = originalFetch;
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+  process.env.OMNIROUTE_PORT = "20128";
+  process.env.PORT = "22128";
+  process.env.DASHBOARD_PORT = "22128";
+  process.env.BASE_URL = "https://attacker.example";
+  delete process.env.NEXT_PUBLIC_BASE_URL;
+  delete process.env.NEXT_PUBLIC_APP_URL;
+  delete process.env.OMNIROUTE_INTERNAL_SCHEME;
+});
+
+test.after(() => {
+  globalThis.fetch = originalFetch;
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  for (const [key, value] of Object.entries(originalEnv)) {
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+});
+
+test("live Codex revalidation sends its internal header only to the dashboard loopback origin", async () => {
+  const connection = await providersDb.createProviderConnection({
+    provider: "codex",
+    authType: "oauth",
+    name: "Codex Runtime Safety",
+    accessToken: "test-token",
+    isActive: true,
+    providerSpecificData: { workspaceId: "runtime-safety" },
+  });
+  const calls: Array<{ url: string; hasInternalAuth: boolean; redirect?: RequestRedirect }> = [];
+  globalThis.fetch = async (input, init) => {
+    const headers = new Headers(init?.headers);
+    calls.push({
+      url: String(input),
+      hasInternalAuth: headers.has("x-model-sync-internal-auth"),
+      redirect: init?.redirect,
+    });
+    return Response.json({ syncedModels: 1 });
+  };
+
+  const result = await revalidation.liveResyncCodexConnections("http://127.0.0.1:7777");
+
+  assert.deepEqual(result, { attempted: 1, succeeded: 1 });
+  assert.deepEqual(calls, [
+    {
+      url: `http://127.0.0.1:22128/api/providers/${connection.id}/sync-models?quiet=1`,
+      hasInternalAuth: true,
+      redirect: "error",
+    },
+  ]);
+});
+
+test("Codex readiness and live sync resolve the same dashboard loopback port", async () => {
+  const calls: string[] = [];
+  globalThis.fetch = async (input, init) => {
+    calls.push(String(input));
+    assert.equal(init?.redirect, "error");
+    return new Response(null, { status: 404 });
+  };
+
+  await revalidation.waitForLoopbackHttpReady({
+    apiBaseUrl: "http://localhost:7777",
+    maxWaitMs: 100,
+    pollMs: 1,
+  });
+
+  assert.deepEqual(calls, ["http://127.0.0.1:22128/api/providers/__readiness_probe__/models"]);
+});
diff --git a/tests/unit/codex-catalog-revalidation.test.ts b/tests/unit/codex-catalog-revalidation.test.ts
new file mode 100644
index 0000000000..e70bdbc686
--- /dev/null
+++ b/tests/unit/codex-catalog-revalidation.test.ts
@@ -0,0 +1,257 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import type { SyncedAvailableModel } from "../../src/lib/db/models.ts";
+import {
+  createCodexCatalogRevalidationCoordinator,
+  executeCodexCatalogRevalidation,
+  resolveBootRevalidationReason,
+  resolveCodexCatalogAppVersion,
+  scrubSyncedModelsWithCodexDenylist,
+} from "../../src/shared/services/codexCatalogRevalidation.ts";
+
+test("Codex revalidation avoids top-level createRequire in packaged Next modules", () => {
+  const source = fs.readFileSync(
+    path.join(process.cwd(), "src/shared/services/codexCatalogRevalidation.ts"),
+    "utf8"
+  );
+  assert.doesNotMatch(source, /^const\s+\w+\s*=\s*createRequire\s*\(/m);
+});
+
+test("scrubSyncedModelsWithCodexDenylist drops the GPT-5.4 family and keeps others", () => {
+  const input = [
+    { id: "gpt-5.6-sol", name: "Sol", source: "imported" },
+    { id: "gpt-5.4", name: "Retired", source: "imported" },
+    { id: "gpt-5.4-mini", name: "Retired Mini", source: "imported" },
+    { id: "future-codex-experimental", name: "Future", source: "imported" },
+  ] satisfies SyncedAvailableModel[];
+  const { kept, removedIds } = scrubSyncedModelsWithCodexDenylist(input);
+
+  assert.deepEqual(
+    kept.map((m) => m.id),
+    ["gpt-5.6-sol", "future-codex-experimental"]
+  );
+  assert.deepEqual(removedIds.sort(), ["gpt-5.4", "gpt-5.4-mini"]);
+});
+
+test("scrubSyncedModelsWithCodexDenylist is a no-op when nothing is denylisted", () => {
+  const input = [
+    { id: "gpt-5.6-sol", name: "Sol", source: "imported" },
+    { id: "gpt-5.5-low", name: "5.5 Low", source: "imported" },
+  ] satisfies SyncedAvailableModel[];
+  const { kept, removedIds } = scrubSyncedModelsWithCodexDenylist(input);
+  assert.equal(removedIds.length, 0);
+  assert.equal(kept.length, 2);
+});
+
+test("resolveCodexCatalogAppVersion uses stable, source-qualified identities", () => {
+  const runtimeRoot = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-version-identity-"));
+  assert.equal(
+    resolveCodexCatalogAppVersion(
+      {
+        OMNIROUTE_BUILD_SHA: "abc123",
+        npm_package_version: "9.9.9",
+      },
+      { runtimeRoot }
+    ),
+    "build:abc123"
+  );
+  assert.equal(
+    resolveCodexCatalogAppVersion(
+      {
+        npm_package_version: "3.8.47",
+      },
+      { runtimeRoot }
+    ),
+    "pkg:3.8.47"
+  );
+
+  try {
+    fs.writeFileSync(path.join(runtimeRoot, "BUILD_SHA"), "sentinel-sha\n");
+    assert.equal(
+      resolveCodexCatalogAppVersion({}, { runtimeRoot, packageVersion: "3.8.47" }),
+      "build:sentinel-sha"
+    );
+    fs.rmSync(path.join(runtimeRoot, "BUILD_SHA"));
+    fs.writeFileSync(path.join(runtimeRoot, "package.json"), '{"version":"9.8.7"}\n');
+    assert.equal(resolveCodexCatalogAppVersion({}, { runtimeRoot }), "pkg:9.8.7");
+    assert.equal(
+      resolveCodexCatalogAppVersion({}, { runtimeRoot, packageVersion: "3.8.47" }),
+      "pkg:3.8.47"
+    );
+    assert.equal(resolveCodexCatalogAppVersion({}, { runtimeRoot, packageVersion: null }), null);
+  } finally {
+    fs.rmSync(runtimeRoot, { recursive: true, force: true });
+  }
+});
+
+test("resolveBootRevalidationReason only fires on first-start or upgrade", () => {
+  assert.equal(resolveBootRevalidationReason(null, "v2"), "first-start");
+  assert.equal(resolveBootRevalidationReason("", "v2"), "first-start");
+  assert.equal(resolveBootRevalidationReason("v1", "v2"), "upgrade");
+  assert.equal(resolveBootRevalidationReason("v2", "v2"), null);
+});
+
+test("executeCodexCatalogRevalidation records completion only after a full live sync", async () => {
+  const events: string[] = [];
+  const failed = await executeCodexCatalogRevalidation({
+    appVersion: "build:audit",
+    scrub: async () => {
+      events.push("scrub");
+    },
+    waitForReady: async () => {
+      events.push("ready");
+    },
+    liveResync: async () => {
+      events.push("sync");
+      return { attempted: 2, succeeded: 1 };
+    },
+    writeMarker: async () => {
+      events.push("marker");
+      return true;
+    },
+    logSuccess: () => {
+      events.push("log");
+    },
+  });
+
+  assert.equal(failed.complete, false);
+  assert.deepEqual(events, ["scrub", "ready", "sync"]);
+
+  events.length = 0;
+  const complete = await executeCodexCatalogRevalidation({
+    appVersion: "build:audit",
+    scrub: async () => {
+      events.push("scrub");
+    },
+    waitForReady: async () => {
+      events.push("ready");
+    },
+    liveResync: async () => {
+      events.push("sync");
+      return { attempted: 2, succeeded: 2 };
+    },
+    writeMarker: async () => {
+      events.push("marker");
+      return true;
+    },
+    logSuccess: () => {
+      events.push("log");
+    },
+  });
+
+  assert.equal(complete.complete, true);
+  assert.deepEqual(events, ["scrub", "ready", "sync", "marker", "log"]);
+});
+
+test("executeCodexCatalogRevalidation leaves an unknown-version run incomplete and unlogged", async () => {
+  const events: string[] = [];
+  const result = await executeCodexCatalogRevalidation({
+    appVersion: null,
+    scrub: async () => undefined,
+    waitForReady: async () => undefined,
+    liveResync: async () => ({ attempted: 0, succeeded: 0 }),
+    writeMarker: async () => {
+      events.push("marker");
+      return true;
+    },
+    logSuccess: () => {
+      events.push("log");
+    },
+  });
+
+  assert.equal(result.complete, false);
+  assert.deepEqual(events, []);
+});
+
+test("executeCodexCatalogRevalidation does not complete after readiness or marker failure", async () => {
+  let liveCalls = 0;
+  let markerCalls = 0;
+  let successLogs = 0;
+  const notReady = await executeCodexCatalogRevalidation({
+    appVersion: "build:audit",
+    scrub: async () => undefined,
+    waitForReady: async () => {
+      throw new Error("not ready");
+    },
+    liveResync: async () => {
+      liveCalls += 1;
+      return { attempted: 1, succeeded: 1 };
+    },
+    writeMarker: async () => {
+      markerCalls += 1;
+      return true;
+    },
+    logSuccess: () => {
+      successLogs += 1;
+    },
+  });
+  assert.equal(notReady.complete, false);
+  assert.equal(liveCalls, 0);
+  assert.equal(markerCalls, 0);
+  assert.equal(successLogs, 0);
+
+  const markerFailed = await executeCodexCatalogRevalidation({
+    appVersion: "build:audit",
+    scrub: async () => undefined,
+    waitForReady: async () => undefined,
+    liveResync: async () => ({ attempted: 1, succeeded: 1 }),
+    writeMarker: async () => false,
+    logSuccess: () => {
+      successLogs += 1;
+    },
+  });
+  assert.equal(markerFailed.complete, false);
+  assert.equal(successLogs, 0);
+});
+
+test("Codex revalidation coordinator coalesces startup and queues one init rerun", async () => {
+  let releaseFirst: (() => void) | undefined;
+  const firstGate = new Promise<void>((resolve) => {
+    releaseFirst = resolve;
+  });
+  const reasons: string[] = [];
+  let active = 0;
+  let maxActive = 0;
+  const request = createCodexCatalogRevalidationCoordinator(async (options) => {
+    reasons.push(options.reason);
+    active += 1;
+    maxActive = Math.max(maxActive, active);
+    if (reasons.length === 1) await firstGate;
+    active -= 1;
+  });
+
+  const startupA = request({ reason: "upgrade" });
+  const startupB = request({ reason: "upgrade" });
+  const initA = request({ reason: "init" });
+  const initB = request({ reason: "init" });
+  releaseFirst?.();
+  await Promise.all([startupA, startupB, initA, initB]);
+
+  assert.deepEqual(reasons, ["upgrade", "init"]);
+  assert.equal(maxActive, 1);
+});
+
+test("Codex revalidation coordinator does not lose init during active-run settlement", async () => {
+  let releaseFirst: (() => void) | undefined;
+  const firstGate = new Promise<void>((resolve) => {
+    releaseFirst = resolve;
+  });
+  const reasons: string[] = [];
+  const request = createCodexCatalogRevalidationCoordinator(async ({ reason }) => {
+    reasons.push(reason);
+    if (reasons.length === 1) await firstGate;
+  });
+
+  const activeRun = request({ reason: "upgrade" });
+  const settlementInit = firstGate.then(() =>
+    Promise.resolve().then(() => request({ reason: "init" }))
+  );
+  releaseFirst?.();
+  await Promise.all([activeRun, settlementInit]);
+
+  assert.deepEqual(reasons, ["upgrade", "init"]);
+});
diff --git a/tests/unit/codex-compact-strip-include-6805.test.ts b/tests/unit/codex-compact-strip-include-6805.test.ts
new file mode 100644
index 0000000000..91e0d080c3
--- /dev/null
+++ b/tests/unit/codex-compact-strip-include-6805.test.ts
@@ -0,0 +1,28 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { CodexExecutor } from "../../open-sse/executors/codex.ts";
+
+// #6805: compact Codex requests must not forward `include` (e.g.
+// "reasoning.encrypted_content") — the compact endpoint rejects it. Kept in a
+// standalone file so the frozen executor-codex.test.ts does not grow past its cap.
+test("CodexExecutor.transformRequest strips include from compact requests (#6805)", () => {
+  const executor = new CodexExecutor();
+  const result = executor.transformRequest(
+    "gpt-5.3-codex",
+    {
+      _nativeCodexPassthrough: true,
+      include: ["reasoning.encrypted_content"],
+      instructions: "keep this",
+      stream: false,
+    },
+    false,
+    {
+      requestEndpointPath: "/responses/compact",
+      providerSpecificData: { requestDefaults: { serviceTier: "priority" } },
+    }
+  );
+  assert.equal(result.include, undefined);
+  assert.equal(result._nativeCodexPassthrough, undefined);
+  assert.equal(result.instructions, "keep this");
+});
diff --git a/tests/unit/codex-connection-edit-6562.test.ts b/tests/unit/codex-connection-edit-6562.test.ts
new file mode 100644
index 0000000000..7a851e6f90
--- /dev/null
+++ b/tests/unit/codex-connection-edit-6562.test.ts
@@ -0,0 +1,175 @@
+// Regression guard for #6562 — editing any existing OpenAI Codex provider
+// connection returned "Invalid request" on save.
+//
+// Root cause: `createProviderConnection()` (src/lib/db/providers.ts) auto-
+// increments a new connection's `priority` to `MAX(priority)+1` per provider,
+// with NO upper bound — and OAuth-imported connections (Codex `codex-auth/
+// import` and `import-bulk`, up to 50 accounts per call, callable repeatedly)
+// never go through `createProviderSchema`'s Zod validation at all, so nothing
+// ever capped that value at creation time. Codex's own bulk-account-rotation
+// workflow (a common Codex workaround for per-account rate limits) routinely
+// pushes a user well past 100 same-provider connections. `EditConnectionModal`
+// always round-trips the connection's current `priority` unchanged on save
+// (src/app/.../modals/EditConnectionModal.tsx `handleSubmit` — `priority:
+// formData.priority` is unconditional), so the *existing, already-valid*
+// priority gets resent as-is. `updateProviderConnectionSchema` capped
+// `priority`/`globalPriority` at `max(100)` — a UI-only ceiling nothing on the
+// create path ever enforced — so any connection whose priority had already
+// grown past 100 failed re-validation on every single edit with "Invalid
+// request", regardless of which field the user changed.
+//
+// Fix: raise the schema ceiling to `max(100_000)` — still bounded (a
+// genuinely out-of-range value is rejected, see the control test below), just
+// wide enough to accept priorities the app itself already produces.
+//
+// This test drives the real PUT handler with a realistic Codex OAuth edit
+// payload (as EditConnectionModal.tsx actually builds it) against a
+// connection whose priority already exceeds the old 100 cap, and asserts it
+// validates + persists instead of 400ing with "Invalid request".
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { makeManagementSessionRequest } from "../helpers/managementSession.ts";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-codex-edit-6562-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.APP_LOG_TO_FILE = "false";
+process.env.JWT_SECRET = "test-jwt-secret-codex-edit-6562";
+process.env.INITIAL_PASSWORD = "admin-secret";
+
+const core = await import("../../src/lib/db/core.ts");
+const { createProviderConnection, getProviderConnectionById } = await import(
+  "../../src/lib/db/providers.ts"
+);
+const providerByIdRoute = await import("../../src/app/api/providers/[id]/route.ts");
+
+function resetDb() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(() => {
+  resetDb();
+});
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+async function createCodexConnection(priority: number) {
+  // Mirrors createConnectionFromAuthFile()'s real Codex-import shape
+  // (src/lib/oauth/utils/codexAuthImport.ts) — an OAuth connection whose
+  // providerSpecificData already carries a normalized `requestDefaults`
+  // (e.g. from a prior edit) alongside the workspaceId/chatgptUserId/importedAt
+  // fields the importer writes. `priority` is passed explicitly here to
+  // simulate the auto-increment (`MAX(priority)+1`, unbounded) a real user's
+  // Nth bulk-imported Codex account would already carry.
+  return createProviderConnection({
+    provider: "codex",
+    authType: "oauth",
+    name: "Codex (imported)",
+    email: "user@example.com",
+    priority,
+    accessToken: "access-token-value",
+    refreshToken: "refresh-token-value",
+    idToken: "id-token-value",
+    expiresAt: new Date(Date.now() + 3600_000).toISOString(),
+    isActive: true,
+    testStatus: "active",
+    providerSpecificData: {
+      workspaceId: "workspace-abc",
+      chatgptUserId: "user-123",
+      importedAt: new Date().toISOString(),
+      requestDefaults: { reasoningEffort: "medium", serviceTier: "fast" },
+    },
+  });
+}
+
+// Builds the exact `updates` body EditConnectionModal.tsx's handleSubmit()
+// constructs for a Codex OAuth connection edit (isOAuth branch + isCodex
+// block) — `priority` is always resent unchanged (line: `priority:
+// formData.priority`), which is exactly what round-trips the pre-existing,
+// already-persisted value that triggers #6562.
+function buildCodexEditPayload(connection: Record<string, unknown>) {
+  return {
+    name: connection.name,
+    priority: connection.priority,
+    maxConcurrent: null,
+    healthCheckInterval: connection.healthCheckInterval ?? 60,
+    rateLimitOverrides: null,
+    providerSpecificData: {
+      ...((connection.providerSpecificData as Record<string, unknown>) || {}),
+      tag: undefined,
+      tags: undefined,
+      excludedModels: undefined,
+      requestDefaults: { reasoningEffort: "high" },
+      openaiStoreEnabled: false,
+      disableCooling: undefined,
+    },
+  };
+}
+
+test("PUT /api/providers/[id] persists a Codex OAuth edit when priority already exceeds the old 100 cap (#6562 RED->GREEN)", async () => {
+  // Simulates the Nth connection from a Codex bulk-account-rotation user —
+  // auto-incremented priority with no upstream cap.
+  const connection = (await createCodexConnection(142)) as Record<string, unknown>;
+  assert.equal(connection.provider, "codex");
+  assert.equal(connection.authType, "oauth");
+  assert.equal(connection.priority, 142);
+
+  const payload = buildCodexEditPayload(connection);
+
+  const request = await makeManagementSessionRequest(
+    `http://localhost/api/providers/${connection.id}`,
+    { method: "PUT", body: payload }
+  );
+
+  const response = await providerByIdRoute.PUT(request, {
+    params: Promise.resolve({ id: connection.id as string }),
+  });
+  const body = await response.json();
+
+  assert.equal(
+    response.status,
+    200,
+    `expected the Codex edit to validate + persist, got ${response.status}: ${JSON.stringify(body)}`
+  );
+  assert.notEqual(body?.error?.message, "Invalid request");
+
+  const persisted = (await getProviderConnectionById(connection.id as string)) as Record<
+    string,
+    unknown
+  >;
+  // `updateProviderConnection` renormalizes every same-provider connection's
+  // priority to a dense 1..N sequence whenever `priority` is part of the
+  // update (`_reorderConnections`, src/lib/db/providers.ts) — this is the
+  // connection's first successful edit, so it lands at rank 1 (only Codex
+  // connection in this test). The point of this assertion is that the save
+  // *persisted* at all instead of 400ing before ever reaching that step.
+  assert.equal(persisted.priority, 1);
+  const persistedPsd = persisted.providerSpecificData as Record<string, unknown>;
+  assert.deepEqual(persistedPsd.requestDefaults, { reasoningEffort: "high" });
+});
+
+test("PUT /api/providers/[id] still rejects a genuinely invalid priority (control)", async () => {
+  const connection = (await createCodexConnection(5)) as Record<string, unknown>;
+
+  const payload = { ...buildCodexEditPayload(connection), priority: 500_000 };
+
+  const request = await makeManagementSessionRequest(
+    `http://localhost/api/providers/${connection.id}`,
+    { method: "PUT", body: payload }
+  );
+
+  const response = await providerByIdRoute.PUT(request, {
+    params: Promise.resolve({ id: connection.id as string }),
+  });
+  const body = await response.json();
+
+  assert.equal(response.status, 400);
+  assert.equal(body?.error?.message, "Invalid request");
+});
diff --git a/tests/unit/codex-effort-model-echo-3697.test.ts b/tests/unit/codex-effort-model-echo-3697.test.ts
new file mode 100644
index 0000000000..0779322459
--- /dev/null
+++ b/tests/unit/codex-effort-model-echo-3697.test.ts
@@ -0,0 +1,130 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { isCodexOriginatedHeaders } from "../../open-sse/config/codexIdentity.ts";
+import {
+  echoModelInObject,
+  echoModelInSseLine,
+} from "../../open-sse/services/responseModelEcho.ts";
+
+const { openaiToOpenAIResponsesResponse } = await import(
+  "../../open-sse/translator/response/openai-responses.ts"
+);
+const { initState } = await import("../../open-sse/translator/index.ts");
+const { FORMATS } = await import("../../open-sse/translator/formats.ts");
+
+// #3697: Codex CLI compatibility shim — echo the client-requested (effort-suffixed) model
+// id (e.g. `gpt-5.5-xhigh`) in Responses API payloads instead of the bare upstream id
+// (`gpt-5.5`), so the Codex CLI status line/model button shows the active effort.
+
+function collectResponsesEvents(chunks: Array<Record<string, unknown> | null>) {
+  const state = initState(FORMATS.OPENAI_RESPONSES) as Record<string, unknown>;
+  const events: Array<{ event: string; data: Record<string, unknown> }> = [];
+  for (const chunk of chunks) {
+    const result = openaiToOpenAIResponsesResponse(chunk as never, state as never);
+    if (result) events.push(...(result as never));
+  }
+  return events;
+}
+
+test("isCodexOriginatedHeaders detects Codex CLI via originator header (Headers instance)", () => {
+  const headers = new Headers({ originator: "codex_cli_rs" });
+  assert.equal(isCodexOriginatedHeaders(headers), true);
+});
+
+test("isCodexOriginatedHeaders detects Codex CLI via User-Agent (plain object, case-insensitive)", () => {
+  assert.equal(isCodexOriginatedHeaders({ "User-Agent": "codex_cli_rs/0.136.0" }), true);
+});
+
+test("isCodexOriginatedHeaders returns false for non-Codex clients", () => {
+  assert.equal(isCodexOriginatedHeaders(new Headers({ "user-agent": "curl/8.0" })), false);
+  assert.equal(isCodexOriginatedHeaders({}), false);
+  assert.equal(isCodexOriginatedHeaders(null), false);
+});
+
+test("OpenAI -> Responses translator carries the upstream model into response.created/completed", () => {
+  const events = collectResponsesEvents([
+    {
+      id: "chatcmpl-1",
+      model: "gpt-5.5",
+      choices: [{ index: 0, delta: { content: "hi" }, finish_reason: null }],
+    },
+    {
+      id: "chatcmpl-1",
+      model: "gpt-5.5",
+      choices: [{ index: 0, delta: {}, finish_reason: "stop" }],
+    },
+    null, // flush -> response.completed
+  ]);
+
+  const created = events.find((e) => e.event === "response.created");
+  const completed = events.find((e) => e.event === "response.completed");
+  assert.equal((created!.data.response as Record<string, unknown>).model, "gpt-5.5");
+  assert.equal((completed!.data.response as Record<string, unknown>).model, "gpt-5.5");
+});
+
+test("OpenAI -> Responses translator omits model when the upstream never sent one (no regression)", () => {
+  const events = collectResponsesEvents([
+    {
+      id: "chatcmpl-1",
+      choices: [{ index: 0, delta: { content: "hi" }, finish_reason: null }],
+    },
+    {
+      id: "chatcmpl-1",
+      choices: [{ index: 0, delta: {}, finish_reason: "stop" }],
+    },
+    null,
+  ]);
+
+  const created = events.find((e) => e.event === "response.created");
+  const completed = events.find((e) => e.event === "response.completed");
+  assert.equal("model" in (created!.data.response as Record<string, unknown>), false);
+  assert.equal("model" in (completed!.data.response as Record<string, unknown>), false);
+});
+
+test("full shim pipeline: bare upstream model in Responses payloads gets rewritten to the requested effort-suffixed id", () => {
+  const events = collectResponsesEvents([
+    {
+      id: "chatcmpl-1",
+      model: "gpt-5.5",
+      choices: [{ index: 0, delta: { content: "hi" }, finish_reason: null }],
+    },
+    {
+      id: "chatcmpl-1",
+      model: "gpt-5.5",
+      choices: [{ index: 0, delta: {}, finish_reason: "stop" }],
+    },
+    null,
+  ]);
+
+  const requestedModel = "gpt-5.5-xhigh";
+  const created = events.find((e) => e.event === "response.created")!.data;
+  const completed = events.find((e) => e.event === "response.completed")!.data;
+
+  // Non-stream / object form (chatCore's non-streaming return path).
+  echoModelInObject(created, requestedModel);
+  echoModelInObject(completed, requestedModel);
+  assert.equal((created.response as Record<string, unknown>).model, requestedModel);
+  assert.equal((completed.response as Record<string, unknown>).model, requestedModel);
+
+  // Streaming SSE-line form (chatCore's createModelEchoTransform pipe stage).
+  const sseLine = `data: ${JSON.stringify({
+    type: "response.completed",
+    response: { id: "resp_1", object: "response", model: "gpt-5.5", status: "completed" },
+  })}`;
+  const rewritten = echoModelInSseLine(sseLine, requestedModel);
+  assert.ok(rewritten.includes(`"model":"${requestedModel}"`), rewritten);
+  assert.ok(!rewritten.includes('"model":"gpt-5.5"'), rewritten);
+});
+
+test("echoModelInObject/echoModelInSseLine leave non-Responses shapes governed by the existing top-level rule (no regression)", () => {
+  const chatCompletionChunk = { id: "x", model: "gpt-5.5", choices: [] };
+  echoModelInObject(chatCompletionChunk, "claude-sonnet-cx");
+  assert.equal(chatCompletionChunk.model, "claude-sonnet-cx");
+
+  const line = echoModelInSseLine(
+    'data: {"id":"1","model":"gpt-5.5","choices":[]}',
+    "claude-sonnet-cx"
+  );
+  assert.equal(line, 'data: {"id":"1","model":"claude-sonnet-cx","choices":[]}');
+});
diff --git a/tests/unit/codex-fast-tier.test.ts b/tests/unit/codex-fast-tier.test.ts
index f411574345..645d4ce43d 100644
--- a/tests/unit/codex-fast-tier.test.ts
+++ b/tests/unit/codex-fast-tier.test.ts
@@ -38,7 +38,11 @@ test("Codex global service mode distinguishes no setting from explicit tiers", (
   );
   assert.deepEqual(
     resolveCodexGlobalFastServiceTier({ codexServiceTier: { enabled: true, tier: "default" } }),
-    { enabled: true, tier: "default", supportedModels: ["gpt-5.5", "gpt-5.4"] }
+    {
+      enabled: true,
+      tier: "default",
+      supportedModels: ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-5.5"],
+    }
   );
 });
 
diff --git a/tests/unit/codex-gpt56-catalog.test.ts b/tests/unit/codex-gpt56-catalog.test.ts
new file mode 100644
index 0000000000..4c5d3c6d30
--- /dev/null
+++ b/tests/unit/codex-gpt56-catalog.test.ts
@@ -0,0 +1,62 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { getModelsByProviderId } from "../../open-sse/config/providerModels.ts";
+
+test("Codex catalog exposes the GPT-5.6 lineup in configured priority order", () => {
+  const models = getModelsByProviderId("codex");
+  const expectedIds = [
+    "gpt-5.6-sol",
+    "gpt-5.6-sol-ultra",
+    "gpt-5.6-sol-max",
+    "gpt-5.6-sol-xhigh",
+    "gpt-5.6-sol-high",
+    "gpt-5.6-sol-medium",
+    "gpt-5.6-sol-low",
+    "gpt-5.6-terra",
+    "gpt-5.6-terra-ultra",
+    "gpt-5.6-terra-max",
+    "gpt-5.6-terra-xhigh",
+    "gpt-5.6-terra-high",
+    "gpt-5.6-terra-medium",
+    "gpt-5.6-terra-low",
+    "gpt-5.6-luna",
+    "gpt-5.6-luna-max",
+    "gpt-5.6-luna-xhigh",
+    "gpt-5.6-luna-high",
+    "gpt-5.6-luna-medium",
+    "gpt-5.6-luna-low",
+  ];
+
+  assert.deepEqual(
+    models.slice(0, expectedIds.length).map((model) => model.id),
+    expectedIds
+  );
+
+  for (const modelId of expectedIds) {
+    const model = models.find((entry) => entry.id === modelId);
+    assert.ok(model, `codex must expose ${modelId}`);
+    assert.equal(model.contextLength, 500000);
+    assert.equal(model.maxInputTokens, 372000);
+    assert.equal(model.maxOutputTokens, 128000);
+    assert.equal(model.targetFormat, "openai-responses");
+    assert.equal(model.toolCalling, true);
+    assert.equal(model.supportsReasoning, true);
+    assert.equal(model.supportsVision, true);
+    assert.equal(model.supportsXHighEffort, true);
+  }
+
+  assert.equal(
+    models.some((model) => model.id === "gpt-5.6-luna-ultra"),
+    false
+  );
+});
+
+test("Codex catalog no longer exposes GPT-5.4 models", () => {
+  const models = getModelsByProviderId("codex");
+
+  assert.deepEqual(
+    models.filter((model) => model.id.startsWith("gpt-5.4")).map((model) => model.id),
+    []
+  );
+});
diff --git a/tests/unit/codex-models-catalog-refresh.test.ts b/tests/unit/codex-models-catalog-refresh.test.ts
index 1889005b17..9de940db09 100644
--- a/tests/unit/codex-models-catalog-refresh.test.ts
+++ b/tests/unit/codex-models-catalog-refresh.test.ts
@@ -32,8 +32,14 @@ process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "catalog-test-secret"
 
 const core = await import("../../src/lib/db/core.ts");
 const apiKeysDb = await import("../../src/lib/db/apiKeys.ts");
+const modelsDb = await import("../../src/lib/db/models.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
 const v1ModelsCatalog = await import("../../src/app/api/v1/models/catalog.ts");
 
+type CatalogResponse = {
+  data?: Array<{ id: string }>;
+};
+
 async function resetStorage() {
   core.resetDbInstance();
   apiKeysDb.resetApiKeyState();
@@ -56,7 +62,8 @@ test("codex client (originator: codex_exec) receives a top-level `models` array
     new Request("http://localhost/v1/models?client_version=0.137.0", {
       headers: {
         originator: "codex_exec",
-        "user-agent": "codex_exec/0.137.0 (Ubuntu 24.4.0; x86_64) vscode/3.7.19 (codex_exec; 0.137.0)",
+        "user-agent":
+          "codex_exec/0.137.0 (Ubuntu 24.4.0; x86_64) vscode/3.7.19 (codex_exec; 0.137.0)",
       },
     })
   );
@@ -103,3 +110,48 @@ test("non-codex OpenAI client keeps the unchanged {object,data} shape (no `model
     "non-codex clients must NOT receive a `models` key (response stays byte-identical)"
   );
 });
+
+test("v1 models catalog exposes remote-only Codex IDs from the discovery cache", async () => {
+  const connection = await providersDb.createProviderConnection({
+    provider: "codex",
+    authType: "oauth",
+    name: "codex-curated-catalog",
+    accessToken: "codex-access-token",
+    isActive: true,
+    testStatus: "active",
+  });
+
+  await modelsDb.replaceSyncedAvailableModelsForConnection("codex", connection.id, [
+    {
+      id: "codex-auto-review",
+      name: "Codex Auto Review Remote",
+      source: "imported",
+      supportedEndpoints: ["responses"],
+    },
+    {
+      id: "future-codex-model",
+      name: "Future Codex Model",
+      source: "imported",
+      supportedEndpoints: ["responses"],
+    },
+    {
+      id: "gpt-5.4-mini",
+      name: "Retired GPT-5.4 Mini",
+      source: "imported",
+      supportedEndpoints: ["responses"],
+    },
+  ]);
+
+  const response = await v1ModelsCatalog.getUnifiedModelsResponse(
+    new Request("http://localhost/api/v1/models")
+  );
+  const body = (await response.json()) as CatalogResponse;
+  const ids = new Set((body.data || []).map((item) => item.id));
+
+  assert.equal(response.status, 200);
+  assert.equal(ids.has("cx/codex-auto-review"), true);
+  assert.equal(ids.has("cx/future-codex-model"), true);
+  assert.equal(ids.has("codex/future-codex-model"), true);
+  assert.equal(ids.has("cx/gpt-5.4-mini"), false);
+  assert.equal(ids.has("codex/gpt-5.4-mini"), false);
+});
diff --git a/tests/unit/codex-oauth-refresh-persist-6352.test.ts b/tests/unit/codex-oauth-refresh-persist-6352.test.ts
new file mode 100644
index 0000000000..12f23cd67d
--- /dev/null
+++ b/tests/unit/codex-oauth-refresh-persist-6352.test.ts
@@ -0,0 +1,204 @@
+/**
+ * #6352 — Codex/ChatGPT OAuth refresh: reuse + persist + rotate + clear stale
+ * "auth failed" state.
+ *
+ * Reported symptom: a ChatGPT Plus account added via Codex OAuth stops working
+ * after ~2 days and the dashboard's manual "Refresh token" button is reported
+ * as "not enough" — after clicking it the connection still shows `auth failed`.
+ *
+ * Root cause traced in this PR: `updateProviderCredentials()`
+ * (src/sse/services/tokenRefresh.ts) is the shared onPersist callback for every
+ * refresh entry point (the manual refresh route, the reactive per-request
+ * refresh in chat.ts's `checkAndRefreshToken`, the Codex auth-file importer).
+ * It correctly persists the new accessToken/refreshToken/expiresAt — but it
+ * NEVER cleared the stale auth-failure metadata (`testStatus`, `lastError`,
+ * `lastErrorType`, `lastErrorSource`, `errorCode`) left over from a prior
+ * expired/invalid refresh or upstream 401/403. Only the separate background
+ * health-check sweep (tokenHealthCheck.ts::checkConnection) did this clearing
+ * inline in its own onPersist callback. So a refresh that ACTUALLY succeeded
+ * — reusing the stored refresh_token, obtaining a fresh access_token, and even
+ * rotating in a new refresh_token — still left the connection displaying
+ * "Auth Failed" forever, because nothing ever reset the error columns.
+ *
+ * This test drives `checkAndRefreshToken("codex", ...)` — the exact function
+ * the real per-request refresh path (src/sse/handlers/chat.ts) calls — against
+ * a connection pre-seeded in a stale "auth failed" state, with a mocked Codex
+ * token endpoint. It asserts:
+ *   (a) the refresh REUSES the stored refresh_token (request body assertion),
+ *   (b) the refreshed access_token is PERSISTED back to the connection row,
+ *   (c) a ROTATED refresh_token REPLACES the previously stored one,
+ *   (d) the stale testStatus/lastError* auth-failure fields are CLEARED so the
+ *       dashboard stops showing "Auth Failed" after a refresh that worked.
+ *
+ * (d) is the part that reproduces the reported bug: before the fix in
+ * src/sse/services/tokenRefresh.ts, this assertion fails (RED) because
+ * updateProviderCredentials left testStatus/lastError untouched.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-codex-refresh-6352-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = "test-api-key-secret-6352";
+
+const core = await import("../../src/lib/db/core.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const tokenRefresh = await import("../../src/sse/services/tokenRefresh.ts");
+const { OAUTH_ENDPOINTS } = await import("../../open-sse/config/constants.ts");
+
+async function resetStorage() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+function jsonResponse(body: unknown, status = 200) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+type ConnectionRecord = {
+  id: string;
+  accessToken?: string | null;
+  refreshToken?: string | null;
+  testStatus?: string | null;
+  lastError?: string | null;
+  lastErrorType?: string | null;
+  lastErrorSource?: string | null;
+  errorCode?: string | null;
+};
+
+type FetchOptions = { body?: string };
+
+async function withMockedFetch<T>(
+  fetchImpl: (url: unknown, options?: FetchOptions) => Promise<Response>,
+  fn: () => Promise<T>
+): Promise<T> {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = fetchImpl as typeof fetch;
+  try {
+    return await fn();
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(async () => {
+  await resetStorage();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("checkAndRefreshToken reuses the stored Codex refresh_token, persists the new access_token, rotates the refresh_token, and clears stale auth-failure state (#6352)", async () => {
+  const now = Date.now();
+
+  // Seed a connection in the exact "auth failed" state the issue describes:
+  // a prior refresh/request failure left testStatus/lastError* populated.
+  const connection = await providersDb.createProviderConnection({
+    provider: "codex",
+    authType: "oauth",
+    name: "ChatGPT Plus (Codex OAuth)",
+    accessToken: "codex-stale-access",
+    refreshToken: "codex-stored-refresh-token",
+    // Already past the 5-minute Codex refresh lead → checkAndRefreshToken refreshes.
+    expiresAt: new Date(now - 60_000).toISOString(),
+    testStatus: "invalid",
+    lastError: "Refresh token expired. Please re-authenticate this account.",
+    lastErrorAt: new Date(now - 120_000).toISOString(),
+    lastErrorType: "upstream_auth_error",
+    lastErrorSource: "oauth",
+    errorCode: "401",
+  } as unknown as Record<string, unknown>);
+  const connectionId = (connection as ConnectionRecord).id;
+
+  const capturedRequests: Array<{ url: string; body: string }> = [];
+
+  await withMockedFetch(
+    async (url, options: FetchOptions = {}) => {
+      const body = String(options?.body ?? "");
+      capturedRequests.push({ url: String(url), body });
+      assert.equal(String(url), OAUTH_ENDPOINTS.openai.token);
+
+      // (a) REUSE assertion: the refresh request must present the refresh_token
+      // that was actually stored on the connection — not a re-run of the full
+      // authorization_code flow, and not a stale/blank token.
+      const params = new URLSearchParams(body);
+      assert.equal(params.get("grant_type"), "refresh_token");
+      assert.equal(
+        params.get("refresh_token"),
+        "codex-stored-refresh-token",
+        "must reuse the connection's stored refresh_token"
+      );
+
+      // Simulate OpenAI rotating in a brand-new refresh_token on this refresh.
+      return jsonResponse({
+        access_token: "codex-fresh-access-token",
+        refresh_token: "codex-rotated-refresh-token",
+        expires_in: 3600,
+      });
+    },
+    async () => {
+      const connSnapshot = connection as ConnectionRecord;
+      const refreshed = await tokenRefresh.checkAndRefreshToken("codex", {
+        connectionId,
+        accessToken: connSnapshot.accessToken,
+        refreshToken: connSnapshot.refreshToken,
+        expiresAt: (connection as Record<string, unknown>).expiresAt,
+      });
+
+      assert.equal(capturedRequests.length, 1, "the Codex token endpoint must be hit exactly once");
+
+      // The in-memory result returned to the caller carries the fresh tokens.
+      assert.equal(refreshed.accessToken, "codex-fresh-access-token");
+      assert.equal(refreshed.refreshToken, "codex-rotated-refresh-token");
+
+      const stored = (await providersDb.getProviderConnectionById(
+        connectionId
+      )) as ConnectionRecord;
+
+      // (b) PERSIST assertion: the refreshed access_token must be saved to the row.
+      assert.equal(
+        stored.accessToken,
+        "codex-fresh-access-token",
+        "the refreshed access_token must be persisted back to the connection"
+      );
+
+      // (c) ROTATION assertion: the new refresh_token must REPLACE the old one.
+      assert.equal(
+        stored.refreshToken,
+        "codex-rotated-refresh-token",
+        "a rotated refresh_token must replace the previously stored one"
+      );
+      assert.notEqual(
+        stored.refreshToken,
+        "codex-stored-refresh-token",
+        "the stale, already-consumed refresh_token must not remain stored"
+      );
+
+      // (d) CLEAR-STALE-STATE assertion: a successful refresh must clear the
+      // auth-failure fields that drive the dashboard's "Auth Failed" badge.
+      // Before the fix these remained "invalid" / "upstream_auth_error" / "401"
+      // even though the token had genuinely refreshed.
+      assert.equal(
+        stored.testStatus,
+        "active",
+        "testStatus must clear to active after a successful refresh"
+      );
+      // The read path (getProviderConnectionById) strips null-valued columns via
+      // cleanNulls(), so a cleared column surfaces as `undefined`, not `null` —
+      // both mean "cleared" here.
+      assert.equal(stored.lastError ?? null, null, "lastError must be cleared");
+      assert.equal(stored.lastErrorType ?? null, null, "lastErrorType must be cleared");
+      assert.equal(stored.lastErrorSource ?? null, null, "lastErrorSource must be cleared");
+      assert.equal(stored.errorCode ?? null, null, "errorCode must be cleared");
+    }
+  );
+});
diff --git a/tests/unit/codex-spark-image-generation.test.ts b/tests/unit/codex-spark-image-generation.test.ts
new file mode 100644
index 0000000000..7d2671b866
--- /dev/null
+++ b/tests/unit/codex-spark-image-generation.test.ts
@@ -0,0 +1,61 @@
+/**
+ * #6651 — Codex Desktop injects the `image_generation` hosted tool into every
+ * Responses API request. OmniRoute only dropped it for free-plan Codex
+ * accounts (isCodexFreePlan). It did NOT drop it for gpt-5.3-codex-spark (and
+ * other Spark-scope models), which reject `image_generation` upstream even on
+ * paid-plan accounts, producing:
+ * [400]: Tool 'image_generation' is not supported with gpt-5.3-codex-spark.
+ *
+ * Fix: CodexExecutor.transformRequest now also drops image_generation when
+ * the target model resolves to the Spark quota scope
+ * (getCodexModelScope(model) === "spark"), independent of plan.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { CodexExecutor } = await import("../../open-sse/executors/codex.ts");
+
+function buildBody() {
+  return {
+    _nativeCodexPassthrough: true,
+    tools: [
+      { type: "image_generation", output_format: "png" },
+      { type: "function", name: "foo", parameters: { type: "object" } },
+    ],
+  };
+}
+
+test("#6651: CodexExecutor.transformRequest drops image_generation for gpt-5.3-codex-spark even on a paid-plan account", () => {
+  const executor = new CodexExecutor();
+
+  // Paid-plan account (not free) — isCodexFreePlan() alone returns false, so
+  // the fix must rely on the model-scope check to still drop the tool.
+  const result = executor.transformRequest("gpt-5.3-codex-spark", buildBody(), false, {
+    providerSpecificData: { workspacePlanType: "team" },
+  }) as { tools: Array<{ type?: string }> };
+
+  assert.equal(
+    result.tools.some((t) => t.type === "image_generation"),
+    false,
+    "image_generation must be dropped for gpt-5.3-codex-spark regardless of account plan (#6651)"
+  );
+  assert.equal(
+    result.tools.some((t) => t.type === "function"),
+    true,
+    "the function tool must survive"
+  );
+});
+
+test("#6651: CodexExecutor.transformRequest still preserves image_generation for non-Spark models on paid plans", () => {
+  const executor = new CodexExecutor();
+
+  const result = executor.transformRequest("gpt-5", buildBody(), false, {
+    providerSpecificData: { workspacePlanType: "team" },
+  }) as { tools: Array<{ type?: string }> };
+
+  assert.equal(
+    result.tools.some((t) => t.type === "image_generation"),
+    true,
+    "image_generation must still be preserved for non-Spark models on paid plans"
+  );
+});
diff --git a/tests/unit/codex-sse-capacity-fallback.test.ts b/tests/unit/codex-sse-capacity-fallback.test.ts
new file mode 100644
index 0000000000..2316e1cd02
--- /dev/null
+++ b/tests/unit/codex-sse-capacity-fallback.test.ts
@@ -0,0 +1,157 @@
+// Sub-bug #3 of upstream decolua/9router#2452 (@ryanngit): Codex sometimes answers
+// with HTTP 200 and a text/event-stream body whose payload carries a transient
+// "model at capacity" / overloaded error mid-stream. Left unhandled, the 200
+// status makes this look like a successful response — no retry, no circuit
+// breaker, no combo/account fallback engages, so the client either hangs or gets
+// a truncated stream while a healthy account sits idle. This must be detected and
+// converted into a real error Response (503) so accountFallback.ts / combo
+// routing rotates to another account.
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { CodexExecutor, __setCodexWebSocketTransportForTesting } from "../../open-sse/executors/codex.ts";
+
+test.afterEach(() => {
+  __setCodexWebSocketTransportForTesting(undefined);
+});
+
+function sseStreamFromChunks(chunks: string[]): ReadableStream<Uint8Array> {
+  const encoder = new TextEncoder();
+  let i = 0;
+  return new ReadableStream<Uint8Array>({
+    pull(controller) {
+      if (i >= chunks.length) {
+        controller.close();
+        return;
+      }
+      controller.enqueue(encoder.encode(chunks[i]));
+      i++;
+    },
+  });
+}
+
+test("CodexExecutor.execute converts a 200-OK SSE stream carrying a model-at-capacity error into a 503 Response", async () => {
+  const executor = new CodexExecutor();
+  const originalFetch = globalThis.fetch;
+
+  globalThis.fetch = async () =>
+    new Response(
+      sseStreamFromChunks([
+        'event: error\ndata: {"error":{"message":"Selected model is at capacity. Please try a different model."}}\n\n',
+      ]),
+      {
+        status: 200,
+        headers: { "Content-Type": "text/event-stream" },
+      }
+    );
+
+  try {
+    const result = await executor.execute({
+      model: "gpt-5.5",
+      body: { model: "gpt-5.5", input: [{ role: "user", content: "hello" }] },
+      stream: true,
+      credentials: { accessToken: "codex-token" },
+    });
+
+    assert.notEqual(result.response.status, 200);
+    assert.equal(result.response.status, 503);
+    const body = await result.response.json();
+    assert.match(body.error.message, /at capacity/i);
+    // Hard Rule #12: never leak raw stack/paths in the sanitized error body.
+    assert.equal(body.error.message.includes("at /"), false);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("CodexExecutor.execute converts server_is_overloaded / service_unavailable_error SSE payloads into a 503 Response", async () => {
+  const executor = new CodexExecutor();
+  const originalFetch = globalThis.fetch;
+
+  globalThis.fetch = async () =>
+    new Response(
+      sseStreamFromChunks([
+        'event: error\ndata: {"error":{"type":"server_is_overloaded","message":"The server is overloaded. Please retry later."}}\n\n',
+      ]),
+      {
+        status: 200,
+        headers: { "Content-Type": "text/event-stream" },
+      }
+    );
+
+  try {
+    const result = await executor.execute({
+      model: "gpt-5.5",
+      body: { model: "gpt-5.5", input: [{ role: "user", content: "hello" }] },
+      stream: true,
+      credentials: { accessToken: "codex-token" },
+    });
+
+    assert.equal(result.response.status, 503);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("CodexExecutor.execute reassembles a normal 200-OK SSE stream byte-intact after peeking for transient errors", async () => {
+  const executor = new CodexExecutor();
+  const originalFetch = globalThis.fetch;
+
+  const normalSse =
+    'event: response.output_text.delta\ndata: {"type":"response.output_text.delta","delta":"Hello"}\n\n' +
+    'event: response.completed\ndata: {"type":"response.completed","response":{"status":"completed"}}\n\n';
+
+  globalThis.fetch = async () =>
+    new Response(sseStreamFromChunks([normalSse]), {
+      status: 200,
+      headers: { "Content-Type": "text/event-stream" },
+    });
+
+  try {
+    const result = await executor.execute({
+      model: "gpt-5.5",
+      body: { model: "gpt-5.5", input: [{ role: "user", content: "hello" }] },
+      stream: true,
+      credentials: { accessToken: "codex-token" },
+    });
+
+    assert.equal(result.response.status, 200);
+    const text = await result.response.text();
+    assert.equal(text, normalSse);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("CodexExecutor.execute reassembles a normal SSE stream split across multiple network chunks", async () => {
+  const executor = new CodexExecutor();
+  const originalFetch = globalThis.fetch;
+
+  const chunks = [
+    'event: response.output_text.delta\ndata: {"type":"response.output_text.delta","delta":"Hel',
+    'lo"}\n\n',
+    'event: response.completed\ndata: {"type":"response.completed","response":{"status":"completed"}}\n\n',
+  ];
+  const expected = chunks.join("");
+
+  globalThis.fetch = async () =>
+    new Response(sseStreamFromChunks(chunks), {
+      status: 200,
+      headers: { "Content-Type": "text/event-stream" },
+    });
+
+  try {
+    const result = await executor.execute({
+      model: "gpt-5.5",
+      body: { model: "gpt-5.5", input: [{ role: "user", content: "hello" }] },
+      stream: true,
+      credentials: { accessToken: "codex-token" },
+    });
+
+    assert.equal(result.response.status, 200);
+    const text = await result.response.text();
+    assert.equal(text, expected);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
diff --git a/tests/unit/codex-stream-false.test.ts b/tests/unit/codex-stream-false.test.ts
index c20ff069b6..5af1f80f3c 100644
--- a/tests/unit/codex-stream-false.test.ts
+++ b/tests/unit/codex-stream-false.test.ts
@@ -213,14 +213,14 @@ test.after(async () => {
 test("CodexExecutor.transformRequest clones the request body before forcing stream=true", () => {
   const executor = new CodexExecutor();
   const body = {
-    model: "gpt-5.4",
+    model: "gpt-5.6-sol",
     input: [{ role: "user", content: [{ type: "input_text", text: "Oi" }] }],
     stream: false,
     reasoning: { effort: "low" },
   };
   const original = structuredClone(body);
 
-  const transformed = executor.transformRequest("gpt-5.4", body, false, {
+  const transformed = executor.transformRequest("gpt-5.6-sol", body, false, {
     requestEndpointPath: "/responses",
   });
 
@@ -314,7 +314,7 @@ test("chatCore converts Responses-style NDJSON fallback into JSON when stream=fa
 test("handleComboChat validates non-stream quality using the original client stream intent", async () => {
   const combo = {
     name: "codex-stream-false-quality",
-    models: ["codex/gpt-5.4", "openai/gpt-4o-mini"],
+    models: ["codex/gpt-5.6-sol", "openai/gpt-4o-mini"],
   };
   const log = createComboLog();
   const seenModels = [];
@@ -327,7 +327,7 @@ test("handleComboChat validates non-stream quality using the original client str
     combo,
     handleSingleModel: async (requestBody, modelStr) => {
       seenModels.push(modelStr);
-      if (modelStr === "codex/gpt-5.4") {
+      if (modelStr === "codex/gpt-5.6-sol") {
         requestBody.stream = true;
         return jsonResponse({
           choices: [
@@ -355,7 +355,7 @@ test("handleComboChat validates non-stream quality using the original client str
   const payload = (await result.json()) as any;
 
   assert.equal(result.ok, true);
-  assert.deepEqual(seenModels, ["codex/gpt-5.4", "openai/gpt-4o-mini"]);
+  assert.deepEqual(seenModels, ["codex/gpt-5.6-sol", "openai/gpt-4o-mini"]);
   assert.equal(payload.choices[0].message.content, "Brasilia");
   assert.ok(
     log.entries.some(
diff --git a/tests/unit/codex-ws-policy-enforcement-6564.test.ts b/tests/unit/codex-ws-policy-enforcement-6564.test.ts
new file mode 100644
index 0000000000..981991dd27
--- /dev/null
+++ b/tests/unit/codex-ws-policy-enforcement-6564.test.ts
@@ -0,0 +1,161 @@
+/**
+ * Regression guard for #6564.
+ *
+ * The Codex Responses-over-WebSocket bridge (`src/app/api/internal/codex-responses-ws/route.ts`)
+ * authenticates the API key (`authenticate()` / `authorizeWebSocketHandshake()`) but historically
+ * never enforced the API-key model/combo policy the HTTP `/v1/responses` path enforces via
+ * `enforceApiKeyPolicy()`. A key restricted via `allowedModels` could still reach a DIRECT Codex
+ * model (e.g. `gpt-5.5`) through this WS transport, as long as an eligible Codex OAuth connection
+ * existed — silently bypassing the restriction the HTTP path correctly rejects.
+ *
+ * `prepare()` now calls `enforceApiKeyPolicy()` against the client-requested model BEFORE any
+ * Codex-specific model remapping / credential selection, using a synthetic `Request` carrying an
+ * explicit `Authorization: Bearer <apiKey>` header (the WS bridge's token normally arrives via a
+ * `requestUrl` query param, not a header, so the same extraction `enforceApiKeyPolicy()` uses on
+ * the HTTP path would otherwise see no credential at all).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-codex-ws-policy-6564-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "issue-6564-api-key-secret";
+process.env.OMNIROUTE_WS_BRIDGE_SECRET = "issue-6564-bridge-secret";
+
+const coreDb = await import("../../src/lib/db/core.ts");
+const apiKeysDb = await import("../../src/lib/db/apiKeys.ts");
+const combosDb = await import("../../src/lib/db/combos.ts");
+const costRules = await import("../../src/domain/costRules.ts");
+const rateLimiter = await import("../../src/shared/utils/rateLimiter.ts");
+const route = await import("../../src/app/api/internal/codex-responses-ws/route.ts");
+
+rateLimiter.setRateLimiterTestMode(true);
+
+function getFsErrorCode(error: unknown): string | undefined {
+  if (typeof error !== "object" || error === null || !("code" in error)) return undefined;
+  const { code } = error as { code?: unknown };
+  return typeof code === "string" ? code : undefined;
+}
+
+async function resetStorage() {
+  apiKeysDb.resetApiKeyState();
+  costRules.resetCostData();
+  coreDb.resetDbInstance();
+
+  for (let attempt = 0; attempt < 10; attempt++) {
+    try {
+      if (fs.existsSync(TEST_DATA_DIR)) {
+        fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+      }
+      break;
+    } catch (error: unknown) {
+      const code = getFsErrorCode(error);
+      if ((code === "EBUSY" || code === "EPERM") && attempt < 9) {
+        await new Promise((resolve) => setTimeout(resolve, 50 * (attempt + 1)));
+      } else {
+        throw error;
+      }
+    }
+  }
+
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(async () => {
+  apiKeysDb.resetApiKeyState();
+  costRules.resetCostData();
+  coreDb.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+/** Builds a bridge POST request for the internal codex-responses-ws route's "prepare" action. */
+function buildPrepareRequest(apiKey: string, model: string): Request {
+  return new Request("http://localhost/api/internal/codex-responses-ws", {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      "x-omniroute-ws-bridge-secret": process.env.OMNIROUTE_WS_BRIDGE_SECRET as string,
+    },
+    body: JSON.stringify({
+      action: "prepare",
+      // The bridge's real client sends the WS auth token via a query param on
+      // requestUrl (api_key/token/access_token) — never a header.
+      requestUrl: `/api/v1/responses?api_key=${encodeURIComponent(apiKey)}`,
+      response: { model },
+    }),
+  });
+}
+
+test("WS prepare() rejects a DIRECT model not in the key's allowedModels policy (403, before credential selection)", async () => {
+  const restrictedKey = await apiKeysDb.createApiKey("Restricted Policy Key", "machine-6564-a");
+  await apiKeysDb.updateApiKeyPermissions(restrictedKey.id, {
+    allowedModels: ["combo/model-1.0"],
+  });
+
+  const response = await route.POST(buildPrepareRequest(restrictedKey.key, "gpt-5.5"));
+  const body = (await response.json()) as { error?: { code?: string; message?: string } };
+
+  assert.equal(
+    response.status,
+    403,
+    `expected a policy rejection (403), got ${response.status}: ${JSON.stringify(body)}`
+  );
+  assert.notEqual(
+    body.error?.code,
+    "codex_credentials_unavailable",
+    "must be rejected by API-key policy, not by (unrelated) missing Codex credentials"
+  );
+  assert.match(body.error?.message ?? "", /not allowed|not enabled/i);
+});
+
+test("WS prepare() allows the requested model when the key's policy permits it (proceeds past policy)", async () => {
+  const allowedKey = await apiKeysDb.createApiKey("Allowed Policy Key", "machine-6564-b");
+  await apiKeysDb.updateApiKeyPermissions(allowedKey.id, {
+    allowedModels: ["gpt-5.5"],
+  });
+
+  const response = await route.POST(buildPrepareRequest(allowedKey.key, "gpt-5.5"));
+  const body = (await response.json()) as { error?: { code?: string; message?: string } };
+
+  // No Codex OAuth connection exists in this test environment, so a request
+  // that clears the policy gate still fails downstream — but with the
+  // credential-unavailable error, never the model/combo policy rejection.
+  assert.notEqual(response.status, 403, `must not be rejected by policy: ${JSON.stringify(body)}`);
+  assert.equal(body.error?.code, "codex_credentials_unavailable");
+});
+
+test("WS prepare() rejects a combo not in the key's allowedCombos policy (403)", async () => {
+  await combosDb.createCombo({
+    name: "model-1.0",
+    strategy: "priority",
+    models: ["anthropic/claude-3-5-sonnet"],
+  });
+  await combosDb.createCombo({
+    name: "other-combo",
+    strategy: "priority",
+    models: ["openai/gpt-4.1"],
+  });
+  const comboRestrictedKey = await apiKeysDb.createApiKey("Combo Restricted Key", "machine-6564-c");
+  await apiKeysDb.updateApiKeyPermissions(comboRestrictedKey.id, {
+    allowedCombos: ["model-1.0"],
+  });
+
+  const response = await route.POST(
+    buildPrepareRequest(comboRestrictedKey.key, "combo/other-combo")
+  );
+  const body = (await response.json()) as { error?: { code?: string; message?: string } };
+
+  assert.equal(
+    response.status,
+    403,
+    `expected a policy rejection (403), got ${response.status}: ${JSON.stringify(body)}`
+  );
+  assert.notEqual(body.error?.code, "codex_credentials_unavailable");
+});
diff --git a/tests/unit/codexBulkImport.test.ts b/tests/unit/codexBulkImport.test.ts
index 7551fe330b..9576b83109 100644
--- a/tests/unit/codexBulkImport.test.ts
+++ b/tests/unit/codexBulkImport.test.ts
@@ -243,3 +243,86 @@ describe("flattenCodexImportPayload", () => {
     assert.equal(flattenCodexImportPayload(null).ok, false);
   });
 });
+
+// ── 9router camelCase export (#6665) ────────────────────────────────────────────
+
+describe("9router camelCase Codex export (#6665)", () => {
+  // The exact shape a 9router Codex account export produces (camelCase fields +
+  // nested providerSpecificData), as pasted in issue #6665.
+  const NINEROUTER_RECORD = {
+    accessToken: "access-9r",
+    refreshToken: "refresh-9r",
+    idToken: makeIdToken({
+      email: "jwt-9r@example.com",
+      "https://api.openai.com/auth": {
+        chatgpt_account_id: "acct-jwt-9r",
+        chatgpt_plan_type: "plus",
+      },
+    }),
+    email: "top-9r@example.com",
+    expiresAt: "2026-07-17T13:18:27.000Z",
+    expiresIn: 849516,
+    providerSpecificData: {
+      chatgptAccountId: "acct-psd-9r",
+      chatgptPlanType: "pro",
+    },
+    testStatus: "active",
+    isActive: true,
+    lastRefreshAt: "2026-07-07T17:19:51.150Z",
+  };
+
+  test("normalizes a 9router camelCase record", () => {
+    const result = normalizeCodexImportRecord(NINEROUTER_RECORD);
+    assert.equal(result.ok, true);
+    if (!result.ok) return;
+    const { payload } = result;
+    assert.equal(payload.accessToken, "access-9r");
+    assert.equal(payload.refreshToken, "refresh-9r");
+    assert.equal(payload.idToken, NINEROUTER_RECORD.idToken);
+    // JWT-derived account info wins over the pre-supplied providerSpecificData.
+    assert.equal(payload.email, "jwt-9r@example.com");
+    assert.deepEqual(payload.providerSpecificData, {
+      chatgptAccountId: "acct-jwt-9r",
+      chatgptPlanType: "plus",
+    });
+    // camelCase `expiresAt` is honored as the expiry source.
+    assert.equal(Date.parse(payload.expiresAt), Date.parse(NINEROUTER_RECORD.expiresAt));
+  });
+
+  test("uses pre-supplied providerSpecificData when there is no id_token", () => {
+    const result = normalizeCodexImportRecord({
+      accessToken: "a",
+      refreshToken: "r",
+      email: "no-jwt-9r@example.com",
+      providerSpecificData: { chatgptAccountId: "acct-psd", chatgptPlanType: "team" },
+    });
+    assert.equal(result.ok, true);
+    if (!result.ok) return;
+    assert.equal(result.payload.email, "no-jwt-9r@example.com");
+    assert.deepEqual(result.payload.providerSpecificData, {
+      chatgptAccountId: "acct-psd",
+      chatgptPlanType: "team",
+    });
+  });
+
+  test("an explicit snake_case field is NOT overridden by a camelCase alias", () => {
+    const result = normalizeCodexImportRecord({
+      access_token: "snake-wins",
+      accessToken: "camel-loses",
+      refresh_token: "r",
+      email: "mixed@example.com",
+    });
+    assert.equal(result.ok, true);
+    if (!result.ok) return;
+    assert.equal(result.payload.accessToken, "snake-wins");
+  });
+
+  test("a full 9router {accounts:[...]} export flattens to its records", () => {
+    const flat = flattenCodexImportPayload([NINEROUTER_RECORD]);
+    assert.equal(flat.ok, true);
+    if (!flat.ok) return;
+    assert.equal(flat.records.length, 1);
+    const norm = normalizeCodexImportRecord(flat.records[0]);
+    assert.equal(norm.ok, true);
+  });
+});
diff --git a/tests/unit/combo-body-specific-400-stop-4279.test.ts b/tests/unit/combo-body-specific-400-stop-4279.test.ts
index 4bf6bf92bd..838f9a5677 100644
--- a/tests/unit/combo-body-specific-400-stop-4279.test.ts
+++ b/tests/unit/combo-body-specific-400-stop-4279.test.ts
@@ -68,7 +68,7 @@ test("#4279 combo stops at the first body-specific 400 instead of trying every t
 
   const result = await handleComboChat({
     body: { model: "test", messages: [{ role: "user", content: "hi" }] },
-    combo: makeCombo(["codex/gpt-5.2", "codex/gpt-5.3-codex", "codex/gpt-5.4"]),
+    combo: makeCombo(["codex/gpt-5.2", "codex/gpt-5.3-codex", "codex/gpt-5.6-sol"]),
     handleSingleModel,
     log,
     settings: {},
diff --git a/tests/unit/combo-breaker-429.test.ts b/tests/unit/combo-breaker-429.test.ts
new file mode 100644
index 0000000000..98fbc966ed
--- /dev/null
+++ b/tests/unit/combo-breaker-429.test.ts
@@ -0,0 +1,69 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+/**
+ * Combo path must NOT trip the whole-provider circuit breaker on a plain rate-limit 429.
+ *
+ * Documented policy (docs/architecture/RESILIENCE_GUIDE.md + CLAUDE.md): only
+ * 408/500/502/503/504 trip the whole-provider breaker. A plain 429 is connection-cooldown
+ * / model-lockout scope, never a whole-provider outage. The single-model path already
+ * excludes 429 via `PROVIDER_BREAKER_FAILURE_STATUSES` (src/sse/handlers/chat.ts:206). This
+ * asserts the combo predicate `shouldRecordProviderBreakerFailure` is aligned — it must NOT
+ * gate on `isProviderFailureCode` (accountFallback.ts), which INCLUDES 429 for the separate
+ * connection-cooldown scope.
+ */
+
+const { shouldRecordProviderBreakerFailure } =
+  await import("../../open-sse/services/combo/comboPredicates.ts");
+
+const OTHER_ARGS = {
+  isStreamReadinessFailure: false,
+  sameProviderNext: false,
+  skipProviderBreaker: false,
+} as const;
+
+test("429 (plain rate limit) does NOT record a whole-provider breaker failure", () => {
+  assert.equal(
+    shouldRecordProviderBreakerFailure({ ...OTHER_ARGS, status: 429 }),
+    false,
+    "a plain 429 must not open the whole-provider breaker (cooldown/lockout scope)"
+  );
+});
+
+for (const status of [408, 500, 502, 503, 504]) {
+  test(`whole-provider failure status ${status} DOES record a breaker failure`, () => {
+    assert.equal(
+      shouldRecordProviderBreakerFailure({ ...OTHER_ARGS, status }),
+      true,
+      `status ${status} must trip the whole-provider breaker`
+    );
+  });
+}
+
+test("sameProviderNext:true suppresses recording regardless of status", () => {
+  for (const status of [408, 429, 500, 502, 503, 504]) {
+    assert.equal(
+      shouldRecordProviderBreakerFailure({
+        ...OTHER_ARGS,
+        sameProviderNext: true,
+        status,
+      }),
+      false,
+      `sameProviderNext must suppress recording for status ${status}`
+    );
+  }
+});
+
+test("skipProviderBreaker:true suppresses recording regardless of status", () => {
+  for (const status of [408, 429, 500, 502, 503, 504]) {
+    assert.equal(
+      shouldRecordProviderBreakerFailure({
+        ...OTHER_ARGS,
+        skipProviderBreaker: true,
+        status,
+      }),
+      false,
+      `skipProviderBreaker must suppress recording for status ${status}`
+    );
+  }
+});
diff --git a/tests/unit/combo-builder-options-route.test.ts b/tests/unit/combo-builder-options-route.test.ts
index 704e4009f4..9d05767e14 100644
--- a/tests/unit/combo-builder-options-route.test.ts
+++ b/tests/unit/combo-builder-options-route.test.ts
@@ -103,10 +103,12 @@ test("combo builder options route aggregates providers, connections, models and
   });
 
   await modelsDb.addCustomModel("openai", "custom-ops", "Custom Ops");
+  // #6975: embeddings-only models (supportedEndpoints without "chat") are no longer
+  // dropped from the combo builder — they must appear like any other model.
   await modelsDb.addCustomModel(
     "openai",
-    "text-embedding-hidden",
-    "Hidden Embedding",
+    "text-embedding-visible",
+    "Text Embedding",
     "manual",
     "chat-completions",
     ["embeddings"]
@@ -148,9 +150,10 @@ test("combo builder options route aggregates providers, connections, models and
     false
   );
   assert.ok(openai.models.some((model) => model.id === "custom-ops"));
+  // #6975: embeddings-only models must now appear in the combo builder output.
   assert.equal(
-    openai.models.some((model) => model.id === "text-embedding-hidden"),
-    false
+    openai.models.some((model) => model.id === "text-embedding-visible"),
+    true
   );
   assert.deepEqual(
     openai.connections.map((connection) => ({
diff --git a/tests/unit/combo-config.test.ts b/tests/unit/combo-config.test.ts
index e3b99e9733..a49513d835 100644
--- a/tests/unit/combo-config.test.ts
+++ b/tests/unit/combo-config.test.ts
@@ -369,7 +369,7 @@ test("resolveComboConfig tolerates invalid or missing inputs and falls back to d
 test("createComboSchema accepts context-relay strategy with handoff config", () => {
   const parsed = createComboSchema.parse({
     name: "codex-relay",
-    models: ["codex/gpt-5.4"],
+    models: ["codex/gpt-5.6-sol"],
     strategy: "context-relay",
     config: {
       handoffThreshold: 0.85,
@@ -443,7 +443,7 @@ test("createComboSchema accepts structured combo steps with pinned connection an
         kind: "model",
         id: "step-codex-a",
         providerId: "codex",
-        model: "gpt-5.4",
+        model: "gpt-5.6-sol",
         connectionId: "conn-codex-a",
         weight: 10,
       },
@@ -472,14 +472,14 @@ test("createComboSchema accepts composite tiers that reference normalized combo
         kind: "model",
         id: "step-primary",
         providerId: "codex",
-        model: "gpt-5.4",
+        model: "gpt-5.6-sol",
         connectionId: "conn-codex-a",
       },
       {
         kind: "model",
         id: "step-backup",
         providerId: "codex",
-        model: "gpt-5.4",
+        model: "gpt-5.6-sol",
         connectionId: "conn-codex-b",
       },
     ],
diff --git a/tests/unit/combo-context-relay.test.ts b/tests/unit/combo-context-relay.test.ts
index ea36bba079..5e83b460c3 100644
--- a/tests/unit/combo-context-relay.test.ts
+++ b/tests/unit/combo-context-relay.test.ts
@@ -156,14 +156,14 @@ test("handleComboChat context-relay skips unavailable models and falls through t
     combo: {
       name: "relay-skip-unavailable",
       strategy: "context-relay",
-      models: ["codex/gpt-5.4", "openai/gpt-4o-mini"],
+      models: ["codex/gpt-5.6-sol", "openai/gpt-4o-mini"],
       config: { maxRetries: 0 },
     },
     handleSingleModel: async (_body, modelStr) => {
       calls.push(modelStr);
       return okResponse();
     },
-    isModelAvailable: async (modelStr) => modelStr !== "codex/gpt-5.4",
+    isModelAvailable: async (modelStr) => modelStr !== "codex/gpt-5.6-sol",
     log: createLog(),
     settings: null,
     allCombos: null,
@@ -181,7 +181,7 @@ test("handleComboChat context-relay treats provider circuit breaker responses as
   const combo = {
     name: "relay-breaker",
     strategy: "context-relay",
-    models: ["codex/gpt-5.4", "openai/gpt-4o-mini"],
+    models: ["codex/gpt-5.6-sol", "openai/gpt-4o-mini"],
     config: { maxRetries: 0 },
   };
   const calls = [];
@@ -193,7 +193,7 @@ test("handleComboChat context-relay treats provider circuit breaker responses as
     combo,
     handleSingleModel: async (_body, modelStr) => {
       calls.push(modelStr);
-      if (modelStr === "codex/gpt-5.4") {
+      if (modelStr === "codex/gpt-5.6-sol") {
         return providerBreakerOpenResponse();
       }
       return okResponse();
@@ -205,7 +205,7 @@ test("handleComboChat context-relay treats provider circuit breaker responses as
   });
 
   assert.equal(result.ok, true);
-  assert.deepEqual(calls, ["codex/gpt-5.4", "openai/gpt-4o-mini"]);
+  assert.deepEqual(calls, ["codex/gpt-5.6-sol", "openai/gpt-4o-mini"]);
 });
 
 test("handleComboChat context-relay persists a handoff when codex quota reaches the warning threshold", async () => {
@@ -235,7 +235,7 @@ test("handleComboChat context-relay persists a handoff when codex quota reaches
     combo: {
       name: "relay-generate",
       strategy: "context-relay",
-      models: ["codex/gpt-5.4"],
+      models: ["codex/gpt-5.6-sol"],
       config: { maxRetries: 0, handoffThreshold: 0.85, handoffProviders: ["codex"] },
     },
     handleSingleModel: async (body) => {
@@ -309,7 +309,7 @@ test("handleComboChat context-relay respects handoffProviders and skips generati
     combo: {
       name: "relay-disabled-provider",
       strategy: "context-relay",
-      models: ["codex/gpt-5.4"],
+      models: ["codex/gpt-5.6-sol"],
       config: { maxRetries: 0, handoffProviders: ["openai"] },
     },
     handleSingleModel: async (body) => {
@@ -363,7 +363,7 @@ test("handleComboChat context-relay treats explicit empty handoffProviders as di
     combo: {
       name: "relay-empty-providers",
       strategy: "context-relay",
-      models: ["codex/gpt-5.4"],
+      models: ["codex/gpt-5.6-sol"],
       config: { maxRetries: 0, handoffProviders: [] },
     },
     handleSingleModel: async () => okResponse(),
diff --git a/tests/unit/combo-context-requirements.test.ts b/tests/unit/combo-context-requirements.test.ts
new file mode 100644
index 0000000000..84efa7204b
--- /dev/null
+++ b/tests/unit/combo-context-requirements.test.ts
@@ -0,0 +1,268 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { comboRuntimeConfigSchema } from "@/shared/validation/schemas/combo";
+
+// Test the context requirements schema extension against the real
+// comboRuntimeConfigSchema export, so this test catches drift if the
+// production schema changes shape.
+describe("Combo Context Requirements", () => {
+  describe("Schema Validation", () => {
+    it("should accept valid minContextWindow", () => {
+      const schema = comboRuntimeConfigSchema;
+
+      const valid = [
+        { contextRequirements: { minContextWindow: 8192 } },
+        { contextRequirements: { minContextWindow: 32000 } },
+        { contextRequirements: { minContextWindow: 128000 } },
+        { contextRequirements: { minContextWindow: 1000000 } },
+        { contextRequirements: {} },
+        {},
+      ];
+
+      for (const input of valid) {
+        const result = schema.safeParse(input);
+        assert.ok(result.success, `Should accept ${JSON.stringify(input)}`);
+      }
+    });
+
+    it("should reject invalid minContextWindow", () => {
+      const schema = comboRuntimeConfigSchema;
+
+      const invalid = [
+        { contextRequirements: { minContextWindow: -1 } },
+        { contextRequirements: { minContextWindow: 20_000_000 } },
+        { contextRequirements: { minContextWindow: "invalid" } },
+      ];
+
+      for (const input of invalid) {
+        const result = schema.safeParse(input);
+        assert.ok(!result.success, `Should reject ${JSON.stringify(input)}`);
+      }
+    });
+
+    it("should accept valid preferLargeContext boolean", () => {
+      const schema = comboRuntimeConfigSchema;
+
+      const valid = [
+        { contextRequirements: { preferLargeContext: true } },
+        { contextRequirements: { preferLargeContext: false } },
+        { contextRequirements: {} },
+      ];
+
+      for (const input of valid) {
+        const result = schema.safeParse(input);
+        assert.ok(result.success, `Should accept ${JSON.stringify(input)}`);
+      }
+    });
+
+    it("should accept valid contextFilterMode", () => {
+      const schema = comboRuntimeConfigSchema;
+
+      const valid = [
+        { contextRequirements: { contextFilterMode: "strict" } },
+        { contextRequirements: { contextFilterMode: "lenient" } },
+        { contextRequirements: {} },
+      ];
+
+      for (const input of valid) {
+        const result = schema.safeParse(input);
+        assert.ok(result.success, `Should accept ${JSON.stringify(input)}`);
+      }
+    });
+
+    it("should reject invalid contextFilterMode", () => {
+      const schema = comboRuntimeConfigSchema;
+
+      const invalid = [
+        { contextRequirements: { contextFilterMode: "invalid" } },
+        { contextRequirements: { contextFilterMode: "permissive" } },
+      ];
+
+      for (const input of invalid) {
+        const result = schema.safeParse(input);
+        assert.ok(!result.success, `Should reject ${JSON.stringify(input)}`);
+      }
+    });
+
+    it("should accept combined context requirements", () => {
+      const schema = comboRuntimeConfigSchema;
+
+      const input = {
+        contextRequirements: {
+          minContextWindow: 32000,
+          preferLargeContext: true,
+          contextFilterMode: "strict" as const,
+        },
+      };
+
+      const result = schema.safeParse(input);
+      assert.ok(result.success);
+      if (result.success) {
+        assert.deepEqual(result.data, input);
+      }
+    });
+  });
+
+  describe("Context Filtering Logic", () => {
+    it("should filter targets below minContextWindow in strict mode", () => {
+      const targets = [
+        { model: "gpt-3.5-turbo", contextWindow: 4096 },
+        { model: "gpt-4", contextWindow: 8192 },
+        { model: "gpt-4-turbo", contextWindow: 128000 },
+        { model: "claude-3-opus", contextWindow: 200000 },
+      ];
+
+      const minContextWindow = 32000;
+      const contextFilterMode = "strict";
+
+      const filtered = targets.filter((t) => {
+        const limit = t.contextWindow ?? null;
+        if (limit === null) {
+          // Unknown limits fail in strict mode
+          return contextFilterMode === "lenient";
+        }
+        return limit >= minContextWindow;
+      });
+
+      assert.equal(filtered.length, 2);
+      assert.equal(filtered[0].model, "gpt-4-turbo");
+      assert.equal(filtered[1].model, "claude-3-opus");
+    });
+
+    it("should include unknown context limits in lenient mode", () => {
+      const targets = [
+        { model: "gpt-4", contextWindow: 8192 },
+        { model: "custom-model", contextWindow: null },
+        { model: "claude-3-opus", contextWindow: 200000 },
+      ];
+
+      const minContextWindow = 32000;
+      const contextFilterMode = "lenient";
+
+      const filtered = targets.filter((t) => {
+        const limit = t.contextWindow ?? null;
+        if (limit === null) {
+          return contextFilterMode === "lenient";
+        }
+        return limit >= minContextWindow;
+      });
+
+      assert.equal(filtered.length, 2);
+      assert.equal(filtered[0].model, "custom-model");
+      assert.equal(filtered[1].model, "claude-3-opus");
+    });
+
+    it("should exclude unknown context limits in strict mode", () => {
+      const targets = [
+        { model: "gpt-4", contextWindow: 8192 },
+        { model: "custom-model", contextWindow: null },
+        { model: "claude-3-opus", contextWindow: 200000 },
+      ];
+
+      const minContextWindow = 32000;
+      const contextFilterMode = "strict";
+
+      const filtered = targets.filter((t) => {
+        const limit = t.contextWindow ?? null;
+        if (limit === null) {
+          return contextFilterMode === "lenient";
+        }
+        return limit >= minContextWindow;
+      });
+
+      assert.equal(filtered.length, 1);
+      assert.equal(filtered[0].model, "claude-3-opus");
+    });
+
+    it("should sort by context size when preferLargeContext is enabled", () => {
+      const targets = [
+        { model: "gpt-4", contextWindow: 8192 },
+        { model: "claude-3-opus", contextWindow: 200000 },
+        { model: "gpt-4-turbo", contextWindow: 128000 },
+        { model: "gemini-pro", contextWindow: 1000000 },
+      ];
+
+      const preferLargeContext = true;
+
+      const sorted = preferLargeContext
+        ? [...targets].sort((a, b) => {
+            const aLimit = a.contextWindow ?? 0;
+            const bLimit = b.contextWindow ?? 0;
+            return bLimit - aLimit; // Descending
+          })
+        : targets;
+
+      assert.equal(sorted[0].model, "gemini-pro");
+      assert.equal(sorted[1].model, "claude-3-opus");
+      assert.equal(sorted[2].model, "gpt-4-turbo");
+      assert.equal(sorted[3].model, "gpt-4");
+    });
+
+    it("should not sort when preferLargeContext is disabled", () => {
+      const targets = [
+        { model: "gpt-4", contextWindow: 8192 },
+        { model: "claude-3-opus", contextWindow: 200000 },
+        { model: "gpt-4-turbo", contextWindow: 128000 },
+      ];
+
+      const preferLargeContext = false;
+
+      const sorted = preferLargeContext
+        ? [...targets].sort((a, b) => (b.contextWindow ?? 0) - (a.contextWindow ?? 0))
+        : targets;
+
+      assert.equal(sorted[0].model, "gpt-4");
+      assert.equal(sorted[1].model, "claude-3-opus");
+      assert.equal(sorted[2].model, "gpt-4-turbo");
+    });
+  });
+
+  describe("Integration with Existing Context Filtering", () => {
+    it("should work with existing filterTargetsByRequestCompatibility logic", () => {
+      // This test verifies the new config integrates with existing code
+      // The actual implementation in comboStructure.ts already has context filtering
+      // We just need to ensure our new config fields are respected
+
+      const config = {
+        contextRequirements: {
+          minContextWindow: 32000,
+          preferLargeContext: true,
+          contextFilterMode: "strict" as const,
+        },
+      };
+
+      const targets = [
+        { model: "small-model", contextWindow: 4096 },
+        { model: "medium-model", contextWindow: 32000 },
+        { model: "large-model", contextWindow: 200000 },
+        { model: "unknown-model", contextWindow: null },
+      ];
+
+      // Step 1: Filter by minContextWindow
+      let filtered = targets.filter((t) => {
+        const limit = t.contextWindow ?? null;
+        if (config.contextRequirements.minContextWindow) {
+          if (limit === null) {
+            return config.contextRequirements.contextFilterMode === "lenient";
+          }
+          return limit >= config.contextRequirements.minContextWindow;
+        }
+        return true;
+      });
+
+      assert.equal(filtered.length, 2);
+
+      // Step 2: Sort by context size if preferLargeContext
+      if (config.contextRequirements.preferLargeContext) {
+        filtered.sort((a, b) => {
+          const aLimit = a.contextWindow ?? 0;
+          const bLimit = b.contextWindow ?? 0;
+          return bLimit - aLimit;
+        });
+      }
+
+      assert.equal(filtered[0].model, "large-model");
+      assert.equal(filtered[1].model, "medium-model");
+    });
+  });
+});
diff --git a/tests/unit/combo-diagnostics-trace.test.ts b/tests/unit/combo-diagnostics-trace.test.ts
new file mode 100644
index 0000000000..be25e64c77
--- /dev/null
+++ b/tests/unit/combo-diagnostics-trace.test.ts
@@ -0,0 +1,81 @@
+/**
+ * QA P0 — sanitized auto-combo diagnostic trace.
+ * Guards the new `errorResponseWithComboDiagnostics` / `sanitizeComboDiagnostics`
+ * helpers: they must surface pool size + attempt order + exclusion reasons as
+ * both `x-omniroute-combo-*` headers and a `diagnostics` body field, while the
+ * sanitizer is the secret-containment boundary (only provider/model/reason ids +
+ * counts may ever escape — never keys/tokens/credentials).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { errorResponseWithComboDiagnostics, sanitizeComboDiagnostics } = await import(
+  "../../open-sse/utils/error.ts"
+);
+
+test("combo diagnostics: headers + body carry the sanitized trace (code override preserved)", async () => {
+  const res = errorResponseWithComboDiagnostics(
+    503,
+    "all upstream accounts inactive",
+    {
+      poolSize: 3,
+      attempted: 2,
+      excluded: [{ provider: "openai", model: "gpt-x", reason: "exhausted" }],
+      attemptOrder: [{ provider: "openai", model: "gpt-x" }],
+      terminalReason: "all_accounts_inactive",
+    },
+    { code: "ALL_ACCOUNTS_INACTIVE", type: "service_unavailable" }
+  );
+
+  assert.equal(res.status, 503);
+  assert.equal(res.headers.get("x-omniroute-combo-pool-size"), "3");
+  assert.equal(res.headers.get("x-omniroute-combo-attempted"), "2");
+  assert.match(res.headers.get("x-omniroute-combo-excluded") || "", /openai\/gpt-x:exhausted/);
+  assert.equal(res.headers.get("x-omniroute-combo-terminal-reason"), "all_accounts_inactive");
+
+  const body = await res.json();
+  assert.equal(body.error.code, "ALL_ACCOUNTS_INACTIVE");
+  assert.equal(body.error.type, "service_unavailable");
+  assert.ok(body.diagnostics, "diagnostics field present in body");
+  assert.equal(body.diagnostics.poolSize, 3);
+  assert.equal(body.diagnostics.attempted, 2);
+  assert.equal(body.diagnostics.terminalReason, "all_accounts_inactive");
+  assert.equal(body.diagnostics.attemptOrder[0].provider, "openai");
+});
+
+test("combo diagnostics: sanitizer caps sizes + keeps only the whitelist keys", () => {
+  const dirty = {
+    poolSize: 1,
+    attempted: 1,
+    excluded: Array.from({ length: 200 }, (_, i) => ({
+      provider: "p" + i,
+      reason: "r".repeat(500),
+    })),
+    attemptOrder: Array.from({ length: 200 }, () => ({ provider: "p", model: "m" })),
+    terminalReason: "x".repeat(1000),
+  };
+  const safe = sanitizeComboDiagnostics(dirty as never);
+  assert.ok(safe.excluded.length <= 64, "excluded capped at 64");
+  assert.ok(safe.attemptOrder.length <= 64, "attemptOrder capped at 64");
+  assert.ok(safe.excluded[0].reason.length <= 64, "reason length clamped");
+  assert.ok(safe.terminalReason.length <= 200, "terminalReason length clamped");
+  assert.deepEqual(Object.keys(safe.excluded[0]).sort(), ["provider", "reason"]);
+});
+
+test("combo diagnostics: secret containment — non-whitelisted fields never survive", () => {
+  const leaky = {
+    poolSize: 1,
+    attempted: 1,
+    excluded: [
+      { provider: "openai", reason: "exhausted", apiKey: "sk-SECRET-KEY", token: "SECRET-TOK" },
+    ],
+    attemptOrder: [{ provider: "openai", model: "m", accessToken: "SECRET-OAUTH" }],
+    terminalReason: "t",
+  };
+  const safe = sanitizeComboDiagnostics(leaky as never);
+  const serialized = JSON.stringify(safe);
+  assert.ok(!serialized.includes("SECRET"), "no secret VALUES survive the projection");
+  assert.ok(!serialized.includes("apiKey"), "no apiKey KEY survives");
+  assert.ok(!serialized.includes("accessToken"), "no accessToken KEY survives");
+  assert.ok(!serialized.includes("token"), "no token KEY survives");
+});
diff --git a/tests/unit/combo-fingerprint-pin-6696.test.ts b/tests/unit/combo-fingerprint-pin-6696.test.ts
new file mode 100644
index 0000000000..6a683f49e8
--- /dev/null
+++ b/tests/unit/combo-fingerprint-pin-6696.test.ts
@@ -0,0 +1,123 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+// #6696 — the combo builder's "pin a specific account" feature for fingerprint
+// providers (mimocode/mcode/opencode) builds a composite connectionId of the
+// form `${rowId}|fp|${fingerprint}` (src/lib/combos/builderOptions.ts:251), but
+// nothing in the combo execution path ever splits that composite id back into
+// a real rowId + a selected fingerprint. This test proves the pin is inert:
+// once a combo step is configured with the composite id produced by the
+// builder, `expandTargetsByFingerprints` (the function combo.ts calls right
+// before target resolution/credential lookup) cannot find the connection in
+// `connectionById` (which is keyed by the real DB row id) and silently passes
+// the target through UNCHANGED, still carrying the bogus composite
+// connectionId. Downstream, `getProviderCredentials`'s `forcedConnectionId`
+// filter (src/sse/services/auth.ts) also can never match `conn.id ===
+// "<rowId>|fp|<fingerprint>"` against a real row id — so the pinned target
+// never resolves to real credentials for the intended (or ANY) account and
+// the combo step is effectively dead weight instead of a working, fail-over-
+// capable target.
+
+const { expandTargetsByFingerprints } = await import(
+  "../../open-sse/services/combo/fingerprintExpansion.ts"
+);
+
+function makeTarget(overrides: Record<string, unknown> = {}) {
+  return {
+    kind: "model" as const,
+    stepId: "step-0",
+    executionKey: "step-0",
+    modelStr: "mimocode/mimo-auto",
+    provider: "mimocode",
+    providerId: null,
+    connectionId: "conn-1",
+    weight: 0,
+    label: null,
+    ...overrides,
+  };
+}
+
+test("#6696: fp-pinned composite connectionId is never resolved to the real connection + fingerprint", () => {
+  const realConnectionId = "conn-1";
+  const conn = {
+    id: realConnectionId,
+    provider: "mimocode",
+    providerSpecificData: { fingerprints: ["fp-aaa", "fp-bbb"] },
+  };
+  const connById = new Map([[realConnectionId, conn]]);
+
+  // Exactly what the combo builder UI persists for a step pinned to
+  // "Account 1" — src/lib/combos/builderOptions.ts:251:
+  //   id: `${connection.id}|fp|${fingerprints[i]}`
+  const pinnedFingerprint = "fp-aaa";
+  const compositeConnectionId = `${realConnectionId}|fp|${pinnedFingerprint}`;
+
+  const targets = [makeTarget({ connectionId: compositeConnectionId })];
+
+  const result = expandTargetsByFingerprints(targets, connById, (t) => t.provider);
+
+  assert.equal(result.length, 1, "pin should resolve to exactly one target");
+
+  // This is what SHOULD hold once fixed: connectionId fed downstream must be
+  // the real DB row id, not the UI-only composite string.
+  assert.equal(
+    result[0].connectionId,
+    realConnectionId,
+    "fp-pinned target must resolve to the real connection id for credential lookup to succeed"
+  );
+
+  // The selected fingerprint must be threaded through so downstream execution
+  // (and future account-scoped cooldown/lockout) can still tell which account
+  // was pinned, instead of losing that information once the composite id is
+  // unwrapped.
+  assert.equal(
+    (result[0] as Record<string, unknown>).pinnedFingerprint,
+    pinnedFingerprint,
+    "the pinned fingerprint must survive resolution so downstream execution can target that account"
+  );
+});
+
+test("#6696: composite connectionId never matches connectionById (root cause of the inert pin)", () => {
+  const realConnectionId = "conn-1";
+  const conn = {
+    id: realConnectionId,
+    provider: "mimocode",
+    providerSpecificData: { fingerprints: ["fp-aaa", "fp-bbb"] },
+  };
+  const connById = new Map([[realConnectionId, conn]]);
+  const compositeConnectionId = `${realConnectionId}|fp|fp-aaa`;
+
+  assert.equal(
+    connById.get(compositeConnectionId),
+    undefined,
+    "composite fp-pin id must not resolve directly against connectionById"
+  );
+});
+
+test("#6696: a pin to an unknown connection does not crash and leaves the target inert but not thrown away", () => {
+  const connById = new Map();
+  const targets = [makeTarget({ connectionId: "missing-conn|fp|fp-zzz" })];
+
+  const result = expandTargetsByFingerprints(targets, connById, (t) => t.provider);
+
+  assert.equal(result.length, 1);
+  assert.equal(result[0].connectionId, "missing-conn");
+  assert.equal((result[0] as Record<string, unknown>).pinnedFingerprint, "fp-zzz");
+});
+
+test("#6696: non-fingerprint providers are unaffected by the |fp| split", () => {
+  const connById = new Map([
+    ["conn-1", { id: "conn-1", provider: "openai", providerSpecificData: {} }],
+  ]);
+  const targets = [
+    makeTarget({ provider: "openai", modelStr: "openai/gpt-4", connectionId: "conn-1|fp|fp-aaa" }),
+  ];
+
+  const result = expandTargetsByFingerprints(targets, connById, (t) => t.provider);
+
+  assert.equal(result.length, 1);
+  // Non-fingerprint providers are passed through unchanged — the literal
+  // string (however unusual) is left alone since this provider never goes
+  // through the fingerprint-pin UI flow.
+  assert.equal(result[0].connectionId, "conn-1|fp|fp-aaa");
+});
diff --git a/tests/unit/combo-fusion-config-warn-6455.test.ts b/tests/unit/combo-fusion-config-warn-6455.test.ts
new file mode 100644
index 0000000000..e15acce0f5
--- /dev/null
+++ b/tests/unit/combo-fusion-config-warn-6455.test.ts
@@ -0,0 +1,157 @@
+/**
+ * Regression guard for #6455 — silent no-op when config.judgeModel is set on a
+ * combo whose top-level strategy is anything other than "fusion".
+ *
+ * Before the fix, open-sse/services/combo.ts read `config.judgeModel` and
+ * `config.fusionTuning` only inside the `if (strategy === "fusion")` branch,
+ * so a persisted judgeModel on a priority/weighted/auto/round-robin combo was
+ * silently ignored — the response reflected whichever priority/panel target
+ * won, not a judge synthesis. Users observed this as their configured judge
+ * (e.g. auto/claude-opus) being ignored in favor of the raw first target.
+ *
+ * The minimal-diff fix logs a warn immediately before the fusion branch, so
+ * the misconfiguration is observable in logs without changing runtime behavior
+ * for legitimate fusion combos.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-combo-6455-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "combo-fusion-warn-test-secret";
+
+const { handleComboChat } = await import("../../open-sse/services/combo.ts");
+
+function okResponse(content: string): Response {
+  const body = JSON.stringify({ choices: [{ message: { role: "assistant", content } }] });
+  return new Response(body, { status: 200, headers: { "Content-Type": "application/json" } });
+}
+
+function makeLog() {
+  const records: Array<{ level: string; scope: string; msg: string }> = [];
+  const cap = (level: string) => (scope: string, msg: string) => {
+    records.push({ level, scope, msg: String(msg) });
+  };
+  return {
+    log: {
+      info: cap("info"),
+      warn: cap("warn"),
+      debug: cap("debug"),
+      error: cap("error"),
+    },
+    records,
+  };
+}
+
+test("6455: warns when config.judgeModel is set but strategy is not fusion", async () => {
+  const { log, records } = makeLog();
+  const handleSingleModel = async () => okResponse("resp");
+
+  const res = await handleComboChat({
+    body: { messages: [{ role: "user", content: "hi" }] },
+    combo: {
+      name: "fusion-free",
+      strategy: "priority",
+      models: [{ model: "p/first" }, { model: "p/second" }],
+      config: { judgeModel: "auto/claude-opus" },
+    },
+    handleSingleModel,
+    log,
+    settings: {},
+    allCombos: [],
+  });
+
+  assert.equal(res.status, 200);
+  const warns = records.filter(
+    (r) => r.level === "warn" && r.scope === "COMBO" && r.msg.includes("judgeModel")
+  );
+  assert.equal(warns.length, 1, `expected exactly one judgeModel warn, got ${warns.length}`);
+  assert.match(warns[0].msg, /priority/);
+  assert.match(warns[0].msg, /fusion-free/);
+  assert.match(warns[0].msg, /#6455/);
+});
+
+test("6455: warns when config.fusionTuning is set but strategy is not fusion", async () => {
+  const { log, records } = makeLog();
+  const handleSingleModel = async () => okResponse("resp");
+
+  await handleComboChat({
+    body: { messages: [{ role: "user", content: "hi" }] },
+    combo: {
+      name: "wrong-strategy",
+      strategy: "weighted",
+      models: [{ model: "p/a", weight: 1 }],
+      config: { fusionTuning: { judgeTemperature: 0.2 } },
+    },
+    handleSingleModel,
+    log,
+    settings: {},
+    allCombos: [],
+  });
+
+  const warns = records.filter(
+    (r) => r.level === "warn" && r.scope === "COMBO" && r.msg.includes("fusionTuning")
+  );
+  assert.equal(warns.length, 1);
+});
+
+test("6455: does NOT warn when strategy is fusion (legitimate use)", async () => {
+  const { log, records } = makeLog();
+  const handleSingleModel = async () => okResponse("resp");
+
+  await handleComboChat({
+    body: { messages: [{ role: "user", content: "hi" }] },
+    combo: {
+      name: "real-fusion",
+      strategy: "fusion",
+      models: [{ model: "p/panelA" }, { model: "p/panelB" }],
+      config: { judgeModel: "auto/claude-opus" },
+    },
+    handleSingleModel,
+    log,
+    settings: {},
+    allCombos: [],
+  });
+
+  const warns = records.filter(
+    (r) =>
+      r.level === "warn" &&
+      r.scope === "COMBO" &&
+      (r.msg.includes("judgeModel") || r.msg.includes("fusionTuning"))
+  );
+  assert.equal(
+    warns.length,
+    0,
+    `expected no judgeModel warn on legitimate fusion, got ${warns.length}`
+  );
+});
+
+test("6455: does NOT warn when strategy is non-fusion and no judgeModel/fusionTuning set", async () => {
+  const { log, records } = makeLog();
+  const handleSingleModel = async () => okResponse("resp");
+
+  await handleComboChat({
+    body: { messages: [{ role: "user", content: "hi" }] },
+    combo: {
+      name: "plain-priority",
+      strategy: "priority",
+      models: [{ model: "p/only" }],
+      config: {},
+    },
+    handleSingleModel,
+    log,
+    settings: {},
+    allCombos: [],
+  });
+
+  const warns = records.filter(
+    (r) =>
+      r.level === "warn" &&
+      r.scope === "COMBO" &&
+      (r.msg.includes("judgeModel") || r.msg.includes("fusionTuning"))
+  );
+  assert.equal(warns.length, 0);
+});
diff --git a/tests/unit/combo-fusion-strategy.test.ts b/tests/unit/combo-fusion-strategy.test.ts
index 775baef70f..7fb2d6148f 100644
--- a/tests/unit/combo-fusion-strategy.test.ts
+++ b/tests/unit/combo-fusion-strategy.test.ts
@@ -168,7 +168,7 @@ test("fusion: proceeds on quorum without waiting for a straggler (grace window)"
   assert.ok(!/slow/.test(judgeText), "straggler answer should not appear in the judge prompt");
 });
 
-test("fusion: returns the lone survivor directly when only one panel model succeeds", async () => {
+test("fusion: returns the lone survivor directly when only one panel model succeeds and no judgeModel is configured", async () => {
   const seen: string[] = [];
   const handleSingleModel = async (_b: Body, m: string) => {
     seen.push(m);
@@ -176,6 +176,37 @@ test("fusion: returns the lone survivor directly when only one panel model succe
     return errResponse(500);
   };
   await handleComboChat({
+    body: { messages: [{ role: "user", content: "Q" }] },
+    combo: fusionCombo(["p/ok", "p/bad"], {
+      // No judgeModel configured: the implicit "judge" is just panel[0], so
+      // synthesizing a single source through itself is redundant.
+      fusionTuning: { minPanel: 2, stragglerGraceMs: 50, panelHardTimeoutMs: 5000 },
+    }),
+    handleSingleModel,
+    log,
+    settings: {},
+    allCombos: [],
+  });
+  // No judge call — single answer + no explicit judge means there is nothing to fuse.
+  assert.ok(
+    !seen.includes("p/judge"),
+    "judge should not be invoked when only one panel model survives and no judgeModel is set"
+  );
+});
+
+// #6455: when an explicit judgeModel IS configured, the lone-survivor degrade
+// path used to silently return the raw panel answer, never invoking the
+// configured judge. See tests/unit/fusion-judge-model-6455.test.ts for the
+// full regression guard.
+test("fusion: honors an explicit judgeModel even with a single surviving panel answer", async () => {
+  const seen: string[] = [];
+  const handleSingleModel = async (_b: Body, m: string) => {
+    seen.push(m);
+    if (m === "p/ok") return okResponse("lone");
+    if (m === "p/judge") return okResponse("JUDGED");
+    return errResponse(500);
+  };
+  const res = await handleComboChat({
     body: { messages: [{ role: "user", content: "Q" }] },
     combo: fusionCombo(["p/ok", "p/bad"], {
       judgeModel: "p/judge",
@@ -186,11 +217,12 @@ test("fusion: returns the lone survivor directly when only one panel model succe
     settings: {},
     allCombos: [],
   });
-  // No judge call — single answer means there is nothing to fuse.
   assert.ok(
-    !seen.includes("p/judge"),
-    "judge should not be invoked when only one panel model survives"
+    seen.includes("p/judge"),
+    "explicit judgeModel should still be invoked to synthesize a single panel answer"
   );
+  assert.equal(seen[seen.length - 1], "p/judge");
+  assert.equal(res.status, 200);
 });
 
 test("fusion: returns 503 when the whole panel fails", async () => {
diff --git a/tests/unit/combo-lockout-quota-reset-6863.test.ts b/tests/unit/combo-lockout-quota-reset-6863.test.ts
new file mode 100644
index 0000000000..84eb7ed70a
--- /dev/null
+++ b/tests/unit/combo-lockout-quota-reset-6863.test.ts
@@ -0,0 +1,140 @@
+// #6863: combo path model lockout must honor a parsed upstream quota reset
+// ("Resets in 92h27m28s") instead of the base cooldown ladder, mirroring the
+// single-model path (src/sse/services/auth.ts usedUpstreamRetryHint/quotaResetHintMs).
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omr-combo-quota-reset-6863-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = "test-combo-quota-reset-6863";
+
+const core = await import("../../src/lib/db/core.ts");
+const { handleComboChat } = await import("../../open-sse/services/combo.ts");
+const { getModelLockoutInfo, clearAllModelLockouts, parseRetryFromErrorText } =
+  await import("../../open-sse/services/accountFallback.ts");
+
+const UPSTREAM_429_MESSAGE =
+  "429: Individual quota reached. Please upgrade your subscription to increase your limits. Resets in 92h27m28s.";
+
+function createLog() {
+  return { info: () => {}, warn: () => {}, error: () => {}, debug: () => {} };
+}
+
+test.beforeEach(() => {
+  clearAllModelLockouts();
+});
+
+test.after(() => {
+  clearAllModelLockouts();
+  try {
+    core.resetDbInstance();
+    fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  } catch {}
+});
+
+test("combo 429 lockout honors parsed upstream quota reset over base cooldown (#6863)", async () => {
+  const provider = "antigravity"; // OAuth category → quota signals preserved on 429
+  const model = "claude-sonnet-4.6";
+
+  const settings = {
+    modelLockout: {
+      enabled: true,
+      errorCodes: [429],
+      baseCooldownMs: 3000,
+      maxCooldownMs: 1_800_000,
+      maxBackoffSteps: 10,
+      useExponentialBackoff: true,
+    },
+  };
+
+  await handleComboChat({
+    body: {},
+    combo: {
+      name: "quota-reset-combo",
+      strategy: "priority",
+      models: [`${provider}/${model}`],
+      config: { maxRetries: 0, retryDelayMs: 0, fallbackDelayMs: 0 },
+    },
+    handleSingleModel: async () =>
+      new Response(JSON.stringify({ error: { message: UPSTREAM_429_MESSAGE } }), {
+        status: 429,
+        headers: { "content-type": "application/json" },
+      }),
+    isModelAvailable: async () => true,
+    log: createLog(),
+    settings,
+    allCombos: null,
+  });
+
+  const parsedResetMs = parseRetryFromErrorText(UPSTREAM_429_MESSAGE);
+  assert.ok(
+    parsedResetMs && parsedResetMs > 90 * 3600 * 1000,
+    `sanity: reset text must parse to ~92.5h, got ${parsedResetMs}`
+  );
+
+  const info = getModelLockoutInfo(provider, "", model);
+  assert.ok(info, "combo 429 must record a model lockout");
+  // Bug #6863: lockout was baseCooldownMs (~seconds) while upstream said 92.5h.
+  // The lockout must equal the parsed reset minus elapsed test runtime (bounded slack),
+  // so a hardcoded long cooldown (e.g. a fixed 1h) cannot pass.
+  assert.ok(
+    info!.remainingMs > parsedResetMs! - 5_000 && info!.remainingMs <= parsedResetMs!,
+    `lockout must equal the parsed upstream reset (~${parsedResetMs}ms); got ${info!.remainingMs}ms (~${Math.round(info!.remainingMs / 1000)}s)`
+  );
+});
+
+test("combo 429 lockout prefers a SHORT parsed reset over the subscription fallback cooldown", async () => {
+  // Review follow-up on #6863: the subscription-quota branch returns
+  // cooldownMs = 1h fallback when useUpstreamRetryHints is off (OAuth default),
+  // while quotaResetHintMs carries the real parsed reset. A max() of the two
+  // would over-lock (1h) — the lockout must follow the parsed value (~45m),
+  // matching the single-model path in src/sse/services/auth.ts.
+  const provider = "claude"; // OAuth category → subscription-quota branch applies
+  const model = "claude-sonnet-4-6";
+  const shortResetMessage =
+    "429: Usage limit reached. Your Claude Pro usage limit resets in 45m0s.";
+
+  const settings = {
+    modelLockout: {
+      enabled: true,
+      errorCodes: [429],
+      baseCooldownMs: 3000,
+      maxCooldownMs: 7_200_000,
+      maxBackoffSteps: 10,
+      useExponentialBackoff: true,
+    },
+  };
+
+  await handleComboChat({
+    body: {},
+    combo: {
+      name: "short-reset-combo",
+      strategy: "priority",
+      models: [`${provider}/${model}`],
+      config: { maxRetries: 0, retryDelayMs: 0, fallbackDelayMs: 0 },
+    },
+    handleSingleModel: async () =>
+      new Response(JSON.stringify({ error: { message: shortResetMessage } }), {
+        status: 429,
+        headers: { "content-type": "application/json" },
+      }),
+    isModelAvailable: async () => true,
+    log: createLog(),
+    settings,
+    allCombos: null,
+  });
+
+  const parsedResetMs = parseRetryFromErrorText(shortResetMessage);
+  assert.equal(parsedResetMs, 45 * 60 * 1000, "sanity: reset text must parse to 45m");
+
+  const info = getModelLockoutInfo(provider, "", model);
+  assert.ok(info, "combo 429 must record a model lockout");
+  // Must be the parsed 45m — NOT the 1h subscription fallback (over-lock).
+  assert.ok(
+    info!.remainingMs > parsedResetMs! - 5_000 && info!.remainingMs <= parsedResetMs!,
+    `lockout must follow the parsed 45m reset, not the 1h fallback; got ${info!.remainingMs}ms (~${Math.round(info!.remainingMs / 1000)}s)`
+  );
+});
diff --git a/tests/unit/combo-quota-share-cooldown-wait.test.ts b/tests/unit/combo-quota-share-cooldown-wait.test.ts
index f699759a6e..a12c16a0aa 100644
--- a/tests/unit/combo-quota-share-cooldown-wait.test.ts
+++ b/tests/unit/combo-quota-share-cooldown-wait.test.ts
@@ -15,6 +15,10 @@
  *
  * The waits use a real (short) cooldown so the real setTimeout in
  * waitForCooldownAwareRetry elapses fast and the model lock expires naturally.
+ *
+ * Scenarios 2 and 4 assert a wall-clock ceiling and were extracted to
+ * tests/unit/serial/combo-quota-share-cooldown-wait-timing.test.ts (#6803) —
+ * see that file's header for why.
  */
 import test from "node:test";
 import assert from "node:assert/strict";
@@ -131,33 +135,12 @@ test("quota-share: short 429 cooldown → waits and re-dispatches (2nd pass 200)
   );
 });
 
-test("quota-share: 403 quota_exhausted → NO wait, error propagated immediately", async () => {
-  let calls = 0;
-  const handleSingleModel = async () => {
-    calls += 1;
-    return rateLimitResponse(403);
-  };
-
-  const startedAt = Date.now();
-  const res = await handleComboChat({
-    body: { model: "openai/gpt-4" },
-    combo: comboOf("quota-share"),
-    handleSingleModel,
-    isModelAvailable: async () => true,
-    log: createLog() as never,
-    settings: shortModelLockoutSettings(),
-    allCombos: null,
-  });
-  const elapsed = Date.now() - startedAt;
-
-  assert.notEqual(res.status, 200, "quota_exhausted must not be retried into a success");
-  // The real signal that the cooldown wait did NOT fire: a single upstream
-  // dispatch (no redispatch). The 403 lock cooldown is multi-second, so the
-  // wait — had it fired — would dominate the elapsed time; assert we stayed far
-  // below that (loose bound; the first combo dispatch pays DB/import overhead).
-  assert.equal(calls, 1, "quota_exhausted must NOT trigger a wait+redispatch");
-  assert.ok(elapsed < 1500, `quota_exhausted must not wait out a cooldown, but ${elapsed}ms elapsed`);
-});
+// NOTE: "quota-share: 403 quota_exhausted → NO wait" and "non quota-share
+// (priority): 429 propagated immediately, NO wait" were extracted to
+// tests/unit/serial/combo-quota-share-cooldown-wait-timing.test.ts (#6803) —
+// both assert a wall-clock ceiling that flaked under CI-runner load; the
+// serial dir (--test-concurrency=1) removes the intra-suite contention that
+// caused it.
 
 test("quota-share: client abort during the wait → 499", async () => {
   const controller = new AbortController();
@@ -185,30 +168,6 @@ test("quota-share: client abort during the wait → 499", async () => {
   assert.equal(res.status, 499, "abort during the cooldown wait must return 499");
 });
 
-test("non quota-share (priority): 429 propagated immediately, NO wait", async () => {
-  let calls = 0;
-  const handleSingleModel = async () => {
-    calls += 1;
-    return rateLimitResponse(429);
-  };
-
-  const startedAt = Date.now();
-  const res = await handleComboChat({
-    body: { model: "openai/gpt-4" },
-    combo: { ...comboOf("priority"), name: "priority-combo" },
-    handleSingleModel,
-    isModelAvailable: async () => true,
-    log: createLog() as never,
-    settings: shortModelLockoutSettings(),
-    allCombos: null,
-  });
-  const elapsed = Date.now() - startedAt;
-
-  assert.equal(res.status, 429, "priority combo must propagate the 429 unchanged");
-  assert.equal(calls, 1, "priority combo must NOT wait+redispatch");
-  assert.ok(elapsed < 1500, `priority combo must not wait out a cooldown, but ${elapsed}ms elapsed`);
-});
-
 test("quota-share with comboCooldownWait disabled → 429 propagated, NO wait", async () => {
   let calls = 0;
   const handleSingleModel = async () => {
diff --git a/tests/unit/combo-rr-sticky-9router.test.ts b/tests/unit/combo-rr-sticky-9router.test.ts
new file mode 100644
index 0000000000..8ab2ec0dfb
--- /dev/null
+++ b/tests/unit/combo-rr-sticky-9router.test.ts
@@ -0,0 +1,13 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { resolveComboStickyRoundRobinLimit } from "../../open-sse/services/combo/rrState.ts";
+
+test("resolveComboStickyRoundRobinLimit prefers per-combo, then comboSticky, then account sticky", () => {
+  const settings = { stickyRoundRobinLimit: 3, comboStickyRoundRobinLimit: 2 };
+  assert.equal(resolveComboStickyRoundRobinLimit(5, settings), 5);
+  assert.equal(resolveComboStickyRoundRobinLimit(undefined, settings), 2);
+  assert.equal(
+    resolveComboStickyRoundRobinLimit(undefined, { stickyRoundRobinLimit: 7 }),
+    7
+  );
+});
\ No newline at end of file
diff --git a/tests/unit/combo-session-stickiness.test.ts b/tests/unit/combo-session-stickiness.test.ts
index ede8def020..39f486836f 100644
--- a/tests/unit/combo-session-stickiness.test.ts
+++ b/tests/unit/combo-session-stickiness.test.ts
@@ -13,12 +13,14 @@
  * - applySessionStickiness: no user message → normal ordering, no crash
  * - applySessionStickiness: different hashes → can map to different connections
  * - applySessionStickiness: saturation fetch error → fail-open
- * - recordStickyBinding / clearStickyBinding lifecycle
+ * - applySessionStickiness: terminal connection status / rateLimitedUntil → rebind (#6692)
+ * - recordStickyBinding / clearStickyBinding / peekStickyConnectionId lifecycle
  */
 
 import test from "node:test";
 import assert from "node:assert/strict";
 import type { HeadroomSaturation } from "../../open-sse/services/combo/headroomRanking.ts";
+import type { StickyConnectionHealth } from "../../open-sse/services/combo/sessionStickiness.ts";
 
 const mod = await import("../../open-sse/services/combo/sessionStickiness.ts");
 const {
@@ -27,7 +29,9 @@ const {
   recordStickyBinding,
   clearStickyBinding,
   clearAllStickyBindings,
+  peekStickyConnectionId,
   __setStickinessHeadroomFetcherForTests,
+  __setStickinessConnectionFetcherForTests,
   STICKINESS_HEADROOM_THRESHOLD,
 } = mod;
 
@@ -51,16 +55,26 @@ function injectSat(sat: HeadroomSaturation | undefined): void {
   __setStickinessHeadroomFetcherForTests(async (_id: string) => sat);
 }
 
+function injectConnectionHealth(byId: Record<string, StickyConnectionHealth | undefined>): void {
+  __setStickinessConnectionFetcherForTests(async (connectionId: string) => byId[connectionId]);
+}
+
 // ─── Test lifecycle ───────────────────────────────────────────────────────────
 
 test.beforeEach(() => {
   clearAllStickyBindings();
   // Default: healthy connection (headroom = 0.5)
   injectSat({ util5h: 0.3, util7d: 0.2 });
+  // Default: unknown to the connection-health fetcher (fail-open, never terminal).
+  // Without this override every test would hit the real dynamic-import → DB path
+  // (resolveConnectionHealth's production branch), which is slow and non-deterministic
+  // for a unit suite that otherwise makes zero DB calls.
+  injectConnectionHealth({});
 });
 
 test.after(() => {
   __setStickinessHeadroomFetcherForTests(null);
+  __setStickinessConnectionFetcherForTests(null);
 });
 
 // ─── deriveMessageHash ───────────────────────────────────────────────────────
@@ -320,3 +334,105 @@ test("messageHash is returned in result even when no binding exists", async () =
   assert.ok(r.messageHash !== null, "hash should be derivable and returned");
   assert.match(r.messageHash!, /^[a-f0-9]{16}$/);
 });
+
+// ─── Terminal connection-status gate (#6692) ─────────────────────────────────
+//
+// Root cause: headroom (5h/weekly usage %) is orthogonal to account
+// availability — a credits_exhausted/banned/expired connection, or one still
+// inside its rateLimitedUntil cooldown, reports perfectly healthy headroom,
+// so the pre-fix headroom-only gate re-promoted a durably dead connection
+// forever. See tests/unit/repro-6692-sticky-terminal.test.ts for the full
+// end-to-end repro.
+
+test("#6692: credits_exhausted sticky connection is rebound even with full headroom", async () => {
+  injectSat({ util5h: 0.0, util7d: 0.0 }); // full headroom — would pass the old gate
+  injectConnectionHealth({ "conn-A": { testStatus: "credits_exhausted" } });
+
+  const targets = [makeTarget("conn-A"), makeTarget("conn-B")];
+  const messages = [{ role: "user", content: "Terminal status test" }];
+  const hash = deriveMessageHash(messages)!;
+  recordStickyBinding(hash, "conn-A");
+
+  const result = await applySessionStickiness(targets, messages);
+  assert.equal(result.stuck, false, "credits_exhausted must release the pin");
+
+  // Binding must actually be cleared (not just skipped this call).
+  assert.equal(peekStickyConnectionId(hash), null);
+});
+
+test("#6692: banned / expired statuses also release the pin", async () => {
+  for (const status of ["banned", "expired"]) {
+    clearAllStickyBindings();
+    injectSat({ util5h: 0.0, util7d: 0.0 });
+    injectConnectionHealth({ "conn-A": { testStatus: status } });
+
+    const targets = [makeTarget("conn-A"), makeTarget("conn-B")];
+    const messages = [{ role: "user", content: `Status ${status}` }];
+    const hash = deriveMessageHash(messages)!;
+    recordStickyBinding(hash, "conn-A");
+
+    const result = await applySessionStickiness(targets, messages);
+    assert.equal(result.stuck, false, `${status} must release the pin`);
+  }
+});
+
+test("#6692: connection still inside rateLimitedUntil window releases the pin", async () => {
+  injectSat({ util5h: 0.0, util7d: 0.0 });
+  const future = new Date(Date.now() + 60_000).toISOString();
+  injectConnectionHealth({ "conn-A": { rateLimitedUntil: future } });
+
+  const targets = [makeTarget("conn-A"), makeTarget("conn-B")];
+  const messages = [{ role: "user", content: "Cooling down" }];
+  const hash = deriveMessageHash(messages)!;
+  recordStickyBinding(hash, "conn-A");
+
+  const result = await applySessionStickiness(targets, messages);
+  assert.equal(result.stuck, false, "an in-window rateLimitedUntil must release the pin");
+});
+
+test("#6692: rateLimitedUntil in the past does NOT release the pin", async () => {
+  injectSat({ util5h: 0.0, util7d: 0.0 });
+  const past = new Date(Date.now() - 60_000).toISOString();
+  injectConnectionHealth({ "conn-A": { rateLimitedUntil: past } });
+
+  const targets = [makeTarget("conn-A"), makeTarget("conn-B")];
+  const messages = [{ role: "user", content: "Cooldown expired" }];
+  const hash = deriveMessageHash(messages)!;
+  recordStickyBinding(hash, "conn-A");
+
+  const result = await applySessionStickiness(targets, messages);
+  assert.ok(result.stuck, "an expired rateLimitedUntil must not block reuse");
+  assert.equal(result.targets[0].connectionId, "conn-A");
+});
+
+test("#6692: connection-health fetch error → fail-open (pin preserved)", async () => {
+  injectSat({ util5h: 0.0, util7d: 0.0 });
+  __setStickinessConnectionFetcherForTests(async () => {
+    throw new Error("db unavailable");
+  });
+
+  const targets = [makeTarget("conn-A"), makeTarget("conn-B")];
+  const messages = [{ role: "user", content: "Fetch error path" }];
+  const hash = deriveMessageHash(messages)!;
+  recordStickyBinding(hash, "conn-A");
+
+  // The production resolveConnectionHealth catches internally and returns
+  // undefined (never throws) — mirrors resolveSaturation's own internal
+  // try/catch. This test injects a THROWING override to prove
+  // applySessionStickiness's outer try/catch also fails open end-to-end
+  // (same behavior as the existing "saturation fetch error" case above:
+  // total fail-open/no-op, never a crash).
+  const result = await applySessionStickiness(targets, messages);
+  assert.equal(result.stuck, false, "a connection-health fetch error must fail open, not crash");
+});
+
+test("peekStickyConnectionId: reflects the current binding without mutating it", () => {
+  const messages = [{ role: "user", content: "Peek test" }];
+  const hash = deriveMessageHash(messages)!;
+
+  assert.equal(peekStickyConnectionId(hash), null, "no binding yet");
+  recordStickyBinding(hash, "conn-peek");
+  assert.equal(peekStickyConnectionId(hash), "conn-peek");
+  // Peeking again must not clear or otherwise mutate the binding.
+  assert.equal(peekStickyConnectionId(hash), "conn-peek");
+});
diff --git a/tests/unit/combo-strategy-fallbacks.test.ts b/tests/unit/combo-strategy-fallbacks.test.ts
index efb0189403..88792e64cc 100644
--- a/tests/unit/combo-strategy-fallbacks.test.ts
+++ b/tests/unit/combo-strategy-fallbacks.test.ts
@@ -782,66 +782,12 @@ test("unknown strategy value normalizes to priority order", async () => {
   assert.deepEqual(calls, ["openai/gpt-4o-mini"], "typo falls back to priority (first model)");
 });
 
-test("combo skips a provider while its breaker is OPEN and attempts it again after the reset timeout (HALF_OPEN)", async () => {
-  const breaker = getCircuitBreaker("openai", { failureThreshold: 1, resetTimeout: 40 });
-  try {
-    await breaker.execute(async () => {
-      throw new Error("simulated provider failure");
-    });
-  } catch {
-    // expected — trips the breaker OPEN
-  }
-  assert.equal(breaker.getStatus().state, "OPEN");
-
-  const comboDef = {
-    name: "half-open-recovery",
-    strategy: "priority",
-    models: ["openai/gpt-4o-mini", "claude/sonnet"],
-    config: { maxRetries: 0, retryDelayMs: 0, fallbackDelayMs: 0 },
-  };
-
-  // While OPEN: the openai target must be skipped, claude serves.
-  const callsWhileOpen: string[] = [];
-  const blocked = await handleComboChat({
-    body: {},
-    combo: comboDef,
-    handleSingleModel: async (_body: any, modelStr: string) => {
-      callsWhileOpen.push(modelStr);
-      return okResponse();
-    },
-    isModelAvailable: async () => true,
-    log: createLog(),
-    settings: null,
-    allCombos: null,
-  });
-  assert.equal(blocked.ok, true);
-  assert.deepEqual(callsWhileOpen, ["claude/sonnet"], "OPEN breaker target must be skipped");
-
-  // After the reset timeout the breaker reads HALF_OPEN — the combo must probe
-  // the provider again instead of excluding it forever (lazy recovery contract).
-  await new Promise((resolve) => setTimeout(resolve, 80));
-  assert.equal(breaker.getStatus().state, "HALF_OPEN");
-
-  const callsAfterExpiry: string[] = [];
-  const probed = await handleComboChat({
-    body: {},
-    combo: comboDef,
-    handleSingleModel: async (_body: any, modelStr: string) => {
-      callsAfterExpiry.push(modelStr);
-      return okResponse();
-    },
-    isModelAvailable: async () => true,
-    log: createLog(),
-    settings: null,
-    allCombos: null,
-  });
-  assert.equal(probed.ok, true);
-  assert.deepEqual(
-    callsAfterExpiry,
-    ["openai/gpt-4o-mini"],
-    "HALF_OPEN provider must be probed again"
-  );
-});
+// NOTE: "combo skips a provider while its breaker is OPEN and attempts it
+// again after the reset timeout (HALF_OPEN)" was extracted to
+// tests/unit/serial/combo-strategy-fallbacks-half-open-timing.test.ts (#6803)
+// — it races an 80ms real setTimeout against a 40ms breaker resetTimeout,
+// which flaked under CI-runner load; the serial dir (--test-concurrency=1)
+// removes the intra-suite contention that caused it.
 
 test("preScreenTargets marks an expired-OPEN (HALF_OPEN) target as available", async () => {
   const breaker = getCircuitBreaker("openai", { failureThreshold: 1, resetTimeout: 30 });
diff --git a/tests/unit/combo/context-requirements-integration.test.ts b/tests/unit/combo/context-requirements-integration.test.ts
new file mode 100644
index 0000000000..b4fe9e99bf
--- /dev/null
+++ b/tests/unit/combo/context-requirements-integration.test.ts
@@ -0,0 +1,101 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { applyContextRequirements } from "../../../open-sse/services/combo/contextRequirements";
+import type { ResolvedComboTarget } from "../../../open-sse/services/combo/types";
+
+// Mock logger
+const mockLog = {
+  info: () => {},
+  debug: () => {},
+  warn: () => {},
+  error: () => {},
+};
+
+describe("Context Requirements Integration", () => {
+  it("should filter and sort targets with full context requirements", () => {
+    const targets = [
+      { modelStr: "gpt-3.5-turbo", provider: "openai", weight: 1 },
+      { modelStr: "gpt-4", provider: "openai", weight: 1 },
+      { modelStr: "gpt-4-turbo", provider: "openai", weight: 1 },
+      { modelStr: "claude-3-opus-20240229", provider: "anthropic", weight: 1 },
+      { modelStr: "gemini-1.5-pro", provider: "google", weight: 1 },
+    ];
+
+    const requirements = {
+      minContextWindow: 100000,
+      preferLargeContext: true,
+      contextFilterMode: "strict" as const,
+    };
+
+    const result = applyContextRequirements(targets, requirements, mockLog);
+    // Should filter out models with <100k context and, in strict mode, also drop
+    // models whose context window is unknown in the current catalog snapshot.
+    assert.ok(result.length < targets.length);
+    assert.ok(
+      result.every((target) => targets.some((original) => original.modelStr === target.modelStr)),
+      "Filtered targets should be a subset of the original list"
+    );
+  });
+
+  it("should not filter when no requirements specified", () => {
+    const targets = [
+      { modelStr: "gpt-3.5-turbo", provider: "openai", weight: 1 },
+      { modelStr: "gpt-4", provider: "openai", weight: 1 },
+    ];
+
+    const result = applyContextRequirements(targets, undefined, mockLog);
+    assert.equal(result.length, targets.length);
+    assert.equal(result, targets); // Same reference
+  });
+
+  it("should handle empty targets array", () => {
+    const targets: ResolvedComboTarget[] = [];
+    const requirements = {
+      minContextWindow: 32000,
+      preferLargeContext: true,
+    };
+
+    const result = applyContextRequirements(targets, requirements, mockLog);
+    assert.equal(result.length, 0);
+  });
+
+  it("should handle lenient mode with unknown context models", () => {
+    const targets = [
+      { modelStr: "gpt-4", provider: "openai", weight: 1 },
+      { modelStr: "unknown-model", provider: "custom", weight: 1 },
+    ];
+
+    const requirements = {
+      minContextWindow: 32000,
+      contextFilterMode: "lenient" as const,
+    };
+
+    const result = applyContextRequirements(targets, requirements, mockLog);
+
+    // Should include unknown-model in lenient mode
+    assert.ok(
+      result.some((t) => t.modelStr === "unknown-model"),
+      "Should include unknown model in lenient mode"
+    );
+  });
+
+  it("should handle strict mode with unknown context models", () => {
+    const targets = [
+      { modelStr: "claude-3-opus-20240229", provider: "anthropic", weight: 1 },
+      { modelStr: "unknown-model", provider: "custom", weight: 1 },
+    ];
+
+    const requirements = {
+      minContextWindow: 32000,
+      contextFilterMode: "strict" as const,
+    };
+
+    const result = applyContextRequirements(targets, requirements, mockLog);
+
+    // Should exclude unknown-model in strict mode
+    assert.ok(
+      !result.some((t) => t.modelStr === "unknown-model"),
+      "Should exclude unknown model in strict mode"
+    );
+  });
+});
diff --git a/tests/unit/compression-cli-rest-fallback-6571.test.ts b/tests/unit/compression-cli-rest-fallback-6571.test.ts
new file mode 100644
index 0000000000..2816cce87a
--- /dev/null
+++ b/tests/unit/compression-cli-rest-fallback-6571.test.ts
@@ -0,0 +1,152 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+// Repro for #6571 — REST-fallback path of `omniroute compression` (hit only when
+// /api/mcp/tools/call is not mounted, i.e. mcpCall()'s 404/501 branch) uses the
+// nonexistent `engine` field instead of the canonical `defaultMode` field, and
+// the table renderer prints "[object Object]" for nested object cells.
+
+type MockResponse = Pick<Response, "ok" | "status" | "headers" | "json" | "text">;
+
+function makeResp(data: unknown, status = 200): MockResponse {
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    headers: new Headers(),
+    json: () => Promise.resolve(data),
+    text: () => Promise.resolve(JSON.stringify(data)),
+  };
+}
+
+interface CommanderLikeCmd {
+  optsWithGlobals: () => { output: string; quiet: boolean };
+}
+
+function makeCmd(output = "json"): CommanderLikeCmd {
+  return { optsWithGlobals: () => ({ output, quiet: output !== "table" }) };
+}
+
+async function captureStdout(fn: () => Promise<void>): Promise<string> {
+  const chunks: string[] = [];
+  const orig = process.stdout.write.bind(process.stdout);
+  process.stdout.write = ((c: string | Uint8Array) => {
+    if (typeof c === "string") chunks.push(c);
+    return true;
+  }) as typeof process.stdout.write;
+  try {
+    await fn();
+  } finally {
+    process.stdout.write = orig;
+  }
+  return chunks.join("");
+}
+
+test("restCompressionStatus (via runCompressionStatus REST fallback) should surface settings.defaultMode as `strategy`, not a nonexistent `engine` field", async () => {
+  const origFetch = globalThis.fetch;
+  globalThis.fetch = (async (url: string | URL | Request) => {
+    const u = String(url);
+    if (u.includes("/api/mcp/tools/call")) return makeResp({ error: "not mounted" }, 404);
+    if (u.includes("/api/settings/compression")) {
+      // Canonical server payload — NOTE: field is `defaultMode`, there is no `engine` key.
+      // src/lib/db/compression.ts COMPRESSION_MODES / GET route just returns getCompressionSettings().
+      return makeResp({ enabled: true, defaultMode: "stacked" });
+    }
+    if (u.includes("/api/context/combos")) return makeResp({ combos: [] });
+    if (u.includes("/api/context/analytics")) return makeResp({ totalRequests: 0 });
+    throw new Error(`unexpected fetch: ${u}`);
+  }) as typeof fetch;
+
+  try {
+    const { runCompressionStatus } = await import(
+      "../../bin/cli/commands/compression.mjs"
+    );
+    const out = await captureStdout(() =>
+      runCompressionStatus({}, makeCmd("json") as unknown as Parameters<typeof runCompressionStatus>[1])
+    );
+    const parsed = JSON.parse(out);
+
+    // The server's actual field is `defaultMode: "stacked"`. The CLI's REST fallback
+    // must surface that as `strategy` (matching the MCP tool's contract in
+    // open-sse/mcp-server/tools/compressionTools.ts::handleCompressionStatus, which
+    // returns `strategy: settings.defaultMode || "standard"`), not a nonexistent
+    // `engine` field that is always null.
+    assert.equal(
+      parsed.strategy,
+      "stacked",
+      `expected REST fallback to expose settings.defaultMode as "strategy" (got: ${JSON.stringify(parsed)})`
+    );
+  } finally {
+    globalThis.fetch = origFetch;
+  }
+});
+
+test("restSetEngine (via runCompressionEngineSet REST fallback) should PUT `defaultMode`, not the nonexistent `engine` field, and translate caveman->standard", async () => {
+  const origFetch = globalThis.fetch;
+  const putBodies: Record<string, unknown>[] = [];
+  globalThis.fetch = (async (url: string | URL | Request, init?: RequestInit) => {
+    const u = String(url);
+    if (u.includes("/api/mcp/tools/call")) return makeResp({ error: "not mounted" }, 404);
+    if (u.includes("/api/settings/compression") && init?.method === "PUT") {
+      const body = init?.body ? JSON.parse(String(init.body)) : {};
+      putBodies.push(body);
+      return makeResp({ enabled: true, defaultMode: body.defaultMode ?? body.engine });
+    }
+    throw new Error(`unexpected fetch: ${u} ${init?.method}`);
+  }) as typeof fetch;
+
+  try {
+    const { runCompressionEngineSet } = await import(
+      "../../bin/cli/commands/compression.mjs"
+    );
+    await runCompressionEngineSet(
+      "caveman",
+      {},
+      makeCmd("json") as unknown as Parameters<typeof runCompressionEngineSet>[2]
+    );
+
+    assert.equal(putBodies.length, 1, "expected exactly one PUT to /api/settings/compression");
+    const body = putBodies[0];
+
+    // Bug 1: CLI currently PUTs `{ engine: "standard" }`. The server's Zod schema
+    // (compressionSettingsUpdateSchema in src/shared/validation/compressionConfigSchemas.ts)
+    // is `.strict()` and has no `engine` key — only `defaultMode` — so this key is not
+    // even silently dropped, it fails validation server-side. The fix must send
+    // `defaultMode`, translating caveman->standard exactly like
+    // open-sse/mcp-server/tools/compressionTools.ts::handleSetCompressionEngine does
+    // (`args.engine === "caveman" ? "standard" : args.engine`).
+    assert.equal(
+      body.defaultMode,
+      "standard",
+      `expected PUT body to contain defaultMode:"standard" (caveman translated), got: ${JSON.stringify(body)}`
+    );
+    assert.equal(body.engine, undefined, `PUT body must not contain a nonexistent "engine" key, got: ${JSON.stringify(body)}`);
+  } finally {
+    globalThis.fetch = origFetch;
+  }
+});
+
+test("output.mjs emit() table renderer must not print [object Object] for nested-object fields", async () => {
+  const { emit } = await import("../../bin/cli/output.mjs");
+
+  const chunks: string[] = [];
+  const origIsTTY = process.stdout.isTTY;
+  const origWrite = process.stdout.write.bind(process.stdout);
+  process.stdout.isTTY = true; // force table format
+  process.stdout.write = ((c: string | Uint8Array) => {
+    if (typeof c === "string") chunks.push(c);
+    return true;
+  }) as typeof process.stdout.write;
+
+  try {
+    emit([{ name: "combo-a", settings: { depth: 2, mode: "stacked" } }], { output: "table" });
+  } finally {
+    process.stdout.write = origWrite;
+    process.stdout.isTTY = origIsTTY;
+  }
+
+  const rendered = chunks.join("");
+  assert.ok(
+    !rendered.includes("[object Object]"),
+    `table rendering must JSON-stringify nested object cells instead of printing "[object Object]"; got:\n${rendered}`
+  );
+});
diff --git a/tests/unit/compression-noop-guard.test.ts b/tests/unit/compression-noop-guard.test.ts
new file mode 100644
index 0000000000..b6dd237a86
--- /dev/null
+++ b/tests/unit/compression-noop-guard.test.ts
@@ -0,0 +1,117 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { guardPipelineInflation } from "../../open-sse/services/compression/pipelineGuards.ts";
+import { applyStackedCompression } from "../../open-sse/services/compression/strategySelector.ts";
+import {
+  registerCompressionEngine,
+  setEngineEnabled,
+} from "../../open-sse/services/compression/engines/registry.ts";
+import type { CompressionEngine } from "../../open-sse/services/compression/engines/types.ts";
+import type { CompressionPipelineStep } from "../../open-sse/services/compression/types.ts";
+
+// Regression suite for the three compression NO-OP defects: a structural engine (ccr /
+// session-dedup) that finds nothing to compress must be treated as ZERO SAVINGS, never as an
+// inflation revert (A), never a silent skip (B), and never lose its identity in the breakdown (C).
+
+// A test-only engine that mimics a structural no-op: body unchanged, compressed:false, stats:null.
+function makeNoopEngine(id: string): CompressionEngine {
+  return {
+    id,
+    name: "Test Noop",
+    description: "test-only engine that finds nothing to compress",
+    icon: "bug_report",
+    targets: ["messages"],
+    stackable: true,
+    stackPriority: 0,
+    metadata: {
+      id,
+      name: "Test Noop",
+      description: "test-only",
+      inputScope: "messages",
+      targetLatencyMs: 0,
+      supportsPreview: false,
+      stable: true,
+    },
+    apply(body) {
+      return { body, compressed: false, stats: null };
+    },
+    compress(body) {
+      return this.apply(body);
+    },
+    getConfigSchema() {
+      return [];
+    },
+    validateConfig() {
+      return { valid: true, errors: [] };
+    },
+  };
+}
+
+// --- Defect A: a net-zero (equal-token) no-op is NOT inflation ---
+
+test("guardPipelineInflation: equal tokens (no-op) is NOT flagged as inflation", () => {
+  const original = { a: 1 };
+  const compressed = { a: 1 };
+  const r = guardPipelineInflation({
+    originalBody: original,
+    compressedBody: compressed,
+    originalTokens: 100,
+    compressedTokens: 100,
+  });
+  assert.equal(r.inflated, false);
+  assert.equal(r.body, compressed);
+});
+
+test("guardPipelineInflation: strictly larger output still reverts as inflation", () => {
+  const original = { a: 1 };
+  const compressed = { a: 1, pad: "xxxx" };
+  const r = guardPipelineInflation({
+    originalBody: original,
+    compressedBody: compressed,
+    originalTokens: 100,
+    compressedTokens: 101,
+  });
+  assert.equal(r.inflated, true);
+  assert.equal(r.body, original);
+});
+
+// --- Defect B: a disabled engine skip records a validationWarning (symmetric with breaker skip) ---
+
+const DISABLED_ID = "test-noop-disabled-guard";
+
+test("applyStackedCompression: a disabled engine skip surfaces a 'disabled' validationWarning", () => {
+  registerCompressionEngine(makeNoopEngine(DISABLED_ID));
+  setEngineEnabled(DISABLED_ID, false);
+
+  const body = { messages: [{ role: "user", content: "hello world" }] };
+  const result = applyStackedCompression(body, [{ engine: DISABLED_ID } as CompressionPipelineStep]);
+
+  const warnings = result.stats?.validationWarnings ?? [];
+  assert.ok(
+    warnings.some((w) => w.includes("disabled")),
+    `expected a 'disabled' validationWarning, got: ${JSON.stringify(warnings)}`
+  );
+  assert.ok(
+    warnings.some((w) => w.includes(DISABLED_ID)),
+    "the warning should name the disabled engine"
+  );
+});
+
+// --- Defect C: a no-op engine keeps its identity in engineBreakdown (not a generic "stacked") ---
+
+const NOOP_ID = "test-noop-breakdown-guard";
+
+test("applyStackedCompression: a no-op engine records its own identity in engineBreakdown", () => {
+  registerCompressionEngine(makeNoopEngine(NOOP_ID));
+  setEngineEnabled(NOOP_ID, true);
+
+  const body = { messages: [{ role: "user", content: "hello world this is a message" }] };
+  const result = applyStackedCompression(body, [{ engine: NOOP_ID } as CompressionPipelineStep]);
+
+  const breakdown = result.stats?.engineBreakdown ?? [];
+  const entry = breakdown.find((e) => e.engine === NOOP_ID);
+  assert.ok(entry, `expected a breakdown entry keyed on "${NOOP_ID}", got: ${JSON.stringify(breakdown)}`);
+  assert.equal(entry?.savingsPercent, 0);
+  // The requested engine's identity must be preserved — never collapsed into a generic "stacked".
+  assert.notEqual(entry?.engine, "stacked");
+});
diff --git a/tests/unit/compression-pipeline-inflation-guard.test.ts b/tests/unit/compression-pipeline-inflation-guard.test.ts
index 07150a13d9..2bc93b0682 100644
--- a/tests/unit/compression-pipeline-inflation-guard.test.ts
+++ b/tests/unit/compression-pipeline-inflation-guard.test.ts
@@ -7,6 +7,7 @@ import {
   setEngineEnabled,
 } from "../../open-sse/services/compression/engines/registry.ts";
 import type { CompressionEngine } from "../../open-sse/services/compression/engines/types.ts";
+import type { CompressionPipelineStep } from "../../open-sse/services/compression/types.ts";
 
 // --- Pure guard logic ---
 
@@ -23,7 +24,10 @@ test("guardPipelineInflation reverts to the original when the stacked output did
   assert.equal(r.body, original);
 });
 
-test("guardPipelineInflation reverts on a net-zero (equal-token) result", () => {
+test("guardPipelineInflation treats a net-zero (equal-token) no-op as NOT inflated", () => {
+  // A structural engine (ccr / session-dedup) that finds nothing returns the body unchanged, so
+  // compressedTokens === originalTokens. That is a no-op (zero savings), not inflation — the guard
+  // must keep the compressed body and never emit the "did not shrink; reverted" warning.
   const original = { a: 1 };
   const compressed = { b: 2 };
   const r = guardPipelineInflation({
@@ -32,8 +36,8 @@ test("guardPipelineInflation reverts on a net-zero (equal-token) result", () =>
     originalTokens: 50,
     compressedTokens: 50,
   });
-  assert.equal(r.inflated, true);
-  assert.equal(r.body, original);
+  assert.equal(r.inflated, false);
+  assert.equal(r.body, compressed);
 });
 
 test("guardPipelineInflation keeps the compressed body when it actually shrank", () => {
@@ -113,7 +117,11 @@ test("applyStackedCompression reverts to the original body when the pipeline inf
   const body = {
     messages: [{ role: "user", content: "hello world this is a short message" }],
   };
-  const result = applyStackedCompression(body, [INFLATE_ID]);
+  // Pass a step object, not a bare string: `normalizePipelineStep()` only recognizes a fixed
+  // set of built-in bare-string aliases ("standard"/"rtk"/"lite"/"aggressive"/"ultra") and
+  // silently falls back to `{ engine: "caveman" }` for any other string — a bare custom-engine
+  // id here would silently run caveman instead of the registered `inflatingEngine`.
+  const result = applyStackedCompression(body, [{ engine: INFLATE_ID } as CompressionPipelineStep]);
 
   // The inflating engine produced a bigger body, so the aggregate guard discarded it.
   assert.equal(result.compressed, false);
diff --git a/tests/unit/compression/combos-engine-ui-schema-parity-4955.test.ts b/tests/unit/compression/combos-engine-ui-schema-parity-4955.test.ts
index 2162dd765d..4855faa60b 100644
--- a/tests/unit/compression/combos-engine-ui-schema-parity-4955.test.ts
+++ b/tests/unit/compression/combos-engine-ui-schema-parity-4955.test.ts
@@ -3,15 +3,17 @@ import assert from "node:assert/strict";
 
 import {
   STACKED_PIPELINE_ENGINE_INTENSITIES,
+  compressionSettingsUpdateSchema,
   stackedPipelineStepSchema,
 } from "../../../src/shared/validation/compressionConfigSchemas.ts";
+import { ENGINE_IDS } from "../../../open-sse/services/compression/engineCatalog.ts";
 
-// Regression guard for #4955: the Engine Combos pipeline editor used to offer engines
-// (headroom, session-dedup, ccr, llmlingua) that `stackedPipelineStepSchema` rejects, so
-// selecting one made `PUT /api/context/combos/[id]` fail with HTTP 400 and the UI swallowed
-// it. The fix routes the dropdown through STACKED_PIPELINE_ENGINE_INTENSITIES, which MUST stay
-// in lockstep with the discriminated union below.
-describe("Engine Combos UI ↔ stackedPipelineStepSchema parity (#4955)", () => {
+// Regression guard for #4955 / #6747:
+// - #4955: UI and API schema must stay in lockstep (no engines the UI offers that PUT rejects).
+// - #6747: PUT must accept every ENGINE_CATALOG / GET stackedPipeline engine so GET→PUT
+//   round-trips of compression settings succeed (session-dedup, ccr, headroom, relevance,
+//   llmlingua were previously rejected by a 5-engine discriminator).
+describe("Engine Combos UI ↔ stackedPipelineStepSchema parity (#4955 / #6747)", () => {
   const unionEngines = stackedPipelineStepSchema.options
     .map((option: { shape: { engine: { value: string } } }) => option.shape.engine.value)
     .sort();
@@ -21,8 +23,18 @@ describe("Engine Combos UI ↔ stackedPipelineStepSchema parity (#4955)", () =>
     assert.deepEqual(uiEngines, unionEngines);
   });
 
+  it("covers every ENGINE_CATALOG id (GET /api/compression/engines parity)", () => {
+    assert.deepEqual([...ENGINE_IDS].sort(), unionEngines);
+  });
+
   it("every (engine, intensity) the UI can emit is accepted by the schema", () => {
     for (const [engine, intensities] of Object.entries(STACKED_PIPELINE_ENGINE_INTENSITIES)) {
+      // Engines with no level selector still need bare { engine } accepted
+      assert.equal(
+        stackedPipelineStepSchema.safeParse({ engine }).success,
+        true,
+        `expected bare { engine: "${engine}" } to be accepted`
+      );
       for (const intensity of intensities) {
         const result = stackedPipelineStepSchema.safeParse({ engine, intensity });
         assert.equal(
@@ -34,18 +46,37 @@ describe("Engine Combos UI ↔ stackedPipelineStepSchema parity (#4955)", () =>
     }
   });
 
-  it("the engines removed from the UI in #4955 are indeed rejected by the schema", () => {
-    for (const engine of ["headroom", "session-dedup", "ccr", "llmlingua"]) {
+  it("accepts structural catalog engines that #4955 had temporarily dropped from the UI (#6747)", () => {
+    for (const engine of ["headroom", "session-dedup", "ccr", "llmlingua", "relevance"]) {
       assert.equal(
-        stackedPipelineStepSchema.safeParse({ engine, intensity: "standard" }).success,
-        false,
-        `engine "${engine}" must not be a valid stacked-pipeline step`
+        stackedPipelineStepSchema.safeParse({ engine }).success,
+        true,
+        `engine "${engine}" must be a valid stacked-pipeline step`
       );
-      assert.equal(
-        STACKED_PIPELINE_ENGINE_INTENSITIES[engine],
-        undefined,
-        `engine "${engine}" must not be offered by the combos UI`
+      assert.ok(
+        Object.prototype.hasOwnProperty.call(STACKED_PIPELINE_ENGINE_INTENSITIES, engine),
+        `engine "${engine}" must be offered by the combos UI`
       );
     }
   });
+
+  it("accepts a full GET-shaped stackedPipeline on settings update (#6747)", () => {
+    const result = compressionSettingsUpdateSchema.safeParse({
+      stackedPipeline: [
+        { engine: "session-dedup" },
+        { engine: "ccr" },
+        { engine: "lite", intensity: "lite" },
+        { engine: "rtk", intensity: "standard" },
+        { engine: "headroom" },
+        { engine: "relevance" },
+        { engine: "caveman", intensity: "full" },
+        { engine: "aggressive", intensity: "ultra" },
+        { engine: "llmlingua" },
+        { engine: "ultra", intensity: "ultra" },
+      ],
+    });
+    assert.equal(result.success, true, () =>
+      result.success ? "" : JSON.stringify(result.error.issues)
+    );
+  });
 });
diff --git a/tests/unit/compression/headroom-smartcrusher.test.ts b/tests/unit/compression/headroom-smartcrusher.test.ts
index 4d107b97bf..4c0baa858d 100644
--- a/tests/unit/compression/headroom-smartcrusher.test.ts
+++ b/tests/unit/compression/headroom-smartcrusher.test.ts
@@ -88,6 +88,40 @@ describe("tabular encoder round-trip", () => {
     assert.deepEqual(decoded, original);
   });
 
+  it("round-trips deeply nested rows (multi-level objects + array-of-objects) via v3.2 flattening", async () => {
+    const original: Record<string, unknown>[] = Array.from({ length: 12 }, (_, i) => ({
+      id: i,
+      meta: { owner: { name: `n-${i}`, team: `t-${i % 2}` }, count: i * 2 },
+      items: [
+        { sku: `s-${i}`, qty: i },
+        { sku: `s2-${i}`, qty: i + 1 },
+      ],
+    }));
+    const encoded = encodeTabular(original);
+    // v3.2 nested flattening emits `>`-prefixed path fields for nested objects.
+    assert.match(encoded, /meta>owner>name/);
+    const decoded = decodeTabular(encoded);
+    // Order-insensitive: flattening may reorder object keys, which is semantically irrelevant.
+    assert.deepEqual(decoded, original);
+  });
+
+  it("round-trips a nested object that is null in some rows without losing the null", async () => {
+    // A null nested object must not be flattened (its leaves would encode absent and
+    // unflatten to a missing key). These must all survive as null, not disappear.
+    const cases: Record<string, unknown>[][] = [
+      [{ id: 0, meta: { a: 1, b: 2 } }, { id: 1, meta: null }, { id: 2, meta: { a: 3, b: 4 } }],
+      [
+        { id: 0, meta: { owner: { name: "a" } } },
+        { id: 1, meta: { owner: null } },
+        { id: 2, meta: { owner: { name: "c" } } },
+      ],
+      [{ id: 0, o: { p: { team: { x: 1 } } } }, { id: 1, o: { p: { team: null } } }],
+    ];
+    for (const original of cases) {
+      assert.deepEqual(decodeTabular(encodeTabular(original)), original);
+    }
+  });
+
   it("encoded form contains an explicit [N] count marker with field declaration", async () => {
     const original = makeRows(25);
     const encoded = encodeTabular(original);
@@ -96,6 +130,45 @@ describe("tabular encoder round-trip", () => {
   });
 });
 
+// ─── 1b. Prototype-pollution safety (v3.2 flatten paths + object parser) ──────
+
+describe("tabular codec — prototype-pollution safety", () => {
+  it("round-trips rows with a literal __proto__ own-key without polluting Object.prototype", async () => {
+    const rows = Array.from({ length: 5 }, (_, i) =>
+      JSON.parse(`{"id":${i},"meta":{"__proto__":{"polluted":true},"real":${i}}}`)
+    );
+    const decoded = decodeTabular(encodeTabular(rows));
+    assert.deepEqual(decoded, rows);
+    assert.equal(({} as Record<string, unknown>).polluted, undefined);
+  });
+
+  it("round-trips a top-level __proto__ column without polluting", async () => {
+    const rows = Array.from({ length: 3 }, (_, i) => JSON.parse(`{"id":${i},"__proto__":"x${i}"}`));
+    const decoded = decodeTabular(encodeTabular(rows));
+    assert.deepEqual(decoded, rows);
+    assert.equal(({} as Record<string, unknown>).x0, undefined);
+  });
+
+  it("does not pollute or throw when decoding hostile GCF with a >__proto__> path column", async () => {
+    const hostile =
+      "```gcf-generic\nGCF profile=generic\n" +
+      '## [1]{id,"a>__proto__>polluted"}\n@0 0|1\n```';
+    decodeTabular(hostile);
+    assert.equal(({} as Record<string, unknown>).polluted, undefined);
+  });
+
+  it("round-trips keys named toString/constructor/valueOf (own-property, not prototype-chain)", async () => {
+    const rows = Array.from({ length: 4 }, (_, i) => ({
+      id: i,
+      toString: `ts${i}`,
+      constructor: `c${i}`,
+      valueOf: i,
+    }));
+    const decoded = decodeTabular(encodeTabular(rows));
+    assert.deepEqual(decoded, rows);
+  });
+});
+
 // ─── 2. engine.apply compresses ≥30% and is reversible ───────────────────────
 
 describe("headroomEngine.apply — compression", () => {
diff --git a/tests/unit/compression/image-aware-tokens.test.ts b/tests/unit/compression/image-aware-tokens.test.ts
new file mode 100644
index 0000000000..8a0e224dd4
--- /dev/null
+++ b/tests/unit/compression/image-aware-tokens.test.ts
@@ -0,0 +1,69 @@
+import { test } from "node:test";
+import assert from "node:assert";
+import { estimateCompressionTokens } from "../../../open-sse/services/compression/stats.ts";
+import { transformAnthropicMessages } from "omniglyph";
+
+const CHARS_PER_TOKEN = 4;
+
+// Corpo Claude denso o bastante para o gate de rentabilidade do omniglyph converter
+// (mesmo fixture usado em omniglyph-adapter.test.ts / omniglyph-plumbing.test.ts).
+const DENSE =
+  "X".repeat(500) +
+  "\n" +
+  Array.from(
+    { length: 400 },
+    (_, i) => `const row_${i} = compute(${i * 17}, "${"v".repeat(80)}");`
+  ).join("\n");
+
+const DENSE_CLAUDE_BODY = {
+  model: "claude-fable-5",
+  max_tokens: 128,
+  system: DENSE,
+  messages: [{ role: "user", content: [{ type: "text", text: "oi" }] }],
+};
+
+test("estimateCompressionTokens é image-aware: encolhe de verdade numa página omniglyph real", async () => {
+  const encoded = new TextEncoder().encode(JSON.stringify(DENSE_CLAUDE_BODY));
+  const result = await transformAnthropicMessages({ body: encoded, model: "claude-fable-5" });
+  assert.ok(
+    result.applied,
+    `omniglyph deveria ter convertido o corpo denso (reason=${result.reason})`
+  );
+  const outBody = JSON.parse(new TextDecoder().decode(result.body)) as Record<string, unknown>;
+  assert.ok(
+    JSON.stringify(outBody).includes('"type":"image"'),
+    "saída deveria conter bloco de imagem"
+  );
+
+  const naiveCharEstimate = Math.ceil(JSON.stringify(outBody).length / CHARS_PER_TOKEN);
+  const imageAwareEstimate = estimateCompressionTokens(outBody);
+  const originalTextEstimate = estimateCompressionTokens(DENSE_CLAUDE_BODY);
+
+  console.log(
+    `naive-char=${naiveCharEstimate} image-aware=${imageAwareEstimate} original-text=${originalTextEstimate}`
+  );
+
+  // O estimador ciente de imagem deve ser MUITO menor que o char-count ingênuo do
+  // próprio base64 (prova que o base64 não é contado por char).
+  assert.ok(
+    imageAwareEstimate < naiveCharEstimate,
+    `esperado image-aware (${imageAwareEstimate}) < naive-char (${naiveCharEstimate})`
+  );
+  // E deve representar encolhimento real frente ao texto original (não só frente ao
+  // próprio char-count do PNG).
+  assert.ok(
+    imageAwareEstimate < originalTextEstimate,
+    `esperado image-aware (${imageAwareEstimate}) < original-text (${originalTextEstimate})`
+  );
+});
+
+test("regressão: corpo sem imagem estima o MESMO valor de antes (char-count puro)", () => {
+  const plainBody = {
+    model: "claude-sonnet-5",
+    max_tokens: 128,
+    system: "prompt curto",
+    messages: [{ role: "user", content: [{ type: "text", text: "olá, tudo bem?" }] }],
+  };
+  const expected = Math.ceil(JSON.stringify(plainBody).length / CHARS_PER_TOKEN);
+  assert.equal(estimateCompressionTokens(plainBody), expected);
+});
diff --git a/tests/unit/compression/omniglyph-adapter.test.ts b/tests/unit/compression/omniglyph-adapter.test.ts
new file mode 100644
index 0000000000..ec499a2b17
--- /dev/null
+++ b/tests/unit/compression/omniglyph-adapter.test.ts
@@ -0,0 +1,82 @@
+import { test } from "node:test";
+import assert from "node:assert";
+import { omniglyphEngine } from "../../../open-sse/services/compression/engines/omniglyphAdapter.ts";
+
+// Corpo Claude denso o bastante para o gate de rentabilidade do omniglyph converter.
+const DENSE =
+  "X".repeat(500) +
+  "\n" +
+  Array.from(
+    { length: 400 },
+    (_, i) => `const row_${i} = compute(${i * 17}, "${"v".repeat(80)}");`
+  ).join("\n");
+function claudeBody(): Record<string, unknown> {
+  return {
+    model: "claude-fable-5",
+    max_tokens: 128,
+    system: DENSE,
+    messages: [{ role: "user", content: [{ type: "text", text: "oi" }] }],
+  };
+}
+const OK = { model: "claude-fable-5", supportsVision: true, providerTransport: "direct" as const };
+
+test("happy path: comprime corpo claude denso em blocos de imagem", async () => {
+  const r = await omniglyphEngine.applyAsync!(claudeBody(), OK);
+  assert.equal(r.compressed, true);
+  assert.ok(JSON.stringify(r.body).includes('"type":"image"'));
+});
+
+test("skip fail-closed: sem supportsVision / transporte agregador / undefined", async () => {
+  for (const opts of [
+    { ...OK, supportsVision: false },
+    { ...OK, providerTransport: "aggregator" as const },
+    { model: "claude-fable-5", supportsVision: true }, // transport undefined
+  ]) {
+    const r = await omniglyphEngine.applyAsync!(claudeBody(), opts);
+    assert.equal(r.compressed, false);
+    assert.ok(!JSON.stringify(r.body).includes('"type":"image"'));
+  }
+});
+
+test("skip: modelo fora da allowlist medida", async () => {
+  const body = { ...claudeBody(), model: "gpt-5.5" };
+  const r = await omniglyphEngine.applyAsync!(body, { ...OK, model: "gpt-5.5" });
+  assert.equal(r.compressed, false);
+});
+
+test("skip: corpo em formato OpenAI (role system nas messages)", async () => {
+  const body = {
+    model: "claude-fable-5",
+    messages: [
+      { role: "system", content: DENSE },
+      { role: "user", content: "oi" },
+    ],
+  };
+  const r = await omniglyphEngine.applyAsync!(body, OK);
+  assert.equal(r.compressed, false);
+});
+
+test("cache_control do cliente sobrevive byte a byte", async () => {
+  const body = claudeBody();
+  (body.messages as Array<Record<string, unknown>>).push({
+    role: "user",
+    content: [{ type: "text", text: "âncora", cache_control: { type: "ephemeral" } }],
+  });
+  const r = await omniglyphEngine.applyAsync!(body, OK);
+  assert.ok(JSON.stringify(r.body).includes('"cache_control"'));
+});
+
+test("apply síncrono é pass-through seguro (engine async-only)", () => {
+  const body = claudeBody();
+  const r = omniglyphEngine.apply(body, OK);
+  assert.equal(r.compressed, false);
+  assert.deepEqual(r.body, body);
+});
+
+test("fail-open: erro no transform vira skip, nunca propaga", async () => {
+  const body = claudeBody() as Record<string, unknown>;
+  (body as { self?: unknown }).self = body; // referência circular → JSON.stringify lança
+  const r = await omniglyphEngine.applyAsync!(body, OK);
+  assert.equal(r.compressed, false);
+  assert.deepEqual(r.body, body); // corpo original devolvido intacto
+});
diff --git a/tests/unit/compression/omniglyph-import.test.ts b/tests/unit/compression/omniglyph-import.test.ts
new file mode 100644
index 0000000000..b24b03e033
--- /dev/null
+++ b/tests/unit/compression/omniglyph-import.test.ts
@@ -0,0 +1,10 @@
+import { test } from "node:test";
+import assert from "node:assert";
+
+test("pacote omniglyph exporta a API que o adapter consome", async () => {
+  const mod = await import("omniglyph");
+  assert.equal(typeof mod.transformAnthropicMessages, "function");
+  assert.equal(typeof mod.isOmniGlyphSupportedModel, "function");
+  assert.equal(mod.isOmniGlyphSupportedModel("claude-fable-5"), true);
+  assert.equal(mod.isOmniGlyphSupportedModel("gpt-5.5"), false);
+});
diff --git a/tests/unit/compression/omniglyph-plumbing.test.ts b/tests/unit/compression/omniglyph-plumbing.test.ts
new file mode 100644
index 0000000000..e5231a10a7
--- /dev/null
+++ b/tests/unit/compression/omniglyph-plumbing.test.ts
@@ -0,0 +1,61 @@
+import { test } from "node:test";
+import assert from "node:assert";
+import { applyCompressionAsync } from "../../../open-sse/services/compression/strategySelector.ts";
+import { registerBuiltinCompressionEngines } from "../../../open-sse/services/compression/engines/index.ts";
+
+const DENSE =
+  "X".repeat(500) +
+  "\n" +
+  Array.from(
+    { length: 400 },
+    (_, i) => `const row_${i} = compute(${i * 17}, "${"v".repeat(80)}");`
+  ).join("\n");
+
+const body = () => ({
+  model: "claude-fable-5",
+  max_tokens: 128,
+  system: DENSE,
+  messages: [{ role: "user", content: [{ type: "text", text: "oi" }] }],
+});
+
+// Agora que `estimateCompressionTokens` (stats.ts) é image-aware (Task 6), o guard
+// honesto de inflação agregada do stacked (`guardPipelineInflation` em
+// pipelineGuards.ts) não reverte mais a saída imageada do omniglyph: o estimador
+// conta o bloco de imagem pelo billing real (patches 28px + overhead), não pelo
+// char-count do base64. Este teste cobre tanto o plumbing de `providerTransport`
+// (Task 5) quanto a saída final ponta a ponta (Task 6).
+test("stacked com step omniglyph recebe providerTransport (engine roda, não é pulado por transporte)", async () => {
+  registerBuiltinCompressionEngines();
+  const r = await applyCompressionAsync(body(), "stacked", {
+    model: "claude-fable-5",
+    supportsVision: true,
+    providerTransport: "direct",
+    config: { stackedPipeline: [{ engine: "rtk" }, { engine: "omniglyph" }] } as never,
+  });
+  const omniglyphStep = r.stats?.engineBreakdown?.find((e) => e.engine === "omniglyph");
+  assert.ok(omniglyphStep, "omniglyph step deveria aparecer no engineBreakdown");
+  assert.ok(
+    omniglyphStep!.techniquesUsed.includes("omniglyph:context-as-image"),
+    `omniglyph deveria ter rodado (não pulado) — techniquesUsed=${JSON.stringify(
+      omniglyphStep!.techniquesUsed
+    )}`
+  );
+  assert.equal(r.compressed, true);
+  assert.ok(
+    JSON.stringify(r.body).includes('"type":"image"'),
+    "stacked mantém a saída imageada (guard não reverte mais)"
+  );
+});
+
+test("stacked sem providerTransport 'direct' pula omniglyph (transport_not_direct)", async () => {
+  registerBuiltinCompressionEngines();
+  const r = await applyCompressionAsync(body(), "stacked", {
+    model: "claude-fable-5",
+    supportsVision: true,
+    // providerTransport ausente → fail-closed, omniglyph deve pular
+    config: { stackedPipeline: [{ engine: "rtk" }, { engine: "omniglyph" }] } as never,
+  });
+  const omniglyphStep = r.stats?.engineBreakdown?.find((e) => e.engine === "omniglyph");
+  assert.ok(omniglyphStep, "omniglyph step deveria aparecer no engineBreakdown mesmo pulado");
+  assert.ok(omniglyphStep!.techniquesUsed.includes("skip:transport_not_direct"));
+});
diff --git a/tests/unit/compression/omniglyph-registries.test.ts b/tests/unit/compression/omniglyph-registries.test.ts
new file mode 100644
index 0000000000..d837611bcd
--- /dev/null
+++ b/tests/unit/compression/omniglyph-registries.test.ts
@@ -0,0 +1,80 @@
+import { describe, it, before, after, beforeEach } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// P2 consistency: "omniglyph" is a registered CompressionMode/engine but several
+// parallel mode/engine lists (DB validation, stacked-pipeline allowlist,
+// deriveDefaultPlan single-mode map, combo schema, MCP tool enums) had not been
+// updated to include it — causing e.g. defaultMode:"omniglyph" to validate on
+// write but get silently dropped on DB read-back. This file proves the round trip
+// and the parallel-schema acceptance.
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-omniglyph-registries-"));
+const ORIGINAL_DATA_DIR = process.env.DATA_DIR;
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../../src/lib/db/core.ts");
+const { getCompressionSettings, updateCompressionSettings, normalizeStackedPipeline } =
+  await import("../../../src/lib/db/compression.ts");
+const { deriveDefaultPlan } =
+  await import("@omniroute/open-sse/services/compression/deriveDefaultPlan.ts");
+const { compressionModeSchema } = await import("../../../src/shared/validation/schemas/combo.ts");
+const { compressionConfigureInput } = await import("../../../open-sse/mcp-server/schemas/tools.ts");
+
+beforeEach(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+});
+
+after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  if (ORIGINAL_DATA_DIR === undefined) {
+    delete process.env.DATA_DIR;
+  } else {
+    process.env.DATA_DIR = ORIGINAL_DATA_DIR;
+  }
+});
+
+describe("db round-trip: defaultMode omniglyph", () => {
+  it("survives write then read (COMPRESSION_MODES must not drop it)", async () => {
+    await updateCompressionSettings({ defaultMode: "omniglyph" } as Parameters<
+      typeof updateCompressionSettings
+    >[0]);
+    const settings = await getCompressionSettings();
+    assert.equal(settings.defaultMode, "omniglyph");
+  });
+});
+
+describe("normalizeStackedPipeline: omniglyph step", () => {
+  it("survives normalization (STACKED_PIPELINE_ENGINE_IDS must include omniglyph)", () => {
+    const pipeline = normalizeStackedPipeline([{ engine: "omniglyph" }]);
+    assert.deepEqual(pipeline, [{ engine: "omniglyph" }]);
+  });
+});
+
+describe("deriveDefaultPlan: single omniglyph engine toggle", () => {
+  it("derives mode:omniglyph (SINGLE_MODE_OF must include omniglyph)", () => {
+    const plan = deriveDefaultPlan({ omniglyph: { enabled: true } }, true);
+    assert.deepEqual(plan, { mode: "omniglyph", stackedPipeline: [] });
+  });
+});
+
+describe("combo schema: compressionModeSchema", () => {
+  it("accepts omniglyph", () => {
+    assert.equal(compressionModeSchema.parse("omniglyph"), "omniglyph");
+  });
+});
+
+describe("MCP compressionConfigureInput: mode enums", () => {
+  it("accepts strategy:omniglyph", () => {
+    assert.doesNotThrow(() => compressionConfigureInput.parse({ strategy: "omniglyph" }));
+  });
+
+  it("accepts autoTriggerMode:omniglyph", () => {
+    assert.doesNotThrow(() => compressionConfigureInput.parse({ autoTriggerMode: "omniglyph" }));
+  });
+});
diff --git a/tests/unit/compression/omniglyph-registry.test.ts b/tests/unit/compression/omniglyph-registry.test.ts
new file mode 100644
index 0000000000..11572bb944
--- /dev/null
+++ b/tests/unit/compression/omniglyph-registry.test.ts
@@ -0,0 +1,19 @@
+import { test } from "node:test";
+import assert from "node:assert";
+import { registerBuiltinCompressionEngines } from "../../../open-sse/services/compression/engines/index.ts";
+import { getCompressionEngine } from "../../../open-sse/services/compression/engines/registry.ts";
+import { ENGINE_CATALOG } from "../../../open-sse/services/compression/engineCatalog.ts";
+
+test("omniglyph registrada nos builtins e no catálogo (single mode, por último)", () => {
+  registerBuiltinCompressionEngines();
+  const engine = getCompressionEngine("omniglyph");
+  assert.ok(engine, "engine registrada");
+  assert.equal(engine!.sampling, true);
+  const meta = ENGINE_CATALOG["omniglyph"];
+  assert.ok(meta, "entrada no catálogo");
+  assert.equal(meta!.isSingleMode, true);
+  const maxOther = Math.max(
+    ...Object.values(ENGINE_CATALOG).filter((m) => m.id !== "omniglyph").map((m) => m.stackPriority)
+  );
+  assert.ok(meta!.stackPriority > maxOther, "roda por último no stack");
+});
diff --git a/tests/unit/compression/omniglyph-single-mode.test.ts b/tests/unit/compression/omniglyph-single-mode.test.ts
new file mode 100644
index 0000000000..d9ff66fb99
--- /dev/null
+++ b/tests/unit/compression/omniglyph-single-mode.test.ts
@@ -0,0 +1,34 @@
+import { test } from "node:test";
+import assert from "node:assert";
+import { applyCompressionAsync } from "../../../open-sse/services/compression/strategySelector.ts";
+import { registerBuiltinCompressionEngines } from "../../../open-sse/services/compression/engines/index.ts";
+
+const DENSE = "X".repeat(500) + "\n" +
+  Array.from({ length: 400 }, (_, i) => `const row_${i} = compute(${i * 17}, "${"v".repeat(80)}");`).join("\n");
+const body = () => ({
+  model: "claude-fable-5",
+  max_tokens: 128,
+  system: DENSE,
+  messages: [{ role: "user", content: [{ type: "text", text: "oi" }] }],
+});
+
+test("modo omniglyph sozinho comprime (selecionar o modo é o enable)", async () => {
+  registerBuiltinCompressionEngines();
+  const r = await applyCompressionAsync(body(), "omniglyph", {
+    model: "claude-fable-5",
+    supportsVision: true,
+    providerTransport: "direct",
+  });
+  assert.equal(r.compressed, true);
+  assert.ok(JSON.stringify(r.body).includes('"type":"image"'));
+});
+
+test("modo omniglyph em transporte agregador é no-op", async () => {
+  registerBuiltinCompressionEngines();
+  const r = await applyCompressionAsync(body(), "omniglyph", {
+    model: "claude-fable-5",
+    supportsVision: true,
+    providerTransport: "aggregator",
+  });
+  assert.equal(r.compressed, false);
+});
diff --git a/tests/unit/compression/preview-fallback-reasons-6461.test.ts b/tests/unit/compression/preview-fallback-reasons-6461.test.ts
new file mode 100644
index 0000000000..4de93f128f
--- /dev/null
+++ b/tests/unit/compression/preview-fallback-reasons-6461.test.ts
@@ -0,0 +1,56 @@
+/**
+ * #6461 — the compression preview response must surface WHY a run fell back
+ * (deduped `fallbackReasons[]`, mirrored into `skippedReasons`) instead of the
+ * previously hard-coded `skippedReasons: []`. Non-fallback runs return [] on
+ * both — zero change on the happy path (regression guard, Rule #18).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { join } from "node:path";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+
+const TEST_DATA_DIR = mkdtempSync(join(tmpdir(), "preview-fallback-6461-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = process.env.API_KEY_SECRET ?? "test-secret-32-chars-min-aaaaaaaa";
+delete process.env.INITIAL_PASSWORD;
+
+const core = await import("../../../src/lib/db/core.ts");
+const route = await import("../../../src/app/api/compression/preview/route.ts");
+
+function makeReq(body: unknown) {
+  return new Request("http://localhost/api/compression/preview", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+test.beforeEach(() => core.resetDbInstance());
+test.after(() => {
+  core.resetDbInstance();
+  rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("#6461 preview exposes fallbackReasons and mirrors it into skippedReasons", async () => {
+  const res = await route.POST(
+    makeReq({
+      messages: [{ role: "user", content: "$ git status\nOn branch main\nnothing to commit" }],
+      engineId: "rtk",
+    })
+  );
+  assert.equal(res.status, 200);
+  const body = await res.json();
+  // Structural contract added by #6461 (absent on the pre-patch response).
+  assert.ok(Array.isArray(body.fallbackReasons), "fallbackReasons must be an array");
+  assert.deepEqual(
+    body.skippedReasons,
+    body.fallbackReasons,
+    "skippedReasons must mirror fallbackReasons"
+  );
+  // Happy path (no fallback): both empty, and fallbackReason is null.
+  if (body.fallbackApplied !== true) {
+    assert.deepEqual(body.fallbackReasons, []);
+    assert.equal(body.fallbackReason ?? null, null);
+  }
+});
diff --git a/tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts b/tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts
new file mode 100644
index 0000000000..0d7d01da9b
--- /dev/null
+++ b/tests/unit/compression/preview-outer-engine-token-reconcile-6488.test.ts
@@ -0,0 +1,79 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { join } from "node:path";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+
+const TEST_DATA_DIR = mkdtempSync(join(tmpdir(), "preview-reconcile-6488-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = process.env.API_KEY_SECRET ?? "test-secret-32-chars-min-aaaaaaaa";
+delete process.env.INITIAL_PASSWORD;
+const core = await import("../../../src/lib/db/core.ts");
+const route = await import("../../../src/app/api/compression/preview/route.ts");
+
+function makeReq(body: unknown) {
+  return new Request("http://localhost/api/compression/preview", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+test.beforeEach(() => core.resetDbInstance());
+test.after(() => {
+  core.resetDbInstance();
+  rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+// Regression for #6488: outer originalTokens/compressedTokens (real tiktoken counter over
+// extracted message text) and engineBreakdown[].originalTokens/compressedTokens (internal
+// JSON.stringify(body).length/4 estimate) used to diverge on small/degenerate input because
+// they measured different things. For a single-engine breakdown, the entry represents the
+// exact same before/after transformation as the overall response, so it must be reconciled
+// to match the outer counts exactly.
+test("degenerate input with pipeline=['lite']: engineBreakdown[0] matches outer token counts", async () => {
+  const res = await route.POST(
+    makeReq({
+      messages: [{ role: "user", content: "user: " }],
+      pipeline: ["lite"],
+    })
+  );
+  const body = await res.json();
+  assert.equal(res.status, 200, `expected 200, got ${res.status}: ${JSON.stringify(body)}`);
+
+  const engines = (body.engineBreakdown ?? []).map((e: { engine: string }) => e.engine);
+  assert.ok(
+    engines.every((e: string) => e === "lite"),
+    `expected engineBreakdown to only contain 'lite', got ${JSON.stringify(engines)}`
+  );
+
+  assert.equal(body.engineBreakdown.length, 1);
+  const [step] = body.engineBreakdown;
+  assert.equal(
+    step.originalTokens,
+    body.originalTokens,
+    `outer originalTokens=${body.originalTokens} vs engine ${step.engine} originalTokens=${step.originalTokens}`
+  );
+  assert.equal(
+    step.compressedTokens,
+    body.compressedTokens,
+    `outer compressedTokens=${body.compressedTokens} vs engine ${step.engine} compressedTokens=${step.compressedTokens}`
+  );
+});
+
+// Same reconciliation must hold for the single-engine (non-pipeline) dispatch path, where
+// engineBreakdown is synthesized by ensureEngineBreakdown from the overall stats.
+test("single-engine dispatch (engineId='rtk'): engineBreakdown[0] matches outer token counts", async () => {
+  const res = await route.POST(
+    makeReq({
+      messages: [{ role: "user", content: "a" }],
+      engineId: "rtk",
+    })
+  );
+  const body = await res.json();
+  assert.equal(res.status, 200, `expected 200, got ${res.status}: ${JSON.stringify(body)}`);
+  assert.equal(body.engineBreakdown.length, 1);
+  const [step] = body.engineBreakdown;
+  assert.equal(step.originalTokens, body.originalTokens);
+  assert.equal(step.compressedTokens, body.compressedTokens);
+});
diff --git a/tests/unit/compression/repro-6479-6491-null-stats-silent-drop.test.ts b/tests/unit/compression/repro-6479-6491-null-stats-silent-drop.test.ts
new file mode 100644
index 0000000000..32bb4315e5
--- /dev/null
+++ b/tests/unit/compression/repro-6479-6491-null-stats-silent-drop.test.ts
@@ -0,0 +1,103 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+
+import { applyStackedCompression } from "../../../open-sse/services/compression/strategySelector.ts";
+
+/**
+ * Regression coverage for #6479 and #6491: a dispatched stacked-pipeline step whose engine
+ * legitimately finds nothing eligible (`session-dedup` with no repeated blocks, `ccr` below its
+ * min-chars threshold) returns `{ stats: null }`. Before the fix, `mergeStackStep()` in
+ * `stackedStepCore.ts` silently dropped that step from the accumulator: no `engineBreakdown`
+ * entry, no `validationWarnings`, no `validationErrors` — zero trace the engine ever ran.
+ *
+ * Both issues report the exact same symptom for two different registered/known engines, so both
+ * are covered here against the shared fix (a `validationWarnings` entry recorded whenever a step
+ * returns `stats: null`).
+ */
+describe("#6479/#6491 — null-stats step no longer silently dropped from the pipeline", () => {
+  it("session-dedup with nothing to dedupe is explained in engineBreakdown or validationWarnings", () => {
+    // Small markdown table, short rows — well under session-dedup's 80-char/3-line
+    // suffix-block threshold, so session-dedup legitimately finds nothing to dedupe.
+    const body = {
+      messages: [
+        {
+          role: "user",
+          content:
+            "| a | b |\n|---|---|\n| 1 | 2 |\n| 1 | 2 |\n| 1 | 2 |\n| 1 | 2 |\n| 1 | 2 |\n| 1 | 2 |",
+        },
+      ],
+    };
+
+    const pipeline = [{ engine: "session-dedup" }, { engine: "rtk" }, { engine: "caveman" }];
+    const result = applyStackedCompression(body, pipeline);
+
+    const engines = result.stats?.engineBreakdown?.map((e) => e.engine) ?? [];
+    const warnings = result.stats?.validationWarnings ?? [];
+    const errors = result.stats?.validationErrors ?? [];
+
+    assert.ok(
+      engines.includes("session-dedup") ||
+        warnings.some((w) => w.includes("session-dedup")) ||
+        errors.some((w) => w.includes("session-dedup")),
+      `session-dedup missing from engineBreakdown (${JSON.stringify(engines)}) with no ` +
+        `explanation in validationWarnings/validationErrors — matches issue #6479's report`
+    );
+    // Specifically: the shared no-op reason must be present.
+    assert.ok(
+      warnings.some((w) => w === "session-dedup: skipped (no eligible content)") ||
+        engines.includes("session-dedup"),
+      `expected an explicit skip reason for session-dedup, got warnings=${JSON.stringify(warnings)}`
+    );
+  });
+
+  it("ccr with no duplicate-eligible block (>=600 chars) is explained, not silently dropped", () => {
+    const body = {
+      messages: [
+        {
+          role: "tool",
+          content: Array.from({ length: 8 }, () => "same noisy tool output line").join("\n"),
+        },
+        {
+          role: "user",
+          content:
+            "Please provide a detailed explanation of the authentication configuration and how it works",
+        },
+      ],
+    };
+
+    const pipeline = [{ engine: "ccr" }];
+    const result = applyStackedCompression(body, pipeline);
+
+    const engines = result.stats?.engineBreakdown?.map((e) => e.engine) ?? [];
+    const warnings = result.stats?.validationWarnings ?? [];
+    const errors = result.stats?.validationErrors ?? [];
+
+    assert.ok(
+      engines.includes("ccr") ||
+        warnings.some((w) => w.includes("ccr")) ||
+        errors.some((w) => w.includes("ccr")),
+      `ccr missing from engineBreakdown (${JSON.stringify(engines)}) with no explanation in ` +
+        `validationWarnings/validationErrors — matches issue #6491's report`
+    );
+    assert.ok(
+      warnings.some((w) => w === "ccr: skipped (no eligible content)") || engines.includes("ccr"),
+      `expected an explicit skip reason for ccr, got warnings=${JSON.stringify(warnings)}`
+    );
+  });
+
+  it("control: ccr with a large duplicate-eligible block (>=600 chars) still runs and advances", () => {
+    const bigBody = {
+      messages: [
+        {
+          role: "tool",
+          content: Array.from({ length: 40 }, () => "same noisy tool output line").join("\n"),
+        },
+        { role: "user", content: "please explain" },
+      ],
+    };
+
+    const result = applyStackedCompression(bigBody, [{ engine: "ccr" }]);
+    const engines = result.stats?.engineBreakdown?.map((e) => e.engine) ?? [];
+    assert.ok(engines.includes("ccr"), `expected 'ccr' in engineBreakdown (control), got ${JSON.stringify(engines)}`);
+  });
+});
diff --git a/tests/unit/compression/repro-6480-noop-guard-misfire.test.ts b/tests/unit/compression/repro-6480-noop-guard-misfire.test.ts
new file mode 100644
index 0000000000..586d7f0af5
--- /dev/null
+++ b/tests/unit/compression/repro-6480-noop-guard-misfire.test.ts
@@ -0,0 +1,39 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { applyStackedCompression } from "../../../open-sse/services/compression/strategySelector.ts";
+
+/**
+ * Regression coverage for #6480: `finalizeStackedResult` in `strategySelector.ts` used to run
+ * the aggregate `guardPipelineInflation` check unconditionally, even when the loop-level
+ * `compressed` flag was `false` (i.e. no engine in the pipeline ever produced/advanced a
+ * candidate). Since `compressedTokens === originalTokens` trivially holds when nothing ran, the
+ * guard mislabeled a genuine no-op as `fallbackApplied: true` with a misleading
+ * "pipeline-inflation-guard ... reverted to original" warning, even though nothing was ever
+ * computed to revert.
+ */
+test("#6480: session-dedup no-op on out-of-charter single message does not fire the pipeline-inflation-guard", () => {
+  const body = {
+    messages: [
+      {
+        role: "user",
+        content:
+          "This is a single message with no prior session history and no internally " +
+          "repeated content whatsoever, so the session-dedup engine has nothing to do.",
+      },
+    ],
+  };
+
+  const result = applyStackedCompression(body, [{ engine: "session-dedup" }]);
+
+  assert.equal(
+    result.stats?.fallbackApplied,
+    undefined,
+    "expected no fallbackApplied flag on a trivial no-op pipeline (engine never advanced)"
+  );
+  assert.equal(
+    (result.stats?.validationWarnings ?? []).some((w) => w.includes("pipeline-inflation-guard")),
+    false,
+    "expected no misleading pipeline-inflation-guard warning when nothing was ever compressed"
+  );
+});
diff --git a/tests/unit/compression/stacked-pipeline-engines-fallback-6463.test.ts b/tests/unit/compression/stacked-pipeline-engines-fallback-6463.test.ts
new file mode 100644
index 0000000000..1397bfb0e5
--- /dev/null
+++ b/tests/unit/compression/stacked-pipeline-engines-fallback-6463.test.ts
@@ -0,0 +1,80 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+
+import { applyCompressionAsync } from "../../../open-sse/services/compression/index.ts";
+import { DEFAULT_COMPRESSION_CONFIG } from "../../../open-sse/services/compression/types.ts";
+import type { CompressionConfig } from "../../../open-sse/services/compression/types.ts";
+
+/**
+ * Regression guard for #6463 (and the 30 downstream engine-substitution reports).
+ *
+ * When a caller dispatches mode="stacked" with a config that carries the operator's
+ * `engines` toggle map but no pre-derived `stackedPipeline` (e.g. /api/compression/preview,
+ * ad-hoc integrations that only forward the persisted config), the stacked loop must
+ * derive the pipeline from `engines` — not silently fall back to [rtk, caveman].
+ */
+describe("stacked pipeline honors engines map when stackedPipeline is missing (#6463)", () => {
+  function body(): Record<string, unknown> {
+    return {
+      messages: [
+        {
+          role: "tool",
+          content: Array.from({ length: 8 }, () => "same noisy tool output line").join("\n"),
+        },
+        {
+          role: "user",
+          content:
+            "Please provide a detailed explanation of the authentication configuration and how it works",
+        },
+      ],
+    };
+  }
+
+  it("derives rtk + caveman from engines map when stackedPipeline is empty", async () => {
+    const config: CompressionConfig = {
+      ...DEFAULT_COMPRESSION_CONFIG,
+      enabled: true,
+      stackedPipeline: [],
+      engines: {
+        ...DEFAULT_COMPRESSION_CONFIG.engines,
+        rtk: { enabled: true },
+        caveman: { enabled: true, level: "full" },
+      },
+    };
+
+    const result = await applyCompressionAsync(body(), "stacked", { config });
+
+    const ran = result.stats?.engineBreakdown?.map((e) => e.engine) ?? [];
+    assert.deepEqual(ran, ["rtk", "caveman"], "engines map must drive the derived pipeline");
+  });
+
+  it("prefers explicit pipeline over engines-derived when both are present", async () => {
+    const config: CompressionConfig = {
+      ...DEFAULT_COMPRESSION_CONFIG,
+      enabled: true,
+      stackedPipeline: [{ engine: "caveman", intensity: "full" }],
+      engines: {
+        ...DEFAULT_COMPRESSION_CONFIG.engines,
+        rtk: { enabled: true },
+        caveman: { enabled: true, level: "full" },
+      },
+    };
+
+    const result = await applyCompressionAsync(body(), "stacked", { config });
+    const ran = result.stats?.engineBreakdown?.map((e) => e.engine) ?? [];
+    assert.deepEqual(ran, ["caveman"], "explicit stackedPipeline must win over engines map");
+  });
+
+  it("falls back to [rtk, caveman] default only when BOTH pipeline and engines are empty", async () => {
+    const config: CompressionConfig = {
+      ...DEFAULT_COMPRESSION_CONFIG,
+      enabled: true,
+      stackedPipeline: [],
+      engines: {},
+    };
+
+    const result = await applyCompressionAsync(body(), "stacked", { config });
+    const ran = result.stats?.engineBreakdown?.map((e) => e.engine) ?? [];
+    assert.deepEqual(ran, ["rtk", "caveman"], "historical fallback preserved");
+  });
+});
diff --git a/tests/unit/context-handoff.test.ts b/tests/unit/context-handoff.test.ts
index 86eeb23024..845f118a5e 100644
--- a/tests/unit/context-handoff.test.ts
+++ b/tests/unit/context-handoff.test.ts
@@ -46,7 +46,7 @@ test("buildHandoffSystemMessage and injectHandoffIntoBody preserve existing hist
     taskProgress: "Need to finish tests",
     activeEntities: ["combo.ts", "chat.ts"],
     messageCount: 42,
-    model: "codex/gpt-5.4",
+    model: "codex/gpt-5.6-sol",
     warningThresholdPct: 0.85,
     generatedAt: "2099-04-08T12:00:00.000Z",
     expiresAt: "2099-04-08T17:00:00.000Z",
@@ -79,7 +79,7 @@ test("injectHandoffIntoBody preserves Responses API shape for native Codex reque
     taskProgress: "Need to carry state across account switches",
     activeEntities: ["chat.ts", "contextHandoff.ts"],
     messageCount: 8,
-    model: "codex/gpt-5.4",
+    model: "codex/gpt-5.6-sol",
     warningThresholdPct: 0.85,
     generatedAt: "2099-04-08T12:00:00.000Z",
     expiresAt: "2099-04-08T17:00:00.000Z",
@@ -139,7 +139,7 @@ test("maybeGenerateHandoff skips below the warning threshold", async () => {
     connectionId: "conn-low",
     percentUsed: 0.7,
     messages: [{ role: "user", content: "hello" }],
-    model: "codex/gpt-5.4",
+    model: "codex/gpt-5.6-sol",
     expiresAt: null,
     handleSingleModel: async () => {
       called = true;
@@ -164,7 +164,7 @@ test("maybeGenerateHandoff persists a structured handoff once the threshold is r
       { role: "user", content: "Please continue wiring the combo" },
       { role: "assistant", content: "Working on it" },
     ],
-    model: "codex/gpt-5.4",
+    model: "codex/gpt-5.6-sol",
     expiresAt: "2099-04-08T17:00:00.000Z",
     handleSingleModel: async (body, modelStr) => {
       calls.push({ body, modelStr });
@@ -197,7 +197,7 @@ test("maybeGenerateHandoff persists a structured handoff once the threshold is r
   assert.equal(saved.summary, "Relay summary generated");
   assert.deepEqual(saved.keyDecisions, ["Use context-relay"]);
   assert.equal(calls.length, 1);
-  assert.equal(calls[0].modelStr, "codex/gpt-5.4");
+  assert.equal(calls[0].modelStr, "codex/gpt-5.6-sol");
   assert.equal(calls[0].body._omnirouteSkipContextRelay, true);
   assert.equal(calls[0].body._omnirouteInternalRequest, "context-handoff");
 });
@@ -215,7 +215,7 @@ test("maybeGenerateHandoff deduplicates concurrent in-flight generations for the
     connectionId: "conn-dedupe",
     percentUsed: 0.89,
     messages: [{ role: "user", content: "Generate once" }],
-    model: "codex/gpt-5.4",
+    model: "codex/gpt-5.6-sol",
     expiresAt: "2099-01-01T00:00:00.000Z",
     handleSingleModel: async () => {
       calls.push("summary");
@@ -265,7 +265,7 @@ test("maybeGenerateHandoff allows a new attempt after a failed in-flight generat
     connectionId: "conn-retry",
     percentUsed: 0.9,
     messages: [{ role: "user", content: "Retry after failure" }],
-    model: "codex/gpt-5.4",
+    model: "codex/gpt-5.6-sol",
     expiresAt: "2099-01-01T00:00:00.000Z",
     handleSingleModel: async () => {
       calls += 1;
@@ -316,7 +316,7 @@ test("maybeGenerateHandoff respects explicit empty handoffProviders and skips ge
     connectionId: "conn-disabled",
     percentUsed: 0.92,
     messages: [{ role: "user", content: "Do not generate" }],
-    model: "codex/gpt-5.4",
+    model: "codex/gpt-5.6-sol",
     expiresAt: null,
     config: { handoffProviders: [] },
     handleSingleModel: async () => {
@@ -340,7 +340,7 @@ test("context handoff DB module upserts and deletes active handoffs", () => {
     taskProgress: "step one",
     activeEntities: ["a.ts"],
     messageCount: 3,
-    model: "codex/gpt-5.4",
+    model: "codex/gpt-5.6-sol",
     warningThresholdPct: 0.85,
     generatedAt: "2099-04-08T10:00:00.000Z",
     expiresAt: "2099-01-01T00:00:00.000Z",
@@ -354,7 +354,7 @@ test("context handoff DB module upserts and deletes active handoffs", () => {
     taskProgress: "step two",
     activeEntities: ["b.ts"],
     messageCount: 4,
-    model: "codex/gpt-5.4",
+    model: "codex/gpt-5.6-sol",
     warningThresholdPct: 0.86,
     generatedAt: "2099-04-08T11:00:00.000Z",
     expiresAt: "2099-01-01T00:00:00.000Z",
@@ -385,7 +385,7 @@ test("selectMessagesForSummary filters falsy values and preserves system/develop
     messages as contextHandoff.MessageLike[],
     2
   );
-  
+
   assert.equal(selected.length, 4);
   assert.equal(selected[0].role, "system");
   assert.equal(selected[1].role, "developer");
diff --git a/tests/unit/cursor-agent-cli-version.test.ts b/tests/unit/cursor-agent-cli-version.test.ts
new file mode 100644
index 0000000000..85bb4e9ecf
--- /dev/null
+++ b/tests/unit/cursor-agent-cli-version.test.ts
@@ -0,0 +1,165 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const {
+  CURSOR_AGENT_CLI_VERSION,
+  detectCursorAgentCliVersionFromFs,
+  extractVersionIdFromResolvedPath,
+  formatCursorAgentClientVersion,
+  getCursorAgentCliVersion,
+  newestVersionInDir,
+  resetCursorAgentCliVersionCache,
+} = await import("../../open-sse/utils/cursorAgentCliVersion.ts");
+
+function withEnv(vars: Record<string, string | undefined>, fn: () => void) {
+  const saved: Record<string, string | undefined> = {};
+  for (const key of Object.keys(vars)) {
+    saved[key] = process.env[key];
+    const next = vars[key];
+    if (next === undefined) delete process.env[key];
+    else process.env[key] = next;
+  }
+  try {
+    fn();
+  } finally {
+    for (const key of Object.keys(saved)) {
+      if (saved[key] === undefined) delete process.env[key];
+      else process.env[key] = saved[key];
+    }
+  }
+}
+
+test("formatCursorAgentClientVersion prefixes cli-", () => {
+  assert.equal(formatCursorAgentClientVersion("2026.07.08-0c04a8a"), "cli-2026.07.08-0c04a8a");
+});
+
+test("extractVersionIdFromResolvedPath reads versions/<id>", () => {
+  assert.equal(
+    extractVersionIdFromResolvedPath(
+      "/home/u/.local/share/cursor-agent/versions/2026.07.08-0c04a8a/cursor-agent"
+    ),
+    "2026.07.08-0c04a8a"
+  );
+  assert.equal(extractVersionIdFromResolvedPath("/tmp/not-an-agent"), null);
+});
+
+test("newestVersionInDir picks lexicographically newest matching child", () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "cursor-cli-ver-dir-"));
+  try {
+    fs.mkdirSync(path.join(tmp, "2026.05.24-dda726e"));
+    fs.mkdirSync(path.join(tmp, "2026.07.08-0c04a8a"));
+    fs.writeFileSync(path.join(tmp, "not-a-version"), "x");
+    fs.mkdirSync(path.join(tmp, "3.9.0"));
+    assert.equal(newestVersionInDir(tmp), "2026.07.08-0c04a8a");
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+test("detectCursorAgentCliVersionFromFs uses shim realpath under versions/<id>", () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), "cursor-cli-home-shim-"));
+  try {
+    const id = "2026.06.01-abcdef0";
+    const versionDir = path.join(home, ".local", "share", "cursor-agent", "versions", id);
+    fs.mkdirSync(versionDir, { recursive: true });
+    const binary = path.join(versionDir, "cursor-agent");
+    fs.writeFileSync(binary, "#!/bin/sh\n");
+    const binDir = path.join(home, ".local", "bin");
+    fs.mkdirSync(binDir, { recursive: true });
+    fs.symlinkSync(binary, path.join(binDir, "agent"));
+
+    withEnv({ CURSOR_DATA_DIR: undefined, CURSOR_AGENT_CLI_VERSION: undefined }, () => {
+      assert.equal(detectCursorAgentCliVersionFromFs(home), id);
+    });
+  } finally {
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test("detectCursorAgentCliVersionFromFs uses CURSOR_DATA_DIR versions when no shim", () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), "cursor-cli-home-empty-"));
+  const data = fs.mkdtempSync(path.join(os.tmpdir(), "cursor-cli-data-"));
+  try {
+    const id = "2026.04.01-deadbeef";
+    fs.mkdirSync(path.join(data, "versions", id), { recursive: true });
+    withEnv({ CURSOR_DATA_DIR: data }, () => {
+      assert.equal(detectCursorAgentCliVersionFromFs(home), id);
+    });
+  } finally {
+    fs.rmSync(home, { recursive: true, force: true });
+    fs.rmSync(data, { recursive: true, force: true });
+  }
+});
+
+test("getCursorAgentCliVersion env override wins", () => {
+  withEnv({ CURSOR_AGENT_CLI_VERSION: "2026.01.02-abc1234" }, () => {
+    resetCursorAgentCliVersionCache();
+    assert.equal(getCursorAgentCliVersion(), "2026.01.02-abc1234");
+  });
+  resetCursorAgentCliVersionCache();
+});
+
+test("getCursorAgentCliVersion ignores invalid env and uses pin when FS empty", () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), "cursor-cli-home-pin-"));
+  try {
+    withEnv(
+      {
+        HOME: home,
+        USERPROFILE: home,
+        CURSOR_AGENT_CLI_VERSION: "3.9",
+        CURSOR_DATA_DIR: undefined,
+      },
+      () => {
+        resetCursorAgentCliVersionCache();
+        assert.equal(getCursorAgentCliVersion(), CURSOR_AGENT_CLI_VERSION);
+      }
+    );
+  } finally {
+    resetCursorAgentCliVersionCache();
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test("getCursorAgentCliVersion caches until reset", () => {
+  withEnv({ CURSOR_AGENT_CLI_VERSION: "2026.02.03-111aaaa" }, () => {
+    resetCursorAgentCliVersionCache();
+    assert.equal(getCursorAgentCliVersion(), "2026.02.03-111aaaa");
+    process.env.CURSOR_AGENT_CLI_VERSION = "2026.02.03-222bbbb";
+    assert.equal(getCursorAgentCliVersion(), "2026.02.03-111aaaa", "cached");
+    resetCursorAgentCliVersionCache();
+    assert.equal(getCursorAgentCliVersion(), "2026.02.03-222bbbb");
+  });
+  resetCursorAgentCliVersionCache();
+});
+
+test("getCursorAgentCliVersion reads CURSOR_DATA_DIR via isolated HOME", () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), "cursor-cli-home-get-"));
+  const data = fs.mkdtempSync(path.join(os.tmpdir(), "cursor-cli-data-get-"));
+  try {
+    const id = "2026.03.15-cafebabe";
+    fs.mkdirSync(path.join(data, "versions", id), { recursive: true });
+    withEnv(
+      {
+        HOME: home,
+        USERPROFILE: home,
+        CURSOR_DATA_DIR: data,
+        CURSOR_AGENT_CLI_VERSION: undefined,
+      },
+      () => {
+        resetCursorAgentCliVersionCache();
+        assert.equal(getCursorAgentCliVersion(), id);
+        assert.equal(
+          formatCursorAgentClientVersion(getCursorAgentCliVersion()),
+          `cli-${id}`
+        );
+      }
+    );
+  } finally {
+    resetCursorAgentCliVersionCache();
+    fs.rmSync(home, { recursive: true, force: true });
+    fs.rmSync(data, { recursive: true, force: true });
+  }
+});
diff --git a/tests/unit/cursor-agent-models.test.ts b/tests/unit/cursor-agent-models.test.ts
index 3893d2b160..a59076f3ff 100644
--- a/tests/unit/cursor-agent-models.test.ts
+++ b/tests/unit/cursor-agent-models.test.ts
@@ -36,7 +36,18 @@ test("humanizeCursorModelId pretty-prints common patterns", () => {
     humanizeCursorModelId("claude-opus-4-7-thinking-high"),
     "Claude Opus 4.7 Thinking High"
   );
+  assert.equal(
+    humanizeCursorModelId("claude-opus-4-8-thinking-high-fast"),
+    "Claude Opus 4.8 Thinking High Fast"
+  );
+  assert.equal(humanizeCursorModelId("claude-fable-5-thinking-xhigh"), "Claude Fable 5 Thinking XHigh");
+  assert.equal(humanizeCursorModelId("claude-sonnet-5-max"), "Claude Sonnet 5 Max");
   assert.equal(humanizeCursorModelId("kimi-k2.5"), "Kimi K2.5");
   assert.equal(humanizeCursorModelId("gemini-3.1-pro"), "Gemini 3.1 Pro");
   assert.equal(humanizeCursorModelId("claude-4-sonnet-thinking"), "Claude 4 Sonnet Thinking");
+  // Grok 4.5 uses infix -fast- (unlike GPT's trailing -fast)
+  assert.equal(humanizeCursorModelId("grok-4.5-medium"), "Grok 4.5 Medium");
+  assert.equal(humanizeCursorModelId("grok-4.5-fast-medium"), "Grok 4.5 Fast Medium");
+  assert.equal(humanizeCursorModelId("grok-4.5-xhigh"), "Grok 4.5 XHigh");
+  assert.equal(humanizeCursorModelId("grok-4.5-fast-xhigh"), "Grok 4.5 Fast XHigh");
 });
diff --git a/tests/unit/cursor-registry-claude-families.test.ts b/tests/unit/cursor-registry-claude-families.test.ts
new file mode 100644
index 0000000000..58df088b38
--- /dev/null
+++ b/tests/unit/cursor-registry-claude-families.test.ts
@@ -0,0 +1,47 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { cursorProvider } from "../../open-sse/config/providers/registry/cursor/index.ts";
+
+const EFFORTS = ["low", "medium", "high", "xhigh", "max"] as const;
+
+function modelIds(): Set<string> {
+  return new Set(cursorProvider.models.map((m) => m.id));
+}
+
+test("cursor registry includes Claude Opus 4.8 effort + thinking + fast variants", () => {
+  const ids = modelIds();
+  for (const effort of EFFORTS) {
+    assert.ok(ids.has(`claude-opus-4-8-${effort}`), `missing claude-opus-4-8-${effort}`);
+    assert.ok(ids.has(`claude-opus-4-8-${effort}-fast`), `missing claude-opus-4-8-${effort}-fast`);
+    assert.ok(
+      ids.has(`claude-opus-4-8-thinking-${effort}`),
+      `missing claude-opus-4-8-thinking-${effort}`
+    );
+    assert.ok(
+      ids.has(`claude-opus-4-8-thinking-${effort}-fast`),
+      `missing claude-opus-4-8-thinking-${effort}-fast`
+    );
+  }
+});
+
+test("cursor registry includes Claude Fable 5 effort + thinking variants", () => {
+  const ids = modelIds();
+  for (const effort of EFFORTS) {
+    assert.ok(ids.has(`claude-fable-5-${effort}`), `missing claude-fable-5-${effort}`);
+    assert.ok(
+      ids.has(`claude-fable-5-thinking-${effort}`),
+      `missing claude-fable-5-thinking-${effort}`
+    );
+  }
+});
+
+test("cursor registry includes Claude Sonnet 5 effort + thinking variants", () => {
+  const ids = modelIds();
+  for (const effort of EFFORTS) {
+    assert.ok(ids.has(`claude-sonnet-5-${effort}`), `missing claude-sonnet-5-${effort}`);
+    assert.ok(
+      ids.has(`claude-sonnet-5-thinking-${effort}`),
+      `missing claude-sonnet-5-thinking-${effort}`
+    );
+  }
+});
diff --git a/tests/unit/db-adapters/driverFactory.test.ts b/tests/unit/db-adapters/driverFactory.test.ts
index d38fe3a846..2716abfe86 100644
--- a/tests/unit/db-adapters/driverFactory.test.ts
+++ b/tests/unit/db-adapters/driverFactory.test.ts
@@ -85,6 +85,56 @@ describe("driverFactory", () => {
     adapter.close();
   });
 
+  // #6628 (remaining gap): concurrent preInitSqlJs() calls for the same
+  // filePath must share ONE in-flight load instead of each caller
+  // independently fs.readFileSync + WASM-decoding the whole file — the
+  // thundering-herd amplifier of the OOM condition #6632 already partly
+  // fixed (restore-cycle-breaker + OOM early-abort), left un-implemented by
+  // the reporter's own proposed promise-sharing fix.
+  test("preInitSqlJs shares one in-flight load across concurrent callers", async (t) => {
+    const os = await import("node:os");
+    const path = await import("node:path");
+    // The dynamic-import namespace object is read-only; grab the mutable CJS
+    // `.default` (== module.exports) so readFileSync can be monkeypatched.
+    const fsNs = await import("node:fs");
+    const fs = fsNs.default;
+
+    const tmpFile = path.join(os.tmpdir(), `sqljs_race_${Date.now()}.sqlite`);
+    fs.writeFileSync(tmpFile, Buffer.alloc(1024 * 1024, 1));
+    t.after(() => {
+      try {
+        fs.unlinkSync(tmpFile);
+      } catch {}
+    });
+
+    let readCountForTarget = 0;
+    const originalReadFileSync = fs.readFileSync;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    (fs as any).readFileSync = (...args: Parameters<typeof fs.readFileSync>) => {
+      if (args[0] === tmpFile) readCountForTarget += 1;
+      return originalReadFileSync(...args);
+    };
+    t.after(() => {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      (fs as any).readFileSync = originalReadFileSync;
+    });
+
+    const [a, b, c] = await Promise.all([
+      preInitSqlJs(tmpFile),
+      preInitSqlJs(tmpFile),
+      preInitSqlJs(tmpFile),
+    ]);
+
+    assert.equal(
+      readCountForTarget,
+      1,
+      `expected exactly 1 shared full-file read for 3 concurrent preInitSqlJs() calls, got ${readCountForTarget}`
+    );
+    assert.equal(a, b, "concurrent callers must resolve to the SAME adapter instance");
+    assert.equal(b, c, "concurrent callers must resolve to the SAME adapter instance");
+    a.close();
+  });
+
   test("cross-driver: escreve com adapter sync, relê com sql.js", async (t) => {
     const os = await import("node:os");
     const path = await import("node:path");
diff --git a/tests/unit/db-adapters/sqljsAdapter.test.ts b/tests/unit/db-adapters/sqljsAdapter.test.ts
index 27512c6143..51f53d5f7f 100644
--- a/tests/unit/db-adapters/sqljsAdapter.test.ts
+++ b/tests/unit/db-adapters/sqljsAdapter.test.ts
@@ -89,4 +89,90 @@ describe("sqljsAdapter", () => {
     assert.equal(row.name, "test-value");
     reader.close();
   });
+
+  // #6802: named-parameter object binds ("... WHERE is_active = @isActive"
+  // called as .all({ isActive: 1 })) must work the same way they do against
+  // better-sqlite3, instead of throwing sql.js's own
+  // "Wrong API use : tried to bind a value of an unknown type (...)." error.
+  describe("named-parameter object bind (#6802)", () => {
+    test("all() with a single named-params object mirrors getProviderConnections", async () => {
+      const adapter = await createSqlJsAdapter(":memory:");
+      adapter.exec(
+        "CREATE TABLE provider_connections (id INTEGER PRIMARY KEY, provider TEXT, is_active INTEGER)"
+      );
+      adapter
+        .prepare("INSERT INTO provider_connections (provider, is_active) VALUES (?, ?)")
+        .run("glm", 1);
+      adapter
+        .prepare("INSERT INTO provider_connections (provider, is_active) VALUES (?, ?)")
+        .run("openai", 0);
+
+      const sql =
+        "SELECT * FROM provider_connections WHERE is_active = @isActive ORDER BY id ASC";
+      const rows = adapter.prepare(sql).all({ isActive: 1 }) as Array<{ provider: string }>;
+
+      assert.equal(rows.length, 1, "expected exactly 1 active provider connection");
+      assert.equal(rows[0].provider, "glm");
+      adapter.close();
+    });
+
+    test("get() with a single named-params object resolves the row", async () => {
+      const adapter = await createSqlJsAdapter(":memory:");
+      adapter.exec("CREATE TABLE t (id INTEGER PRIMARY KEY, val TEXT)");
+      adapter.prepare("INSERT INTO t (val) VALUES (?)").run("named-get");
+
+      const row = adapter.prepare("SELECT val FROM t WHERE id = @id").get({ id: 1 }) as {
+        val: string;
+      };
+      assert.equal(row.val, "named-get");
+      adapter.close();
+    });
+
+    test("run() with a single named-params object binds correctly", async () => {
+      const adapter = await createSqlJsAdapter(":memory:");
+      adapter.exec("CREATE TABLE t (id INTEGER PRIMARY KEY, val TEXT)");
+      const result = adapter
+        .prepare("INSERT INTO t (val) VALUES (@val)")
+        .run({ val: "named-run" });
+      assert.equal(result.changes, 1);
+
+      const row = adapter
+        .prepare("SELECT val FROM t WHERE id = ?")
+        .get(result.lastInsertRowid) as { val: string };
+      assert.equal(row.val, "named-run");
+      adapter.close();
+    });
+
+    test("supports :name and $name sigils in addition to @name", async () => {
+      const adapter = await createSqlJsAdapter(":memory:");
+      adapter.exec("CREATE TABLE t (id INTEGER PRIMARY KEY, val TEXT)");
+      adapter.prepare("INSERT INTO t (val) VALUES (?)").run("colon-sigil");
+      adapter.prepare("INSERT INTO t (val) VALUES (?)").run("dollar-sigil");
+
+      const colonRow = adapter.prepare("SELECT val FROM t WHERE val = :val").get({
+        val: "colon-sigil",
+      }) as { val: string };
+      assert.equal(colonRow.val, "colon-sigil");
+
+      const dollarRow = adapter.prepare("SELECT val FROM t WHERE val = $val").get({
+        val: "dollar-sigil",
+      }) as { val: string };
+      assert.equal(dollarRow.val, "dollar-sigil");
+      adapter.close();
+    });
+
+    test("existing positional-array binding still works unchanged", async () => {
+      const adapter = await createSqlJsAdapter(":memory:");
+      adapter.exec("CREATE TABLE t (id INTEGER PRIMARY KEY, a TEXT, b TEXT)");
+      const result = adapter.prepare("INSERT INTO t (a, b) VALUES (?, ?)").run("x", "y");
+      assert.equal(result.changes, 1);
+
+      const row = adapter
+        .prepare("SELECT a, b FROM t WHERE id = ?")
+        .get(result.lastInsertRowid) as { a: string; b: string };
+      assert.equal(row.a, "x");
+      assert.equal(row.b, "y");
+      adapter.close();
+    });
+  });
 });
diff --git a/tests/unit/db-provider-daily-usage-4009.test.ts b/tests/unit/db-provider-daily-usage-4009.test.ts
new file mode 100644
index 0000000000..9c19f747a3
--- /dev/null
+++ b/tests/unit/db-provider-daily-usage-4009.test.ts
@@ -0,0 +1,137 @@
+/**
+ * #4009 — Request count log per provider, per date.
+ *
+ * Some providers bill by request rather than by token, so operators need a
+ * plain per-provider, per-date request count breakdown. Verifies
+ * `getProviderDailyUsageRows` (src/lib/db/usageAnalytics.ts) groups
+ * `usage_history` rows correctly by DATE(timestamp) + provider.
+ *
+ * Seeds an in-memory temp SQLite DB and releases the handle in test.after
+ * (CLAUDE.md PII/Stream Learnings #3 — otherwise node:test hangs).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omni-db-provider-daily-4009-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const mod = await import("../../src/lib/db/usageAnalytics.ts");
+
+function insertUsageHistory(row: Record<string, unknown>) {
+  const db = core.getDbInstance();
+  const full = {
+    provider: "openai",
+    model: "gpt-4.1",
+    tokens_input: 10,
+    tokens_output: 20,
+    tokens_cache_read: 0,
+    tokens_cache_creation: 0,
+    tokens_reasoning: 0,
+    service_tier: "standard",
+    success: 1,
+    latency_ms: 100,
+    connection_id: null,
+    api_key_id: null,
+    api_key_name: null,
+    ...row,
+    timestamp: row.timestamp ?? new Date().toISOString(),
+  };
+  db.prepare(
+    `INSERT INTO usage_history (
+      timestamp, provider, model,
+      tokens_input, tokens_output, tokens_cache_read, tokens_cache_creation, tokens_reasoning,
+      service_tier, success, latency_ms, connection_id, api_key_id, api_key_name
+    ) VALUES (
+      @timestamp, @provider, @model,
+      @tokens_input, @tokens_output, @tokens_cache_read, @tokens_cache_creation, @tokens_reasoning,
+      @service_tier, @success, @latency_ms, @connection_id, @api_key_id, @api_key_name
+    )`
+  ).run(full);
+}
+
+test.before(() => {
+  core.resetDbInstance();
+});
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("#4009 getProviderDailyUsageRows is exported as a function", () => {
+  assert.equal(typeof mod.getProviderDailyUsageRows, "function");
+});
+
+test("#4009 getProviderDailyUsageRows — groups requests by date + provider", () => {
+  const rawCutoffDate = "2020-01-01";
+  const day1 = "2026-02-10T09:00:00.000Z";
+  const day2 = "2026-02-11T09:00:00.000Z";
+
+  // 3 requests for openai on day1, 1 for anthropic on day1, 2 for openai on day2
+  insertUsageHistory({ timestamp: day1, provider: "openai", tokens_input: 10, tokens_output: 20 });
+  insertUsageHistory({ timestamp: day1, provider: "openai", tokens_input: 5, tokens_output: 15 });
+  insertUsageHistory({ timestamp: day1, provider: "openai", tokens_input: 8, tokens_output: 12 });
+  insertUsageHistory({
+    timestamp: day1,
+    provider: "anthropic",
+    tokens_input: 100,
+    tokens_output: 50,
+  });
+  insertUsageHistory({ timestamp: day2, provider: "openai", tokens_input: 1, tokens_output: 1 });
+  insertUsageHistory({ timestamp: day2, provider: "openai", tokens_input: 2, tokens_output: 2 });
+
+  const { unifiedSource, unifiedParams } = mod.buildUnifiedSource({
+    sinceIso: "2026-02-10T00:00:00.000Z",
+    untilIso: "2026-02-11T23:59:59.000Z",
+    rawCutoffDate,
+    apiKeyWhere: "",
+    apiKeyParams: {},
+  });
+
+  const rows = mod.getProviderDailyUsageRows(unifiedSource, unifiedParams);
+
+  const openaiDay1 = rows.find((r) => r.date === "2026-02-10" && r.provider === "openai");
+  const anthropicDay1 = rows.find((r) => r.date === "2026-02-10" && r.provider === "anthropic");
+  const openaiDay2 = rows.find((r) => r.date === "2026-02-11" && r.provider === "openai");
+
+  assert.ok(openaiDay1, "openai/day1 row present");
+  assert.equal(openaiDay1!.requests, 3, "3 openai requests on day1");
+  assert.equal(openaiDay1!.promptTokens, 23, "10+5+8 input tokens summed");
+  assert.equal(openaiDay1!.completionTokens, 47, "20+15+12 output tokens summed");
+  assert.equal(openaiDay1!.totalTokens, 70, "23+47 total tokens");
+
+  assert.ok(anthropicDay1, "anthropic/day1 row present");
+  assert.equal(anthropicDay1!.requests, 1, "1 anthropic request on day1");
+
+  assert.ok(openaiDay2, "openai/day2 row present");
+  assert.equal(openaiDay2!.requests, 2, "2 openai requests on day2 (separate from day1)");
+
+  // provider+date pairing must not conflate different dates for the same provider
+  assert.notEqual(openaiDay1!.requests, openaiDay2!.requests);
+});
+
+test("#4009 getProviderDailyUsageRows — lowercases provider for consistent grouping", () => {
+  const rawCutoffDate = "2020-01-01";
+  const ts = "2026-03-01T09:00:00.000Z";
+
+  insertUsageHistory({ timestamp: ts, provider: "OpenAI", tokens_input: 1, tokens_output: 1 });
+  insertUsageHistory({ timestamp: ts, provider: "openai", tokens_input: 1, tokens_output: 1 });
+
+  const { unifiedSource, unifiedParams } = mod.buildUnifiedSource({
+    sinceIso: "2026-03-01T00:00:00.000Z",
+    untilIso: "2026-03-01T23:59:59.000Z",
+    rawCutoffDate,
+    apiKeyWhere: "",
+    apiKeyParams: {},
+  });
+
+  const rows = mod.getProviderDailyUsageRows(unifiedSource, unifiedParams);
+  const openaiRows = rows.filter((r) => r.date === "2026-03-01" && r.provider === "openai");
+
+  assert.equal(openaiRows.length, 1, "mixed-case provider values fold into one group");
+  assert.equal(openaiRows[0].requests, 2, "both rows counted in the single lowercase group");
+});
diff --git a/tests/unit/db-providers-crud.test.ts b/tests/unit/db-providers-crud.test.ts
index 638af3b50d..9c005fc179 100644
--- a/tests/unit/db-providers-crud.test.ts
+++ b/tests/unit/db-providers-crud.test.ts
@@ -81,6 +81,34 @@ test("createProviderConnection assigns provider-scoped priorities and supports f
   assert.equal(second.isActive, false);
 });
 
+test("getProviderConnections filters by authType", async () => {
+  const apiKeyConnection = await providersDb.createProviderConnection({
+    provider: "openai",
+    authType: "apikey",
+    name: "API Key Connection",
+    apiKey: "sk-apikey",
+  });
+  const oauthConnection = await providersDb.createProviderConnection({
+    provider: "claude",
+    authType: "oauth",
+    email: "oauth@example.com",
+    accessToken: "token-a",
+    refreshToken: "refresh-a",
+  });
+
+  const oauthOnly = await providersDb.getProviderConnections({ authType: "oauth" });
+  const apiKeyOnly = await providersDb.getProviderConnections({ authType: "apikey" });
+
+  assert.deepEqual(
+    oauthOnly.map((connection) => connection.id),
+    [oauthConnection.id]
+  );
+  assert.deepEqual(
+    apiKeyOnly.map((connection) => connection.id),
+    [apiKeyConnection.id]
+  );
+});
+
 test("oauth connections upsert by provider and email instead of duplicating rows", async () => {
   const original = await providersDb.createProviderConnection({
     provider: "claude",
@@ -142,6 +170,37 @@ test("codex workspace uniqueness uses workspaceId alongside email", async () =>
   ]);
 });
 
+test("codex logins without a workspaceId are not merged on bare email match", async () => {
+  const loginA = await providersDb.createProviderConnection({
+    provider: "codex",
+    authType: "oauth",
+    email: "shared@example.com",
+    accessToken: "token-account-a",
+    refreshToken: "refresh-account-a",
+    providerSpecificData: { chatgptUserId: "user-a" },
+  });
+  const loginB = await providersDb.createProviderConnection({
+    provider: "codex",
+    authType: "oauth",
+    email: "shared@example.com",
+    accessToken: "token-account-b",
+    refreshToken: "refresh-account-b",
+    providerSpecificData: { chatgptUserId: "user-b" },
+  });
+
+  const rows = await providersDb.getProviderConnections({ provider: "codex" });
+
+  // Two distinct Codex accounts sharing an email but lacking a verifiable
+  // workspaceId must NOT collapse into a single row — that would silently
+  // overwrite the first account's token pair on the second login.
+  assert.notEqual(loginB.id, loginA.id);
+  assert.equal(rows.length, 2);
+
+  const rowA = rows.find((row) => row.id === loginA.id);
+  assert.equal(rowA?.accessToken, "token-account-a");
+  assert.equal(rowA?.refreshToken, "refresh-account-a");
+});
+
 test("updateProviderConnection reorders priorities and returns decrypted payloads", async () => {
   const first = await providersDb.createProviderConnection({
     provider: "openai",
diff --git a/tests/unit/db/omp.test.ts b/tests/unit/db/omp.test.ts
new file mode 100644
index 0000000000..19dc0177c0
--- /dev/null
+++ b/tests/unit/db/omp.test.ts
@@ -0,0 +1,140 @@
+/**
+ * Unit tests for src/lib/db/omp.ts — OMP (Oh My Pi) credential CRUD.
+ *
+ * omp.ts opens the third-party OMP CLI's OWN local sqlite database
+ * (~/.omp/agent/agent.db) directly, per request — NOT OmniRoute's own DB.
+ * These tests cover both the happy path (round trip against a fixture DB
+ * with the omp CLI's real `auth_credentials` schema) and the missing-DB-file
+ * path (omp CLI never run yet), which each exported function must handle
+ * gracefully without throwing.
+ */
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import Database from "better-sqlite3";
+
+const {
+  getOmpCredentials,
+  saveOmpCredentials,
+  deleteOmpCredentials,
+} = await import("../../../src/lib/db/omp.ts");
+
+const PROVIDER_ID = "omniroute";
+
+let tmpHome: string;
+let origHome: string | undefined;
+
+function getOmpDbPath() {
+  return path.join(tmpHome, ".omp", "agent", "agent.db");
+}
+
+/** Simulate the omp CLI having already created its sqlite DB + schema. */
+function seedOmpDb() {
+  const dbPath = getOmpDbPath();
+  fs.mkdirSync(path.dirname(dbPath), { recursive: true });
+  const db = new Database(dbPath);
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS auth_credentials (
+      provider TEXT NOT NULL,
+      credential_type TEXT NOT NULL,
+      data TEXT,
+      disabled_cause TEXT,
+      identity_key TEXT,
+      created_at INTEGER,
+      updated_at INTEGER
+    )
+  `);
+  db.close();
+}
+
+beforeEach(() => {
+  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "omp-db-test-"));
+  origHome = process.env.HOME;
+  process.env.HOME = tmpHome;
+});
+
+afterEach(() => {
+  process.env.HOME = origHome;
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+
+describe("db/omp.ts — getOmpCredentials", () => {
+  it("returns hasOmniRoute:false without throwing when the omp DB file does not exist", () => {
+    assert.ok(!fs.existsSync(getOmpDbPath()), "precondition: no DB file yet");
+    const creds = getOmpCredentials(PROVIDER_ID);
+    assert.deepEqual(creds, { hasOmniRoute: false, baseUrl: null, apiKey: null });
+  });
+
+  it("returns hasOmniRoute:false when the DB exists but has no matching row", () => {
+    seedOmpDb();
+    const creds = getOmpCredentials(PROVIDER_ID);
+    assert.deepEqual(creds, { hasOmniRoute: false, baseUrl: null, apiKey: null });
+  });
+
+  it("returns hasOmniRoute:false gracefully when the schema itself is missing (corrupt/foreign DB)", () => {
+    const dbPath = getOmpDbPath();
+    fs.mkdirSync(path.dirname(dbPath), { recursive: true });
+    // Valid sqlite file, but no auth_credentials table at all.
+    const db = new Database(dbPath);
+    db.exec("CREATE TABLE unrelated (id INTEGER)");
+    db.close();
+
+    const creds = getOmpCredentials(PROVIDER_ID);
+    assert.deepEqual(creds, { hasOmniRoute: false, baseUrl: null, apiKey: null });
+  });
+});
+
+describe("db/omp.ts — saveOmpCredentials + getOmpCredentials round trip", () => {
+  it("persists apiKey/baseUrl so a subsequent read sees them", () => {
+    seedOmpDb();
+
+    saveOmpCredentials(PROVIDER_ID, "sk-test-omp-key", "http://localhost:20128/v1");
+
+    const creds = getOmpCredentials(PROVIDER_ID);
+    assert.equal(creds.hasOmniRoute, true);
+    assert.equal(creds.apiKey, "sk-test-omp-key");
+    assert.equal(creds.baseUrl, "http://localhost:20128/v1");
+  });
+
+  it("overwrites an existing row for the same provider instead of duplicating it", () => {
+    seedOmpDb();
+
+    saveOmpCredentials(PROVIDER_ID, "sk-old-key", "http://localhost:20128/v1");
+    saveOmpCredentials(PROVIDER_ID, "sk-new-key", "http://localhost:20129/v1");
+
+    const dbPath = getOmpDbPath();
+    const db = new Database(dbPath, { readonly: true });
+    const rows = db
+      .prepare("SELECT data FROM auth_credentials WHERE provider = ?")
+      .all(PROVIDER_ID) as { data: string }[];
+    db.close();
+
+    assert.equal(rows.length, 1, "must not accumulate duplicate rows for the same provider");
+    const parsed = JSON.parse(rows[0].data);
+    assert.equal(parsed.apiKey, "sk-new-key");
+    assert.equal(parsed.baseUrl, "http://localhost:20129/v1");
+  });
+});
+
+describe("db/omp.ts — deleteOmpCredentials", () => {
+  it("removes the row so a subsequent get reports hasOmniRoute:false", () => {
+    seedOmpDb();
+    saveOmpCredentials(PROVIDER_ID, "sk-test-omp-key", "http://localhost:20128/v1");
+    assert.equal(getOmpCredentials(PROVIDER_ID).hasOmniRoute, true);
+
+    deleteOmpCredentials(PROVIDER_ID);
+
+    assert.deepEqual(getOmpCredentials(PROVIDER_ID), {
+      hasOmniRoute: false,
+      baseUrl: null,
+      apiKey: null,
+    });
+  });
+
+  it("does not throw when deleting a provider that was never saved", () => {
+    seedOmpDb();
+    assert.doesNotThrow(() => deleteOmpCredentials(PROVIDER_ID));
+  });
+});
diff --git a/tests/unit/devin-cloud-agent-validator-6142.test.ts b/tests/unit/devin-cloud-agent-validator-6142.test.ts
new file mode 100644
index 0000000000..39463beadb
--- /dev/null
+++ b/tests/unit/devin-cloud-agent-validator-6142.test.ts
@@ -0,0 +1,71 @@
+// #6142 — devin cloud-agent provider validator + static model catalog wiring.
+// Regression guard for the "not supported" fallback devin used to always hit on the
+// generic Providers config page (parity with the existing jules cloud-agent wiring).
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+import { validateProviderApiKey } from "../../src/lib/providers/validation.ts";
+import { validateDevinCloudAgentProvider } from "../../src/lib/providers/validation/webProvidersB.ts";
+import { getStaticModelsForProvider } from "../../src/lib/providers/staticModels.ts";
+
+test("#6142: devin cloud-agent validator is wired into the SPECIALTY_VALIDATORS dispatcher", async () => {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = (async () =>
+    new Response("{}", { status: 401 })) as unknown as typeof fetch;
+  try {
+    const result = await validateProviderApiKey({
+      provider: "devin",
+      apiKey: "cog_bad_key",
+    });
+    assert.equal(result.valid, false);
+    assert.equal(result.error, "Invalid API key");
+    assert.notEqual(result.unsupported, true);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("#6142: validateDevinCloudAgentProvider maps 401 to Invalid API key", async () => {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = (async () =>
+    new Response("{}", { status: 401 })) as unknown as typeof fetch;
+  try {
+    const result = await validateDevinCloudAgentProvider({ apiKey: "bad-key" });
+    assert.equal(result.valid, false);
+    assert.equal(result.error, "Invalid API key");
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("#6142: validateDevinCloudAgentProvider maps 403 to Invalid API key", async () => {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = (async () =>
+    new Response("{}", { status: 403 })) as unknown as typeof fetch;
+  try {
+    const result = await validateDevinCloudAgentProvider({ apiKey: "bad-key" });
+    assert.equal(result.valid, false);
+    assert.equal(result.error, "Invalid API key");
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("#6142: validateDevinCloudAgentProvider accepts a 2xx probe as valid", async () => {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = (async () =>
+    new Response(JSON.stringify({ sessions: [] }), { status: 200 })) as unknown as typeof fetch;
+  try {
+    const result = await validateDevinCloudAgentProvider({ apiKey: "cog_good_key" });
+    assert.equal(result.valid, true);
+    assert.equal(result.error, null);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("#6142: devin exposes a static model catalog for the 'Available Models' UI (parity with jules)", () => {
+  const models = getStaticModelsForProvider("devin");
+  assert.ok(Array.isArray(models) && models.length > 0);
+  assert.equal(models[0].id, "devin");
+});
diff --git a/tests/unit/discontinued-providers-2026.test.ts b/tests/unit/discontinued-providers-2026.test.ts
index 79fef1ead5..1979a7cd9a 100644
--- a/tests/unit/discontinued-providers-2026.test.ts
+++ b/tests/unit/discontinued-providers-2026.test.ts
@@ -13,31 +13,46 @@ describe("2026 discontinued free tiers — providers.ts hasFree reconciliation",
     // they are KEPT with hasFree:false. phind is NOT here: the whole phind.com service
     // shut down 2026-01-16, so it was removed entirely (registry/executor/catalogs),
     // matching the dead-service-removal precedent (#5246 Gemini CLI).
-    for (const id of ["chutes", "kluster", "glhf", "gitlawb", "gitlawb-gmi", "aimlapi", "yi"]) {
+    for (const id of ["chutes", "gitlawb", "gitlawb-gmi", "aimlapi", "yi"]) {
       const p = (APIKEY_PROVIDERS as Record<string, { hasFree?: boolean }>)[id];
-      assert.ok(p, `${id} should still exist in APIKEY_PROVIDERS (provider not removed, only its free flag)`);
-      assert.strictEqual(p.hasFree, false, `${id} should have hasFree:false (discontinued in 2026)`);
+      assert.ok(
+        p,
+        `${id} should still exist in APIKEY_PROVIDERS (provider not removed, only its free flag)`
+      );
+      assert.strictEqual(
+        p.hasFree,
+        false,
+        `${id} should have hasFree:false (discontinued in 2026)`
+      );
     }
   });
 
   it("phind is fully removed (service shut down 2026-01) from both catalogs", async () => {
-    const { APIKEY_PROVIDERS, WEB_COOKIE_PROVIDERS } = await import(
-      "../../src/shared/constants/providers.ts"
-    );
+    const { APIKEY_PROVIDERS, WEB_COOKIE_PROVIDERS } =
+      await import("../../src/shared/constants/providers.ts");
     assert.ok(!("phind" in APIKEY_PROVIDERS), "phind must not be in APIKEY_PROVIDERS");
     assert.ok(!("phind" in WEB_COOKIE_PROVIDERS), "phind must not be in WEB_COOKIE_PROVIDERS");
   });
 
   it("intentionally-kept providers still advertise free (genuinely free / ToS-flagged, not flipped)", async () => {
-    const { NOAUTH_PROVIDERS, APIKEY_PROVIDERS } = await import("../../src/shared/constants/providers.ts");
+    const { NOAUTH_PROVIDERS, APIKEY_PROVIDERS } =
+      await import("../../src/shared/constants/providers.ts");
     // theoldllm is a keyless, no-signup web chat (genuinely free, just no catalogable API tier) — kept.
     // iflytek/sparkdesk stay hasFree:true but carry a ToS-caution freeNote (Spark Lite is free, the ToS
     // restricts proxy/relay use). gitlawb/gitlawb-gmi/aimlapi/yi were re-verified dead 2026-06-18 and are
     // asserted false above — keeping them out of this list guards against a silent re-flip-to-true.
     const noauth = NOAUTH_PROVIDERS as Record<string, { hasFree?: boolean }>;
     const apikey = APIKEY_PROVIDERS as Record<string, { hasFree?: boolean; freeNote?: string }>;
-    assert.strictEqual(noauth["theoldllm"]?.hasFree, true, "theoldllm intentionally kept hasFree:true");
+    assert.strictEqual(
+      noauth["theoldllm"]?.hasFree,
+      true,
+      "theoldllm intentionally kept hasFree:true"
+    );
     assert.strictEqual(apikey["iflytek"]?.hasFree, true, "iflytek kept free with ToS-caution note");
-    assert.match(apikey["iflytek"]?.freeNote ?? "", /caution/i, "iflytek freeNote should carry a caution");
+    assert.match(
+      apikey["iflytek"]?.freeNote ?? "",
+      /caution/i,
+      "iflytek freeNote should carry a caution"
+    );
   });
 });
diff --git a/tests/unit/dns-config-generic.test.ts b/tests/unit/dns-config-generic.test.ts
index e267af1337..2f77cd671d 100644
--- a/tests/unit/dns-config-generic.test.ts
+++ b/tests/unit/dns-config-generic.test.ts
@@ -69,6 +69,7 @@ const tmpHostsFile = path.join(tmpDir, "hosts");
 // Import the module under test AFTER all setup.
 const dnsModule = await import("../../src/mitm/dns/dnsConfig.ts");
 const { addDNSEntries, removeDNSEntries, addDNSEntry, removeDNSEntry, checkDNSEntry } = dnsModule;
+const { ALL_TARGETS } = await import("../../src/mitm/targets/index.ts");
 
 // ---------------------------------------------------------------------------
 // Tests
@@ -95,10 +96,60 @@ test("addDNSEntry (legacy) is a function that delegates for Antigravity hosts",
   assert.equal(typeof addDNSEntry, "function");
 });
 
+test("addDNSEntry with agentId resolves agent-specific hosts from ALL_TARGETS", async () => {
+  // Cursor target has hosts: ["api2.cursor.sh"]
+  // Verify that calling addDNSEntry with agentId="cursor" passes the right hosts.
+  // We call with [] to skip actual exec — just verifying the function signature accepts agentId.
+  await assert.doesNotReject(
+    addDNSEntry("fake-sudo", "cursor"),
+    "addDNSEntry must accept optional agentId parameter"
+  );
+});
+
+test("addDNSEntry without agentId falls back to Antigravity hosts (backward compat)", async () => {
+  await assert.doesNotReject(
+    addDNSEntry("fake-sudo"),
+    "addDNSEntry without agentId must still work for backward compat"
+  );
+});
+
+test("addDNSEntry with unknown agentId falls back to Antigravity hosts", async () => {
+  await assert.doesNotReject(
+    addDNSEntry("fake-sudo", "__nonexistent_agent__"),
+    "addDNSEntry with unknown agentId must fall back to Antigravity hosts"
+  );
+});
+
 test("removeDNSEntry (legacy) is a function that delegates for Antigravity hosts", () => {
   assert.equal(typeof removeDNSEntry, "function");
 });
 
+test("removeDNSEntry with agentId resolves agent-specific hosts from ALL_TARGETS", async () => {
+  await assert.doesNotReject(
+    removeDNSEntry("fake-sudo", "copilot"),
+    "removeDNSEntry must accept optional agentId parameter"
+  );
+});
+
+test("resolveHostsForAgent returns Antigravity hosts when agentId is undefined", () => {
+  // Verify ALL_TARGETS exists and cursor target has expected hosts
+  const cursorTarget = ALL_TARGETS.find((t) => t.id === "cursor");
+  assert.ok(cursorTarget, "cursor target must exist in ALL_TARGETS");
+  assert.ok(
+    cursorTarget.hosts.includes("api2.cursor.sh"),
+    "cursor target must include api2.cursor.sh"
+  );
+  // Codex target
+  const codexTarget = ALL_TARGETS.find((t) => t.id === "codex");
+  assert.ok(codexTarget, "codex target must exist in ALL_TARGETS");
+  assert.ok(codexTarget.hosts.includes("chatgpt.com"), "codex target must include chatgpt.com");
+});
+
+test("addDNSEntries batches missing entries with no-op on empty list", async () => {
+  // Empty list must resolve immediately (no exec, no error)
+  await assert.doesNotReject(addDNSEntries([], "fake-sudo"));
+});
+
 test("addDNSEntries: skips hosts already in /etc/hosts (idempotency)", async () => {
   // Read live /etc/hosts and pick the first entry that already exists.
   // If localhost is in /etc/hosts we use it; otherwise skip this sub-assertion.
@@ -157,11 +208,17 @@ test("addDNSEntries: entry passed as stdin data, not shell-interpolated", () =>
   const srcPath = new URL("../../src/mitm/dns/dnsConfig.ts", import.meta.url).pathname;
   const src = fs.readFileSync(srcPath, "utf8");
 
-  // The stdin data `${entry}\n` is the body text sent to tee via pipe — not
-  // part of the command array. Verify the pattern appears in the source.
+  // The stdin `data` is built from the batched entries and sent to tee via pipe —
+  // not part of the command array. Verify the pattern appears in the source and
+  // that it's passed as the 4th positional arg to execFileWithPassword (stdin),
+  // not interpolated into the argv array.
   assert.ok(
-    src.includes("`${entry}\\n`"),
-    "entry content must be passed as stdin to tee, not interpolated in args"
+    src.includes('missingEntries.map((e) => `${e}\\n`).join("")'),
+    "entry content must be built from missingEntries for stdin, not interpolated in args"
+  );
+  assert.ok(
+    src.includes('execFileWithPassword("sudo", ["-S", "tee", "-a", HOSTS_FILE], sudoPassword, data)'),
+    "entry data must be passed as stdin to tee, not interpolated in args"
   );
 });
 
diff --git a/tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts b/tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts
new file mode 100644
index 0000000000..36d0441362
--- /dev/null
+++ b/tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts
@@ -0,0 +1,79 @@
+/**
+ * #6700 — Dokploy (and some other self-hosted) Docker builds ended up with a
+ * broken/mismatched better-sqlite3 native binding under npm 11. The `builder`
+ * stage installed dependencies with `npm ci --ignore-scripts` (deliberate — it
+ * closes the supply-chain surface where a transitive dep's install script runs
+ * arbitrary code) and then re-enabled the native build for the one package that
+ * needs it via `npm rebuild better-sqlite3`. `npm rebuild` re-runs the package's
+ * own install script indirectly, which depends on npm's script-allowlist
+ * machinery correctly re-enabling that single package's script — some
+ * self-hosted build environments hit a broken build via that indirection.
+ *
+ * Fix: invoke `node-gyp rebuild` directly inside `node_modules/better-sqlite3`,
+ * bypassing npm's script-running layer entirely, so the compile step is
+ * deterministic regardless of npm version or ignore-scripts allowlist behavior.
+ *
+ * This guards the mechanism (the direct node-gyp invocation replaces the
+ * `npm rebuild` indirection, and a smoke-load still follows it); the end-to-end
+ * "the Dokploy build now produces a working binding" proof is a successful
+ * `docker build` in that environment (tracked as a live-validation follow-up —
+ * this sandbox has no accessible Docker daemon to run the real build).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+const dockerfile = fs.readFileSync(path.join(repoRoot, "Dockerfile"), "utf-8");
+const lines = dockerfile.split("\n");
+
+/** Line indices that bound the `builder` stage (from its FROM to the next FROM). */
+function builderStageRange(): { start: number; end: number } {
+  const start = lines.findIndex((l) => /^FROM\s+\S+\s+AS\s+builder\b/i.test(l.trim()));
+  assert.ok(start >= 0, "Dockerfile must declare a `builder` stage");
+  const after = lines.slice(start + 1).findIndex((l) => /^FROM\s+/i.test(l.trim()));
+  const end = after === -1 ? lines.length : start + 1 + after;
+  return { start, end };
+}
+
+test("#6700 builder stage compiles better-sqlite3 via a direct node-gyp rebuild, not `npm rebuild`", () => {
+  const { start, end } = builderStageRange();
+  const stage = lines.slice(start, end).join("\n");
+
+  assert.match(
+    stage,
+    /cd node_modules\/better-sqlite3\s*&&\s*npx\s+(--yes\s+)?node-gyp rebuild/,
+    "builder stage must compile better-sqlite3 by invoking node-gyp directly inside its " +
+      "package directory (bypasses npm's rebuild-script indirection)"
+  );
+  assert.doesNotMatch(
+    stage,
+    /npm rebuild better-sqlite3/,
+    "builder stage must not fall back to `npm rebuild better-sqlite3` — that indirection " +
+      "is the #6700 Dokploy build failure mode"
+  );
+});
+
+test("#6700 the better-sqlite3 rebuild happens after `npm ci --ignore-scripts` and before the smoke-load", () => {
+  const { start, end } = builderStageRange();
+  // Ignore comment lines (`#…`) so prose that merely mentions these commands
+  // (e.g. explaining *why* in a comment above the RUN step) is not mistaken
+  // for the real instruction when checking ordering.
+  const stage = lines.slice(start, end).filter((l) => !l.trim().startsWith("#"));
+
+  const ignoreScriptsIdx = stage.findIndex((l) => /npm ci\b.*--ignore-scripts/.test(l));
+  const rebuildIdx = stage.findIndex((l) => /node-gyp rebuild/.test(l));
+  const smokeLoadIdx = stage.findIndex((l) =>
+    /node -e ".*require\('better-sqlite3'\)\(':memory:'\)\.close\(\)"/.test(l)
+  );
+
+  assert.ok(ignoreScriptsIdx >= 0, "builder stage must run `npm ci --ignore-scripts`");
+  assert.ok(rebuildIdx >= 0, "builder stage must run the better-sqlite3 node-gyp rebuild");
+  assert.ok(smokeLoadIdx >= 0, "builder stage must smoke-load better-sqlite3 after the rebuild");
+  assert.ok(
+    ignoreScriptsIdx <= rebuildIdx && rebuildIdx <= smokeLoadIdx,
+    "order must be: npm ci --ignore-scripts -> node-gyp rebuild -> smoke-load"
+  );
+});
diff --git a/tests/unit/embeddings-lan-noauth-6925.test.ts b/tests/unit/embeddings-lan-noauth-6925.test.ts
new file mode 100644
index 0000000000..e2e07e5c0d
--- /dev/null
+++ b/tests/unit/embeddings-lan-noauth-6925.test.ts
@@ -0,0 +1,125 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// Isolate the DB to a temp dir BEFORE importing any module that opens it.
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-embed-lan-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const { createProviderNode } = await import("../../src/lib/db/providers/nodes.ts");
+const { createEmbeddingResponse } = await import("../../src/lib/embeddings/service.ts");
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+// #6925: a keyless LAN OpenAI-compatible embeddings provider (e.g. Ollama at
+// 10.x/192.168.x) must be classified as a no-auth local provider — never
+// forced through the apikey/bearer fallback (which returns 401 because no
+// credentials exist for a provider that was never meant to need any).
+test("#6925: 10.x LAN embeddings provider is treated as no-auth (no Authorization header, no 401)", async () => {
+  await createProviderNode({
+    type: "openai-compatible-embeddings",
+    name: "LAN Ollama",
+    prefix: "lanollama6925",
+    apiType: "embeddings",
+    baseUrl: "http://10.10.0.181:11434/v1",
+  });
+
+  const originalFetch = globalThis.fetch;
+  let captured: { url: string; headers: Record<string, string> } | null = null;
+  globalThis.fetch = async (url: RequestInfo | URL, options: RequestInit = {}) => {
+    captured = {
+      url: String(url),
+      headers: (options.headers as Record<string, string>) || {},
+    };
+    return new Response(
+      JSON.stringify({
+        data: [{ object: "embedding", embedding: [0.1, 0.2], index: 0 }],
+        usage: { prompt_tokens: 3, total_tokens: 3 },
+      }),
+      { status: 200, headers: { "content-type": "application/json" } }
+    );
+  };
+
+  try {
+    const res = await createEmbeddingResponse({
+      model: "lanollama6925/nomic-embed-text",
+      input: "hello world",
+    });
+    assert.equal(res.status, 200, "LAN embeddings request should succeed, not be blocked by auth");
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+
+  assert.ok(captured, "upstream fetch should have been called");
+  assert.equal(
+    captured!.url,
+    "http://10.10.0.181:11434/v1/embeddings",
+    "should hit the LAN provider's own embeddings endpoint"
+  );
+  assert.equal(
+    captured!.headers.Authorization,
+    undefined,
+    "a keyless LAN provider must not receive a fabricated Authorization header"
+  );
+});
+
+test("#6925: 192.168.x LAN embeddings provider is also treated as no-auth", async () => {
+  await createProviderNode({
+    type: "openai-compatible-embeddings",
+    name: "LAN Ollama 192",
+    prefix: "lanollama6925b",
+    apiType: "embeddings",
+    baseUrl: "http://192.168.1.10:11434/v1",
+  });
+
+  const originalFetch = globalThis.fetch;
+  let captured: { headers: Record<string, string> } | null = null;
+  globalThis.fetch = async (_url: RequestInfo | URL, options: RequestInit = {}) => {
+    captured = { headers: (options.headers as Record<string, string>) || {} };
+    return new Response(
+      JSON.stringify({
+        data: [{ object: "embedding", embedding: [0.1, 0.2], index: 0 }],
+        usage: { prompt_tokens: 3, total_tokens: 3 },
+      }),
+      { status: 200, headers: { "content-type": "application/json" } }
+    );
+  };
+
+  try {
+    const res = await createEmbeddingResponse({
+      model: "lanollama6925b/nomic-embed-text",
+      input: "hello world",
+    });
+    assert.equal(res.status, 200);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+
+  assert.ok(captured);
+  assert.equal(captured!.headers.Authorization, undefined);
+});
+
+test("#6925: cloud-metadata endpoint (169.254.169.254) stays blocked, does not become a bare no-auth provider", async () => {
+  await createProviderNode({
+    type: "openai-compatible-embeddings",
+    name: "Metadata Probe",
+    prefix: "metadataprobe6925",
+    apiType: "embeddings",
+    baseUrl: "http://169.254.169.254/v1",
+  });
+
+  const res = await createEmbeddingResponse({
+    model: "metadataprobe6925/whatever",
+    input: "hello world",
+  });
+
+  // Must not be silently treated as a trusted no-auth local provider — either
+  // rejected outright or still routed through the fallback (never authType "none").
+  assert.notEqual(res.status, 200, "cloud-metadata host must not resolve as a no-auth provider");
+});
diff --git a/tests/unit/embeddings-route-apikeymeta-6929.test.ts b/tests/unit/embeddings-route-apikeymeta-6929.test.ts
new file mode 100644
index 0000000000..8e241d731c
--- /dev/null
+++ b/tests/unit/embeddings-route-apikeymeta-6929.test.ts
@@ -0,0 +1,123 @@
+/**
+ * #6929 — eliminate the redundant getApiKeyMetadata DB read in the embeddings route.
+ *
+ * src/app/api/v1/embeddings/route.ts used to do a THIRD DB lookup
+ * (`apiKeyMeta = apiKeyRaw ? await getApiKeyMetadata(apiKeyRaw) : null`) even though
+ * `enforceApiKeyPolicy()` already fetches the same metadata internally and returns it
+ * as `policy.apiKeyInfo`. The fix replaces that call with `policy.apiKeyInfo` directly.
+ *
+ * Regression coverage: the old code gated the lookup on the ROUTE's own
+ * `extractApiKey(request)` result (`apiKeyRaw`), which is null for a request
+ * authenticated only via the dashboard-playground "test this key by id" fallback
+ * (`resolvePlaygroundTestKey`, only reachable via an authenticated dashboard
+ * session + `x-omniroute-playground-key-id`, no bearer key). In that case the old
+ * code ALWAYS produced `apiKeyMeta = null` — so the downstream handler's call log
+ * never carried apiKeyId/apiKeyName. `policy.apiKeyInfo` is a superset that also
+ * covers this path, so the fixed code populates it correctly.
+ *
+ * This test drives that exact scenario end-to-end through the real POST handler and
+ * asserts the persisted call_logs row (the observable sink that receives
+ * `EmbeddingHandlerOptions.apiKeyId/apiKeyName`) carries the pre-fetched key's real
+ * id/name — proving the downstream handler received `policy.apiKeyInfo`, not a
+ * second/independent (and in this path, always-null) lookup.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { SignJWT } from "jose";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omr-embed-apikeymeta-6929-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "embed-6929-api-secret";
+process.env.JWT_SECRET = "embed-6929-jwt-secret";
+
+const core = await import("../../src/lib/db/core.ts");
+const apiKeysDb = await import("../../src/lib/db/apiKeys.ts");
+const { createProviderNode } = await import("../../src/lib/db/providers/nodes.ts");
+const { getCallLogs } = await import("../../src/lib/usage/callLogs.ts");
+const { POST } = await import("../../src/app/api/v1/embeddings/route.ts");
+
+const PLAYGROUND_KEY_ID_HEADER = "x-omniroute-playground-key-id";
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+async function sessionCookie(): Promise<string> {
+  const secret = new TextEncoder().encode(process.env.JWT_SECRET);
+  const jwt = await new SignJWT({ sub: "admin" })
+    .setProtectedHeader({ alg: "HS256" })
+    .setExpirationTime("1h")
+    .sign(secret);
+  return `auth_token=${jwt}`;
+}
+
+async function waitForCallLog(apiKeyId: string, timeoutMs = 2000) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const logs = await getCallLogs({ apiKey: apiKeyId, limit: 5 });
+    const match = logs.find((l: { apiKeyId?: string | null }) => l.apiKeyId === apiKeyId);
+    if (match) return match;
+    await new Promise((resolve) => setTimeout(resolve, 25));
+  }
+  return null;
+}
+
+test("#6929: playground-test-key request forwards pre-fetched policy.apiKeyInfo to the downstream call log (no dependence on a second getApiKeyMetadata read)", async () => {
+  const created = await apiKeysDb.createApiKey("embed-6929-playground-key", "machine-6929", []);
+
+  await createProviderNode({
+    type: "openai-compatible-embeddings",
+    name: "LAN Embed 6929",
+    prefix: "lanembed6929",
+    apiType: "embeddings",
+    baseUrl: "http://10.10.0.182:11434/v1",
+  });
+
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async () =>
+    new Response(
+      JSON.stringify({
+        data: [{ object: "embedding", embedding: [0.1, 0.2], index: 0 }],
+        usage: { prompt_tokens: 3, total_tokens: 3 },
+      }),
+      { status: 200, headers: { "content-type": "application/json" } }
+    );
+
+  try {
+    // No Authorization header at all — the route's own extractApiKey() returns null.
+    // Only enforceApiKeyPolicy's resolvePlaygroundTestKey() fallback (authenticated
+    // dashboard session + key-id header) resolves the key.
+    const req = new Request("http://localhost/v1/embeddings", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        [PLAYGROUND_KEY_ID_HEADER]: created.id,
+        cookie: await sessionCookie(),
+      },
+      body: JSON.stringify({ model: "lanembed6929/nomic-embed-text", input: "hello world" }),
+    });
+
+    const res = await POST(req);
+    assert.equal(res.status, 200, "playground-key-authenticated embeddings request should succeed");
+
+    const logged = await waitForCallLog(created.id);
+    assert.ok(logged, "expected a call_logs row for the playground-resolved api key id");
+    assert.equal(
+      logged!.apiKeyId,
+      created.id,
+      "downstream handler must receive policy.apiKeyInfo.id, not a null/independent lookup"
+    );
+    assert.equal(
+      logged!.apiKeyName,
+      "embed-6929-playground-key",
+      "downstream handler must receive policy.apiKeyInfo.name"
+    );
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
diff --git a/tests/unit/error-classifier.test.ts b/tests/unit/error-classifier.test.ts
index c3a2ea1589..ef9b740955 100644
--- a/tests/unit/error-classifier.test.ts
+++ b/tests/unit/error-classifier.test.ts
@@ -120,3 +120,22 @@ test("classifyProviderError: OAuth provider 429 with daily quota signal => QUOTA
   );
   assert.equal(result, PROVIDER_ERROR_TYPES.QUOTA_EXHAUSTED);
 });
+
+// #6827 — 404 must be classified as MODEL_NOT_FOUND, not fall through to null.
+// Without this, no cooldown/lockout is applied and the retry loop keeps hitting
+// the dead endpoint until the upstream rate-limits it (404 + 429 storm).
+test("classifyProviderError: 404 => MODEL_NOT_FOUND", () => {
+  const result = classifyProviderError(404, {
+    error: { message: "model v0-1.5-md not found" },
+  });
+  assert.equal(result, PROVIDER_ERROR_TYPES.MODEL_NOT_FOUND);
+});
+
+test("classifyProviderError: 404 with provider => MODEL_NOT_FOUND", () => {
+  const result = classifyProviderError(
+    404,
+    { error: { message: "Not Found" } },
+    "v0-vercel"
+  );
+  assert.equal(result, PROVIDER_ERROR_TYPES.MODEL_NOT_FOUND);
+});
diff --git a/tests/unit/errorClassifier-noauth-403-6315.test.ts b/tests/unit/errorClassifier-noauth-403-6315.test.ts
new file mode 100644
index 0000000000..1c9ede34f7
--- /dev/null
+++ b/tests/unit/errorClassifier-noauth-403-6315.test.ts
@@ -0,0 +1,32 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import {
+  classifyProviderError,
+  PROVIDER_ERROR_TYPES,
+} from "../../open-sse/services/errorClassifier.ts";
+
+// #6315 / #6345 — a single generic upstream 403 on a no-credential ("authType:
+// none") provider like mimocode or theoldllm was permanently banning the whole
+// connection (classified as FORBIDDEN, a terminal type). These providers are
+// free/stateless — there is no real account/credential to revoke, so a bare
+// 403 should be RECOVERABLE (null) and handled by the existing connection
+// cooldown/retry layer, same as apikey providers already are.
+
+test("#6315: mimocode 'high-frequency non-compliant' 403 -> recoverable (null), not FORBIDDEN", () => {
+  const body = { error: "Detected high-frequency non-compliant requests, please slow down." };
+  assert.equal(classifyProviderError(403, body, "mimocode"), null);
+});
+
+test("#6345: theoldllm 'Request blocked'/access_denied 403 -> recoverable (null), not FORBIDDEN", () => {
+  const body = { error: "Request blocked", type: "access_denied" };
+  assert.equal(classifyProviderError(403, body, "theoldllm"), null);
+});
+
+test("control: apikey-provider bare 403 still recoverable (null) — no regression", () => {
+  assert.equal(classifyProviderError(403, "forbidden", "openai"), null);
+});
+
+test("control: recognized ban phrase on a no-credential provider still terminal (ACCOUNT_DEACTIVATED)", () => {
+  const body = "This service has been disabled in this account for violation of policy.";
+  assert.equal(classifyProviderError(403, body, "mimocode"), PROVIDER_ERROR_TYPES.ACCOUNT_DEACTIVATED);
+});
diff --git a/tests/unit/executor-codex-gpt56.test.ts b/tests/unit/executor-codex-gpt56.test.ts
new file mode 100644
index 0000000000..3e5d2b9506
--- /dev/null
+++ b/tests/unit/executor-codex-gpt56.test.ts
@@ -0,0 +1,52 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { CodexExecutor } from "../../open-sse/executors/codex.ts";
+
+test("CodexExecutor.transformRequest preserves max effort for GPT-5.6", () => {
+  const executor = new CodexExecutor();
+  const result = executor.transformRequest(
+    "gpt-5.6-sol",
+    {
+      model: "gpt-5.6-sol",
+      input: [],
+      reasoning_effort: "max",
+    },
+    false,
+    { requestEndpointPath: "/responses" }
+  );
+
+  assert.equal(result.model, "gpt-5.6-sol");
+  assert.equal(result.reasoning.effort, "max");
+  assert.equal(result.reasoning_effort, undefined);
+});
+
+test("CodexExecutor.transformRequest maps GPT-5.6 ultra aliases to max wire effort", () => {
+  const executor = new CodexExecutor();
+
+  for (const model of ["gpt-5.6-sol-ultra", "gpt-5.6-terra-ultra"]) {
+    const result = executor.transformRequest(model, { model, input: [] }, false, {
+      requestEndpointPath: "/responses",
+    });
+
+    assert.equal(result.model, model.replace(/-ultra$/, ""));
+    assert.equal(result.reasoning.effort, "max");
+  }
+});
+
+test("CodexExecutor.transformRequest clamps Luna ultra requests to its max effort", () => {
+  const executor = new CodexExecutor();
+  const result = executor.transformRequest(
+    "gpt-5.6-luna",
+    {
+      model: "gpt-5.6-luna",
+      input: [],
+      reasoning_effort: "ultra",
+    },
+    false,
+    { requestEndpointPath: "/responses" }
+  );
+
+  assert.equal(result.model, "gpt-5.6-luna");
+  assert.equal(result.reasoning.effort, "max");
+});
diff --git a/tests/unit/executor-codex.test.ts b/tests/unit/executor-codex.test.ts
index 9b4ecaa7da..771930e1e5 100644
--- a/tests/unit/executor-codex.test.ts
+++ b/tests/unit/executor-codex.test.ts
@@ -86,16 +86,15 @@ test("Codex helper functions isolate rate-limit scopes and parse quota headers",
   assert.equal(getCodexModelScope("gpt-5.5-xhigh"), "codex");
   assert.equal(getCodexUpstreamModel("gpt-5.5-xhigh"), "gpt-5.5");
   assert.equal(getCodexUpstreamModel("gpt-5.5-medium"), "gpt-5.5");
+  assert.equal(getCodexUpstreamModel("gpt-5.1-codex-max"), "gpt-5.1-codex-max");
   // With mock WS transport + codexTransport=websocket, gpt-5.5 models require WS
-  __setCodexWebSocketTransportForTesting(
-    async (): Promise<MockCodexWebSocket> => ({
-      send() {},
-      close() {},
-      onmessage: null,
-      onerror: null,
-      onclose: null,
-    })
-  );
+  __setCodexWebSocketTransportForTesting(async (): Promise<MockCodexWebSocket> => ({
+    send() {},
+    close() {},
+    onmessage: null,
+    onerror: null,
+    onclose: null,
+  }));
   assert.equal(
     isCodexResponsesWebSocketRequired("gpt-5.5-xhigh", {
       providerSpecificData: { codexTransport: "websocket" },
@@ -185,10 +184,10 @@ test("CodexExecutor.buildHeaders binds workspace ids and disables SSE accept for
   assert.equal(standardHeaders.Authorization, "Bearer codex-token");
   assert.equal(standardHeaders.Accept, "text/event-stream");
   assert.equal(standardHeaders["chatgpt-account-id"], "workspace-1");
-  assert.equal(standardHeaders.Version, "0.142.0");
+  assert.equal(standardHeaders.Version, "0.144.1");
   assert.equal(standardHeaders["Openai-Beta"], "responses=experimental");
   assert.equal(standardHeaders["X-Codex-Beta-Features"], "responses_websockets");
-  assert.equal(standardHeaders["User-Agent"], "codex-cli/0.142.0 (Windows 10.0.26200; x64)");
+  assert.equal(standardHeaders["User-Agent"], "codex-cli/0.144.1 (Windows 10.0.26200; x64)");
   assert.equal(compactHeaders.Accept, "application/json");
 });
 
@@ -197,13 +196,13 @@ test("CodexExecutor.buildHeaders honors safe env overrides for Version and User-
 
   await withEnv(
     {
-      CODEX_CLIENT_VERSION: "0.142.0",
+      CODEX_CLIENT_VERSION: "0.144.0",
       CODEX_USER_AGENT: undefined,
     },
     () => {
       const headers = executor.buildHeaders({ accessToken: "codex-token" }, true);
-      assert.equal(headers.Version, "0.142.0");
-      assert.equal(headers["User-Agent"], "codex-cli/0.142.0 (Windows 10.0.26200; x64)");
+      assert.equal(headers.Version, "0.144.0");
+      assert.equal(headers["User-Agent"], "codex-cli/0.144.0 (Windows 10.0.26200; x64)");
     }
   );
 
@@ -214,7 +213,7 @@ test("CodexExecutor.buildHeaders honors safe env overrides for Version and User-
     },
     () => {
       const headers = executor.buildHeaders({ accessToken: "codex-token" }, true);
-      assert.equal(headers.Version, "0.142.0");
+      assert.equal(headers.Version, "0.144.1");
       assert.equal(headers["User-Agent"], "custom-codex/9.9.9");
     }
   );
@@ -799,12 +798,12 @@ test("CodexExecutor.transformRequest keeps GPT 5.3 Codex reasoning in Responses
   assert.equal(sanitized.reasoning_effort, undefined);
 });
 
-test("CodexExecutor.transformRequest passes GPT 5.4 Mini xhigh reasoning through unchanged in Responses shape (#3756)", () => {
+test("CodexExecutor.transformRequest passes GPT 5.6 Luna xhigh reasoning through unchanged", () => {
   const executor = new CodexExecutor();
   const transformed = executor.transformRequest(
-    "gpt-5.4-mini",
+    "gpt-5.6-luna",
     {
-      model: "gpt-5.4-mini",
+      model: "gpt-5.6-luna",
       input: [],
       reasoning: { effort: "xhigh", summary: "detailed" },
       include: ["code_interpreter_call.outputs"],
@@ -817,12 +816,12 @@ test("CodexExecutor.transformRequest passes GPT 5.4 Mini xhigh reasoning through
   const sanitized = sanitizeReasoningEffortForProvider(
     transformed,
     "codex",
-    "gpt-5.4-mini",
+    "gpt-5.6-luna",
     null
   ) as Record<string, unknown>;
   const reasoning = getRecord(sanitized.reasoning);
 
-  assert.equal(sanitized.model, "gpt-5.4-mini");
+  assert.equal(sanitized.model, "gpt-5.6-luna");
   assert.deepEqual(reasoning, { effort: "xhigh", summary: "detailed" });
   assert.deepEqual(sanitized.include, [
     "code_interpreter_call.outputs",
@@ -1058,9 +1057,9 @@ test("CodexExecutor.execute skips identity headers for unsafe session ids", asyn
 test("CodexExecutor.transformRequest preserves namespace MCP tools and hosted tool types", () => {
   const executor = new CodexExecutor();
   const result = executor.transformRequest(
-    "gpt-5.4",
+    "gpt-5.6-sol",
     {
-      model: "gpt-5.4",
+      model: "gpt-5.6-sol",
       input: [],
       tools: [
         { type: "function", name: "exec_command", parameters: { type: "object" } },
diff --git a/tests/unit/executor-kimi-web.test.ts b/tests/unit/executor-kimi-web.test.ts
index bff69e30d6..5b3c7de203 100644
--- a/tests/unit/executor-kimi-web.test.ts
+++ b/tests/unit/executor-kimi-web.test.ts
@@ -9,6 +9,7 @@ import { describe, it } from "node:test";
 import assert from "node:assert/strict";
 
 const mod = await import("../../open-sse/executors/kimi-web.ts");
+const { getModelsByProviderId } = await import("../../open-sse/config/providerModels.ts");
 
 describe("KimiWebExecutor", () => {
   it("can be instantiated", () => {
@@ -79,6 +80,24 @@ describe("resolveModelConfig", () => {
   });
 });
 
+describe("kimi-web catalog", () => {
+  it("lists only currently supported non-agent web models", () => {
+    const models = getModelsByProviderId("kimi-web");
+    assert.deepEqual(
+      models.map((model) => ({ id: model.id, name: model.name })),
+      [
+        { id: "k2d6", name: "K2.6 Instant" },
+        { id: "k2d6-thinking", name: "K2.6 Thinking" },
+      ]
+    );
+    assert.ok(models.find((model) => model.id === "k2d6-thinking")?.supportsReasoning);
+    assert.ok(!models.some((model) => model.id.includes("agent")));
+    assert.ok(
+      !models.some((model) => ["kimi-default", "kimi-k2.6", "kimi-128k"].includes(model.id))
+    );
+  });
+});
+
 describe("extractKimiJwt", () => {
   const { extractKimiJwt } = mod;
 
diff --git a/tests/unit/executor-kiro.test.ts b/tests/unit/executor-kiro.test.ts
index 61f5a4493c..8fde25b3e3 100644
--- a/tests/unit/executor-kiro.test.ts
+++ b/tests/unit/executor-kiro.test.ts
@@ -147,6 +147,17 @@ test("KiroExecutor.buildHeaders includes Kiro-specific auth and metadata", () =>
   assert.ok(headers["Amz-Sdk-Invocation-Id"]);
 });
 
+test("KiroExecutor.buildHeaders marks long-lived Kiro API keys", () => {
+  const executor = new KiroExecutor();
+  const headers = executor.buildHeaders(
+    { apiKey: "kiro-api-key", providerSpecificData: { authMethod: "api_key" } },
+    true
+  );
+
+  assert.equal(headers.Authorization, "Bearer kiro-api-key");
+  assert.equal(headers.tokentype, "API_KEY");
+});
+
 test("KiroExecutor.transformRequest removes the top-level model field", () => {
   const executor = new KiroExecutor();
   const body = {
@@ -382,6 +393,13 @@ test("KiroExecutor.refreshCredentials handles missing and AWS-style refresh toke
 
   try {
     assert.equal(await executor.refreshCredentials({}, null), null);
+    assert.equal(
+      await executor.refreshCredentials(
+        { refreshToken: "ignored", providerSpecificData: { authMethod: "api_key" } },
+        null
+      ),
+      null
+    );
     const result = await executor.refreshCredentials(
       {
         refreshToken: "refresh",
diff --git a/tests/unit/executor-xai.test.ts b/tests/unit/executor-xai.test.ts
index df5d096ecd..f8a6031e5e 100644
--- a/tests/unit/executor-xai.test.ts
+++ b/tests/unit/executor-xai.test.ts
@@ -92,3 +92,21 @@ test("leaves a plain, unlisted model id and body unchanged (no suffix, not allow
   assert.equal(out.reasoning_effort, undefined);
   assert.deepEqual(out.messages, body.messages);
 });
+
+// Port of decolua/9router#2439 (author: @ryanngit): xAI ships a native
+// `/v1/responses` endpoint. grok-4.20-multi-agent-0309 is tagged
+// targetFormat: "openai-responses" in the registry (upstream's own tag) — it
+// must resolve to xAI's native Responses URL, not the chat-completions
+// bridge, mirroring the gh executor's targetFormat-driven routing (9router#102)
+// and the "openai" -pro heuristic in open-sse/executors/default.ts.
+test("XaiExecutor.buildUrl routes the Responses-tagged model (grok-4.20-multi-agent-0309) to xAI's native /v1/responses endpoint", () => {
+  const executor = new XaiExecutor();
+  const url = executor.buildUrl("grok-4.20-multi-agent-0309", true);
+  assert.equal(url, "https://api.x.ai/v1/responses");
+});
+
+test("XaiExecutor.buildUrl keeps a plain chat model (grok-4.3) on /v1/chat/completions", () => {
+  const executor = new XaiExecutor();
+  const url = executor.buildUrl("grok-4.3", true);
+  assert.equal(url, "https://api.x.ai/v1/chat/completions");
+});
diff --git a/tests/unit/executor-zai-web.test.ts b/tests/unit/executor-zai-web.test.ts
new file mode 100644
index 0000000000..2634c73e20
--- /dev/null
+++ b/tests/unit/executor-zai-web.test.ts
@@ -0,0 +1,223 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+
+const mod = await import("../../open-sse/executors/zai-web.ts");
+
+describe("ZaiWebExecutor", () => {
+  it("can be instantiated", () => {
+    const executor = new mod.ZaiWebExecutor();
+    assert.ok(executor);
+  });
+
+  it("extracts the token cookie value from a full Cookie header", () => {
+    assert.equal(mod.extractZaiToken("token=abc123; other=xyz"), "abc123");
+    assert.equal(mod.extractZaiToken("Cookie: other=xyz; token=abc123"), "abc123");
+  });
+
+  it("accepts a bare JWT/token with no cookie name prefix", () => {
+    // a bare token with no '=' and no ';' falls through to the raw string
+    assert.equal(
+      mod.extractZaiToken("eyJhbGciOiJIUzI1NiJ9.payload.sig"),
+      "eyJhbGciOiJIUzI1NiJ9.payload.sig"
+    );
+    assert.equal(mod.extractZaiToken("plainsessiontoken"), "plainsessiontoken");
+  });
+
+  it("returns empty string when no cookie is provided", () => {
+    assert.equal(mod.extractZaiToken(""), "");
+  });
+
+  it("parses the internal z.ai delta_content/phase SSE envelope", () => {
+    const delta = mod.parseZaiFrame({
+      type: "chat:completion",
+      data: { delta_content: "Hello", phase: "answer", done: false },
+    });
+    assert.deepEqual(delta, { content: "Hello", reasoning: "", done: false });
+  });
+
+  it("routes thinking-phase content into the reasoning field", () => {
+    const delta = mod.parseZaiFrame({
+      type: "chat:completion",
+      data: { delta_content: "pondering...", phase: "thinking", done: false },
+    });
+    assert.deepEqual(delta, { content: "", reasoning: "pondering...", done: false });
+  });
+
+  it("detects end-of-stream from the internal envelope", () => {
+    const delta = mod.parseZaiFrame({
+      type: "chat:completion",
+      data: { phase: "done", done: true },
+    });
+    assert.equal(delta?.done, true);
+  });
+
+  it("parses an OpenAI-shaped pass-through frame", () => {
+    const delta = mod.parseZaiFrame({
+      choices: [{ delta: { content: "Hi there" }, finish_reason: null }],
+    });
+    assert.deepEqual(delta, { content: "Hi there", reasoning: "", done: false });
+  });
+
+  it("detects end-of-stream from an OpenAI-shaped finish_reason", () => {
+    const delta = mod.parseZaiFrame({
+      choices: [{ delta: {}, finish_reason: "stop" }],
+    });
+    assert.equal(delta?.done, true);
+  });
+
+  it("returns null for frames with no usable delta", () => {
+    assert.equal(mod.parseZaiFrame(null), null);
+    assert.equal(mod.parseZaiFrame({}), null);
+    assert.equal(mod.parseZaiFrame({ data: { phase: "answer" } }), null);
+  });
+
+  it("folds non-string message content into JSON strings", () => {
+    const folded = mod.foldMessages([
+      { role: "user", content: "hi" },
+      { role: "user", content: { foo: "bar" } },
+    ]);
+    assert.deepEqual(folded, [
+      { role: "user", content: "hi" },
+      { role: "user", content: '{"foo":"bar"}' },
+    ]);
+  });
+
+  it("returns a credential error when no cookie is provided", async () => {
+    const executor = new mod.ZaiWebExecutor();
+    const result = await executor.execute({
+      model: "glm-4.6",
+      body: { messages: [{ role: "user", content: "hi" }] },
+      stream: false,
+      credentials: { apiKey: "" },
+      signal: null,
+    });
+
+    assert.equal(result.response.status, 400);
+    assert.equal(new URL(result.url).hostname, "chat.z.ai");
+    const parsed = await result.response.json();
+    assert.match(parsed.error.message, /Z\.ai session/);
+  });
+
+  it("sends the cookie + bearer token and builds the request body", async () => {
+    const originalFetch = globalThis.fetch;
+    let capturedUrl = "";
+    let capturedInit: RequestInit | undefined;
+    globalThis.fetch = (async (url: string, init?: RequestInit) => {
+      capturedUrl = String(url);
+      capturedInit = init;
+      return new Response("data: [DONE]\n\n", {
+        headers: { "Content-Type": "text/event-stream" },
+      });
+    }) as typeof fetch;
+
+    try {
+      const executor = new mod.ZaiWebExecutor();
+      await executor.execute({
+        model: "glm-4.6",
+        body: { messages: [{ role: "user", content: "hello" }] },
+        stream: false,
+        credentials: { apiKey: "token=abc123; foo=bar" },
+        signal: null,
+      });
+
+      assert.equal(capturedUrl, "https://chat.z.ai/api/chat/completions");
+      const headers = capturedInit?.headers as Record<string, string>;
+      assert.equal(headers.Cookie, "token=abc123; foo=bar");
+      assert.equal(headers.Authorization, "Bearer abc123");
+
+      const parsedBody = JSON.parse(String(capturedInit?.body));
+      assert.equal(parsedBody.model, "glm-4.6");
+      assert.equal(parsedBody.stream, true);
+      assert.deepEqual(parsedBody.messages, [{ role: "user", content: "hello" }]);
+      assert.equal(parsedBody.features.web_search, false);
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+
+  it("aggregates streamed internal-envelope deltas into a non-streaming completion", async () => {
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = (async () =>
+      new Response(
+        [
+          `data: ${JSON.stringify({ type: "chat:completion", data: { delta_content: "Hel", phase: "answer", done: false } })}`,
+          `data: ${JSON.stringify({ type: "chat:completion", data: { delta_content: "lo", phase: "answer", done: false } })}`,
+          `data: ${JSON.stringify({ type: "chat:completion", data: { phase: "done", done: true } })}`,
+          "data: [DONE]",
+          "",
+          "",
+        ].join("\n"),
+        { headers: { "Content-Type": "text/event-stream" } }
+      )) as typeof fetch;
+
+    try {
+      const executor = new mod.ZaiWebExecutor();
+      const result = await executor.execute({
+        model: "glm-4.6",
+        body: { messages: [{ role: "user", content: "hi" }] },
+        stream: false,
+        credentials: { apiKey: "token=abc123" },
+        signal: null,
+      });
+
+      const completion = await result.response.json();
+      assert.equal(completion.choices[0].message.content, "Hello");
+      assert.equal(completion.choices[0].finish_reason, "stop");
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+
+  it("streams internal-envelope deltas as OpenAI-shaped SSE chunks", async () => {
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = (async () =>
+      new Response(
+        [
+          `data: ${JSON.stringify({ type: "chat:completion", data: { delta_content: "Hi", phase: "answer", done: false } })}`,
+          `data: ${JSON.stringify({ type: "chat:completion", data: { phase: "done", done: true } })}`,
+          "",
+          "",
+        ].join("\n"),
+        { headers: { "Content-Type": "text/event-stream" } }
+      )) as typeof fetch;
+
+    try {
+      const executor = new mod.ZaiWebExecutor();
+      const result = await executor.execute({
+        model: "glm-4.6",
+        body: { messages: [{ role: "user", content: "hi" }] },
+        stream: true,
+        credentials: { apiKey: "token=abc123" },
+        signal: null,
+      });
+
+      const text = await result.response.text();
+      assert.match(text, /"content":"Hi"/);
+      assert.match(text, /"finish_reason":"stop"/);
+      assert.match(text, /data: \[DONE\]/);
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+
+  it("propagates upstream HTTP errors", async () => {
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = (async () =>
+      new Response("session expired", { status: 401 })) as typeof fetch;
+
+    try {
+      const executor = new mod.ZaiWebExecutor();
+      const result = await executor.execute({
+        model: "glm-4.6",
+        body: { messages: [{ role: "user", content: "hi" }] },
+        stream: false,
+        credentials: { apiKey: "token=abc123" },
+        signal: null,
+      });
+
+      assert.equal(result.response.status, 401);
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+});
diff --git a/tests/unit/executors-strip-unsupported-params.test.ts b/tests/unit/executors-strip-unsupported-params.test.ts
index e9169d731f..9e98a9f9de 100644
--- a/tests/unit/executors-strip-unsupported-params.test.ts
+++ b/tests/unit/executors-strip-unsupported-params.test.ts
@@ -6,6 +6,10 @@
 //   2. github + gpt-5.4: temperature unsupported.
 //   3. github + Claude (except opus/sonnet 4.6): thinking + reasoning_effort rejected.
 //   4. nvidia + z-ai/glm-5.2: reasoning rejected → NVIDIA 400.
+//   5. volcengine + kimi-k2-5-260127: max_tokens clamped to the Ark endpoint cap
+//      (32768), confirmed independently against two live-endpoint reports for the
+//      same Volcengine Ark Kimi coding-plan endpoint (decolua/9router#2460;
+//      NousResearch/hermes-agent#51773; MoonshotAI/kimi-cli#1124).
 
 import { test } from "node:test";
 import assert from "node:assert/strict";
@@ -154,10 +158,46 @@ test("stripUnsupportedParams: nvidia non-glm-5 model keeps reasoning", () => {
   assert.ok(body.reasoning !== undefined, "reasoning must survive for non-glm-5 nvidia model");
 });
 
-test("STRIP_RULES is non-empty and every rule has a drop list", () => {
+test("STRIP_RULES is non-empty and every rule has a drop list or a clamp mechanism", () => {
   assert.ok(__STRIP_RULES_FOR_TEST.length > 0);
   for (const rule of __STRIP_RULES_FOR_TEST) {
-    assert.ok(Array.isArray(rule.drop) && rule.drop.length > 0);
+    const hasDrop = Array.isArray(rule.drop) && rule.drop.length > 0;
+    const hasClamp = rule.clampToModelMaxOutput === true || Number.isFinite(rule.maxOutputCap);
+    assert.ok(hasDrop || hasClamp, "rule must either drop params or clamp max output");
     assert.ok(typeof rule.match === "function" || rule.match instanceof RegExp);
   }
 });
+
+test("stripUnsupportedParams: volcengine kimi-k2-5-260127 clamps max_tokens above the Ark endpoint cap (32768)", () => {
+  const body: Record<string, unknown> = { max_tokens: 65536 };
+  stripUnsupportedParams("volcengine", "kimi-k2-5-260127", body);
+  assert.equal(body.max_tokens, 32768, "oversized max_tokens must be clamped to the Ark cap");
+});
+
+test("stripUnsupportedParams: volcengine kimi-k2-5-260127 leaves max_tokens under the cap unchanged", () => {
+  const body: Record<string, unknown> = { max_tokens: 8000 };
+  stripUnsupportedParams("volcengine", "kimi-k2-5-260127", body);
+  assert.equal(body.max_tokens, 8000, "max_tokens under the cap must not be modified");
+});
+
+test("stripUnsupportedParams: volcengine kimi-k2-5-260127 also clamps max_completion_tokens/max_output_tokens", () => {
+  const body: Record<string, unknown> = {
+    max_completion_tokens: 100000,
+    max_output_tokens: 50000,
+  };
+  stripUnsupportedParams("volcengine", "kimi-k2-5-260127", body);
+  assert.equal(body.max_completion_tokens, 32768);
+  assert.equal(body.max_output_tokens, 32768);
+});
+
+test("stripUnsupportedParams: volcengine non-kimi model (glm-4-7-251222) is NOT clamped by the kimi rule", () => {
+  const body: Record<string, unknown> = { max_tokens: 65536 };
+  stripUnsupportedParams("volcengine", "glm-4-7-251222", body);
+  assert.equal(body.max_tokens, 65536, "kimi-specific cap must not apply to other volcengine models");
+});
+
+test("stripUnsupportedParams: kimi rule is provider-scoped (no-op for non-volcengine providers)", () => {
+  const body: Record<string, unknown> = { max_tokens: 65536 };
+  stripUnsupportedParams("kimi", "kimi-k2-5-260127", body);
+  assert.equal(body.max_tokens, 65536, "the Ark-specific cap must not leak to other kimi-hosting providers");
+});
diff --git a/tests/unit/export-json-hide-paid-combos-6328.test.ts b/tests/unit/export-json-hide-paid-combos-6328.test.ts
new file mode 100644
index 0000000000..adb2130bd4
--- /dev/null
+++ b/tests/unit/export-json-hide-paid-combos-6328.test.ts
@@ -0,0 +1,34 @@
+/**
+ * #6328 (export/backup boundary) — when `hidePaidModels` is on, the settings
+ * JSON export must strip paid combo model steps so a round-trip (export →
+ * import) does not silently re-materialise the paid targets the operator asked
+ * to REMOVE. `filterPaidComboSteps` is the pure filter wired into the export
+ * route; `combo-ref` steps and pricing-less combos are left untouched.
+ * Rule #18 regression guard.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { filterPaidComboSteps } from "../../src/app/api/settings/export-json/route.ts";
+
+test("#6328 export filter drops paid model steps but keeps combo-ref steps", () => {
+  // `openai` has no curated free roster, so `openai/gpt-4o` is paid-tier.
+  const combos = [
+    {
+      id: "c1",
+      models: [
+        { kind: "combo-ref", ref: "other-combo" },
+        { model: "openai/gpt-4o" },
+      ],
+    },
+  ];
+  const [out] = filterPaidComboSteps(combos);
+  const kinds = out.models.map((m) => (m as { kind?: string; model?: string }).kind ?? (m as { model?: string }).model);
+  assert.deepEqual(kinds, ["combo-ref"], "paid model dropped, combo-ref kept");
+});
+
+test("#6328 export filter leaves a combo without a models array untouched", () => {
+  const combos = [{ id: "c2", name: "no-models" }];
+  const out = filterPaidComboSteps(combos);
+  assert.deepEqual(out, combos);
+});
diff --git a/tests/unit/free-model-catalog.test.ts b/tests/unit/free-model-catalog.test.ts
index 60dfa2e6a4..96e11e3f3d 100644
--- a/tests/unit/free-model-catalog.test.ts
+++ b/tests/unit/free-model-catalog.test.ts
@@ -60,7 +60,8 @@ test("recurring-uncapped models are surfaced but NEVER summed into the steady he
   const t = computeFreeModelTotals();
   // every uncapped record must carry monthlyTokens 0 (un-quantifiable, not counted)
   for (const m of FREE_MODEL_BUDGETS) {
-    if (m.freeType === "recurring-uncapped") assert.equal(m.monthlyTokens, 0, `${m.provider}/${m.modelId} uncapped but counted`);
+    if (m.freeType === "recurring-uncapped")
+      assert.equal(m.monthlyTokens, 0, `${m.provider}/${m.modelId} uncapped but counted`);
   }
   // uncappedProviders is the de-duped provider list and is non-empty (siliconflow, glm-cn, kilo…)
   assert.ok(Array.isArray(t.uncappedProviders) && t.uncappedProviders.length >= 3);
@@ -81,7 +82,7 @@ test("deposit-unlock boost is reported separately, not folded into steady", () =
 test("2026-06-17 refresh: discontinued providers dropped, new free providers added", () => {
   const providers = new Set(FREE_MODEL_BUDGETS.map((m) => m.provider));
   // dead in 2026 — must be gone from the budget catalog
-  for (const dead of ["chutes", "phind", "kluster", "glhf", "gitlawb", "aimlapi", "theoldllm"]) {
+  for (const dead of ["chutes", "phind", "kluster", "gitlawb", "aimlapi", "theoldllm"]) {
     assert.ok(!providers.has(dead), `${dead} should be removed (discontinued)`);
   }
   // qwen-web is KEPT on purpose: only its OAuth API tier died — OmniRoute uses the cookie/web path.
diff --git a/tests/unit/free-provider-rankings-custom-models-6368.test.ts b/tests/unit/free-provider-rankings-custom-models-6368.test.ts
new file mode 100644
index 0000000000..95b53064cb
--- /dev/null
+++ b/tests/unit/free-provider-rankings-custom-models-6368.test.ts
@@ -0,0 +1,116 @@
+/**
+ * Regression test for #6368 (follow-up to #6150).
+ *
+ * Custom models a user adds to a provider (e.g. "Claude Fable 5" added on
+ * top of the Puter provider) were invisible in the Free Provider Rankings
+ * once the "Configured only" / "Available only" filters were applied,
+ * because `getProviderModels()` only ever walked the static
+ * `open-sse/config/providerRegistry.ts` catalog — a provider's user-added
+ * custom models were never folded into the candidate model list that gets
+ * matched against intelligence scores, so they could never appear in the
+ * ranking regardless of the filters.
+ *
+ * This test proves:
+ *  1. `mergeProviderModels` (pure) additively includes custom models and
+ *     de-dupes against the registry list.
+ *  2. `computeFreeProviderRankings()` end-to-end surfaces a provider whose
+ *     *only* matching model is a user-added custom model, under BOTH
+ *     `configuredOnly` and `availableOnly` filters.
+ *  3. Existing catalog-model based free/paid... i.e. configured/available
+ *     filtering still behaves as before (#6150 regression guard) — a
+ *     provider with no connection is still dropped under `configuredOnly`.
+ */
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-rankings-6368-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const modelsDb = await import("../../src/lib/db/models.ts");
+const intelligenceDb = await import("../../src/lib/db/modelIntelligence.ts");
+const rankings = await import("../../src/lib/freeProviderRankings.ts");
+
+const CUSTOM_MODEL_ID = "claude-fable-5-6368";
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("mergeProviderModels: additively includes custom models, de-duping by id", () => {
+  const registryModels = [{ id: "known-model", name: "Known Model" }];
+  const customModels = [
+    { id: "known-model", name: "Should not duplicate" },
+    { id: "claude-fable-5-6368", name: "Claude Fable 5" },
+  ];
+  const merged = rankings.mergeProviderModels(registryModels, customModels);
+  assert.deepEqual(
+    merged.map((m) => m.id).sort(),
+    ["claude-fable-5-6368", "known-model"]
+  );
+});
+
+test("mergeProviderModels: no custom models returns the registry list unchanged", () => {
+  const registryModels = [{ id: "known-model", name: "Known Model" }];
+  assert.deepEqual(rankings.mergeProviderModels(registryModels, []), registryModels);
+});
+
+test("#6368: a provider whose only scored model is a user-added custom model appears under configuredOnly+availableOnly", async () => {
+  // Give the custom model an arena_elo intelligence entry so it survives
+  // the ranking builder's scoring step, same as any catalog model would.
+  intelligenceDb.upsertModelIntelligence({
+    model: CUSTOM_MODEL_ID,
+    source: "arena_elo",
+    category: "default",
+    score: 0.91,
+    eloRaw: 1400,
+    confidence: "high",
+    expiresAt: null,
+  });
+
+  await modelsDb.addCustomModel("puter", CUSTOM_MODEL_ID, "Claude Fable 5");
+
+  await providersDb.createProviderConnection({
+    provider: "puter",
+    authType: "apikey",
+    name: "puter-main-6368",
+    apiKey: "test-token",
+    isActive: true,
+  });
+
+  const unfiltered = await rankings.computeFreeProviderRankings(undefined, 100, {});
+  const puterUnfiltered = unfiltered.find((r) => r.id === "puter");
+  assert.ok(puterUnfiltered, "puter must appear in the unfiltered ranking");
+  assert.ok(
+    puterUnfiltered!.topModel?.modelId === CUSTOM_MODEL_ID ||
+      unfiltered.some((r) => r.id === "puter" && r.modelCount >= 1),
+    "puter ranking must reflect the custom model score"
+  );
+
+  const filtered = await rankings.computeFreeProviderRankings(undefined, 100, {
+    configuredOnly: true,
+    availableOnly: true,
+  });
+  const puterFiltered = filtered.find((r) => r.id === "puter");
+  assert.ok(
+    puterFiltered,
+    "puter (configured + available, ranked only via its custom model) must survive configuredOnly+availableOnly filters"
+  );
+});
+
+test("#6150 regression guard: a free provider with no connection is still dropped under configuredOnly", async () => {
+  // "groq" is a no-auth free provider (always eligible, no connection needed
+  // to exist as a *candidate*), but configuredOnly still requires an actual
+  // connection row — assert the filter itself hasn't been loosened by the
+  // #6368 custom-model change.
+  const filtered = await rankings.computeFreeProviderRankings(undefined, 100, {
+    configuredOnly: true,
+  });
+  const groq = filtered.find((r) => r.id === "groq");
+  assert.equal(groq, undefined, "groq has no configured connection and must stay excluded");
+});
diff --git a/tests/unit/free-proxies-list-search.test.ts b/tests/unit/free-proxies-list-search.test.ts
new file mode 100644
index 0000000000..57dea9618b
--- /dev/null
+++ b/tests/unit/free-proxies-list-search.test.ts
@@ -0,0 +1,97 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import type { FreeProxyItem } from "@/lib/freeProxyProviders/types";
+
+// DATA_DIR must be set before the DB core module evaluates its singleton, so we
+// make the temp dir + env assignment first, then dynamic-import the modules.
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-free-list-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const freeProxiesDb = await import("../../src/lib/db/freeProxies.ts");
+
+async function reset() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+function make(host: string, quality: number, latency: number): FreeProxyItem {
+  return {
+    source: "1proxy",
+    host,
+    port: 8080,
+    type: "http",
+    countryCode: "US",
+    qualityScore: quality,
+    latencyMs: latency,
+    anonymity: "elite",
+    lastValidated: "2026-01-01T00:00:00.000Z",
+  };
+}
+
+test("listFreeProxies + countFreeProxies agree on a filtered total", async () => {
+  await reset();
+  await freeProxiesDb.upsertFreeProxy(make("alpha.example", 90, 100));
+  await freeProxiesDb.upsertFreeProxy(make("bravo.example", 40, 300));
+  await freeProxiesDb.upsertFreeProxy(make("charlie.example", 70, 200));
+
+  const all = await freeProxiesDb.listFreeProxies({});
+  assert.equal(all.length, 3);
+  assert.equal(await freeProxiesDb.countFreeProxies({}), 3);
+});
+
+test("search filters by host LIKE (case-sensitive on stored host)", async () => {
+  await reset();
+  await freeProxiesDb.upsertFreeProxy(make("alpha.example", 90, 100));
+  await freeProxiesDb.upsertFreeProxy(make("bravo.example", 40, 300));
+
+  const hit = await freeProxiesDb.listFreeProxies({ search: "alph" });
+  assert.equal(hit.length, 1);
+  assert.equal(hit[0].host, "alpha.example");
+  assert.equal(await freeProxiesDb.countFreeProxies({ search: "alph" }), 1);
+  assert.equal(await freeProxiesDb.countFreeProxies({ search: "zzz" }), 0);
+});
+
+test('sortBy "latency" orders by latency ascending with nulls last', async () => {
+  await reset();
+  await freeProxiesDb.upsertFreeProxy(make("slow.example", 50, 500));
+  await freeProxiesDb.upsertFreeProxy(make("fast.example", 50, 50));
+  await freeProxiesDb.upsertFreeProxy(make("mid.example", 50, 200));
+
+  const sorted = await freeProxiesDb.listFreeProxies({ sortBy: "latency" });
+  assert.deepEqual(
+    sorted.map((p) => p.host),
+    ["fast.example", "mid.example", "slow.example"]
+  );
+});
+
+test('sortBy "quality" orders by quality descending (default)', async () => {
+  await reset();
+  await freeProxiesDb.upsertFreeProxy(make("low.example", 10, 100));
+  await freeProxiesDb.upsertFreeProxy(make("high.example", 99, 100));
+
+  const sorted = await freeProxiesDb.listFreeProxies({});
+  assert.deepEqual(
+    sorted.map((p) => p.host),
+    ["high.example", "low.example"]
+  );
+});
+
+test("pagination limit+offset is reflected in list but not count", async () => {
+  await reset();
+  for (let i = 0; i < 5; i++) {
+    await freeProxiesDb.upsertFreeProxy(make(`host-${i}.example`, 10 + i, 100));
+  }
+  const page = await freeProxiesDb.listFreeProxies({ limit: 2, offset: 1 });
+  assert.equal(page.length, 2);
+  assert.equal(await freeProxiesDb.countFreeProxies({}), 5);
+});
diff --git a/tests/unit/free-tier-catalog.test.ts b/tests/unit/free-tier-catalog.test.ts
index b0845e015b..e5c77306d7 100644
--- a/tests/unit/free-tier-catalog.test.ts
+++ b/tests/unit/free-tier-catalog.test.ts
@@ -27,7 +27,7 @@ test("FREE_TIER_TOS marks proxy-prohibited providers as avoid", () => {
 
 test("computeFreeTierTotals sums the documented budgets", () => {
   const t = computeFreeTierTotals();
-  assert.equal(t.providerCount, 21);
+  assert.equal(t.providerCount, 20);
   assert.ok(t.documentedMonthlyTokens >= 1_350_000_000);
   assert.ok(t.documentedMonthlyTokens <= 1_450_000_000);
   assert.equal(typeof t.headline, "string");
@@ -38,5 +38,5 @@ test("computeFreeTierTotals can exclude ToS-avoid providers", () => {
   const all = computeFreeTierTotals();
   const clean = computeFreeTierTotals({ excludeTosAvoid: true });
   assert.equal(all.documentedMonthlyTokens - clean.documentedMonthlyTokens, 25_000);
-  assert.equal(clean.providerCount, 20);
+  assert.equal(clean.providerCount, 19);
 });
diff --git a/tests/unit/fusion-judge-model-6455.test.ts b/tests/unit/fusion-judge-model-6455.test.ts
new file mode 100644
index 0000000000..c241bc98e0
--- /dev/null
+++ b/tests/unit/fusion-judge-model-6455.test.ts
@@ -0,0 +1,142 @@
+/**
+ * Regression guard for #6455 — fusion combo silently returning a panel member
+ * instead of the configured judgeModel's synthesis.
+ *
+ * Root cause: handleFusionChat()'s "degrade gracefully" path (added for #6454)
+ * returned the lone surviving panel answer directly whenever only one panel
+ * member succeeded — regardless of whether an explicit `config.judgeModel`
+ * was configured. With a 2-model panel and the default `minPanel: 2`, any
+ * single flaky/rate-limited panelist forces this path on *every* request, so
+ * the configured judge (e.g. "auto/claude-opus") was never invoked and the
+ * client-visible `.model` field always reflected whichever panel member
+ * happened to survive that request (case (a): judge genuinely not run).
+ *
+ * Fix: when an explicit judgeModel is configured, still route the lone
+ * surviving answer through the judge for synthesis instead of returning it
+ * raw. Only the truly implicit case (no judgeModel set, "judge" defaults to
+ * panel[0]) keeps the cheap direct-answer shortcut.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-fusion-6455-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "fusion-6455-test-secret";
+
+const { handleComboChat } = await import("../../open-sse/services/combo.ts");
+
+type Body = Record<string, unknown>;
+
+function jsonResponse(model: string, content: string): Response {
+  const body = JSON.stringify({ model, choices: [{ message: { role: "assistant", content } }] });
+  return new Response(body, { status: 200, headers: { "Content-Type": "application/json" } });
+}
+
+function errResponse(status = 500): Response {
+  return new Response(JSON.stringify({ error: { message: "boom" } }), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+const noop = () => {};
+const log = { info: noop, warn: noop, debug: noop, error: noop };
+
+function fusionCombo(models: string[], extra: Record<string, unknown> = {}) {
+  return {
+    name: "fusion-free",
+    strategy: "fusion",
+    models: models.map((m) => ({ model: m })),
+    config: extra,
+  };
+}
+
+test("6455: judge synthesizes even a single surviving panel answer when judgeModel is explicit", async () => {
+  const calls: string[] = [];
+  const handleSingleModel = async (_b: Body, m: string) => {
+    calls.push(m);
+    if (m === "gpt-5.5-panelist") return jsonResponse(m, "panel answer");
+    if (m === "sonar-pro-panelist") return errResponse(503); // flaky panel member
+    if (m === "auto/claude-opus") return jsonResponse("auto/claude-opus", "JUDGED FINAL");
+    throw new Error(`unexpected model ${m}`);
+  };
+
+  const res = await handleComboChat({
+    body: { messages: [{ role: "user", content: "hi" }] },
+    combo: fusionCombo(["gpt-5.5-panelist", "sonar-pro-panelist"], {
+      judgeModel: "auto/claude-opus",
+    }),
+    handleSingleModel,
+    log,
+    settings: {},
+    allCombos: [],
+  });
+
+  // (a) The judge model MUST be invoked to synthesize, not skipped.
+  assert.ok(
+    calls.includes("auto/claude-opus"),
+    `expected the configured judge to be invoked; calls were: ${calls.join(", ")}`
+  );
+  // The judge call is the last one — it consumes the panel answer(s).
+  assert.equal(calls[calls.length - 1], "auto/claude-opus");
+
+  // (b) The response body reflects the judge's synthesis, not the raw panelist.
+  assert.equal(res.status, 200);
+  const json = (await res.json()) as { model?: string; choices?: Array<Record<string, unknown>> };
+  assert.equal(json.model, "auto/claude-opus");
+  const message = json.choices?.[0]?.message as { content?: string } | undefined;
+  assert.equal(message?.content, "JUDGED FINAL");
+});
+
+test("6455: panel still fans out to every member before degrading (no regression)", async () => {
+  const calls: string[] = [];
+  const handleSingleModel = async (_b: Body, m: string) => {
+    calls.push(m);
+    if (m === "p/a") return jsonResponse(m, "answer-a");
+    if (m === "p/b") return jsonResponse(m, "answer-b");
+    if (m === "p/judge") return jsonResponse("p/judge", "FUSED");
+    throw new Error(`unexpected model ${m}`);
+  };
+
+  const res = await handleComboChat({
+    body: { messages: [{ role: "user", content: "hi" }] },
+    combo: fusionCombo(["p/a", "p/b"], { judgeModel: "p/judge" }),
+    handleSingleModel,
+    log,
+    settings: {},
+    allCombos: [],
+  });
+
+  assert.deepEqual(calls.slice(0, 2).sort(), ["p/a", "p/b"]);
+  assert.equal(calls[2], "p/judge");
+  assert.equal(res.status, 200);
+  const json = (await res.json()) as { model?: string };
+  assert.equal(json.model, "p/judge");
+});
+
+test("6455: implicit judge (no judgeModel configured) still short-circuits a lone survivor", async () => {
+  const calls: string[] = [];
+  const handleSingleModel = async (_b: Body, m: string) => {
+    calls.push(m);
+    if (m === "p/ok") return jsonResponse(m, "lone");
+    return errResponse(500);
+  };
+
+  await handleComboChat({
+    body: { messages: [{ role: "user", content: "hi" }] },
+    combo: fusionCombo(["p/ok", "p/bad"]), // no judgeModel — defaults to panel[0]
+    handleSingleModel,
+    log,
+    settings: {},
+    allCombos: [],
+  });
+
+  // Panel fan-out calls p/ok and p/bad; the lone survivor is then answered
+  // directly with the client's original body (not a judge-synthesis turn) —
+  // panel[0] IS the implicit judge, so there is nothing to gain by routing
+  // it through a separate synthesis call.
+  assert.deepEqual(calls, ["p/ok", "p/bad", "p/ok"]);
+});
diff --git a/tests/unit/fusion-judge-own-intelligence.test.ts b/tests/unit/fusion-judge-own-intelligence.test.ts
new file mode 100644
index 0000000000..52c6317b80
--- /dev/null
+++ b/tests/unit/fusion-judge-own-intelligence.test.ts
@@ -0,0 +1,30 @@
+// ABOUTME: buildJudgePrompt must license the judge to use its own knowledge and override
+// ABOUTME: the panel — not just synthesize within it — while still embedding panel responses.
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { buildJudgePrompt } from "../../open-sse/services/fusion.ts";
+
+test("judge prompt embeds all panel answers, anonymized by source", () => {
+  const prompt = buildJudgePrompt([
+    { text: "answer-alpha" },
+    { text: "answer-beta" },
+  ]);
+  assert.match(prompt, /\[Source 1\]/);
+  assert.match(prompt, /\[Source 2\]/);
+  assert.match(prompt, /answer-alpha/);
+  assert.match(prompt, /answer-beta/);
+  assert.match(prompt, /2 expert models/);
+});
+
+test("judge is licensed to use its own intelligence and override the panel", () => {
+  const prompt = buildJudgePrompt([{ text: "x" }]);
+  // Must NOT cap the judge at panel content ("grounded in that analysis" was the old ceiling).
+  assert.doesNotMatch(prompt, /grounded in that analysis/);
+  // Must explicitly grant own-reasoning + override authority.
+  assert.match(prompt, /OWN reasoning and knowledge/);
+  assert.match(prompt, /override/i);
+  assert.match(prompt, /not a vote-counter/i);
+  // Must keep the honesty guard so it doesn't fabricate.
+  assert.match(prompt, /not confident about/i);
+});
diff --git a/tests/unit/fusion-judge-survivor.test.ts b/tests/unit/fusion-judge-survivor.test.ts
new file mode 100644
index 0000000000..22eb2e5bda
--- /dev/null
+++ b/tests/unit/fusion-judge-survivor.test.ts
@@ -0,0 +1,141 @@
+/**
+ * Regression test: with NO explicit judgeModel, the synthesis judge must be a
+ * SURVIVING panel member — never a panel[0] that failed fan-out.
+ *
+ * Bug: `handleFusionChat` fixed the default judge to `panel[0]` BEFORE fan-out
+ * and never reassigned it. When panel[0] timed out / was rate-limited / dropped
+ * as a straggler it landed in `failures`, not `answers` — yet the multi-answer
+ * synthesis path still dispatched `handleSingleModel(judgeBody, panel[0])`,
+ * handing synthesis to a dead model. The whole fusion request then errored even
+ * though a quorum of OTHER panel members succeeded — exactly the failure mode
+ * fusion exists to tolerate.
+ *
+ * Fix: when no explicit judge is configured, resolve the effective judge from a
+ * survivor (prefer panel[0] only when it survived, else the first survivor). An
+ * explicitly configured judge is still honored unchanged.
+ */
+
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { handleFusionChat } from "../../open-sse/services/fusion.ts";
+
+const noop = () => {};
+const log = { info: noop, warn: noop, debug: noop, error: noop };
+
+type Body = Record<string, unknown>;
+
+function okResponse(content: string): Promise<Response> {
+  const body = JSON.stringify({
+    choices: [{ message: { role: "assistant", content } }],
+  });
+  return Promise.resolve(
+    new Response(body, {
+      status: 200,
+      headers: { "Content-Type": "application/json" },
+    })
+  );
+}
+
+function errResponse(status: number): Promise<Response> {
+  const body = JSON.stringify({ error: { message: "boom" } });
+  return Promise.resolve(
+    new Response(body, {
+      status,
+      headers: { "Content-Type": "application/json" },
+    })
+  );
+}
+
+const PANEL = ["prov/model-a", "prov/model-b", "prov/model-c"];
+
+test("fusion judge-survivor: no explicit judge + panel[0] fails fan-out → synthesis uses a surviving member, not the dead panel[0]", async () => {
+  const seen: string[] = [];
+  const handleSingleModel = (_b: Body, m: string) => {
+    seen.push(m);
+    // panel[0] (model-a) fails fan-out; B & C succeed.
+    if (m === "prov/model-a") return errResponse(429);
+    return okResponse(`ans-${m}`);
+  };
+
+  const res = await handleFusionChat({
+    body: { messages: [{ role: "user", content: "hi" }] },
+    models: PANEL,
+    handleSingleModel,
+    log,
+    // NO explicit judge — this is the default-judge path that was broken.
+    tuning: { minPanel: 1, stragglerGraceMs: 4000, panelHardTimeoutMs: 60000 },
+  });
+
+  assert.notEqual(
+    res.status,
+    503,
+    "a healthy quorum (B, C) must not error just because panel[0] died"
+  );
+  const body = (await res.clone().json()) as {
+    choices?: Array<{ message?: { content?: string } }>;
+  };
+  assert.ok(
+    (body.choices?.[0]?.message?.content ?? "").length > 0,
+    "must carry a real synthesized answer"
+  );
+
+  // The synthesis dispatch is the LAST handleSingleModel call.
+  const synthesisJudge = seen[seen.length - 1];
+  assert.notEqual(synthesisJudge, "prov/model-a", "judge must NOT be the failed panel[0]");
+  assert.ok(
+    synthesisJudge === "prov/model-b" || synthesisJudge === "prov/model-c",
+    `judge must be a survivor (B or C), got ${synthesisJudge}`
+  );
+});
+
+test("fusion judge-survivor: no explicit judge + panel[0] survives → panel[0] is still chosen (existing-good case unchanged)", async () => {
+  const seen: string[] = [];
+  const handleSingleModel = (_b: Body, m: string) => {
+    seen.push(m);
+    // panel[0] (model-a) survives; model-b fails.
+    if (m === "prov/model-b") return errResponse(429);
+    return okResponse(`ans-${m}`);
+  };
+
+  const res = await handleFusionChat({
+    body: { messages: [{ role: "user", content: "hi" }] },
+    models: PANEL,
+    handleSingleModel,
+    log,
+    tuning: { minPanel: 1, stragglerGraceMs: 4000, panelHardTimeoutMs: 60000 },
+  });
+
+  assert.notEqual(res.status, 503);
+  assert.equal(
+    seen[seen.length - 1],
+    "prov/model-a",
+    "when panel[0] survives it remains the default judge"
+  );
+});
+
+test("fusion judge-survivor: explicit judge is honored unchanged even if it failed fan-out", async () => {
+  const seen: string[] = [];
+  const handleSingleModel = (_b: Body, m: string) => {
+    seen.push(m);
+    // The configured judge (model-a) fails fan-out; B & C succeed.
+    if (m === "prov/model-a") return errResponse(429);
+    return okResponse(`ans-${m}`);
+  };
+
+  const res = await handleFusionChat({
+    body: { messages: [{ role: "user", content: "hi" }] },
+    models: PANEL,
+    handleSingleModel,
+    log,
+    judgeModel: "prov/model-a", // explicit — operator intent is honored as-is.
+    tuning: { minPanel: 1, stragglerGraceMs: 4000, panelHardTimeoutMs: 60000 },
+  });
+
+  assert.notEqual(res.status, 503);
+  assert.equal(
+    seen[seen.length - 1],
+    "prov/model-a",
+    "an explicitly configured judge is dispatched unchanged (operator's choice)"
+  );
+});
diff --git a/tests/unit/fusion-partial-panel-failure-6454.test.ts b/tests/unit/fusion-partial-panel-failure-6454.test.ts
new file mode 100644
index 0000000000..ef0994340d
--- /dev/null
+++ b/tests/unit/fusion-partial-panel-failure-6454.test.ts
@@ -0,0 +1,100 @@
+/**
+ * Regression test for issue #6454 at the exact panel scale from the report
+ * (11 panel members, `fusionTuning.minPanel=1`).
+ *
+ * #6454 reported that a fusion panel returned the opaque "All fusion panel
+ * models failed" error even though only a minority of members were actually
+ * cooling down / rate-limited — the majority would have answered given the
+ * chance. Root cause (fixed by #6521, merged into this branch already):
+ * `open-sse/services/fusion.ts` used to hard-clamp the quorum floor to
+ * `Math.max(2, cfg.minPanel)`, silently overriding a user-supplied
+ * `minPanel=1` and per-member failure reasons were never surfaced in the
+ * 503 body.
+ *
+ * This file exercises the scenario at the reported scale (11 members) to
+ * lock in the fix as a permanent regression guard: a minority cooling down
+ * must not sink an otherwise-healthy majority, and a genuinely all-failed
+ * panel must still return the documented 503.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { handleFusionChat } from "../../open-sse/services/fusion.ts";
+
+const noop = () => {};
+const log = { info: noop, warn: noop, debug: noop, error: noop };
+
+type Body = Record<string, unknown>;
+
+function okResponse(content: string): Promise<Response> {
+  const body = JSON.stringify({ choices: [{ message: { role: "assistant", content } }] });
+  return Promise.resolve(
+    new Response(body, { status: 200, headers: { "Content-Type": "application/json" } })
+  );
+}
+
+function errResponse(status: number): Promise<Response> {
+  const body = JSON.stringify({ error: { message: "boom" } });
+  return Promise.resolve(new Response(body, { status, headers: { "Content-Type": "application/json" } }));
+}
+
+// Mirrors the #6454 repro: an 11-member "fusion-free" style panel where only
+// 2 members are actually cooling/rate-limited and 9 are healthy.
+const PANEL_11 = [
+  "auto/claude-opus",
+  "auto/gpt-5.5",
+  "auto/sonar-pro",
+  "auto/deepseek-v4",
+  "auto/minimax-m3",
+  "auto/glm-5.2",
+  "auto/zai-glm-4.7",
+  "auto/mimo-v2.5",
+  "auto/gemma-4-31b",
+  "auto/llama-3.3-70b",
+  "auto/llama-3.1-8b",
+];
+const COOLING = new Set(["auto/glm-5.2", "auto/zai-glm-4.7"]);
+
+test("fusion #6454: a cooling minority (2/11) does not sink a healthy majority — panel proceeds, not 'all failed'", async () => {
+  const seen: string[] = [];
+  const handleSingleModel = (_b: Body, m: string) => {
+    seen.push(m);
+    if (COOLING.has(m)) return errResponse(429);
+    return okResponse(`ans-${m}`);
+  };
+
+  const res = await handleFusionChat({
+    body: { messages: [{ role: "user", content: "List 3 file operations" }] },
+    models: PANEL_11,
+    handleSingleModel,
+    log,
+    judgeModel: "auto/claude-opus",
+    tuning: { minPanel: 1, stragglerGraceMs: 4000, panelHardTimeoutMs: 60000 },
+  });
+
+  assert.notEqual(res.status, 503, "9/11 healthy members must not be reported as a total panel failure");
+  const body = (await res.clone().json()) as { choices?: Array<{ message?: { content?: string } }> };
+  const text = body.choices?.[0]?.message?.content ?? "";
+  assert.ok(text.length > 0, "should carry a real synthesized/answer body, not an error");
+  // The judge call is the final dispatch, invoked with every healthy answer available to it.
+  assert.equal(seen[seen.length - 1], "auto/claude-opus");
+});
+
+test("fusion #6454: a genuinely all-failed 11-member panel still returns the documented 503 (no over-correction)", async () => {
+  const handleSingleModel = (_b: Body, m: string) => {
+    return COOLING.has(m) ? errResponse(429) : errResponse(500);
+  };
+
+  const res = await handleFusionChat({
+    body: { messages: [{ role: "user", content: "List 3 file operations" }] },
+    models: PANEL_11,
+    handleSingleModel,
+    log,
+    judgeModel: "auto/claude-opus",
+    tuning: { minPanel: 1, stragglerGraceMs: 4000, panelHardTimeoutMs: 60000 },
+  });
+
+  assert.equal(res.status, 503, "a genuinely all-failed panel must still surface the fusion failure error");
+  const body = (await res.clone().json()) as { error: { message: string } };
+  assert.match(body.error.message, /All fusion panel models failed/);
+});
diff --git a/tests/unit/gemini-helper.test.ts b/tests/unit/gemini-helper.test.ts
index 479a9d3fa9..e7a14cd858 100644
--- a/tests/unit/gemini-helper.test.ts
+++ b/tests/unit/gemini-helper.test.ts
@@ -20,7 +20,7 @@ test("DEFAULT_SAFETY_SETTINGS is an array", () => {
 
 test("tryParseJSON parses valid JSON", () => {
   assert.deepEqual(gemini.tryParseJSON('{"a":1}'), { a: 1 });
-  assert.deepEqual(gemini.tryParseJSON('[1,2,3]'), [1, 2, 3]);
+  assert.deepEqual(gemini.tryParseJSON("[1,2,3]"), [1, 2, 3]);
   assert.equal(gemini.tryParseJSON('"hello"'), "hello");
   assert.equal(gemini.tryParseJSON("42"), 42);
   assert.equal(gemini.tryParseJSON("true"), true);
@@ -130,3 +130,37 @@ test("cleanJSONSchemaForAntigravity handles nested schema", () => {
   const result = gemini.cleanJSONSchemaForAntigravity(schema);
   assert.ok(typeof result === "object");
 });
+
+test("convertOpenAIContentToParts maps OpenAI Chat Completions file (PDF) to inlineData", () => {
+  const content = [
+    { type: "text", text: "read this" },
+    {
+      type: "file",
+      file: { filename: "doc.pdf", file_data: "data:application/pdf;base64,JVBERiAtMQ==" },
+    },
+  ];
+  const parts = gemini.convertOpenAIContentToParts(content);
+  const inline = parts.find((p) => p.inlineData);
+  assert.ok(inline, "PDF file part must be converted to inlineData, not dropped");
+  assert.equal(inline.inlineData.mimeType, "application/pdf");
+  assert.equal(inline.inlineData.data, "JVBERiAtMQ==");
+});
+
+test("convertOpenAIContentToParts keeps the real mime for a video file_data", () => {
+  const content = [
+    { type: "file", file: { filename: "clip.mp4", file_data: "data:video/mp4;base64,AAAAIGZ0" } },
+  ];
+  const parts = gemini.convertOpenAIContentToParts(content);
+  const inline = parts.find((p) => p.inlineData);
+  assert.ok(inline, "video file part must be converted to inlineData");
+  assert.equal(inline.inlineData.mimeType, "video/mp4");
+  assert.equal(inline.inlineData.data, "AAAAIGZ0");
+});
+
+test("convertOpenAIContentToParts still maps image_url data URIs (regression)", () => {
+  const content = [{ type: "image_url", image_url: { url: "data:image/png;base64,iVBORw0KGgo=" } }];
+  const parts = gemini.convertOpenAIContentToParts(content);
+  const inline = parts.find((p) => p.inlineData);
+  assert.ok(inline, "image_url must still convert to inlineData");
+  assert.equal(inline.inlineData.mimeType, "image/png");
+});
diff --git a/tests/unit/gemini-malformed-function-call-finish-reason-2462.test.ts b/tests/unit/gemini-malformed-function-call-finish-reason-2462.test.ts
new file mode 100644
index 0000000000..4cda9fa761
--- /dev/null
+++ b/tests/unit/gemini-malformed-function-call-finish-reason-2462.test.ts
@@ -0,0 +1,156 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+// Upstream: decolua/9router#2462 sub-bug #2 (@anhdiepmmk).
+//
+// Gemini/Antigravity aborts a turn mid tool-call with finishReason
+// MALFORMED_FUNCTION_CALL (or a sibling abort reason like UNEXPECTED_TOOL_CALL)
+// instead of completing it cleanly. Before this fix:
+//   - open-sse/utils/finishReason.ts had no notion of these reasons, so they
+//     passed through the OpenAI hub unchanged (harmless on their own).
+//   - open-sse/translator/response/openai-to-claude.ts's convertFinishReason()
+//     collapsed ANY unrecognized OpenAI finish_reason to a clean "end_turn" in
+//     its default case — presenting an aborted tool call to the Claude client
+//     as a successful completion.
+// This regression guard chains the real Gemini -> OpenAI -> Claude translator
+// pipeline (mirroring translateResponse's hub-and-spoke Step 1 + Step 2) and
+// asserts the Claude stop_reason is never a silent "end_turn" for these
+// abort/error finish reasons, while a genuine clean STOP still maps to
+// "end_turn" (no regression).
+
+const { geminiToOpenAIResponse } = await import(
+  "../../open-sse/translator/response/gemini-to-openai.ts"
+);
+const { openaiToClaudeResponse } = await import(
+  "../../open-sse/translator/response/openai-to-claude.ts"
+);
+const { geminiToClaudeResponse } = await import(
+  "../../open-sse/translator/response/gemini-to-claude.ts"
+);
+
+// Direct Gemini -> Claude translator (the path Claude Code hits through an
+// antigravity/Gemini-routed model — sourceFormat=CLAUDE, targetFormat=GEMINI —
+// which bypasses the OpenAI hub). Its finishReason classifier had the identical
+// bug: any unrecognized reason (incl. MALFORMED_FUNCTION_CALL) fell through to
+// a clean "end_turn".
+function runDirectGeminiToClaude(finishReason: string) {
+  const state: Record<string, unknown> = {};
+  const events =
+    geminiToClaudeResponse(
+      {
+        responseId: "resp-direct",
+        modelVersion: "gemini-2.5-pro",
+        candidates: [{ content: { parts: [{ text: "partial" }] }, finishReason, index: 0 }],
+      },
+      state
+    ) || [];
+  const messageDelta = (events as Array<Record<string, unknown>>).find(
+    (event) => event.type === "message_delta"
+  );
+  return (messageDelta?.delta as { stop_reason?: string } | undefined)?.stop_reason;
+}
+
+function runGeminiToClaude(geminiChunk) {
+  const geminiState: { toolCalls: Map<number, unknown> } = { toolCalls: new Map() };
+  const openaiEvents = geminiToOpenAIResponse(geminiChunk, geminiState) || [];
+
+  const claudeState: { toolCalls: Map<number, unknown> } = { toolCalls: new Map() };
+  const claudeEvents: Array<Record<string, unknown>> = [];
+  for (const chunk of openaiEvents) {
+    const converted = openaiToClaudeResponse(chunk, claudeState);
+    if (converted) claudeEvents.push(...converted);
+  }
+  return { openaiEvents, claudeEvents };
+}
+
+test("Gemini MALFORMED_FUNCTION_CALL does not surface as a clean Claude end_turn", () => {
+  const { openaiEvents, claudeEvents } = runGeminiToClaude({
+    responseId: "resp-malformed",
+    modelVersion: "gemini-2.5-pro",
+    candidates: [
+      {
+        content: { parts: [{ text: "partial text" }] },
+        finishReason: "MALFORMED_FUNCTION_CALL",
+        index: 0,
+      },
+    ],
+  });
+
+  // Sanity: the OpenAI hub must not silently rewrite it to a clean "stop" either.
+  const openaiFinish = openaiEvents.at(-1)?.choices?.[0]?.finish_reason;
+  assert.notEqual(openaiFinish, "stop");
+
+  const messageDelta = claudeEvents.find((event) => event.type === "message_delta");
+  assert.ok(messageDelta, "expected a Claude message_delta terminal event");
+  const stopReason = (messageDelta.delta as { stop_reason?: string }).stop_reason;
+  assert.notEqual(stopReason, "end_turn");
+});
+
+test("Gemini UNEXPECTED_TOOL_CALL does not surface as a clean Claude end_turn", () => {
+  const { claudeEvents } = runGeminiToClaude({
+    responseId: "resp-unexpected",
+    modelVersion: "gemini-2.5-pro",
+    candidates: [
+      {
+        content: { parts: [{ text: "partial text" }] },
+        finishReason: "UNEXPECTED_TOOL_CALL",
+        index: 0,
+      },
+    ],
+  });
+
+  const messageDelta = claudeEvents.find((event) => event.type === "message_delta");
+  assert.ok(messageDelta, "expected a Claude message_delta terminal event");
+  const stopReason = (messageDelta.delta as { stop_reason?: string }).stop_reason;
+  assert.notEqual(stopReason, "end_turn");
+});
+
+test("Gemini clean STOP still maps to Claude end_turn (no regression)", () => {
+  const { claudeEvents } = runGeminiToClaude({
+    responseId: "resp-clean",
+    modelVersion: "gemini-2.5-pro",
+    candidates: [
+      {
+        content: { parts: [{ text: "All done." }] },
+        finishReason: "STOP",
+        index: 0,
+      },
+    ],
+  });
+
+  const messageDelta = claudeEvents.find((event) => event.type === "message_delta");
+  assert.ok(messageDelta, "expected a Claude message_delta terminal event");
+  const stopReason = (messageDelta.delta as { stop_reason?: string }).stop_reason;
+  assert.equal(stopReason, "end_turn");
+});
+
+test("direct Gemini->Claude: MALFORMED_FUNCTION_CALL does not surface as a clean end_turn", () => {
+  assert.notEqual(runDirectGeminiToClaude("MALFORMED_FUNCTION_CALL"), "end_turn");
+});
+
+test("direct Gemini->Claude: UNEXPECTED_TOOL_CALL does not surface as a clean end_turn", () => {
+  assert.notEqual(runDirectGeminiToClaude("UNEXPECTED_TOOL_CALL"), "end_turn");
+});
+
+test("direct Gemini->Claude: clean STOP still maps to end_turn (no regression)", () => {
+  assert.equal(runDirectGeminiToClaude("STOP"), "end_turn");
+});
+
+test("Gemini MAX_TOKENS still maps to Claude max_tokens (no regression)", () => {
+  const { claudeEvents } = runGeminiToClaude({
+    responseId: "resp-length",
+    modelVersion: "gemini-2.5-pro",
+    candidates: [
+      {
+        content: { parts: [{ text: "Truncated" }] },
+        finishReason: "MAX_TOKENS",
+        index: 0,
+      },
+    ],
+  });
+
+  const messageDelta = claudeEvents.find((event) => event.type === "message_delta");
+  assert.ok(messageDelta, "expected a Claude message_delta terminal event");
+  const stopReason = (messageDelta.delta as { stop_reason?: string }).stop_reason;
+  assert.equal(stopReason, "max_tokens");
+});
diff --git a/tests/unit/gemini-midstream-nonstreaming-responses.test.ts b/tests/unit/gemini-midstream-nonstreaming-responses.test.ts
new file mode 100644
index 0000000000..1779c23a96
--- /dev/null
+++ b/tests/unit/gemini-midstream-nonstreaming-responses.test.ts
@@ -0,0 +1,136 @@
+/**
+ * Non-streaming Responses API & Chat Completions mid-stream error handling.
+ *
+ * When Gemini returns an error JSON (e.g. 503 UNAVAILABLE) as the non-streaming
+ * response body, the non-streaming translator must handle it gracefully.
+ *
+ * Streaming Responses API mid-stream error coverage is in
+ * `gemini-midstream-responses.test.ts` (via `translateResponse`).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { translateNonStreamingResponse } =
+  await import("../../open-sse/handlers/responseTranslator.ts");
+const { FORMATS } = await import("../../open-sse/translator/formats.ts");
+
+const ERROR_BODY = {
+  error: {
+    code: 503,
+    message:
+      "This model is currently experiencing high demand. Spikes in demand are usually temporary. Please try again later.",
+    status: "UNAVAILABLE",
+  },
+};
+
+const ERROR_BODY_RESOURCE_EXHAUSTED = {
+  error: {
+    code: 429,
+    message: "Resource has been exhausted (e.g. check quota).",
+    status: "RESOURCE_EXHAUSTED",
+  },
+};
+
+test("Responses API non-streaming: Gemini error returns raw error body (no candidates)", () => {
+  const result = translateNonStreamingResponse(
+    ERROR_BODY,
+    FORMATS.GEMINI,
+    FORMATS.OPENAI_RESPONSES
+  );
+
+  // The translator has no candidates or promptFeedback to work with
+  // so it returns the raw error body unchanged. The caller's
+  // detectMalformedNonStream catches this as `empty_choices`.
+  assert.equal(result, ERROR_BODY);
+});
+
+test("Responses API non-streaming: Gemini error body has no valid output", () => {
+  const result = translateNonStreamingResponse(
+    ERROR_BODY,
+    FORMATS.GEMINI,
+    FORMATS.OPENAI_RESPONSES
+  ) as Record<string, unknown>;
+
+  // No chat.completion shape, no choices, no output array
+  assert.equal(result.object, undefined);
+  assert.equal(result.choices, undefined);
+  assert.ok(result.error, "raw error object should be preserved");
+});
+
+test("Chat Completions non-streaming: Gemini error returns raw error body", () => {
+  const result = translateNonStreamingResponse(ERROR_BODY, FORMATS.GEMINI, FORMATS.OPENAI);
+
+  // Same behavior as Responses API: no candidates → pass-through
+  assert.equal(result, ERROR_BODY);
+});
+
+test("Non-streaming: 429 RESOURCE_EXHAUSTED also returns raw error body", () => {
+  const result = translateNonStreamingResponse(
+    ERROR_BODY_RESOURCE_EXHAUSTED,
+    FORMATS.GEMINI,
+    FORMATS.OPENAI_RESPONSES
+  ) as Record<string, unknown>;
+
+  assert.equal(result, ERROR_BODY_RESOURCE_EXHAUSTED);
+  if (result.error) {
+    assert.equal((result.error as Record<string, unknown>).code, 429);
+    assert.equal((result.error as Record<string, unknown>).status, "RESOURCE_EXHAUSTED");
+  }
+});
+
+test("Non-streaming: Antigravity error inside response envelope is passed through", () => {
+  const agErrorBody = {
+    response: {
+      error: { code: 503, message: "overloaded", status: "UNAVAILABLE" },
+    },
+  };
+
+  const result = translateNonStreamingResponse(
+    agErrorBody,
+    FORMATS.GEMINI,
+    FORMATS.OPENAI_RESPONSES
+  );
+
+  // The response envelope has no candidates → passes through
+  assert.equal(result, agErrorBody);
+});
+
+test("Non-streaming: valid Gemini response with candidates still translates correctly", () => {
+  const result = translateNonStreamingResponse(
+    {
+      responseId: "resp-ok",
+      modelVersion: "gemini-2.5-flash",
+      createTime: "2026-04-05T12:00:00.000Z",
+      candidates: [
+        {
+          content: { parts: [{ text: "Hello" }] },
+          finishReason: "STOP",
+        },
+      ],
+      usageMetadata: {
+        promptTokenCount: 1,
+        candidatesTokenCount: 1,
+        totalTokenCount: 2,
+      },
+    },
+    FORMATS.GEMINI,
+    FORMATS.OPENAI_RESPONSES
+  ) as Record<string, unknown>;
+
+  assert.equal(result.object, "chat.completion");
+  assert.equal((result.choices as unknown[])[0]?.message?.content, "Hello");
+});
+
+test("detectMalformedNonStream classifies Gemini error body as empty_choices", async () => {
+  const { detectMalformedNonStream } = await import("../../open-sse/utils/diagnostics.ts");
+
+  // translateNonStreamingResponse returns the raw error body
+  const raw = translateNonStreamingResponse(ERROR_BODY, FORMATS.GEMINI, FORMATS.OPENAI_RESPONSES);
+
+  const diagnosis = detectMalformedNonStream(raw);
+  assert.equal(
+    diagnosis,
+    "empty_choices",
+    "error body without choices should be classified as empty_choices"
+  );
+});
diff --git a/tests/unit/gemini-midstream-responses.test.ts b/tests/unit/gemini-midstream-responses.test.ts
new file mode 100644
index 0000000000..284591f1e4
--- /dev/null
+++ b/tests/unit/gemini-midstream-responses.test.ts
@@ -0,0 +1,166 @@
+/**
+ * Regression test: Gemini mid-stream 503 error translated through the
+ * Responses-API pipeline must emit a proper `response.completed` with
+ * `status: "failed"` and close the reasoning item, instead of silently
+ * aborting the stream.
+ *
+ * The event sequence from the Gemini SSE stream was:
+ *   1. thought chunk (reasoning content)
+ *   2. 503 error chunk
+ *   3. provider closes connection (flush)
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { translateResponse, initState } =
+  await import("../../open-sse/translator/index.ts");
+const { FORMATS } = await import("../../open-sse/translator/formats.ts");
+
+const THOUGHT_TEXT = "The user wants me to execute a cron job named `vibe-check`";
+
+const THOUGHT_CHUNK = {
+  responseId: "faxOavr4K52qxN8PntP3mAY",
+  modelVersion: "gemma-4-31b-it",
+  candidates: [
+    {
+      content: {
+        parts: [{ text: THOUGHT_TEXT, thought: true }],
+        role: "model",
+      },
+      index: 0,
+    },
+  ],
+  usageMetadata: {
+    promptTokenCount: 22865,
+    totalTokenCount: 22879,
+    promptTokensDetails: [{ modality: "TEXT", tokenCount: 22865 }],
+    thoughtsTokenCount: 14,
+    serviceTier: "standard",
+  },
+};
+
+const ERROR_CHUNK = {
+  error: {
+    code: 503,
+    message:
+      "This model is currently experiencing high demand. Spikes in demand are usually temporary. Please try again later.",
+    status: "UNAVAILABLE",
+  },
+};
+
+test("mid-stream 503 error -> response.completed with status='failed'", () => {
+  const state = initState(FORMATS.OPENAI_RESPONSES);
+
+  // ── Step 1: Send thought chunk ──
+  const thoughtEvents = translateResponse(
+    FORMATS.GEMINI,
+    FORMATS.OPENAI_RESPONSES,
+    THOUGHT_CHUNK,
+    state
+  );
+
+  assert.ok(
+    thoughtEvents?.length > 0,
+    "thought chunk should produce Responses API events"
+  );
+
+  // Verify reasoning was started
+  const reasoningItemAdded = thoughtEvents.find(
+    (e) => e?.data?.type === "response.output_item.added" && e.data.item?.type === "reasoning"
+  );
+  assert.ok(reasoningItemAdded, "should emit response.output_item.added for reasoning");
+
+  const reasoningDelta = thoughtEvents.find(
+    (e) => e?.data?.type === "response.reasoning_summary_text.delta"
+  );
+  assert.ok(reasoningDelta, "should emit reasoning delta");
+  assert.equal(reasoningDelta.data.delta, THOUGHT_TEXT);
+
+  // ── Step 2: Send 503 error chunk ──
+  const errorEvents = translateResponse(
+    FORMATS.GEMINI,
+    FORMATS.OPENAI_RESPONSES,
+    ERROR_CHUNK,
+    state
+  );
+
+  // Error chunk itself should produce no events
+  assert.equal(errorEvents?.length ?? 0, 0, "error chunk should produce no events");
+
+  // But must be recorded in state
+  assert.ok(state.upstreamError, "state.upstreamError should be set");
+  assert.equal(state.upstreamError.status, 503);
+
+  // ── Step 3: Flush stream ──
+  const flushEvents = translateResponse(
+    FORMATS.GEMINI,
+    FORMATS.OPENAI_RESPONSES,
+    null,
+    state
+  );
+
+  assert.ok(flushEvents?.length > 0, "flush should produce events");
+
+  // The reasoning item should be properly closed
+  const reasoningDone = flushEvents.find(
+    (e) => e?.data?.type === "response.output_item.done"
+  );
+  assert.ok(reasoningDone, "flush should emit response.output_item.done for reasoning");
+  assert.equal(
+    reasoningDone.data.item?.type,
+    "reasoning",
+    "done item should be type 'reasoning'"
+  );
+
+  // The response should be completed with status 'failed' and error info
+  const completedEvent = flushEvents.find(
+    (e) => e?.data?.type === "response.completed"
+  );
+  assert.ok(completedEvent, "flush should emit response.completed");
+  assert.equal(
+    completedEvent.data.response.status,
+    "failed",
+    "response should have status 'failed' when upstreamError is set"
+  );
+  assert.ok(
+    completedEvent.data.response.error,
+    "response.error should be present when upstreamError is set"
+  );
+  assert.ok(
+    completedEvent.data.response.error?.code,
+    "response.error.code should be truthy"
+  );
+  assert.match(
+    completedEvent.data.response.error?.message || "",
+    /high demand/
+  );
+
+  // ── Step 4: Verify the reverse — no upstreamError = status "completed" ──
+  const cleanState = initState(FORMATS.OPENAI_RESPONSES);
+
+  // Send thought chunk
+  translateResponse(FORMATS.GEMINI, FORMATS.OPENAI_RESPONSES, THOUGHT_CHUNK, cleanState);
+
+  // Flush without error
+  const cleanFlush = translateResponse(
+    FORMATS.GEMINI,
+    FORMATS.OPENAI_RESPONSES,
+    null,
+    cleanState
+  );
+
+  const cleanCompleted = cleanFlush.find(
+    (e) => e?.data?.type === "response.completed"
+  );
+  assert.ok(cleanCompleted, "clean flush should emit response.completed");
+  assert.equal(
+    cleanCompleted.data.response.status,
+    "completed",
+    "clean response should have status 'completed'"
+  );
+  assert.equal(
+    cleanCompleted.data.response.error,
+    null,
+    "clean response should have error: null"
+  );
+});
diff --git a/tests/unit/gemini-thinking-budget-zero-6813.test.ts b/tests/unit/gemini-thinking-budget-zero-6813.test.ts
new file mode 100644
index 0000000000..4402c7ed85
--- /dev/null
+++ b/tests/unit/gemini-thinking-budget-zero-6813.test.ts
@@ -0,0 +1,50 @@
+/**
+ * #6813 (defect 1) — the openai->gemini transform forwards the Claude-style
+ * `thinking.budget_tokens` into `generationConfig.thinkingConfig.thinkingBudget`, but the
+ * presence check was truthy (`&& thinking.budget_tokens`). An explicit `budget_tokens: 0`
+ * (the natural "disable thinking" request) is falsy, so it was dropped and the request fell
+ * through to the default thinkingConfig injection — the model thought despite an explicit
+ * request for zero. A `budget_tokens: 0` must be honored as thinkingBudget: 0.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { openaiToGeminiRequest } = await import(
+  "../../open-sse/translator/request/openai-to-gemini.ts"
+);
+
+test("thinking.budget_tokens: 0 is honored as thinkingBudget 0 (not dropped) (#6813)", () => {
+  const result = openaiToGeminiRequest(
+    "gemini-2.5-flash",
+    {
+      messages: [{ role: "user", content: "hi" }],
+      thinking: { type: "enabled", budget_tokens: 0 },
+    },
+    false
+  ) as { generationConfig: { thinkingConfig?: { thinkingBudget: number; includeThoughts: boolean } } };
+
+  assert.equal(
+    result.generationConfig.thinkingConfig?.thinkingBudget,
+    0,
+    "explicit budget_tokens: 0 must map to thinkingBudget: 0"
+  );
+  assert.equal(
+    result.generationConfig.thinkingConfig?.includeThoughts,
+    false,
+    "with a zero budget there are no thoughts to include"
+  );
+});
+
+test("thinking.budget_tokens: positive value still maps through with includeThoughts true (#6813 no-regression)", () => {
+  const result = openaiToGeminiRequest(
+    "gemini-2.5-flash",
+    {
+      messages: [{ role: "user", content: "hi" }],
+      thinking: { type: "enabled", budget_tokens: 2048 },
+    },
+    false
+  ) as { generationConfig: { thinkingConfig?: { thinkingBudget: number; includeThoughts: boolean } } };
+
+  assert.equal(result.generationConfig.thinkingConfig?.thinkingBudget, 2048);
+  assert.equal(result.generationConfig.thinkingConfig?.includeThoughts, true);
+});
diff --git a/tests/unit/generic-quota-fetcher.test.ts b/tests/unit/generic-quota-fetcher.test.ts
index 3cfa62d8e1..d8edbd9dae 100644
--- a/tests/unit/generic-quota-fetcher.test.ts
+++ b/tests/unit/generic-quota-fetcher.test.ts
@@ -76,6 +76,31 @@ test("convertUsageToQuotaInfo clamps remainingPercentage outside 0-100", () => {
   assert.equal(result!.windows!.b.percentUsed, 1);
 });
 
+test("convertUsageToQuotaInfo ignores a window whose fraction was not reported by upstream (#6295)", () => {
+  // Antigravity sets fractionReported:false and defaults remainingPercentage
+  // to 0 when a model's usage fraction isn't returned upstream. That must
+  // NOT be treated as "100% used" — the window should be skipped entirely.
+  const result = convertUsageToQuotaInfo({
+    quotas: {
+      unreported_model: { remainingPercentage: 0, fractionReported: false, resetAt: null },
+    },
+  });
+  assert.equal(result, null);
+});
+
+test("convertUsageToQuotaInfo does not let an unreported window inflate worstPercent (#6295)", () => {
+  const result = convertUsageToQuotaInfo({
+    quotas: {
+      reported_low: { remainingPercentage: 80, fractionReported: true, resetAt: null },
+      unreported_model: { remainingPercentage: 0, fractionReported: false, resetAt: null },
+    },
+  });
+  assert.ok(result);
+  assert.deepEqual(Object.keys(result!.windows || {}), ["reported_low"]);
+  assert.equal(result!.percentUsed, 0.2);
+  assert.equal(result!.limitReached, false);
+});
+
 test("registerGenericQuotaFetchers registers Claude, GLM, and OpenCode Go via the generic adapter", () => {
   registerGenericQuotaFetchers();
   // Claude has no bespoke fetcher → should be registered.
diff --git a/tests/unit/github-skill-tools-mcp.test.ts b/tests/unit/github-skill-tools-mcp.test.ts
new file mode 100644
index 0000000000..fe3cfd7831
--- /dev/null
+++ b/tests/unit/github-skill-tools-mcp.test.ts
@@ -0,0 +1,104 @@
+/**
+ * Unit tests for the MCP tool handlers in open-sse/mcp-server/tools/githubSkillTools.ts:
+ *
+ * - omniroute_github_skills_search
+ * - omniroute_github_skills_scan
+ * - omniroute_github_skills_install
+ *
+ * global.fetch is monkey-patched for the duration of this file to avoid live
+ * GitHub API calls from searchGitHubSkills() (20+ queries per invocation).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { githubSkillTools } = await import("../../open-sse/mcp-server/tools/githubSkillTools.ts");
+const { GitHubSkillsSearchSchema, GitHubSkillsScanSchema, GitHubSkillsInstallSchema } =
+  await import("../../src/lib/skills/githubCollector.ts");
+
+const originalFetch = globalThis.fetch;
+
+test.before(() => {
+  globalThis.fetch = (async () =>
+    new Response(JSON.stringify({ items: [] }), {
+      status: 200,
+      headers: { "content-type": "application/json" },
+    })) as typeof fetch;
+});
+
+test.after(() => {
+  globalThis.fetch = originalFetch;
+});
+
+// ─── omniroute_github_skills_search ────────────────────────────────────────
+
+test("omniroute_github_skills_search: returns a well-shaped result for a valid search", async () => {
+  const args = GitHubSkillsSearchSchema.parse({ minStars: 1, maxResults: 5 });
+  const result = await githubSkillTools.omniroute_github_skills_search.handler(args);
+
+  assert.ok(Array.isArray(result.skills));
+  assert.equal(typeof result.total, "number");
+});
+
+// ─── omniroute_github_skills_scan ──────────────────────────────────────────
+
+test("omniroute_github_skills_scan: flags a blocked pattern as unclean", async () => {
+  // Inert string fixture only — never executed. scanText() pattern-matches this
+  // text against BLOCKED_PATTERNS (src/lib/skills/githubCollector.ts); no eval() runs.
+  const args = GitHubSkillsScanSchema.parse({
+    repoName: "user/malicious-skill",
+    content: "run this: eval(base64_decode('...'))",
+  });
+  const result = await githubSkillTools.omniroute_github_skills_scan.handler(args);
+
+  assert.equal(result.repoName, "user/malicious-skill");
+  assert.equal(result.clean, false);
+  assert.ok(result.findings.length > 0);
+});
+
+test("omniroute_github_skills_scan: reports clean for benign content", async () => {
+  const args = GitHubSkillsScanSchema.parse({
+    repoName: "user/benign-skill",
+    content: "# My Skill\n\nThis skill helps you write better commit messages.",
+  });
+  const result = await githubSkillTools.omniroute_github_skills_scan.handler(args);
+
+  assert.equal(result.clean, true);
+  assert.deepEqual(result.findings, []);
+});
+
+// ─── omniroute_github_skills_install ───────────────────────────────────────
+
+test("omniroute_github_skills_install: reports action 'planned' (honest — no file is actually cloned)", async () => {
+  const args = GitHubSkillsInstallSchema.parse({
+    repoName: "user/skill-example",
+    targets: ["claude"],
+    description: "an example agent skill",
+  });
+  const result = await githubSkillTools.omniroute_github_skills_install.handler(args);
+
+  assert.equal(result.allOk, true);
+  assert.equal(result.results.length, 1);
+  assert.equal(result.results[0].action, "planned");
+  assert.ok(result.results[0].destDir);
+});
+
+test("omniroute_github_skills_install: error path never leaks a stack trace", async () => {
+  // GitHubSkillsInstallSchema.targets is an enum of INSTALL_TARGETS, so a genuinely
+  // unknown target can't reach the handler through the schema — but resolveInstallPath
+  // can still throw for other reasons. Exercise the catch branch directly by using a
+  // valid enum target and asserting the success path never has a raw error either.
+  const args = GitHubSkillsInstallSchema.parse({
+    repoName: "user/skill-example",
+    targets: ["hermes", "gemini"],
+  });
+  const result = await githubSkillTools.omniroute_github_skills_install.handler(args);
+
+  for (const r of result.results) {
+    if (r.error) {
+      assert.ok(
+        !r.error.match(/\bat \/|\bat file:\/\//),
+        `Error message must not contain a stack trace: "${r.error}"`
+      );
+    }
+  }
+});
diff --git a/tests/unit/glm-executor.test.ts b/tests/unit/glm-executor.test.ts
index fad28da90e..0ae127d7e8 100644
--- a/tests/unit/glm-executor.test.ts
+++ b/tests/unit/glm-executor.test.ts
@@ -181,7 +181,7 @@ test("GlmExecutor separates OpenAI-compatible coding headers from Anthropic head
   assert.equal(anthropicHeaders["anthropic-version"], "2023-06-01");
   assert.match(anthropicHeaders["anthropic-beta"], /claude-code-20250219/);
   assert.equal(anthropicHeaders["anthropic-dangerous-direct-browser-access"], "true");
-  assert.match(anthropicHeaders["User-Agent"], /^claude-cli\/2\.1\.195 \(external, sdk-cli\)$/);
+  assert.match(anthropicHeaders["User-Agent"], /^claude-cli\/2\.1\.207 \(external, sdk-cli\)$/);
   assert.equal(anthropicHeaders["X-Stainless-Lang"], "js");
   assert.equal(anthropicHeaders["X-Stainless-Runtime"], "node");
 });
diff --git a/tests/unit/gpt-max-input-tokens-6191.test.ts b/tests/unit/gpt-max-input-tokens-6191.test.ts
index f89c42edb1..df2a90fd60 100644
--- a/tests/unit/gpt-max-input-tokens-6191.test.ts
+++ b/tests/unit/gpt-max-input-tokens-6191.test.ts
@@ -55,10 +55,10 @@ test("all codex gpt-5.5 effort variants carry the distinct input cap (#6191)", (
 });
 
 test("regression: a model without maxInputTokens still falls back to its context window", () => {
-  // codex gpt-5.4 declares no maxInputTokens, so max_input_tokens must equal
-  // the context window (the historical fallback) — no under-reporting.
-  const caps = modelCapabilities.getResolvedModelCapabilities("codex/gpt-5.4");
-  assert.ok((caps.contextWindow ?? 0) > 0, "gpt-5.4 should have a context window");
+  // OpenAI GPT-5.4 declares a context window without maxInputTokens, so the
+  // historical fallback must still avoid under-reporting.
+  const caps = modelCapabilities.getResolvedModelCapabilities("openai/gpt-5.4");
+  assert.ok((caps.contextWindow ?? 0) > 0, "OpenAI GPT-5.4 should have a context window");
   assert.equal(
     caps.maxInputTokens,
     caps.contextWindow,
diff --git a/tests/unit/gpt5-sampling-guard.test.ts b/tests/unit/gpt5-sampling-guard.test.ts
index 1bfa01433c..9bc9d72e6c 100644
--- a/tests/unit/gpt5-sampling-guard.test.ts
+++ b/tests/unit/gpt5-sampling-guard.test.ts
@@ -61,8 +61,8 @@ test("model suffix -high triggers strip; -none keeps sampling", () => {
 });
 
 test("non-openai provider is untouched (codex is guarded by the executor allowlist)", () => {
-  const body = { model: "gpt-5.4", temperature: 0.7, reasoning_effort: "high" };
-  const result = stripGpt5SamplingWhenReasoning(body, "codex", "gpt-5.4");
+  const body = { model: "gpt-5.6-sol", temperature: 0.7, reasoning_effort: "high" };
+  const result = stripGpt5SamplingWhenReasoning(body, "codex", "gpt-5.6-sol");
   assert.equal(result.temperature, 0.7);
 });
 
diff --git a/tests/unit/grok-cli-reasoning-strip-6288.test.ts b/tests/unit/grok-cli-reasoning-strip-6288.test.ts
new file mode 100644
index 0000000000..d84bb2f438
--- /dev/null
+++ b/tests/unit/grok-cli-reasoning-strip-6288.test.ts
@@ -0,0 +1,72 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { GrokCliExecutor } = await import("@omniroute/open-sse/executors/grok-cli");
+
+// Regression for #6288: Grok Build (`grok-cli` executor) returns 400 on every
+// request from Claude Code because Claude Code forwards `reasoning_effort`
+// (and sometimes a nested `reasoning` object), which Grok Build's upstream
+// chat-proxy endpoint does not accept. transformRequest() must strip both
+// before forwarding, without breaking the existing #5273 stripping.
+
+test("#6288 grok-cli transformRequest strips reasoning_effort", () => {
+  const executor = new GrokCliExecutor();
+  const body = {
+    model: "grok-build",
+    messages: [{ role: "user", content: "hi" }],
+    reasoning_effort: "high",
+  };
+
+  const out = executor.transformRequest("grok-build", body, false, {} as never) as Record<
+    string,
+    unknown
+  >;
+
+  assert.equal("reasoning_effort" in out, false, "reasoning_effort must be stripped");
+  assert.deepEqual(out.messages, [{ role: "user", content: "hi" }]);
+  assert.equal(out.model, "grok-build");
+});
+
+test("#6288 grok-cli transformRequest strips nested reasoning object", () => {
+  const executor = new GrokCliExecutor();
+  const body = {
+    model: "grok-build",
+    messages: [{ role: "user", content: "hi" }],
+    reasoning: { effort: "high" },
+  };
+
+  const out = executor.transformRequest("grok-build", body, false, {} as never) as Record<
+    string,
+    unknown
+  >;
+
+  assert.equal("reasoning" in out, false, "reasoning must be stripped");
+});
+
+test("#6288 grok-cli transformRequest still strips #5273 unsupported sampling params", () => {
+  const executor = new GrokCliExecutor();
+  const body = {
+    model: "grok-build",
+    messages: [{ role: "user", content: "hi" }],
+    presencePenalty: 0.5,
+    frequencyPenalty: 0.3,
+    logprobs: true,
+    topLogprobs: 5,
+    reasoning_effort: "medium",
+  };
+
+  const out = executor.transformRequest("grok-build", body, false, {} as never) as Record<
+    string,
+    unknown
+  >;
+
+  for (const param of [
+    "presencePenalty",
+    "frequencyPenalty",
+    "logprobs",
+    "topLogprobs",
+    "reasoning_effort",
+  ]) {
+    assert.equal(param in out, false, `${param} must be stripped`);
+  }
+});
diff --git a/tests/unit/guardrails/visionBridge.test.ts b/tests/unit/guardrails/visionBridge.test.ts
index 847c9d6115..c59713b371 100644
--- a/tests/unit/guardrails/visionBridge.test.ts
+++ b/tests/unit/guardrails/visionBridge.test.ts
@@ -190,12 +190,19 @@ test("VB-S02b: respects native vision support for GPT-family models", async () =
     const result = await guardrail.preCall(payload, createContext({ model }));
 
     assert.strictEqual(result.block, false, `expected passthrough for ${model}`);
-    assert.strictEqual(
-      result.modifiedPayload,
-      undefined,
-      `expected unmodified payload for ${model}`
-    );
     assert.strictEqual(visionCallCount, 0, `expected no bridge call for ${model}`);
+
+    // If supportsVision is true, payload should be unmodified.
+    // If supportsVision is null, the guardrail reroutes (modifiedPayload defined, model changed).
+    // Both are correct behavior — the key invariant is no describe call.
+    const caps = getResolvedModelCapabilities(model);
+    if (caps.supportsVision === true) {
+      assert.strictEqual(
+        result.modifiedPayload,
+        undefined,
+        `expected unmodified payload for ${model}`
+      );
+    }
   }
 });
 
@@ -225,10 +232,60 @@ test("VB-S04: passthroughs when messages array is empty", async () => {
   assert.strictEqual(result.block, false);
 });
 
-// ── VB-S01: Single image processing ─────────────────────────────────────────
+// ── VB-S12: Auto-prefix skip ────────────────────────────────────────────────
 
-test("VB-S01: replaces image with description for non-vision model", async () => {
-  mockVisionResponse = "A beautiful sunset over the ocean";
+test("VB-S12: skips guardrail for auto/ prefix model (auto/vision)", async () => {
+  const guardrail = createGuardrail();
+
+  const payload = createPayload({
+    model: "auto/vision",
+    messages: [
+      {
+        role: "user",
+        content: [
+          { type: "text", text: "What is in this image?" },
+          {
+            type: "image_url",
+            image_url: { url: "https://example.com/image.png" },
+          },
+        ],
+      },
+    ],
+  });
+
+  const result = await guardrail.preCall(payload, createContext({ model: "auto/vision" }));
+  assert.strictEqual(result.block, false);
+  assert.strictEqual(result.modifiedPayload, undefined, "auto/vision should passthrough");
+  assert.strictEqual(visionCallCount, 0, "should NOT call vision API for auto prefix");
+});
+
+test("VB-S12b: skips guardrail for bare auto prefix", async () => {
+  const guardrail = createGuardrail();
+
+  const payload = createPayload({
+    model: "auto",
+    messages: [
+      {
+        role: "user",
+        content: [
+          { type: "text", text: "What is in this image?" },
+          {
+            type: "image_url",
+            image_url: { url: "https://example.com/image.png" },
+          },
+        ],
+      },
+    ],
+  });
+
+  const result = await guardrail.preCall(payload, createContext({ model: "auto" }));
+  assert.strictEqual(result.block, false);
+  assert.strictEqual(result.modifiedPayload, undefined, "auto should passthrough");
+});
+
+// ── VB-S01: Single image → reroute (individual non-vision model) ───────────
+
+test("VB-S01: reroutes non-vision model with images to best vision model", async () => {
   const guardrail = createGuardrail();
 
   const payload = createPayload({
@@ -252,37 +309,40 @@ test("VB-S01: replaces image with description for non-vision model", async () =>
   assert.strictEqual(result.block, false);
   assert.ok(result.modifiedPayload);
 
+  // Model should be rerouted to best vision-capable model (auto-selected from providers)
   const modified = result.modifiedPayload as {
+    model?: string;
     messages: Array<{ content: unknown[] }>;
   };
-  const content = modified.messages[0].content as Array<{
-    type: string;
-    text?: string;
-  }>;
+  assert.ok(modified.model, "rerouted model should be set");
+  assert.notStrictEqual(
+    modified.model,
+    "minimax/minimax-01",
+    "model should be different from original"
+  );
 
+  // Images should be KEPT since the vision model handles them natively
+  const content = modified.messages[0].content as Array<{ type: string; [key: string]: unknown }>;
   const imagePart = content.find((p) => p.type === "image_url");
-  assert.strictEqual(imagePart, undefined);
+  assert.ok(imagePart, "original image_url part must be preserved for rerouted vision model");
 
-  const descriptionPart = content.find((p) => p.type === "text" && p.text?.includes("sunset"));
-  assert.ok(descriptionPart);
+  // Meta should indicate reroute occurred
+  const meta = result.meta as Record<string, unknown>;
+  assert.strictEqual(meta.rerouted, true);
+  assert.strictEqual(meta.fromModel, "minimax/minimax-01");
+  assert.ok(
+    typeof meta.toModel === "string" && meta.toModel.length > 0,
+    "toModel should be a non-empty string"
+  );
+  assert.notStrictEqual(meta.toModel, "minimax/minimax-01", "toModel should differ from original");
+  assert.strictEqual(meta.imagesKept, 1);
+  assert.strictEqual(visionCallCount, 0, "should NOT call vision API for description");
 });
 
-// ── VB-S04: Multiple images ─────────────────────────────────────────────────
+// ── VB-S13: Reroute preserves multiple images ──────────────────────────────
 
-test("VB-S04: processes multiple images and concatenates descriptions", async () => {
-  let callIdx = 0;
-  const descriptions = ["A cute cat", "A playful dog", "A colorful bird"];
-
-  const guardrail = new VisionBridgeGuardrail({
-    deps: {
-      getSettings: async () => mockSettings,
-      callVisionModel: async () => {
-        const desc = descriptions[callIdx] || "Unknown image";
-        callIdx++;
-        return desc;
-      },
-    },
-  });
+test("VB-S13: reroutes with multiple images, all preserved", async () => {
+  const guardrail = createGuardrail();
 
   const payload = createPayload({
     model: "minimax/minimax-01",
@@ -312,106 +372,21 @@ test("VB-S04: processes multiple images and concatenates descriptions", async ()
 
   assert.strictEqual(result.block, false);
   assert.ok(result.modifiedPayload);
-  assert.strictEqual(callIdx, 3);
 
+  // All 3 images should be present in the rerouted payload
   const modified = result.modifiedPayload as {
+    model?: string;
     messages: Array<{ content: unknown[] }>;
   };
-  const content = modified.messages[0].content as Array<{
-    type: string;
-    text?: string;
-  }>;
-
-  assert.ok(content.some((p) => p.type === "text" && p.text?.includes("[Image 1]")));
-  assert.ok(content.some((p) => p.type === "text" && p.text?.includes("[Image 2]")));
-  assert.ok(content.some((p) => p.type === "text" && p.text?.includes("[Image 3]")));
+  const content = modified.messages[0].content as Array<{ type: string; [key: string]: unknown }>;
+  const images = content.filter((p) => p.type === "image_url");
+  assert.strictEqual(images.length, 3, "all 3 images should be preserved");
+  assert.strictEqual(visionCallCount, 0, "should NOT call vision API");
 });
 
-// ── VB-S03: Fail-open on vision error ──────────────────────────────────────
+// ── VB-S07: Base64 image format → reroute ──────────────────────────────────
 
-test("VB-S03: preserves the original image when the vision API fails (#4012)", async () => {
-  shouldVisionFail = true;
-  const guardrail = createGuardrail();
-
-  const payload = createPayload({
-    model: "minimax/minimax-01",
-    messages: [
-      {
-        role: "user",
-        content: [
-          { type: "text", text: "What is this?" },
-          {
-            type: "image_url",
-            image_url: { url: "https://example.com/image.png" },
-          },
-        ],
-      },
-    ],
-  });
-
-  const result = await guardrail.preCall(payload, createContext({ model: "minimax/minimax-01" }));
-
-  assert.strictEqual(result.block, false);
-
-  const modified = (result.modifiedPayload ?? payload) as {
-    messages: Array<{ content: unknown[] }>;
-  };
-  const content = modified.messages[0].content as Array<{
-    type: string;
-    text?: string;
-  }>;
-
-  // #4012: a failed describe must NOT replace the image with an "(unavailable)"
-  // stub — the original image is preserved so a vision-capable upstream can see it.
-  const imagePart = content.find((p) => p.type === "image_url");
-  assert.ok(imagePart, "original image_url part must be preserved on describe failure");
-  const unavailPart = content.find((p) => p.type === "text" && p.text?.includes("unavailable"));
-  assert.strictEqual(unavailPart, undefined);
-});
-
-test("VB-S03: logs warning when vision API fails", async () => {
-  shouldVisionFail = true;
-  let warningLogged = false;
-  const guardrail = createGuardrail();
-
-  const payload = createPayload({
-    model: "minimax/minimax-01",
-    messages: [
-      {
-        role: "user",
-        content: [
-          {
-            type: "image_url",
-            image_url: { url: "https://example.com/image.png" },
-          },
-        ],
-      },
-    ],
-  });
-
-  const mockLog = {
-    warn: (_tag: string, msg: string) => {
-      if (msg.includes("Failed to get description")) {
-        warningLogged = true;
-      }
-    },
-  };
-
-  await guardrail.preCall(
-    payload,
-    createContext({
-      model: "minimax/minimax-01",
-      log: mockLog as GuardrailContext["log"],
-    })
-  );
-
-  assert.strictEqual(warningLogged, true);
-});
-
-// ── VB-S07: Base64 image format ─────────────────────────────────────────────
-
-test("VB-S07: handles base64 image format", async () => {
-  mockVisionResponse = "An image description";
+test("VB-S07: reroutes base64 image to vision model", async () => {
   const guardrail = createGuardrail();
 
   const payload = createPayload({
@@ -437,13 +412,115 @@ test("VB-S07: handles base64 image format", async () => {
 
   assert.strictEqual(result.block, false);
   assert.ok(result.modifiedPayload);
+  const modified = result.modifiedPayload as { model?: string };
+  assert.ok(modified.model, "rerouted model should be set");
+  assert.notStrictEqual(
+    modified.model,
+    "minimax/minimax-01",
+    "model should be different from original"
+  );
+  // Don't assert a specific model — auto-router picks the best available vision model
+  assert.strictEqual(visionCallCount, 0, "should NOT call vision API");
 });
 
-// ── VB-S09: Image count limit ───────────────────────────────────────────────
+// ── VB-S03: Fail-open on vision error (via combo mapping path) ────────────
 
-test("VB-S09: respects maxImages setting", async () => {
+test("VB-S03: preserves the original image when the vision API fails (#4012)", async () => {
+  shouldVisionFail = true;
+  const guardrail = createGuardrail({
+    deps: {
+      checkModelHasComboMapping: async (_model: string) => true,
+    },
+  });
+
+  const payload = createPayload({
+    model: "openai/gpt-4o",
+    messages: [
+      {
+        role: "user",
+        content: [
+          { type: "text", text: "What is this?" },
+          {
+            type: "image_url",
+            image_url: { url: "https://example.com/image.png" },
+          },
+        ],
+      },
+    ],
+  });
+
+  const result = await guardrail.preCall(payload, createContext({ model: "openai/gpt-4o" }));
+
+  assert.strictEqual(result.block, false);
+
+  const modified = (result.modifiedPayload ?? payload) as {
+    messages: Array<{ content: unknown[] }>;
+  };
+  const content = modified.messages[0].content as Array<{
+    type: string;
+    text?: string;
+  }>;
+
+  // #4012: a failed describe must NOT replace the image with an "(unavailable)"
+  // stub — the original image is preserved so a vision-capable upstream can see it.
+  const imagePart = content.find((p) => p.type === "image_url");
+  assert.ok(imagePart, "original image_url part must be preserved on describe failure");
+  const unavailPart = content.find((p) => p.type === "text" && p.text?.includes("unavailable"));
+  assert.strictEqual(unavailPart, undefined);
+});
+
+test("VB-S03: logs warning when vision API fails (via combo mapping)", async () => {
+  shouldVisionFail = true;
+  let warningLogged = false;
+  const guardrail = createGuardrail({
+    deps: {
+      checkModelHasComboMapping: async (_model: string) => true,
+    },
+  });
+
+  const payload = createPayload({
+    model: "openai/gpt-4o",
+    messages: [
+      {
+        role: "user",
+        content: [
+          {
+            type: "image_url",
+            image_url: { url: "https://example.com/image.png" },
+          },
+        ],
+      },
+    ],
+  });
+
+  const mockLog = {
+    warn: (_tag: string, msg: string) => {
+      if (msg.includes("Failed to get description")) {
+        warningLogged = true;
+      }
+    },
+  };
+
+  await guardrail.preCall(
+    payload,
+    createContext({
+      model: "openai/gpt-4o",
+      log: mockLog as GuardrailContext["log"],
+    })
+  );
+
+  assert.strictEqual(warningLogged, true);
+});
+
+// ── VB-S09: Image count limit (via combo mapping) ──────────────────────────
+
+test("VB-S09: respects maxImages setting in combo mapping path", async () => {
   mockSettings.visionBridgeMaxImages = 2;
-  const guardrail = createGuardrail();
+  const guardrail = createGuardrail({
+    deps: {
+      checkModelHasComboMapping: async (_model: string) => true,
+    },
+  });
 
   const images = Array.from({ length: 5 }, (_, i) => ({
     type: "image_url" as const,
@@ -451,7 +528,7 @@ test("VB-S09: respects maxImages setting", async () => {
   }));
 
   const payload = createPayload({
-    model: "minimax/minimax-01",
+    model: "openai/gpt-4o",
     messages: [
       {
         role: "user",
@@ -460,16 +537,15 @@ test("VB-S09: respects maxImages setting", async () => {
     ],
   });
 
-  await guardrail.preCall(payload, createContext({ model: "minimax/minimax-01" }));
+  await guardrail.preCall(payload, createContext({ model: "openai/gpt-4o" }));
 
   // Should only call vision API for 2 images (maxImages=2)
   assert.strictEqual(visionCallCount, 2);
 });
 
-// ── VB-S10: Meta information returned ───────────────────────────────────────
+// ── VB-S10: Meta information returned (reroute path) ───────────────────────
 
-test("VB-S10: returns meta with imagesProcessed count", async () => {
-  mockVisionResponse = "A test description";
+test("VB-S10: returns meta with reroute info for individual non-vision model", async () => {
   const guardrail = createGuardrail();
 
   const payload = createPayload({
@@ -498,11 +574,57 @@ test("VB-S10: returns meta with imagesProcessed count", async () => {
   assert.ok(typeof result.meta === "object");
 
   const meta = result.meta as Record<string, unknown>;
-  assert.strictEqual(meta.imagesProcessed, 2);
-  assert.ok(Array.isArray(meta.descriptions));
-  assert.strictEqual((meta.descriptions as string[]).length, 2);
-  assert.strictEqual(typeof meta.processingTimeMs, "number");
-  assert.strictEqual(meta.visionModel, "openai/gpt-4o-mini");
+  assert.strictEqual(meta.rerouted, true);
+  assert.strictEqual(meta.fromModel, "minimax/minimax-01");
+  assert.ok(
+    typeof meta.toModel === "string" && meta.toModel.length > 0,
+    "toModel should be a non-empty string"
+  );
+  assert.notStrictEqual(meta.toModel, "minimax/minimax-01", "toModel should differ from original");
+  assert.strictEqual(meta.imagesKept, 2);
+});
+
+// ── VB-S01b: Describe images via combo mapping path ────────────────────────
+
+test("VB-S01b: describes images when combo mapping forces process path", async () => {
+  mockVisionResponse = "A cat sitting on a windowsill";
+  const guardrail = createGuardrail({
+    deps: {
+      checkModelHasComboMapping: async (_model: string) => true,
+    },
+  });
+
+  const payload = createPayload({
+    model: "openai/gpt-4o",
+    messages: [
+      {
+        role: "user",
+        content: [
+          { type: "text", text: "What is this?" },
+          {
+            type: "image_url",
+            image_url: { url: "https://example.com/cat.png" },
+          },
+        ],
+      },
+    ],
+  });
+
+  const result = await guardrail.preCall(payload, createContext({ model: "openai/gpt-4o" }));
+
+  assert.strictEqual(result.block, false);
+  assert.ok(result.modifiedPayload);
+
+  const modified = result.modifiedPayload as { messages: Array<{ content: unknown[] }> };
+  const content = modified.messages[0].content as Array<{ type: string; text?: string }>;
+
+  // Images should be replaced with text descriptions (combo path)
+  const imagePart = content.find((p) => p.type === "image_url");
+  assert.strictEqual(imagePart, undefined, "image should be replaced by description");
+
+  const descriptionPart = content.find((p) => p.type === "text" && p.text?.includes("cat"));
+  assert.ok(descriptionPart, "description should be present");
+  assert.ok(visionCallCount > 0, "vision API should have been called for description");
 });
 
 // ── VB-S11: Combo mapping forces vision processing despite vision-capable model ──
@@ -568,7 +690,7 @@ test("VB-S11b: passthroughs when vision-capable model has NO combo mapping", asy
 
   const result = await guardrail.preCall(payload, createContext({ model: "openai/gpt-4o" }));
 
-  // Vision bridge should skip (passthrough) since model supports vision and no combo mapping
+  // Vision bridge should skip (passthrough) since model supports vision + no combo mapping
   assert.strictEqual(result.block, false);
   assert.strictEqual(result.modifiedPayload, undefined);
   assert.strictEqual(visionCallCount, 0);
diff --git a/tests/unit/guide-settings-route.test.ts b/tests/unit/guide-settings-route.test.ts
index 75960c2938..b6648d2d79 100644
--- a/tests/unit/guide-settings-route.test.ts
+++ b/tests/unit/guide-settings-route.test.ts
@@ -224,9 +224,9 @@ test("guide-settings POST preserves existing OpenCode config fields while only u
     body: JSON.stringify({
       baseUrl: "http://my-omni/v1",
       apiKey: "sk-123",
-      models: ["cx/gpt-5.4", "opencode-go/kimi-k2.6"],
+      models: ["cx/gpt-5.6-sol", "opencode-go/kimi-k2.6"],
       modelLabels: {
-        "cx/gpt-5.4": "GPT-5.4",
+        "cx/gpt-5.6-sol": "GPT-5.6 Sol",
         "opencode-go/kimi-k2.6": "Kimi K2.6",
       },
     }),
@@ -252,7 +252,7 @@ test("guide-settings POST preserves existing OpenCode config fields while only u
   assert.equal(content.provider.omniroute.options.baseURL, "http://my-omni/v1");
   assert.ok(content.provider.omniroute.options.apiKey.startsWith("sk-"));
   assert.deepEqual(content.provider.omniroute.models, {
-    "cx/gpt-5.4": { name: "GPT-5.4" },
+    "cx/gpt-5.6-sol": { name: "GPT-5.6 Sol" },
     "opencode-go/kimi-k2.6": { name: "Kimi K2.6" },
   });
 });
diff --git a/tests/unit/head-request-closes-6400.test.ts b/tests/unit/head-request-closes-6400.test.ts
new file mode 100644
index 0000000000..f10180911c
--- /dev/null
+++ b/tests/unit/head-request-closes-6400.test.ts
@@ -0,0 +1,237 @@
+import { describe, it, after } from "node:test";
+import assert from "node:assert/strict";
+import http from "node:http";
+import { EventEmitter } from "node:events";
+import { createRequire } from "node:module";
+import type { AddressInfo } from "node:net";
+
+const require = createRequire(import.meta.url);
+const headResponseGuard = require("../../scripts/dev/head-response-guard.cjs") as {
+  wrapRequestListenerWithHeadResponseGuard: (
+    listener: (req: http.IncomingMessage, res: http.ServerResponse) => unknown
+  ) => (req: http.IncomingMessage, res: http.ServerResponse) => unknown;
+  suppressBodyAndForceClose: (res: http.ServerResponse) => void;
+};
+
+const { wrapRequestListenerWithHeadResponseGuard, suppressBodyAndForceClose } = headResponseGuard;
+
+/**
+ * Regression test for issue #6400 — "HEAD requests hang ~6s — response never
+ * closes after headers", reported across EVERY route (valid, unknown, authed,
+ * unauthed).
+ *
+ * Root cause: Next.js 16's App Router route-handler pipeline
+ * (`next/dist/server/send-response.js`) correctly skips piping a `Response`
+ * body for HEAD requests, but its *page*-rendering pipeline
+ * (`next/dist/server/pipe-readable.js` -> `pipeToNodeResponse`, used for every
+ * app-router page/layout render — including the `not-found` boundary that
+ * unmatched paths fall through to) has NO such check: it always streams the
+ * full rendered body to the HTTP response regardless of method. Combined with
+ * Node's default keep-alive framing this leaves clients (observed on
+ * Windows/curl) unsure whether the — implicitly bodyless — HEAD response has
+ * actually finished.
+ *
+ * Fix: `scripts/dev/head-response-guard.cjs` wraps the Node request listener
+ * (wired into both the dev/start custom server `scripts/dev/run-next.mjs` and
+ * the packaged standalone server `scripts/dev/standalone-server-ws.mjs`) so
+ * that, for every inbound HEAD request, any body bytes the inner handler
+ * tries to write are discarded (never blocking on backpressure) and the
+ * connection is force-closed (`Connection: close`) as soon as `.end()` is
+ * called — independent of route existence or auth state.
+ */
+describe("issue #6400 — HEAD response guard (unit)", () => {
+  function makeMockResponse() {
+    const emitter = new EventEmitter() as EventEmitter & {
+      headers: Record<string, string>;
+      ended: boolean;
+      writeCalls: unknown[][];
+      endCalls: unknown[][];
+      write: (...args: unknown[]) => boolean;
+      end: (...args: unknown[]) => unknown;
+      setHeader: (name: string, value: string) => void;
+    };
+    emitter.headers = {};
+    emitter.ended = false;
+    emitter.writeCalls = [];
+    emitter.endCalls = [];
+    emitter.setHeader = (name: string, value: string) => {
+      emitter.headers[name.toLowerCase()] = value;
+    };
+    emitter.write = (...args: unknown[]) => {
+      emitter.writeCalls.push(args);
+      return true;
+    };
+    emitter.end = (...args: unknown[]) => {
+      emitter.endCalls.push(args);
+      emitter.ended = true;
+      return emitter;
+    };
+    return emitter;
+  }
+
+  it("sets Connection: close on the response", () => {
+    const res = makeMockResponse();
+    suppressBodyAndForceClose(res as unknown as http.ServerResponse);
+    assert.equal(res.headers.connection, "close");
+  });
+
+  it("discards any body written via res.write() but still reports success (no backpressure stall)", () => {
+    const res = makeMockResponse();
+    const originalWrite = res.write;
+    suppressBodyAndForceClose(res as unknown as http.ServerResponse);
+
+    const ok = res.write("this body must never reach the socket");
+    assert.equal(ok, true, "write must report success so callers never block on a drain event");
+    assert.equal(
+      res.writeCalls.length,
+      0,
+      "the original write() must never be called — the body must be fully discarded"
+    );
+    assert.notEqual(res.write, originalWrite);
+  });
+
+  it("res.end() forwards to the original end with NO body argument, and is idempotent", () => {
+    const res = makeMockResponse();
+    suppressBodyAndForceClose(res as unknown as http.ServerResponse);
+
+    res.end("<html>this must be dropped</html>");
+    res.end("second call must be a no-op");
+
+    assert.equal(res.endCalls.length, 1, "end() must only forward to the original once");
+    assert.deepEqual(
+      res.endCalls[0],
+      [],
+      "the discarded body must never be forwarded to the real end()"
+    );
+    assert.equal(res.ended, true);
+  });
+
+  it("wrapRequestListenerWithHeadResponseGuard only guards HEAD requests, GET/POST pass through untouched", () => {
+    let receivedReq: { method?: string } | null = null;
+    let receivedRes: unknown = null;
+    const listener = (req: { method?: string }, res: unknown) => {
+      receivedReq = req;
+      receivedRes = res;
+    };
+    const guarded = wrapRequestListenerWithHeadResponseGuard(
+      listener as unknown as (req: http.IncomingMessage, res: http.ServerResponse) => unknown
+    );
+
+    const getRes = makeMockResponse();
+    guarded({ method: "GET" } as unknown as http.IncomingMessage, getRes as unknown as http.ServerResponse);
+    assert.equal(getRes.headers.connection, undefined, "GET must not be forced to close");
+
+    const headRes = makeMockResponse();
+    guarded(
+      { method: "HEAD" } as unknown as http.IncomingMessage,
+      headRes as unknown as http.ServerResponse
+    );
+    assert.equal(headRes.headers.connection, "close", "HEAD must be force-closed");
+
+    // Sanity: the inner listener was actually invoked in both cases (guard
+    // must not swallow the request — routing/auth/status-code logic still
+    // runs, only the body write path is intercepted).
+    assert.ok(receivedReq);
+    assert.ok(receivedRes);
+  });
+});
+
+/**
+ * End-to-end confirmation over a real TCP socket: a HEAD request through the
+ * guarded listener gets an empty body and a closed connection even when the
+ * underlying handler writes a large body synchronously (the shape that, on
+ * an un-guarded pipe, streams the full page/RSC payload for HEAD exactly as
+ * Next's `pipeToNodeResponse` does today).
+ */
+describe("issue #6400 — HEAD response guard (integration, real socket)", () => {
+  const servers: http.Server[] = [];
+
+  after(() => {
+    for (const server of servers) server.close();
+  });
+
+  function startGuardedServer(
+    handler: (req: http.IncomingMessage, res: http.ServerResponse) => void
+  ): Promise<{ port: number }> {
+    const server = http.createServer(wrapRequestListenerWithHeadResponseGuard(handler));
+    servers.push(server);
+    return new Promise((resolve) => {
+      server.listen(0, "127.0.0.1", () => resolve({ port: (server.address() as AddressInfo).port }));
+    });
+  }
+
+  function rawRequest(
+    port: number,
+    method: string
+  ): Promise<{ statusCode: number; headers: Record<string, string>; body: string }> {
+    return new Promise((resolvePromise, reject) => {
+      const req = http.request(
+        { host: "127.0.0.1", port, method, path: "/", headers: { Connection: "keep-alive" } },
+        (res) => {
+          const chunks: Buffer[] = [];
+          res.on("data", (chunk) => chunks.push(chunk));
+          res.on("end", () => {
+            resolvePromise({
+              statusCode: res.statusCode ?? 0,
+              headers: Object.fromEntries(
+                Object.entries(res.headers).map(([k, v]) => [k, String(v)])
+              ),
+              body: Buffer.concat(chunks).toString("utf8"),
+            });
+          });
+        }
+      );
+      req.on("error", reject);
+      req.end();
+    });
+  }
+
+  it("HEAD to a handler that writes a large body synchronously still returns an empty body + Connection: close", async () => {
+    const largeBody = "x".repeat(1_000_000);
+    const { port } = await startGuardedServer((req, res) => {
+      res.writeHead(200, { "Content-Type": "text/html" });
+      res.write(largeBody);
+      res.end();
+    });
+
+    const result = await rawRequest(port, "HEAD");
+
+    assert.equal(result.statusCode, 200);
+    assert.equal(result.body, "", "HEAD body must be empty per RFC 9110 §9.3.2");
+    assert.equal(
+      result.headers.connection,
+      "close",
+      "HEAD response must force Connection: close so the client never has to guess"
+    );
+  });
+
+  it("GET through the SAME guarded listener is unaffected (still streams the full body)", async () => {
+    const { port } = await startGuardedServer((req, res) => {
+      res.writeHead(200, { "Content-Type": "text/plain" });
+      res.end("hello world");
+    });
+
+    const result = await rawRequest(port, "GET");
+
+    assert.equal(result.statusCode, 200);
+    assert.equal(result.body, "hello world");
+    assert.notEqual(
+      result.headers.connection,
+      "close",
+      "GET requests must not be forced to close — only HEAD is guarded"
+    );
+  });
+
+  it("HEAD to a 404/unknown-route-shaped handler also closes immediately with an empty body", async () => {
+    const { port } = await startGuardedServer((req, res) => {
+      res.writeHead(404, { "Content-Type": "text/html" });
+      res.end("<html>not found</html>");
+    });
+
+    const result = await rawRequest(port, "HEAD");
+
+    assert.equal(result.statusCode, 404);
+    assert.equal(result.body, "");
+    assert.equal(result.headers.connection, "close");
+  });
+});
diff --git a/tests/unit/head-request-v1-models-6400.test.ts b/tests/unit/head-request-v1-models-6400.test.ts
new file mode 100644
index 0000000000..b8481cb1c1
--- /dev/null
+++ b/tests/unit/head-request-v1-models-6400.test.ts
@@ -0,0 +1,48 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+
+import * as modelsRoute from "../../src/app/api/v1/models/route";
+
+/**
+ * Regression test for issue #6400.
+ *
+ * Before the fix, `src/app/api/v1/models/route.ts` exported only `OPTIONS` and
+ * `GET`. Next.js 16 App Router auto-derives `HEAD` from `GET` when no explicit
+ * handler exists, and the derived `HEAD` streams the full `GET` body (which
+ * the client discards). Because `getUnifiedModelsResponse()` enumerates 200+
+ * providers on-demand, the body stream stayed open ~6s — clients issuing HEAD
+ * as an availability probe (OpenAI SDK, openai-python, httpx, gateway
+ * health-checkers) stalled until their timeout fired.
+ *
+ * RFC 9110 §9.3.2: HEAD MUST close after the headers.
+ *
+ * Fix: explicit `HEAD` handler that returns `{ status: 200, body: null }`, and
+ * `OPTIONS` advertises `HEAD` in `Access-Control-Allow-Methods`.
+ */
+describe("issue #6400 — HEAD /v1/models returns immediately", () => {
+  it("exports an explicit HEAD handler", () => {
+    assert.equal(
+      typeof (modelsRoute as { HEAD?: unknown }).HEAD,
+      "function",
+      "HEAD export missing — Next.js will auto-derive from GET and stream the body"
+    );
+  });
+
+  it("HEAD returns 200 with a null body (no streaming)", async () => {
+    const head = (modelsRoute as unknown as {
+      HEAD: () => Promise<Response>;
+    }).HEAD;
+    const response = await head();
+    assert.equal(response.status, 200);
+    assert.equal(response.body, null, "HEAD body must be null per RFC 9110 §9.3.2");
+  });
+
+  it("OPTIONS advertises HEAD in Access-Control-Allow-Methods", async () => {
+    const response = await modelsRoute.OPTIONS();
+    const methods = response.headers.get("Access-Control-Allow-Methods") ?? "";
+    assert.ok(
+      /\bHEAD\b/.test(methods),
+      `expected HEAD in Access-Control-Allow-Methods, got: ${methods}`
+    );
+  });
+});
diff --git a/tests/unit/headroom-codex-quota-snapshot-6379.test.ts b/tests/unit/headroom-codex-quota-snapshot-6379.test.ts
new file mode 100644
index 0000000000..6472496b15
--- /dev/null
+++ b/tests/unit/headroom-codex-quota-snapshot-6379.test.ts
@@ -0,0 +1,137 @@
+/**
+ * tests/unit/headroom-codex-quota-snapshot-6379.test.ts
+ *
+ * Regression guard for #6379: headroom combo routing did not always select
+ * the Codex account with the most free quota.
+ *
+ * Root cause: `orderTargetsByHeadroom` (open-sse/services/combo/quotaStrategies.ts)
+ * expands targets into per-connection candidates via
+ * `expandTargetsByQuotaAwareConnections` — which ALSO builds a `connectionById`
+ * map of the loaded DB connection snapshots (decrypted credentials included) —
+ * but discarded that map and called `getSaturation(connectionId, provider, dim)`
+ * with no connection. For Codex, `fetchCodexSaturation` forwards straight to
+ * `fetchCodexQuota(connectionId, connection)`, which needs `connection` (or a
+ * prior `registerCodexConnection()` call) to read `accessToken`. Headroom
+ * ranking runs BEFORE any request is dispatched for a candidate, so no prior
+ * registration exists — `fetchCodexQuota` returned null for EVERY Codex
+ * candidate, saturation failed open to 0 across the board, and headroom could
+ * not tell accounts apart: the original combo order won regardless of which
+ * account actually had more free quota.
+ *
+ * This test seeds two real Codex connections in a throwaway SQLite DB (one
+ * heavily used, one nearly untouched) and a fake upstream `fetch` that reports
+ * different usage per access token. It runs the REAL `orderTargetsByHeadroom`
+ * end-to-end (through the real `expandTargetsByQuotaAwareConnections` +
+ * `getSaturation` + `fetchCodexQuota`, no stub of the headroom fetcher seam)
+ * with the busier account listed FIRST in the combo. Only the fix (threading
+ * `connectionById` into `getSaturation`) lets the freer account rank first.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-headroom-codex-6379-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+// Register the real "codex" quota fetcher (normally done once at server
+// startup by src/sse/handlers/chat.ts) so getQuotaFetcher("codex") is truthy
+// and expandTargetsByQuotaAwareConnections actually loads connections from
+// the DB instead of short-circuiting to [].
+const codexFetcher = await import("../../open-sse/services/codexQuotaFetcher.ts");
+codexFetcher.registerCodexQuotaFetcher();
+const { orderTargetsByHeadroom } = await import(
+  "../../open-sse/services/combo/quotaStrategies.ts"
+);
+const { _clearSaturationCache } = await import("../../src/lib/quota/saturationSignals.ts");
+
+async function resetStorage() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+  _clearSaturationCache();
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(async () => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+const silentLog = { warn: () => {} };
+
+function target(connectionId: string) {
+  return {
+    kind: "model" as const,
+    stepId: connectionId,
+    executionKey: `key-${connectionId}`,
+    modelStr: "codex/gpt-5-codex",
+    provider: "codex",
+    providerId: "codex",
+    connectionId,
+    weight: 1,
+    label: null,
+  };
+}
+
+/** Codex /wham/usage response with a given primary/secondary used_percent. */
+function usageResponse(primaryUsedPercent: number, secondaryUsedPercent: number) {
+  return {
+    rate_limit: {
+      primary_window: { used_percent: primaryUsedPercent },
+      secondary_window: { used_percent: secondaryUsedPercent },
+    },
+  };
+}
+
+test("orderTargetsByHeadroom (codex): ranks the account with more free quota first, even when it is second in the combo", async () => {
+  // "busy" is listed FIRST in the combo but is 90% saturated (5h).
+  // "free" is listed SECOND but is only 5% saturated (5h).
+  const busyConn = await providersDb.createProviderConnection({
+    provider: "codex",
+    authType: "oauth",
+    email: "busy@example.com",
+    accessToken: "tok-busy",
+  });
+  const freeConn = await providersDb.createProviderConnection({
+    provider: "codex",
+    authType: "oauth",
+    email: "free@example.com",
+    accessToken: "tok-free",
+  });
+
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = (async (_url: string, init?: RequestInit) => {
+    const headers = init?.headers as Record<string, string> | undefined;
+    const auth = headers?.["Authorization"] ?? "";
+    const body =
+      auth === "Bearer tok-busy" ? usageResponse(90, 10) : usageResponse(5, 5);
+    return new Response(JSON.stringify(body), { status: 200 });
+  }) as typeof fetch;
+
+  try {
+    const ordered = await orderTargetsByHeadroom(
+      [target(busyConn.id), target(freeConn.id)],
+      "combo-codex-headroom",
+      silentLog
+    );
+
+    assert.deepEqual(
+      ordered.map((t) => t.connectionId),
+      [freeConn.id, busyConn.id],
+      "the account with more free quota (freeConn) must be ranked first, " +
+        "even though busyConn is first in the combo definition — this only " +
+        "holds when the connection snapshot (with accessToken) reaches " +
+        "fetchCodexQuota via getSaturation"
+    );
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
diff --git a/tests/unit/i18n-hardcoded-pt-dashboard-6761.test.ts b/tests/unit/i18n-hardcoded-pt-dashboard-6761.test.ts
new file mode 100644
index 0000000000..75d723d047
--- /dev/null
+++ b/tests/unit/i18n-hardcoded-pt-dashboard-6761.test.ts
@@ -0,0 +1,44 @@
+// ABOUTME: Guard test — the 4 dashboard files translated in #6761/#6768 must stay free of
+// ABOUTME: hardcoded Portuguese UI strings (regression guard for the i18n cleanup).
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+
+const repoRoot = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+
+// Files cleaned of hardcoded Portuguese in #6769 (issues #6761, #6768).
+const FILES = [
+  "src/app/(dashboard)/dashboard/compression/studio/CompareView.tsx",
+  "src/app/(dashboard)/dashboard/compression/studio/PlaygroundInput.tsx",
+  "src/app/(dashboard)/dashboard/context/combos/CompressionHub.tsx",
+  "src/app/(dashboard)/dashboard/translator/components/advanced/CompressionPreviewAccordion.tsx",
+];
+
+// Portuguese-only words that appeared as hardcoded UI copy before the fix.
+// Distinct from English + from shared tech terms, so a hit means real PT regression.
+const PT_MARKERS = [
+  "Retenção",
+  "Fidelidade",
+  "Compressão",
+  "Proteger conteúdo",
+  "delegada ao provedor",
+  "Deixa o próprio provedor",
+  "Hoje disponível apenas",
+  "Técnicas:",
+  "Não afeta",
+  "reescrevemos",
+];
+
+for (const rel of FILES) {
+  test(`no hardcoded Portuguese in ${rel}`, () => {
+    const src = readFileSync(join(repoRoot, rel), "utf8");
+    const hits = PT_MARKERS.filter((m) => src.includes(m));
+    assert.deepEqual(
+      hits,
+      [],
+      `Hardcoded Portuguese found in ${rel}: ${hits.join(", ")} — translate to English or route through t().`
+    );
+  });
+}
diff --git a/tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts b/tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts
new file mode 100644
index 0000000000..57041bd9a1
--- /dev/null
+++ b/tests/unit/i18n-provider-visibility-filter-keys-6694.test.ts
@@ -0,0 +1,66 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readdirSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+/**
+ * Regression guard for #6694.
+ *
+ * On the provider detail page the visibility + free/paid filter row
+ * (`providers.filterVisible/filterHidden/freeFilterAll/freeFilterFreeOnly/
+ * freeFilterPaidOnly/showVisibleOnly/showHiddenOnly/filterByVisibility/
+ * hideAllModels`) rendered as the literal `__MISSING__:<english>` sentinel in
+ * 15 locales (including pt-BR) because those keys were mirrored by
+ * scripts/i18n/sync-ui-keys.mjs but never translated.
+ *
+ * This is a DISJOINT key set from #6290 (filterAll/filterActive/filterError/
+ * filterBanned/filterCreditsExhausted, guarded by
+ * tests/unit/i18n-provider-filter-keys-6290.test.ts).
+ */
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const MESSAGES_DIR = path.resolve(__dirname, "..", "..", "src", "i18n", "messages");
+const PLACEHOLDER_PREFIX = "__MISSING__:";
+const FILTER_KEYS = [
+  "filterVisible",
+  "filterHidden",
+  "freeFilterAll",
+  "freeFilterFreeOnly",
+  "freeFilterPaidOnly",
+  "showVisibleOnly",
+  "showHiddenOnly",
+  "filterByVisibility",
+  "hideAllModels",
+] as const;
+
+function localeFiles(): string[] {
+  return readdirSync(MESSAGES_DIR)
+    .filter((f) => f.endsWith(".json"))
+    .sort();
+}
+
+test("every shipped locale has real (non-__MISSING__) providers visibility filter labels (#6694)", () => {
+  const offenders: string[] = [];
+
+  for (const file of localeFiles()) {
+    const locale = file.replace(/\.json$/, "");
+    const json = JSON.parse(readFileSync(path.join(MESSAGES_DIR, file), "utf8"));
+    const providers = json.providers ?? {};
+
+    for (const key of FILTER_KEYS) {
+      const value = providers[key];
+      // Absent is harmless here (t.has() is false -> clean English fallback fires).
+      if (value === undefined || value === null) continue;
+      if (typeof value === "string" && value.startsWith(PLACEHOLDER_PREFIX)) {
+        offenders.push(`${locale}: providers.${key} is sentinel "${value}"`);
+      }
+    }
+  }
+
+  assert.equal(
+    offenders.length,
+    0,
+    `Untranslated provider visibility filter labels (#6694 regression):\n${offenders.join("\n")}`
+  );
+});
diff --git a/tests/unit/i18n-pt-br.test.ts b/tests/unit/i18n-pt-br.test.ts
index 7ce9ddc92c..7f38f96603 100644
--- a/tests/unit/i18n-pt-br.test.ts
+++ b/tests/unit/i18n-pt-br.test.ts
@@ -3,6 +3,20 @@ import assert from "node:assert";
 import fs from "node:fs";
 import path from "node:path";
 
+function flatten(obj: Record<string, unknown>, prefix = ""): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const k of Object.keys(obj)) {
+    const key = prefix ? `${prefix}.${k}` : k;
+    const v = obj[k];
+    if (v && typeof v === "object" && !Array.isArray(v)) {
+      Object.assign(out, flatten(v as Record<string, unknown>, key));
+    } else {
+      out[key] = v;
+    }
+  }
+  return out;
+}
+
 describe("i18n pt-BR integrity", () => {
   it("should be a valid JSON file", () => {
     const ptPath = path.resolve("src/i18n/messages/pt-BR.json");
@@ -23,4 +37,29 @@ describe("i18n pt-BR integrity", () => {
     assert.ok(json.cache.loadingCacheAria);
     assert.ok(json.analytics.usageAnalyticsTitle);
   });
+
+  // Regression guard for #6695: en.json gained 194 keys that were never
+  // mirrored into pt-BR.json (i18n:sync-ui was not re-run), and the
+  // i18n-ui-coverage CI gate is a percentage threshold (80%) so it stayed
+  // green at 93.8% coverage despite the gap. This asserts full key parity
+  // so a future drift fails loudly instead of silently degrading coverage.
+  it("should contain every key present in en.json (no drift, #6695)", () => {
+    const enPath = path.resolve("src/i18n/messages/en.json");
+    const ptPath = path.resolve("src/i18n/messages/pt-BR.json");
+    const en = JSON.parse(fs.readFileSync(enPath, "utf8"));
+    const pt = JSON.parse(fs.readFileSync(ptPath, "utf8"));
+
+    const enFlat = flatten(en);
+    const ptFlat = flatten(pt);
+
+    const missing = Object.keys(enFlat).filter((k) => !(k in ptFlat));
+
+    assert.strictEqual(
+      missing.length,
+      0,
+      `pt-BR.json is missing ${missing.length} keys present in en.json. Sample: ${missing
+        .slice(0, 10)
+        .join(", ")}`
+    );
+  });
 });
diff --git a/tests/unit/idempotency-fusion-collision.test.ts b/tests/unit/idempotency-fusion-collision.test.ts
new file mode 100644
index 0000000000..1285b4a6a7
--- /dev/null
+++ b/tests/unit/idempotency-fusion-collision.test.ts
@@ -0,0 +1,99 @@
+/**
+ * Regression: fusion judge must not replay a panel member's cached response.
+ *
+ * The idempotency layer keys on the client's `Idempotency-Key` / `x-request-id`
+ * header with a 5s replay window. Fusion's internal panel + judge sub-requests
+ * re-enter chatCore SHARING the client's headers, so they all derived the SAME
+ * key: a panel answer saved under the key, and ~1ms later the judge's check hit
+ * it — the client received a panel member's answer (labeled with the judge's
+ * meta headers) instead of the judge synthesis. Observed live on
+ * "nexa/conversation-fusion" (body = Gemini panel answer verbatim,
+ * X-OmniRoute-Idempotent: true, judge "latency" ~0ms).
+ *
+ * Fix: namespace the composed key by target provider/model AND a digest of the
+ * request messages. Panel members differ by model; the judge differs by model
+ * AND by messages (it appends the judge directive turn), so sub-requests can
+ * never collide — while a genuine client retry (same key, same model, same
+ * body) still replays.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { composeIdempotencyKey } from "../../open-sse/handlers/chatCore/idempotency.ts";
+
+const MSGS = [{ role: "user", content: "Client asks about our PST coverage" }];
+const JUDGE_MSGS = [...MSGS, { role: "user", content: "You are the judge. Synthesize: ..." }];
+
+test("no raw header -> null (idempotency disabled for the request)", () => {
+  assert.equal(
+    composeIdempotencyKey({
+      rawKey: null,
+      provider: "cc",
+      model: "claude-opus-4-8",
+      messages: MSGS,
+    }),
+    null
+  );
+});
+
+test("panel members (same raw key, same body, different models) get DIFFERENT keys", () => {
+  const base = { rawKey: "req-1", messages: MSGS };
+  const opus = composeIdempotencyKey({ ...base, provider: "cc", model: "claude-opus-4-6" });
+  const gemini = composeIdempotencyKey({
+    ...base,
+    provider: "antigravity",
+    model: "gemini-3.1-pro-high",
+  });
+  const gpt = composeIdempotencyKey({ ...base, provider: "cx", model: "gpt-5.5-high" });
+  assert.ok(opus && gemini && gpt);
+  assert.notEqual(opus, gemini);
+  assert.notEqual(gemini, gpt);
+  assert.notEqual(opus, gpt);
+});
+
+test("judge (same raw key, different model AND extra judge turn) never collides with a panel member", () => {
+  const panel = composeIdempotencyKey({
+    rawKey: "req-1",
+    provider: "antigravity",
+    model: "gemini-3.1-pro-high",
+    messages: MSGS,
+  });
+  const judge = composeIdempotencyKey({
+    rawKey: "req-1",
+    provider: "cc",
+    model: "claude-opus-4-8",
+    messages: JUDGE_MSGS,
+  });
+  assert.notEqual(judge, panel);
+});
+
+test("judge that reuses a panel member's model still differs (messages digest separates them)", () => {
+  const panel = composeIdempotencyKey({
+    rawKey: "req-1",
+    provider: "cc",
+    model: "claude-opus-4-8",
+    messages: MSGS,
+  });
+  const judge = composeIdempotencyKey({
+    rawKey: "req-1",
+    provider: "cc",
+    model: "claude-opus-4-8",
+    messages: JUDGE_MSGS,
+  });
+  assert.notEqual(judge, panel);
+});
+
+test("genuine client retry (same key + model + body) -> SAME key (replay semantics preserved)", () => {
+  const a = composeIdempotencyKey({
+    rawKey: "retry-9",
+    provider: "cc",
+    model: "claude-opus-4-8",
+    messages: MSGS,
+  });
+  const b = composeIdempotencyKey({
+    rawKey: "retry-9",
+    provider: "cc",
+    model: "claude-opus-4-8",
+    messages: MSGS,
+  });
+  assert.equal(a, b);
+});
diff --git a/tests/unit/image-generation-handler.test.ts b/tests/unit/image-generation-handler.test.ts
index 0fcc9e5d13..348cd83817 100644
--- a/tests/unit/image-generation-handler.test.ts
+++ b/tests/unit/image-generation-handler.test.ts
@@ -1814,7 +1814,7 @@ test("handleImageGeneration routes codex image requests through /responses with
   try {
     const result = await handleImageGeneration({
       body: {
-        model: "codex/gpt-5.4",
+        model: "codex/gpt-5.6-sol",
         prompt: "Draw a happy red kitten",
         response_format: "b64_json",
       },
@@ -1829,7 +1829,7 @@ test("handleImageGeneration routes codex image requests through /responses with
     assert.equal(captured.url, "https://chatgpt.com/backend-api/codex/responses");
     assert.equal(captured.headers.Authorization, "Bearer codex-token");
     assert.equal(captured.headers["chatgpt-account-id"], "acct-123");
-    assert.equal(captured.body.model, "gpt-5.4");
+    assert.equal(captured.body.model, "gpt-5.6-sol");
     assert.equal(captured.body.stream, true);
     assert.equal(captured.body.store, false);
     assert.deepEqual(captured.body.tools, [{ type: "image_generation", output_format: "png" }]);
@@ -1853,7 +1853,7 @@ test("handleImageGeneration (codex) returns a data URL when response_format is n
 
   try {
     const result = await handleImageGeneration({
-      body: { model: "cx/gpt-5.4", prompt: "kitten" },
+      body: { model: "cx/gpt-5.6-sol", prompt: "kitten" },
       credentials: { accessToken: "codex-token" },
       log: null,
     });
@@ -1895,7 +1895,7 @@ test("handleImageGeneration (codex) fans out n>1 requests in parallel", async ()
   try {
     pending = handleImageGeneration({
       body: {
-        model: "codex/gpt-5.4",
+        model: "codex/gpt-5.6-sol",
         prompt: "kitten",
         n: 2,
         response_format: "b64_json",
@@ -1937,7 +1937,7 @@ test("handleImageGeneration (codex) surfaces an error when no image_generation_c
 
   try {
     const result = await handleImageGeneration({
-      body: { model: "codex/gpt-5.4", prompt: "kitten" },
+      body: { model: "codex/gpt-5.6-sol", prompt: "kitten" },
       credentials: { accessToken: "codex-token" },
       log: null,
     });
@@ -1956,7 +1956,7 @@ test("handleImageGeneration (codex) propagates upstream HTTP errors", async () =
 
   try {
     const result = await handleImageGeneration({
-      body: { model: "codex/gpt-5.4", prompt: "kitten" },
+      body: { model: "codex/gpt-5.6-sol", prompt: "kitten" },
       credentials: { accessToken: "codex-token" },
       log: null,
     });
@@ -1982,7 +1982,7 @@ test("handleImageGeneration (codex) forwards size and maps GPT-Image quality to
   try {
     await handleImageGeneration({
       body: {
-        model: "codex/gpt-5.4",
+        model: "codex/gpt-5.6-sol",
         prompt: "kitten",
         size: "1024x1792",
         quality: "hd",
@@ -2000,14 +2000,14 @@ test("handleImageGeneration (codex) forwards size and maps GPT-Image quality to
     ]);
 
     await handleImageGeneration({
-      body: { model: "codex/gpt-5.4", prompt: "kitten", quality: "standard" },
+      body: { model: "codex/gpt-5.6-sol", prompt: "kitten", quality: "standard" },
       credentials: { accessToken: "codex-token" },
       log: null,
     });
     assert.equal(captured.tools[0].quality, "medium");
 
     await handleImageGeneration({
-      body: { model: "codex/gpt-5.4", prompt: "kitten" },
+      body: { model: "codex/gpt-5.6-sol", prompt: "kitten" },
       credentials: { accessToken: "codex-token" },
       log: null,
     });
diff --git a/tests/unit/image-generation-route.test.ts b/tests/unit/image-generation-route.test.ts
index b00c159255..4cd99aa0e5 100644
--- a/tests/unit/image-generation-route.test.ts
+++ b/tests/unit/image-generation-route.test.ts
@@ -69,7 +69,7 @@ test("v1 image models GET exposes image-only modalities for credential-backed im
   assert.deepEqual((byId.get("stability-ai/fast") as any).input_modalities, ["image"]);
 });
 
-test("v1 image models GET hides providers without active credentials", async () => {
+test("v1 image models GET exposes current Codex image models and hides inactive providers", async () => {
   await seedConnection("codex", { apiKey: "codex-key" });
 
   const response = await imageRoute.GET();
@@ -77,7 +77,11 @@ test("v1 image models GET hides providers without active credentials", async ()
   const ids = body.data.map((item) => item.id);
 
   assert.equal(response.status, 200);
-  assert.ok(ids.includes("codex/gpt-5.5"));
+  assert.deepEqual(
+    ids.filter((id) => id.startsWith("codex/")),
+    ["codex/gpt-5.6-sol", "codex/gpt-5.6-terra", "codex/gpt-5.6-luna"]
+  );
+  assert.ok(!ids.includes("codex/gpt-5.5"));
   assert.ok(!ids.includes("openai/gpt-image-2"));
   assert.ok(!ids.some((id: string) => id.startsWith("xai/")));
 });
@@ -147,7 +151,7 @@ test("v1 image edit POST enforces disabled API key policy", async () => {
 
   const formData = new FormData();
   formData.set("prompt", "make the background lighter");
-  formData.set("model", "cgpt-web/gpt-5.3-instant");
+  formData.set("model", "cgpt-web/gpt-5.5");
   formData.set("image", new File([new Uint8Array([1, 2, 3])], "source.png", { type: "image/png" }));
 
   const response = await imageEditRoute.POST(
diff --git a/tests/unit/image-model-not-in-chat-catalog-6457.test.ts b/tests/unit/image-model-not-in-chat-catalog-6457.test.ts
new file mode 100644
index 0000000000..cbd9b2033e
--- /dev/null
+++ b/tests/unit/image-model-not-in-chat-catalog-6457.test.ts
@@ -0,0 +1,102 @@
+// Regression test for #6457 — huggingface/stabilityai/stable-diffusion-xl-base-1.0
+// (an image/diffusion model) was listed as a CHAT model in GET /v1/models, so firing
+// POST /v1/chat/completions with it hit the upstream and returned a raw HuggingFace
+// "[400] The requested model '...' is not a chat model." error.
+//
+// Root cause: the synced-provider-models loop in catalog.ts (fed by live discovery —
+// e.g. HuggingFace's own `/v1/models`) defaults a model's `endpoints` to `["chat"]`
+// whenever the upstream discovery payload carries no modality/endpoint info, which is
+// exactly what HuggingFace's live catalog returns for image models. That produced a
+// second, bogus chat-typed entry for the SAME id already correctly listed with
+// `type: "image"` by the imageRegistry loop — and catalogDedupe.ts keys on
+// (id, type, subtype), so the two distinct-`type` entries both survived.
+//
+// Fix: skip a synced model in the chat-catalog loop when it is already a registered
+// image model for that exact provider (open-sse/config/imageRegistry.ts
+// isRegisteredImageModel()) — the imageRegistry loop still adds the correctly-typed
+// `type: "image"` entry.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-image-chat-6457-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "catalog-test-secret-6457";
+
+const core = await import("../../src/lib/db/core.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const modelsDb = await import("../../src/lib/db/models.ts");
+const v1ModelsCatalog = await import("../../src/app/api/v1/models/catalog.ts");
+
+async function resetStorage() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(async () => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+async function seedHuggingFaceConnection() {
+  return providersDb.createProviderConnection({
+    provider: "huggingface",
+    authType: "apikey",
+    name: `huggingface-${Math.random().toString(16).slice(2, 8)}`,
+    apiKey: "hf-key",
+    isActive: true,
+    testStatus: "active",
+  });
+}
+
+test("#6457 image/diffusion model discovered via live sync is NOT listed as a chat model", async () => {
+  const connection = await seedHuggingFaceConnection();
+
+  // Simulate what HuggingFace's live `/v1/models` discovery persists for an
+  // image/diffusion model: no supportedEndpoints/modality info at all — the exact
+  // upstream shape that made the synced-models loop default to `["chat"]`.
+  await modelsDb.replaceSyncedAvailableModelsForConnection("huggingface", connection.id, [
+    { id: "stabilityai/stable-diffusion-xl-base-1.0", name: "Stable Diffusion XL (HF)" },
+    { id: "meta-llama/llama-3.1-8b-instruct", name: "Llama 3.1 8B" },
+  ]);
+
+  const response = await v1ModelsCatalog.getUnifiedModelsResponse(
+    new Request("http://localhost/api/v1/models")
+  );
+  assert.equal(response.status, 200);
+
+  const body = (await response.json()) as {
+    data: Array<{ id: string; type?: string }>;
+  };
+
+  const imageModelEntries = body.data.filter((m) =>
+    m.id.includes("stabilityai/stable-diffusion-xl-base-1.0")
+  );
+
+  assert.ok(imageModelEntries.length > 0, "the image model must still be listed somewhere");
+  for (const entry of imageModelEntries) {
+    assert.equal(
+      entry.type,
+      "image",
+      `every listing of the diffusion model must be type:"image", got ${JSON.stringify(entry)}`
+    );
+  }
+
+  // A real chat model synced alongside it must still be listed as chat (no `type`,
+  // per the OpenAI-compatible convention used throughout this catalog).
+  const chatModelEntries = body.data.filter((m) =>
+    m.id.includes("meta-llama/llama-3.1-8b-instruct")
+  );
+  assert.ok(chatModelEntries.length > 0, "the real chat model must still be listed");
+  for (const entry of chatModelEntries) {
+    assert.equal(entry.type, undefined, "the real chat model must not carry a non-chat type");
+  }
+});
diff --git a/tests/unit/image-registry-gpt56.test.ts b/tests/unit/image-registry-gpt56.test.ts
new file mode 100644
index 0000000000..937e0393c0
--- /dev/null
+++ b/tests/unit/image-registry-gpt56.test.ts
@@ -0,0 +1,26 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { IMAGE_PROVIDERS, parseImageModel } from "../../open-sse/config/imageRegistry.ts";
+
+test("ChatGPT Web image catalog exposes GPT-5.5 Instant instead of GPT-5.3 Instant", () => {
+  assert.deepEqual(IMAGE_PROVIDERS["chatgpt-web"].models, [
+    { id: "gpt-5.5", name: "GPT-5.5 Instant (ChatGPT Web Image)" },
+  ]);
+  assert.deepEqual(parseImageModel("cgpt-web/gpt-5.5"), {
+    provider: "chatgpt-web",
+    model: "gpt-5.5",
+  });
+});
+
+test("Codex image catalog exposes only the GPT-5.6 Sol, Terra, and Luna models", () => {
+  assert.deepEqual(IMAGE_PROVIDERS.codex.models, [
+    { id: "gpt-5.6-sol", name: "GPT 5.6 Sol (Codex Image)" },
+    { id: "gpt-5.6-terra", name: "GPT 5.6 Terra (Codex Image)" },
+    { id: "gpt-5.6-luna", name: "GPT 5.6 Luna (Codex Image)" },
+  ]);
+
+  for (const model of ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"]) {
+    assert.deepEqual(parseImageModel(`cx/${model}`), { provider: "codex", model });
+  }
+});
diff --git a/tests/unit/image-routes-combo-edits-3214-3215.test.ts b/tests/unit/image-routes-combo-edits-3214-3215.test.ts
index c71a5c08e4..55201c85ce 100644
--- a/tests/unit/image-routes-combo-edits-3214-3215.test.ts
+++ b/tests/unit/image-routes-combo-edits-3214-3215.test.ts
@@ -124,16 +124,17 @@ test("resolveImageRouteModel lets bare combos shadow built-in image aliases", as
 });
 
 test("resolveImageRouteModel keeps codex bare aliases over same-name combos", async () => {
-  await createCombo({ name: "gpt-5.5", models: ["myimg/gpt-5.5"], strategy: "priority" });
+  await createCombo({
+    name: "gpt-5.6-sol",
+    models: ["myimg/gpt-5.6-sol"],
+    strategy: "priority",
+  });
 
-  assert.equal(await resolveSingleImageComboTarget("gpt-5.5"), "myimg/gpt-5.5");
-  assert.equal(await resolveImageRouteModel("gpt-5.5"), "gpt-5.5");
+  assert.equal(await resolveSingleImageComboTarget("gpt-5.6-sol"), "myimg/gpt-5.6-sol");
+  assert.equal(await resolveImageRouteModel("gpt-5.6-sol"), "gpt-5.6-sol");
 });
 
 test("resolveImageRouteModel leaves built-in / already-resolved ids untouched", async () => {
-  assert.equal(
-    await resolveImageRouteModel("cgpt-web/gpt-5.3-instant"),
-    "cgpt-web/gpt-5.3-instant"
-  );
+  assert.equal(await resolveImageRouteModel("cgpt-web/gpt-5.5"), "cgpt-web/gpt-5.5");
   assert.equal(await resolveSingleImageComboTarget("definitely-not-a-combo-3215"), null);
 });
diff --git a/tests/unit/inclusionai-provider.test.ts b/tests/unit/inclusionai-provider.test.ts
new file mode 100644
index 0000000000..dff2608f65
--- /dev/null
+++ b/tests/unit/inclusionai-provider.test.ts
@@ -0,0 +1,17 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { FREE_MODEL_BUDGETS } from "../../open-sse/config/freeModelCatalog.ts";
+import { FREE_TIER_BUDGETS } from "../../open-sse/config/freeTierCatalog.ts";
+import { REGISTRY } from "../../open-sse/config/providerRegistry.ts";
+import { APIKEY_PROVIDERS } from "../../src/shared/constants/providers/apikey/index.ts";
+
+test("inclusionai is no longer registered as a first-party provider", () => {
+  assert.equal(Object.hasOwn(REGISTRY, "inclusionai"), false);
+  assert.equal(Object.hasOwn(APIKEY_PROVIDERS, "inclusionai"), false);
+  assert.equal(Object.hasOwn(FREE_TIER_BUDGETS, "inclusionai"), false);
+  assert.equal(
+    FREE_MODEL_BUDGETS.some((entry) => entry.provider === "inclusionai"),
+    false
+  );
+});
diff --git a/tests/unit/instrumentation-database-closed-6560.test.ts b/tests/unit/instrumentation-database-closed-6560.test.ts
new file mode 100644
index 0000000000..a693dd361c
--- /dev/null
+++ b/tests/unit/instrumentation-database-closed-6560.test.ts
@@ -0,0 +1,108 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import {
+  normalizeBootError,
+  ensureDbReadyForBoot,
+} from "../../src/instrumentation-node";
+
+// Regression guard for #6560: during an update/restart, sql.js's WASM adapter
+// can throw the bare string `"Database closed"` (not an Error instance) when a
+// stale, already-closed handle is reused. Next.js's own
+// `registerInstrumentation()` wrapper unconditionally does
+// `err.message = ...` on whatever `register()` rejects with — if that value is
+// a primitive string, the assignment itself throws
+// `TypeError: Cannot create property 'message' on string 'Database closed'`,
+// masking the real error and crashing the whole server on every boot.
+
+test("normalizeBootError wraps a raw thrown string into a real Error", () => {
+  const normalized = normalizeBootError("Database closed");
+  assert.ok(normalized instanceof Error, "must be a real Error instance");
+  assert.equal(normalized.message, "Database closed");
+
+  // The exact crash from #6560: assigning `.message` on the original raw
+  // string throws; on the normalized Error it must be a no-op assignment.
+  assert.throws(() => {
+    // @ts-expect-error - deliberately mutating a primitive to reproduce the bug
+    ("Database closed").message = "mutated";
+  }, TypeError);
+  assert.doesNotThrow(() => {
+    normalized.message = `An error occurred while loading instrumentation hook: ${normalized.message}`;
+  });
+  assert.equal(
+    normalized.message,
+    "An error occurred while loading instrumentation hook: Database closed"
+  );
+});
+
+test("normalizeBootError passes real Error instances through unchanged (identity)", () => {
+  const original = new Error("boom");
+  const normalized = normalizeBootError(original);
+  assert.equal(normalized, original);
+});
+
+test("normalizeBootError wraps non-string, non-Error throws (null/undefined/object)", () => {
+  assert.equal(normalizeBootError(null).message, "null");
+  assert.equal(normalizeBootError(undefined).message, "undefined");
+  assert.equal(normalizeBootError({ code: "X" }).message, "[object Object]");
+});
+
+test("ensureDbReadyForBoot retries once and succeeds when the first attempt throws the raw 'Database closed' string (RED before fix, GREEN after)", async () => {
+  let calls = 0;
+  const fakeEnsureDbInitialized = async (): Promise<void> => {
+    calls += 1;
+    if (calls === 1) {
+      throw "Database closed";
+    }
+    // second attempt (post-retry) succeeds, as it would once the caller gets a
+    // fresh, non-stale adapter.
+  };
+
+  await assert.doesNotReject(ensureDbReadyForBoot(fakeEnsureDbInitialized));
+  assert.equal(calls, 2, "must retry exactly once after a transient 'Database closed' failure");
+});
+
+test("ensureDbReadyForBoot re-throws (normalized) when the retry also fails", async () => {
+  let calls = 0;
+  const fakeEnsureDbInitialized = async (): Promise<void> => {
+    calls += 1;
+    throw "Database closed";
+  };
+
+  await assert.rejects(
+    ensureDbReadyForBoot(fakeEnsureDbInitialized),
+    (err: unknown) => {
+      assert.ok(err instanceof Error, "rejection must be a real Error, never a raw string");
+      assert.equal((err as Error).message, "Database closed");
+      return true;
+    }
+  );
+  assert.equal(calls, 2);
+});
+
+test("ensureDbReadyForBoot does not retry and re-throws (normalized) unrelated failures", async () => {
+  let calls = 0;
+  const fakeEnsureDbInitialized = async (): Promise<void> => {
+    calls += 1;
+    throw new Error("disk full");
+  };
+
+  await assert.rejects(
+    ensureDbReadyForBoot(fakeEnsureDbInitialized),
+    (err: unknown) => {
+      assert.ok(err instanceof Error);
+      assert.equal((err as Error).message, "disk full");
+      return true;
+    }
+  );
+  assert.equal(calls, 1, "unrelated errors must not trigger the closed-DB retry");
+});
+
+test("ensureDbReadyForBoot resolves without retrying when there is no failure", async () => {
+  let calls = 0;
+  const fakeEnsureDbInitialized = async (): Promise<void> => {
+    calls += 1;
+  };
+
+  await assert.doesNotReject(ensureDbReadyForBoot(fakeEnsureDbInitialized));
+  assert.equal(calls, 1);
+});
diff --git a/tests/unit/instrumentation-live-ws.test.ts b/tests/unit/instrumentation-live-ws.test.ts
new file mode 100644
index 0000000000..ef8cb8462b
--- /dev/null
+++ b/tests/unit/instrumentation-live-ws.test.ts
@@ -0,0 +1,12 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+test("instrumentation-node.ts imports liveServer for in-process WS auto-start", () => {
+  const source = readFileSync(resolve("src/instrumentation-node.ts"), "utf8");
+  assert.ok(
+    source.includes("server/ws/liveServer"),
+    "instrumentation-node.ts should import @/server/ws/liveServer"
+  );
+});
diff --git a/tests/unit/interception-rules.test.ts b/tests/unit/interception-rules.test.ts
new file mode 100644
index 0000000000..bad1e0a281
--- /dev/null
+++ b/tests/unit/interception-rules.test.ts
@@ -0,0 +1,96 @@
+import { describe, it, beforeEach, after } from "node:test";
+import assert from "node:assert/strict";
+import os from "node:os";
+import path from "node:path";
+import fs from "node:fs";
+
+// Set DATA_DIR to a temp dir before any imports that touch the DB.
+const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-test-interception-rules-"));
+process.env.DATA_DIR = tmpDir;
+
+const core = await import("../../src/lib/db/core.ts");
+const {
+  getInterceptionRules,
+  setInterceptionRules,
+  deleteInterceptionRules,
+  resolveInterceptSearch,
+} = await import("../../src/lib/db/interceptionRules.ts");
+
+// #3384 — per-model web-search/web-fetch interception rule store.
+describe("db/interceptionRules — per-model interception rules (#3384)", () => {
+  function resetDb() {
+    core.resetDbInstance();
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+    fs.mkdirSync(tmpDir, { recursive: true });
+  }
+
+  beforeEach(() => {
+    resetDb();
+  });
+
+  after(() => {
+    core.resetDbInstance();
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  it("returns null for an unconfigured provider", () => {
+    assert.equal(getInterceptionRules("anthropic"), null);
+  });
+
+  it("round-trips a provider-level rule via set/get", () => {
+    setInterceptionRules("anthropic", { interceptSearch: true, interceptFetch: false });
+    const rules = getInterceptionRules("anthropic");
+    assert.equal(rules?.interceptSearch, true);
+    assert.equal(rules?.interceptFetch, false);
+  });
+
+  it("round-trips a per-model override", () => {
+    setInterceptionRules("anthropic", {
+      interceptSearch: false,
+      models: { "claude-opus-4": { interceptSearch: true } },
+    });
+    const rules = getInterceptionRules("anthropic");
+    assert.equal(rules?.interceptSearch, false);
+    assert.equal(rules?.models?.["claude-opus-4"]?.interceptSearch, true);
+  });
+
+  it("delete resets a provider back to unconfigured", () => {
+    setInterceptionRules("anthropic", { interceptSearch: true });
+    deleteInterceptionRules("anthropic");
+    assert.equal(getInterceptionRules("anthropic"), null);
+  });
+
+  it("invalidates the in-memory cache after a write", () => {
+    setInterceptionRules("openai", { interceptSearch: true });
+    assert.equal(getInterceptionRules("openai")?.interceptSearch, true);
+    setInterceptionRules("openai", { interceptSearch: false });
+    assert.equal(getInterceptionRules("openai")?.interceptSearch, false);
+  });
+
+  describe("resolveInterceptSearch — precedence", () => {
+    it("returns undefined when no rule is configured (caller falls back to bypass defaults)", () => {
+      assert.equal(resolveInterceptSearch("anthropic", "claude-opus-4"), undefined);
+    });
+
+    it("returns the provider-level rule when no model override exists", () => {
+      setInterceptionRules("anthropic", { interceptSearch: true });
+      assert.equal(resolveInterceptSearch("anthropic", "claude-opus-4"), true);
+      assert.equal(resolveInterceptSearch("anthropic", "claude-haiku-4"), true);
+    });
+
+    it("per-model rule overrides the provider-level rule", () => {
+      setInterceptionRules("anthropic", {
+        interceptSearch: false,
+        models: { "claude-opus-4": { interceptSearch: true } },
+      });
+      assert.equal(resolveInterceptSearch("anthropic", "claude-opus-4"), true);
+      assert.equal(resolveInterceptSearch("anthropic", "claude-haiku-4"), false);
+    });
+
+    it("returns undefined for an empty/missing provider", () => {
+      assert.equal(resolveInterceptSearch("", "claude-opus-4"), undefined);
+      assert.equal(resolveInterceptSearch(null, "claude-opus-4"), undefined);
+      assert.equal(resolveInterceptSearch(undefined, "claude-opus-4"), undefined);
+    });
+  });
+});
diff --git a/tests/unit/issue-6343-v0-web-alias-collision.test.ts b/tests/unit/issue-6343-v0-web-alias-collision.test.ts
new file mode 100644
index 0000000000..15e672e3b2
--- /dev/null
+++ b/tests/unit/issue-6343-v0-web-alias-collision.test.ts
@@ -0,0 +1,90 @@
+// Regression test for #6343: "v0 Web cannot detect added credentials".
+//
+// Root cause: 'v0 Vercel Web (Code Gen)' (id v0-vercel-web, cookie auth) and the
+// unrelated 'v0 (Vercel)' API-key provider (id v0-vercel) both declared alias
+// "v0". The dashboard's per-model Test button builds the test model string from
+// the provider's ALIAS (not its canonical id), and open-sse's alias->id map is
+// necessarily 1:1, so "v0/<model>" always resolved to v0-vercel (which the user
+// has no credentials for) instead of v0-vercel-web (the provider they actually
+// configured). See _tasks/pipeline/bugs/2-implementing/6343-*.plan.md.
+import { describe, it, after } from "node:test";
+import assert from "node:assert/strict";
+import os from "node:os";
+import path from "node:path";
+import fs from "node:fs";
+
+const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-6343-"));
+process.env.DATA_DIR = tmpDir;
+process.env.JWT_SECRET = "test-jwt-secret-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+process.env.API_KEY_SECRET = "0123456789abcdef0123456789abcdef";
+
+describe("#6343: v0-vercel-web credential detection (alias collision)", () => {
+  after(async () => {
+    try {
+      const { resetDbInstance } = await import("../../src/lib/db/core.ts");
+      resetDbInstance();
+    } catch {
+      // best-effort cleanup
+    }
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  it("v0-vercel and v0-vercel-web no longer share an alias", async () => {
+    const { getProviderAlias } = await import("../../src/shared/constants/providers.ts");
+    const apiKeyAlias = getProviderAlias("v0-vercel");
+    const webAlias = getProviderAlias("v0-vercel-web");
+    assert.notEqual(
+      webAlias,
+      apiKeyAlias,
+      "v0-vercel and v0-vercel-web must have distinct aliases so alias->id resolution is unambiguous"
+    );
+  });
+
+  it("a saved v0-vercel-web connection is found by getProviderCredentials", async () => {
+    const { createProviderConnection } = await import("../../src/lib/db/providers.ts");
+    const { getProviderCredentials } = await import("../../src/sse/services/auth.ts");
+    const conn = await createProviderConnection({
+      provider: "v0-vercel-web",
+      authType: "cookie",
+      name: "test-v0-web",
+      apiKey: "__vercel_session=faketoken123",
+      priority: 1,
+      isActive: true,
+      testStatus: "active",
+    });
+    const creds = await getProviderCredentials("v0-vercel-web", null, null, "v0-fable-5");
+    assert.ok(creds);
+    assert.equal((creds as { connectionId?: string }).connectionId, conn.id);
+  });
+
+  it("dashboard 'Test Model' fullModel (built from provider ALIAS) resolves back to v0-vercel-web and finds the real credential", async () => {
+    const { getProviderAlias } = await import("../../src/shared/constants/providers.ts");
+    const { parseModel } = await import("../../open-sse/services/model.ts");
+    const { getProviderCredentials } = await import("../../src/sse/services/auth.ts");
+
+    const providerId = "v0-vercel-web";
+    // Mirrors ProviderDetailPageClient.tsx:266 for a non-"compatible" provider.
+    const providerDisplayAlias = getProviderAlias(providerId);
+    // Mirrors ProviderModelsSection.tsx:461.
+    const fullModelFromUi = `${providerDisplayAlias}/v0-fable-5`;
+
+    const parsed = parseModel(fullModelFromUi);
+    assert.equal(parsed.provider, providerId);
+
+    const creds = await getProviderCredentials(String(parsed.provider), null, null, parsed.model);
+    assert.ok(creds);
+  });
+
+  it("v0-vercel and v0-vercel-web are the only two AI_PROVIDERS entries with alias 'v0'", async () => {
+    // Guards against a future re-introduction of the exact collision this bug fixed
+    // (see AI_PROVIDERS scan in the plan-file / triage). Deliberately scoped to the
+    // "v0" alias only — other pre-existing alias collisions (e.g. poe / poe-web) are
+    // out of scope for #6343 and are not asserted here.
+    const { AI_PROVIDERS } = await import("../../src/shared/constants/providers.ts");
+    const idsWithV0Alias = Object.values(AI_PROVIDERS)
+      .filter((p: { alias?: string; id: string }) => p.alias === "v0")
+      .map((p: { alias?: string; id: string }) => p.id)
+      .sort();
+    assert.deepEqual(idsWithV0Alias, ["v0-vercel"]);
+  });
+});
diff --git a/tests/unit/issue-6623-opencode-mimo-reasoning-details-nonstream.test.ts b/tests/unit/issue-6623-opencode-mimo-reasoning-details-nonstream.test.ts
new file mode 100644
index 0000000000..4507c34415
--- /dev/null
+++ b/tests/unit/issue-6623-opencode-mimo-reasoning-details-nonstream.test.ts
@@ -0,0 +1,44 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { translateNonStreamingResponse } from "../../open-sse/handlers/responseTranslator.ts";
+import { detectMalformedNonStream } from "../../open-sse/utils/diagnostics.ts";
+import { isEmptyContentResponse } from "../../open-sse/services/errorClassifier.ts";
+
+const mimoOpenRouterStyleResponse = {
+  id: "gen-1783636289-lJcRXwMde7qjgDJfHiBC",
+  object: "chat.completion",
+  created: 1783636289,
+  model: "mimo-v2.5-free",
+  choices: [
+    {
+      index: 0,
+      finish_reason: "length",
+      logprobs: null,
+      message: {
+        role: "assistant",
+        content: null,
+        refusal: null,
+        reasoning: "Hmm, the user just said hi",
+        reasoning_details: [
+          { type: "reasoning.text", text: "Hmm, the user just said hi", format: "unknown", index: 0 },
+        ],
+      },
+    },
+  ],
+  usage: { prompt_tokens: 248, completion_tokens: 10, total_tokens: 258 },
+};
+
+test("#6623 raw responseBody is not flagged empty by isEmptyContentResponse", () => {
+  assert.equal(isEmptyContentResponse(mimoOpenRouterStyleResponse), false);
+});
+
+test("#6623 /v1/messages non-stream translation of an OpenRouter reasoning-only turn is flagged malformed (502) - RED", () => {
+  const translated = translateNonStreamingResponse(mimoOpenRouterStyleResponse, "openai", "claude", null);
+  const malformedReason = detectMalformedNonStream(translated);
+  assert.equal(malformedReason, null);
+});
+
+test("#6623 /v1/chat/completions (openai->openai, no translation) is unaffected", () => {
+  const passthrough = translateNonStreamingResponse(mimoOpenRouterStyleResponse, "openai", "openai", null);
+  assert.equal(passthrough, mimoOpenRouterStyleResponse);
+});
diff --git a/tests/unit/issue-6638-ollama-quota.test.ts b/tests/unit/issue-6638-ollama-quota.test.ts
new file mode 100644
index 0000000000..79eb8fc4ca
--- /dev/null
+++ b/tests/unit/issue-6638-ollama-quota.test.ts
@@ -0,0 +1,33 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { checkFallbackError } from "../../open-sse/services/accountFallback.ts";
+
+// Repro for GitHub issue #6638: "OmniRoute doesn't respect exhausted quotas"
+test("#6638: Ollama Cloud weekly-quota-exhausted 429 must NOT get a short generic rate-limit cooldown", () => {
+  const errorText = JSON.stringify({
+    error: "You have exceeded your weekly usage quota. Your quota will reset in 3 days.",
+  });
+
+  const result = checkFallbackError(
+    429,
+    errorText,
+    0,
+    "deepseek-v4-pro",
+    "ollama-cloud",
+    null,
+    null,
+    undefined
+  );
+
+  console.log("checkFallbackError result:", result);
+
+  assert.equal(
+    result.reason,
+    "quota_exhausted",
+    `expected reason "quota_exhausted" but got "${result.reason}" — quota text is being ignored for apikey-category 429s`
+  );
+  assert.ok(
+    result.cooldownMs > 60 * 60 * 1000,
+    `expected a long (>1h) cooldown reflecting the weekly quota reset, got ${result.cooldownMs}ms`
+  );
+});
diff --git a/tests/unit/issue-6662-repro.test.ts b/tests/unit/issue-6662-repro.test.ts
new file mode 100644
index 0000000000..6f058d7789
--- /dev/null
+++ b/tests/unit/issue-6662-repro.test.ts
@@ -0,0 +1,152 @@
+import { describe, it, mock, afterEach } from "node:test";
+import assert from "node:assert/strict";
+
+// Repro for #6662: reasoning_content dropped from /v1/chat/completions SSE
+// deltas on the v0-vercel-web and claude-web executors.
+//
+// v0-vercel-web: its upstream (v0.dev/api/chat) speaks an OpenAI-compatible
+// SSE format. When the upstream chunk carries `delta.reasoning_content`
+// (as OpenAI-compatible reasoning-capable backends do — see the DeepSeek
+// pattern already handled at open-sse/executors/deepseek-web.ts:221), the
+// v0 executor's stream transform only ever reads `delta?.content` and
+// silently drops any `reasoning_content` field instead of forwarding it.
+//
+// claude-web: its upstream (claude.ai's real chat_conversations/.../completion
+// endpoint) speaks the native Anthropic SSE shape — `content_block_delta`
+// events with `delta.type === "thinking_delta"` / `delta.thinking` for
+// extended-thinking text (the same shape the real-Anthropic-API translator
+// at open-sse/translator/response/claude-to-openai.ts already maps to
+// `reasoning_content`). Before the fix, `buildClaudeStreamingResponse` in
+// open-sse/executors/claude-web.ts only ever read `delta.text`, so any
+// `thinking_delta` event was silently dropped instead of forwarded.
+
+const mod = await import("../../open-sse/executors/v0-vercel-web.ts");
+const { ClaudeWebExecutor } = await import("../../open-sse/executors/claude-web.ts");
+const { __setTlsFetchOverrideForTesting } = await import(
+  "../../open-sse/services/claudeTlsClient.ts"
+);
+
+function sseUpstream(events: string[]): Response {
+  const encoder = new TextEncoder();
+  const stream = new ReadableStream<Uint8Array>({
+    start(controller) {
+      for (const e of events) {
+        controller.enqueue(encoder.encode(`data: ${e}\n\n`));
+      }
+      controller.enqueue(encoder.encode("data: [DONE]\n\n"));
+      controller.close();
+    },
+  });
+  return new Response(stream, {
+    status: 200,
+    headers: { "Content-Type": "text/event-stream" },
+  });
+}
+
+describe("#6662 repro — v0-vercel-web drops reasoning_content", () => {
+  const originalFetch = globalThis.fetch;
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+  });
+
+  it("forwards reasoning_content deltas from the upstream SSE stream (RED on current code)", async () => {
+    const upstreamEvents = [
+      JSON.stringify({
+        choices: [{ delta: { reasoning_content: "Let me think about 17*23..." } }],
+      }),
+      JSON.stringify({
+        choices: [{ delta: { content: "391" } }],
+      }),
+    ];
+
+    globalThis.fetch = mock.fn(async () => sseUpstream(upstreamEvents)) as unknown as typeof fetch;
+
+    const executor = new mod.V0VercelWebExecutor();
+    const result = await executor.execute({
+      model: "v0-default",
+      body: { messages: [{ role: "user", content: "Solve 17*23" }] },
+      stream: true,
+      credentials: { apiKey: "fake-cookie" },
+      signal: null,
+    });
+
+    assert.ok(result.response instanceof Response);
+    const text = await result.response.text();
+
+    assert.ok(
+      text.includes("reasoning_content"),
+      `expected translated SSE stream to carry a reasoning_content field, got:\n${text}`
+    );
+  });
+});
+
+describe("#6662 repro — claude-web drops thinking_delta reasoning_content", () => {
+  afterEach(() => {
+    __setTlsFetchOverrideForTesting(null);
+  });
+
+  function claudeSseStream(events: Array<Record<string, unknown>>): ReadableStream<Uint8Array> {
+    const encoder = new TextEncoder();
+    return new ReadableStream<Uint8Array>({
+      start(controller) {
+        for (const e of events) {
+          controller.enqueue(encoder.encode(`data: ${JSON.stringify(e)}\n\n`));
+        }
+        controller.close();
+      },
+    });
+  }
+
+  it("forwards thinking_delta text as reasoning_content in the translated SSE stream (RED on current code)", async () => {
+    const upstreamEvents = [
+      { type: "message_start", message: { id: "msg_1", model: "claude-sonnet-4-6" } },
+      { type: "content_block_start", index: 0, content_block: { type: "thinking" } },
+      {
+        type: "content_block_delta",
+        index: 0,
+        delta: { type: "thinking_delta", thinking: "Let me think about 17*23..." },
+      },
+      { type: "content_block_stop", index: 0 },
+      { type: "content_block_start", index: 1, content_block: { type: "text" } },
+      { type: "content_block_delta", index: 1, delta: { type: "text_delta", text: "391" } },
+      { type: "content_block_stop", index: 1 },
+      { type: "message_delta", delta: { stop_reason: "end_turn" } },
+      { type: "message_stop" },
+    ];
+
+    __setTlsFetchOverrideForTesting(async () => ({
+      status: 200,
+      headers: new Headers({ "Content-Type": "text/event-stream" }),
+      text: null,
+      body: claudeSseStream(upstreamEvents),
+    }));
+
+    const executor = new ClaudeWebExecutor();
+    const result = await executor.execute({
+      model: "claude-sonnet-4-6",
+      body: { messages: [{ role: "user", content: "Solve 17*23" }] },
+      stream: true,
+      credentials: {
+        // cf_clearance present up front so normalizeClaudeSessionCookieWithAutoRefresh
+        // takes the fast path and never attempts a real Turnstile solve in-test.
+        apiKey: "sessionKey=fake-session; cf_clearance=fake-clearance",
+        orgId: "org-test",
+        conversationId: "conv-test",
+      },
+      signal: null,
+    });
+
+    assert.ok(result.response instanceof Response);
+    const text = await result.response.text();
+
+    assert.ok(
+      text.includes("reasoning_content"),
+      `expected translated SSE stream to carry a reasoning_content field, got:\n${text}`
+    );
+    assert.ok(
+      text.includes("Let me think about 17*23"),
+      `expected the thinking text to be forwarded, got:\n${text}`
+    );
+  });
+});
diff --git a/tests/unit/issue-6686-quota-preflight-coverage.test.ts b/tests/unit/issue-6686-quota-preflight-coverage.test.ts
new file mode 100644
index 0000000000..488ee55f58
--- /dev/null
+++ b/tests/unit/issue-6686-quota-preflight-coverage.test.ts
@@ -0,0 +1,140 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import os from "node:os";
+
+// Regression guard for issue #6686:
+// "Account selection can pick accounts already out of quota (no live quota
+// preflight outside chat/codex)."
+//
+// Root cause: getProviderCredentials() (src/sse/services/auth.ts) only skips
+// a connection when a LOCAL CACHE already flags it exhausted
+// (isQuotaExhaustedForRequest / src/domain/quotaCache.ts). It never itself
+// calls the registered upstream QuotaFetcher. Only
+// getProviderCredentialsWithQuotaPreflight() performs that live upstream
+// check, and before this fix it was wired into exactly 2 call sites
+// (src/sse/handlers/chat.ts, src/app/api/internal/codex-responses-ws).
+// Every other credentialed route called the plain selector, so an account
+// whose local cache entry was never populated (e.g. its first request landed
+// on a non-chat/codex route) could be selected even at 0% quota remaining.
+//
+// The fix routes those remaining call sites through
+// getProviderCredentialsWithQuotaPreflight() instead. This test has two
+// parts:
+//   1) A static, file-content check that every affected route no longer
+//      calls the plain, cache-only selector.
+//   2) A behavioral check that the preflight-aware selector — now used by
+//      every credentialed route — genuinely blocks an account reported
+//      100% used by a registered upstream quota fetcher.
+
+const repoRoot = path.resolve(fileURLToPath(new URL("../../", import.meta.url)));
+
+const ROUTES_REQUIRING_QUOTA_PREFLIGHT = [
+  "src/app/api/v1/rerank/route.ts",
+  "src/app/api/v1/images/generations/route.ts",
+  "src/app/api/v1/images/edits/route.ts",
+  "src/app/api/v1/audio/transcriptions/route.ts",
+  "src/app/api/v1/audio/speech/route.ts",
+  "src/app/api/v1/audio/translations/route.ts",
+  "src/app/api/v1/videos/generations/route.ts",
+  "src/app/api/v1/music/generations/route.ts",
+  "src/app/api/v1/ocr/route.ts",
+  "src/app/api/v1/providers/[provider]/embeddings/route.ts",
+  "src/app/api/v1/providers/[provider]/images/generations/route.ts",
+  "src/app/api/v1/web/fetch/route.ts",
+  "src/app/api/v1/moderations/route.ts",
+  "src/app/api/v1/search/route.ts",
+];
+
+test("#6686: previously-plain-selector routes must call the quota-preflight-aware selector, not the plain cache-only one", () => {
+  for (const relPath of ROUTES_REQUIRING_QUOTA_PREFLIGHT) {
+    const filePath = path.join(repoRoot, relPath);
+    const source = fs.readFileSync(filePath, "utf8");
+
+    // A bare `getProviderCredentials(` call (not immediately followed by
+    // `WithQuotaPreflight`) means live upstream quota is never checked before
+    // the account is used for this route — the exact #6686 gap.
+    const bareCalls = source.match(/getProviderCredentials(?!WithQuotaPreflight)\(/g) || [];
+    assert.equal(
+      bareCalls.length,
+      0,
+      `${relPath} must not call the plain getProviderCredentials() — use ` +
+        `getProviderCredentialsWithQuotaPreflight() instead (issue #6686)`
+    );
+
+    assert.match(
+      source,
+      /getProviderCredentialsWithQuotaPreflight/,
+      `${relPath} is expected to select credentials via ` +
+        `getProviderCredentialsWithQuotaPreflight (issue #6686)`
+    );
+  }
+});
+
+test("#6686: getProviderCredentialsWithQuotaPreflight (now used by every credentialed route) blocks an account already 100% out of quota upstream", async () => {
+  const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-issue-6686-"));
+  process.env.DATA_DIR = TEST_DATA_DIR;
+  process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "issue-6686-secret";
+
+  const core = await import("../../src/lib/db/core.ts");
+  const providersDb = await import("../../src/lib/db/providers.ts");
+  const apiKeysDb = await import("../../src/lib/db/apiKeys.ts");
+  const auth = await import("../../src/sse/services/auth.ts");
+  const quotaPreflight = await import("../../open-sse/services/quotaPreflight.ts");
+
+  core.resetDbInstance();
+  apiKeysDb.resetApiKeyState();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+
+  try {
+    const provider = "issue6686";
+
+    const account = await providersDb.createProviderConnection({
+      provider,
+      authType: "apikey",
+      name: "issue-6686-exhausted",
+      apiKey: "sk-issue-6686-exhausted",
+      isActive: true,
+      testStatus: "active",
+      // Same shape used by every affected route's selection call — no
+      // cooldown, no rate-limit, nothing that would trip the reactive
+      // filters. Only a live upstream check can catch this account.
+      providerSpecificData: {
+        quotaPreflightEnabled: true,
+      },
+    });
+
+    // A registered upstream quota fetcher — what
+    // getProviderCredentialsWithQuotaPreflight() calls to discover the
+    // account is exhausted before the request is sent.
+    quotaPreflight.registerQuotaFetcher(provider, async () => ({
+      used: 100,
+      total: 100,
+      percentUsed: 1.0,
+      resetAt: new Date(Date.now() + 60_000).toISOString(),
+    }));
+
+    const preflightSelection = await auth.getProviderCredentialsWithQuotaPreflight(
+      provider,
+      null,
+      null,
+      null
+    );
+    const preflightResult = preflightSelection as {
+      allRateLimited?: boolean;
+      connectionId?: string;
+    } | null;
+
+    assert.ok(
+      preflightResult?.allRateLimited === true || preflightResult?.connectionId !== account.id,
+      "getProviderCredentialsWithQuotaPreflight should correctly block the exhausted account"
+    );
+  } finally {
+    core.resetDbInstance();
+    apiKeysDb.resetApiKeyState();
+    fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  }
+});
diff --git a/tests/unit/kimi-web-models-discovery.test.ts b/tests/unit/kimi-web-models-discovery.test.ts
new file mode 100644
index 0000000000..676347c9e2
--- /dev/null
+++ b/tests/unit/kimi-web-models-discovery.test.ts
@@ -0,0 +1,74 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-kimi-web-models-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const modelsRoute = await import("../../src/app/api/providers/[id]/models/route.ts");
+
+async function resetStorage() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("kimi-web model discovery sends Kimi auth as bearer and cookie", async () => {
+  await resetStorage();
+  const jwt = "eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJ1c2VyIn0.signature";
+  const connection = await providersDb.createProviderConnection({
+    provider: "kimi-web",
+    authType: "apikey",
+    name: "kimi-web-discovery",
+    apiKey: `_ga=ignored; theme=dark; kimi-auth=${jwt}; __cf_bm=ignored`,
+  });
+
+  let captured: { url: string; init?: RequestInit } | null = null;
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = (async (url: string | URL | Request, init?: RequestInit) => {
+    captured = { url: String(url), init };
+    return Response.json({
+      availableModels: [
+        { key: "k2d6", displayName: "K2.6 Instant" },
+        { key: "k2d6-thinking", displayName: "K2.6 Thinking", thinking: true },
+        { key: "k2d6-agent", displayName: "K2.6 Agent" },
+        { key: "k2d6-agent-ultra", displayName: "K2.6 Agent Swarm" },
+      ],
+    });
+  }) as typeof globalThis.fetch;
+
+  try {
+    const response = await modelsRoute.GET(
+      new Request(`http://localhost/api/providers/${connection.id}/models?refresh=true`),
+      { params: { id: connection.id } }
+    );
+    assert.equal(response.status, 200);
+    const body = await response.json();
+    assert.equal(body.source, "api");
+    assert.deepEqual(
+      body.models.map((model: { id: string }) => model.id),
+      ["k2d6", "k2d6-thinking"]
+    );
+    assert.equal(
+      captured?.url,
+      "https://www.kimi.com/apiv2/kimi.gateway.config.v1.ConfigService/GetAvailableModels"
+    );
+    assert.equal(captured?.init?.method, "POST");
+    assert.equal(captured?.init?.body, "{}");
+    const headers = captured?.init?.headers as Record<string, string>;
+    assert.equal(headers.Authorization, `Bearer ${jwt}`);
+    assert.equal(headers.Cookie, `kimi-auth=${jwt}`);
+    assert.equal(headers["connect-protocol-version"], "1");
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
diff --git a/tests/unit/kiro-api-key-route-helpers.test.ts b/tests/unit/kiro-api-key-route-helpers.test.ts
new file mode 100644
index 0000000000..a40a6a7b9f
--- /dev/null
+++ b/tests/unit/kiro-api-key-route-helpers.test.ts
@@ -0,0 +1,38 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  buildKiroApiKeyConnectionName,
+  isKiroApiKeyImportClientError,
+} from "../../src/app/api/oauth/kiro/api-key/helpers.ts";
+
+test("Kiro API key connection names differ for different keys in the same region", () => {
+  const first = buildKiroApiKeyConnectionName("kiro", "us-east-1", "ksk_first_key");
+  const second = buildKiroApiKeyConnectionName("kiro", "us-east-1", "ksk_second_key");
+
+  assert.match(first, /^Kiro API Key \(us-east-1, [a-f0-9]{8}\)$/);
+  assert.match(second, /^Kiro API Key \(us-east-1, [a-f0-9]{8}\)$/);
+  assert.notEqual(first, second);
+});
+
+test("Kiro API key connection names are stable for the same trimmed key", () => {
+  const first = buildKiroApiKeyConnectionName("amazon-q", "eu-west-1", " ksk_same_key ");
+  const second = buildKiroApiKeyConnectionName("amazon-q", "eu-west-1", "ksk_same_key");
+
+  assert.equal(first, second);
+  assert.match(first, /^Amazon Q API Key \(eu-west-1, [a-f0-9]{8}\)$/);
+});
+
+test("Kiro API key import classifies client validation failures as 400-class", () => {
+  assert.equal(isKiroApiKeyImportClientError(new Error("API key is required")), true);
+  assert.equal(isKiroApiKeyImportClientError(new Error("Invalid region")), true);
+  assert.equal(
+    isKiroApiKeyImportClientError(new Error("Failed to list profiles: Invalid API key")),
+    true
+  );
+});
+
+test("Kiro API key import leaves network/server failures as 500-class", () => {
+  assert.equal(isKiroApiKeyImportClientError(new Error("fetch failed")), false);
+  assert.equal(isKiroApiKeyImportClientError(new Error("ECONNRESET")), false);
+});
diff --git a/tests/unit/kiro-api-key-service.test.ts b/tests/unit/kiro-api-key-service.test.ts
new file mode 100644
index 0000000000..36ebe686df
--- /dev/null
+++ b/tests/unit/kiro-api-key-service.test.ts
@@ -0,0 +1,62 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { KiroService } from "../../src/lib/oauth/services/kiro.ts";
+
+test("KiroService.validateApiKey validates via ListAvailableProfiles with API_KEY token type", async () => {
+  const service = new KiroService();
+  const originalFetch = globalThis.fetch;
+
+  globalThis.fetch = (async (url: string, init?: RequestInit) => {
+    assert.equal(url, "https://q.eu-central-1.amazonaws.com");
+    const headers = init?.headers as Record<string, string>;
+    assert.equal(headers.Authorization, "Bearer kiro-api-key");
+    assert.equal(headers.tokentype, "API_KEY");
+    assert.equal(headers["x-amz-target"], "AmazonCodeWhispererService.ListAvailableProfiles");
+    return new Response(
+      JSON.stringify({
+        profiles: [
+          { arn: "arn:aws:codewhisperer:us-east-1:1:profile/OTHER" },
+          { arn: "arn:aws:codewhisperer:eu-central-1:1:profile/MATCH" },
+        ],
+      }),
+      { status: 200, headers: { "Content-Type": "application/json" } }
+    );
+  }) as typeof fetch;
+
+  try {
+    const credential = await service.validateApiKey(" kiro-api-key ", "eu-central-1");
+    assert.equal(credential.accessToken, "kiro-api-key");
+    assert.equal(credential.refreshToken, null);
+    assert.equal(credential.authMethod, "api_key");
+    assert.equal(credential.region, "eu-central-1");
+    assert.equal(credential.profileArn, "arn:aws:codewhisperer:eu-central-1:1:profile/MATCH");
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("KiroService.validateApiKey accepts API keys when profile discovery is denied", async () => {
+  const service = new KiroService();
+  const originalFetch = globalThis.fetch;
+
+  globalThis.fetch = (async () =>
+    new Response(
+      JSON.stringify({
+        __type: "com.amazon.aws.codewhisperer#AccessDeniedException",
+        message: "API key authentication is not supported for this operation.",
+      }),
+      { status: 403, headers: { "Content-Type": "application/json" } }
+    )) as typeof fetch;
+
+  try {
+    const credential = await service.validateApiKey(" kiro-api-key ", "us-east-1");
+    assert.equal(credential.accessToken, "kiro-api-key");
+    assert.equal(credential.refreshToken, null);
+    assert.equal(credential.authMethod, "api_key");
+    assert.equal(credential.region, "us-east-1");
+    assert.equal(credential.profileArn, null);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
diff --git a/tests/unit/kiro-available-models.test.ts b/tests/unit/kiro-available-models.test.ts
index 4f57ec1a92..58a0841f34 100644
--- a/tests/unit/kiro-available-models.test.ts
+++ b/tests/unit/kiro-available-models.test.ts
@@ -1,4 +1,4 @@
-import test from "node:test";
+import test, { beforeEach } from "node:test";
 import assert from "node:assert/strict";
 
 import {
@@ -6,10 +6,15 @@ import {
   resolveKiroRegion,
   buildKiroModelsEndpoints,
   fetchKiroAvailableModels,
+  clearKiroModelCache,
 } from "../../open-sse/services/kiroModels.ts";
 
 const FALLBACK = [{ id: "auto-kiro", name: "Auto" }, { id: "claude-sonnet-4.6" }];
 
+beforeEach(() => {
+  clearKiroModelCache();
+});
+
 function jsonResponse(body: unknown, status = 200): Response {
   return new Response(JSON.stringify(body), {
     status,
@@ -70,7 +75,14 @@ test("fetchKiroAvailableModels: simple (Builder ID) account, us-east-1, origin-o
   });
 
   assert.equal(result.source, "api");
-  assert.deepEqual(result.models.map((m) => m.id).sort(), ["auto", "claude-sonnet-4.6"]);
+  assert.deepEqual(result.models.map((m) => m.id).sort(), [
+    "auto",
+    "auto-thinking",
+    "claude-sonnet-4.6",
+    "claude-sonnet-4.6-agentic",
+    "claude-sonnet-4.6-thinking",
+    "claude-sonnet-4.6-thinking-agentic",
+  ]);
   assert.deepEqual(calls, [
     "https://q.us-east-1.amazonaws.com/ListAvailableModels?origin=AI_EDITOR",
   ]);
@@ -94,7 +106,12 @@ test("fetchKiroAvailableModels: IAM Identity Center account, region-matched endp
   assert.equal(result.source, "api");
   assert.deepEqual(
     result.models.map((m) => m.id),
-    ["claude-opus-4.8"]
+    [
+      "claude-opus-4.8",
+      "claude-opus-4.8-thinking",
+      "claude-opus-4.8-agentic",
+      "claude-opus-4.8-thinking-agentic",
+    ]
   );
   assert.equal(
     calls[0],
@@ -125,7 +142,12 @@ test("fetchKiroAvailableModels: retries with profileArn when origin-only fails",
   assert.equal(result.source, "api");
   assert.deepEqual(
     result.models.map((m) => m.id),
-    ["claude-sonnet-4.6"]
+    [
+      "claude-sonnet-4.6",
+      "claude-sonnet-4.6-thinking",
+      "claude-sonnet-4.6-agentic",
+      "claude-sonnet-4.6-thinking-agentic",
+    ]
   );
   // origin-only attempted first, then profileArn retry.
   assert.equal(calls.length, 2);
diff --git a/tests/unit/kiro-external-idp.test.ts b/tests/unit/kiro-external-idp.test.ts
new file mode 100644
index 0000000000..a8f5273b6e
--- /dev/null
+++ b/tests/unit/kiro-external-idp.test.ts
@@ -0,0 +1,138 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+// Coverage for enterprise / Microsoft Entra "Your organization" (external_idp) Kiro accounts:
+//   • public-client refresh_token grant against the org IdP tokenEndpoint (no client secret),
+//   • the runtime `TokenType: EXTERNAL_IDP` header the CodeWhisperer service requires to bind
+//     the bearer to the Amazon Q Developer profile (without it every call is
+//     `ValidationException: Invalid ARN <clientId>`),
+//   • tokenEndpoint SSRF allowlist, scope normalization, and JWT identity extraction.
+
+import {
+  buildExternalIdpRefreshParams,
+  validateExternalIdpTokenEndpoint,
+  normalizeScope,
+  isExternalIdpAuthMethod,
+  emailFromExternalIdpToken,
+  KIRO_EXTERNAL_IDP_TOKEN_TYPE_HEADER,
+  KIRO_EXTERNAL_IDP_TOKEN_TYPE_VALUE,
+} from "../../open-sse/services/kiroExternalIdp.ts";
+import { KiroExecutor } from "../../open-sse/executors/kiro.ts";
+
+const MS_ENDPOINT = "https://login.microsoftonline.com/9d769d6d-e03a-442a-8ab1-a7da2037a5d4/oauth2/v2.0/token";
+
+function makeJwt(payload: Record<string, unknown>): string {
+  const b64 = (o: unknown) => Buffer.from(JSON.stringify(o)).toString("base64url");
+  return `${b64({ alg: "none", typ: "JWT" })}.${b64(payload)}.sig`;
+}
+
+test("validateExternalIdpTokenEndpoint accepts Microsoft/Okta https, rejects others", () => {
+  assert.equal(validateExternalIdpTokenEndpoint(MS_ENDPOINT), MS_ENDPOINT);
+  assert.ok(validateExternalIdpTokenEndpoint("https://dev-123.okta.com/oauth2/v1/token"));
+  assert.throws(() => validateExternalIdpTokenEndpoint("http://login.microsoftonline.com/x/token"));
+  assert.throws(() => validateExternalIdpTokenEndpoint("https://evil.example.com/token"));
+  assert.throws(() => validateExternalIdpTokenEndpoint(""));
+});
+
+test("normalizeScope handles array and space-delimited string", () => {
+  assert.equal(normalizeScope(["a", "b", "offline_access"]), "a b offline_access");
+  assert.equal(normalizeScope("a b offline_access"), "a b offline_access");
+  assert.equal(normalizeScope([" x ", "", "y"]), "x y");
+  assert.equal(normalizeScope(undefined), "");
+});
+
+test("isExternalIdpAuthMethod recognizes external_idp (case-insensitive)", () => {
+  assert.equal(isExternalIdpAuthMethod("external_idp"), true);
+  assert.equal(isExternalIdpAuthMethod("EXTERNAL_IDP"), true);
+  assert.equal(isExternalIdpAuthMethod("idc"), false);
+  assert.equal(isExternalIdpAuthMethod(undefined), false);
+});
+
+test("emailFromExternalIdpToken reads preferred_username / upn / email", () => {
+  assert.equal(
+    emailFromExternalIdpToken(makeJwt({ preferred_username: "finbar.heslin@mrdevvn.cyou" })),
+    "finbar.heslin@mrdevvn.cyou"
+  );
+  assert.equal(emailFromExternalIdpToken(makeJwt({ upn: "a@b.com" })), "a@b.com");
+  assert.equal(emailFromExternalIdpToken(makeJwt({ email: "c@d.com" })), "c@d.com");
+  assert.equal(emailFromExternalIdpToken("not-a-jwt"), null);
+});
+
+test("buildExternalIdpRefreshParams builds a public-client form body", () => {
+  const req = buildExternalIdpRefreshParams("RT-123", {
+    clientId: "app-guid",
+    tokenEndpoint: MS_ENDPOINT,
+    scopes: ["api://app-guid/codewhisperer:conversations", "offline_access"],
+  });
+  assert.equal(req.tokenEndpoint, MS_ENDPOINT);
+  assert.equal(req.body.get("grant_type"), "refresh_token");
+  assert.equal(req.body.get("client_id"), "app-guid");
+  assert.equal(req.body.get("refresh_token"), "RT-123");
+  assert.equal(
+    req.body.get("scope"),
+    "api://app-guid/codewhisperer:conversations offline_access"
+  );
+  // Public client: never a secret.
+  assert.equal(req.body.get("client_secret"), null);
+});
+
+test("buildExternalIdpRefreshParams fails closed on missing fields", () => {
+  assert.throws(() => buildExternalIdpRefreshParams("", { clientId: "x", tokenEndpoint: MS_ENDPOINT, scopes: "s" }));
+  assert.throws(() => buildExternalIdpRefreshParams("rt", { tokenEndpoint: MS_ENDPOINT, scopes: "s" }));
+  assert.throws(() => buildExternalIdpRefreshParams("rt", { clientId: "x", scopes: "s" }));
+  assert.throws(() => buildExternalIdpRefreshParams("rt", { clientId: "x", tokenEndpoint: MS_ENDPOINT }));
+});
+
+test("KiroService.refreshToken uses the org IdP tokenEndpoint for external_idp", async () => {
+  const { KiroService } = await import("../../src/lib/oauth/services/kiro.ts");
+  const ORIGINAL_FETCH = globalThis.fetch;
+  const calls: { url: string; body: string; contentType: string | null }[] = [];
+  globalThis.fetch = (async (url: string | URL | Request, init?: RequestInit) => {
+    const u = String(url);
+    const body = init?.body instanceof URLSearchParams ? init.body.toString() : String(init?.body ?? "");
+    calls.push({ url: u, body, contentType: (init?.headers as Record<string, string>)?.["Content-Type"] ?? null });
+    return new Response(
+      JSON.stringify({ access_token: "new-at", refresh_token: "rotated-rt", expires_in: 4481 }),
+      { status: 200, headers: { "Content-Type": "application/json" } }
+    );
+  }) as typeof fetch;
+  try {
+    const svc = new KiroService();
+    const res = await svc.refreshToken("RT-old", {
+      authMethod: "external_idp",
+      clientId: "app-guid",
+      tokenEndpoint: MS_ENDPOINT,
+      scopes: "codewhisperer:conversations offline_access",
+    });
+    assert.equal(res.accessToken, "new-at");
+    assert.equal(res.refreshToken, "rotated-rt");
+    assert.equal(calls.length, 1);
+    assert.equal(calls[0].url, MS_ENDPOINT);
+    assert.ok(calls[0].url.includes("login.microsoftonline.com"));
+    // Must NOT hit AWS OIDC or the Kiro social endpoint.
+    assert.ok(!calls[0].url.includes("amazonaws.com"));
+    assert.ok(!calls[0].url.includes("desktop.kiro.dev"));
+    assert.ok(calls[0].body.includes("grant_type=refresh_token"));
+    assert.ok(calls[0].body.includes("client_id=app-guid"));
+  } finally {
+    globalThis.fetch = ORIGINAL_FETCH;
+  }
+});
+
+test("KiroExecutor.buildHeaders sends TokenType: EXTERNAL_IDP only for external_idp", () => {
+  const exec = new KiroExecutor();
+  const idpHeaders = exec.buildHeaders({
+    accessToken: "at",
+    providerSpecificData: { authMethod: "external_idp" },
+  } as never);
+  assert.equal(idpHeaders[KIRO_EXTERNAL_IDP_TOKEN_TYPE_HEADER], KIRO_EXTERNAL_IDP_TOKEN_TYPE_VALUE);
+
+  const idcHeaders = exec.buildHeaders({
+    accessToken: "at",
+    providerSpecificData: { authMethod: "idc" },
+  } as never);
+  assert.equal(idcHeaders[KIRO_EXTERNAL_IDP_TOKEN_TYPE_HEADER], undefined);
+
+  const builderIdHeaders = exec.buildHeaders({ accessToken: "at" } as never);
+  assert.equal(builderIdHeaders[KIRO_EXTERNAL_IDP_TOKEN_TYPE_HEADER], undefined);
+});
diff --git a/tests/unit/kiro-iam-profilearn-usage.test.ts b/tests/unit/kiro-iam-profilearn-usage.test.ts
index 3afd99f2f4..9bfc7f4132 100644
--- a/tests/unit/kiro-iam-profilearn-usage.test.ts
+++ b/tests/unit/kiro-iam-profilearn-usage.test.ts
@@ -1,169 +1,227 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-
-import {
-  __testing,
-  buildKiroUsageResult,
-  discoverKiroProfileArn,
-} from "@omniroute/open-sse/services/usage.ts";
-
-const { getKiroUsage } = __testing;
-
-// Real-world shape returned by GetUsageLimits for an AWS IAM Identity Center ("KIRO POWER")
-// account — the usage is reported under resourceType "CREDIT" (not "AGENTIC_REQUEST").
-const IAM_CREDIT_RESPONSE = {
-  daysUntilReset: 0,
-  nextDateReset: 1.782864e9,
-  subscriptionInfo: { subscriptionTitle: "KIRO POWER", type: "Q_DEVELOPER_STANDALONE_POWER" },
-  usageBreakdownList: [
-    {
-      currency: "USD",
-      currentUsage: 3670,
-      currentUsageWithPrecision: 3670.9,
-      displayName: "Credit",
-      resourceType: "CREDIT",
-      unit: "INVOCATIONS",
-      usageLimit: 10000,
-      usageLimitWithPrecision: 10000.0,
-    },
-  ],
-};
-
-test("buildKiroUsageResult parses the IAM CREDIT breakdown into non-zero usage", () => {
-  const result = buildKiroUsageResult(IAM_CREDIT_RESPONSE) as {
-    plan: string;
-    quotas: Record<string, { used: number; total: number; remaining: number }>;
-  };
-  assert.ok("quotas" in result, "must return quotas for a CREDIT breakdown");
-  assert.equal(result.plan, "KIRO POWER");
-  const credit = result.quotas.credit;
-  assert.ok(credit, "CREDIT resource should map to a 'credit' quota key");
-  assert.equal(credit.used, 3670.9);
-  assert.equal(credit.total, 10000);
-  assert.equal(credit.remaining, 10000 - 3670.9);
-});
-
-test("discoverKiroProfileArn prefers the region-matched profile ARN", async () => {
-  const originalFetch = globalThis.fetch;
-  globalThis.fetch = (async () =>
-    new Response(
-      JSON.stringify({
-        profiles: [
-          { arn: "arn:aws:codewhisperer:us-east-1:111111111111:profile/AAAA" },
-          { arn: "arn:aws:codewhisperer:eu-central-1:820374639727:profile/RX4VNUHGHGAQ" },
-        ],
-      }),
-      { status: 200, headers: { "Content-Type": "application/json" } }
-    )) as typeof fetch;
-  try {
-    const arn = await discoverKiroProfileArn(
-      "tok",
-      "https://q.eu-central-1.amazonaws.com",
-      "eu-central-1"
-    );
-    assert.equal(arn, "arn:aws:codewhisperer:eu-central-1:820374639727:profile/RX4VNUHGHGAQ");
-  } finally {
-    globalThis.fetch = originalFetch;
-  }
-});
-
-test("discoverKiroProfileArn falls back to the first profile when no region match", async () => {
-  const originalFetch = globalThis.fetch;
-  globalThis.fetch = (async () =>
-    new Response(
-      JSON.stringify({ profiles: [{ arn: "arn:aws:codewhisperer:us-east-1:1:profile/X" }] }),
-      { status: 200, headers: { "Content-Type": "application/json" } }
-    )) as typeof fetch;
-  try {
-    const arn = await discoverKiroProfileArn("tok", "https://q.eu-west-1.amazonaws.com", "eu-west-1");
-    assert.equal(arn, "arn:aws:codewhisperer:us-east-1:1:profile/X");
-  } finally {
-    globalThis.fetch = originalFetch;
-  }
-});
-
-test("discoverKiroProfileArn returns undefined for empty profiles or non-ok response", async () => {
-  const originalFetch = globalThis.fetch;
-  try {
-    globalThis.fetch = (async () =>
-      new Response(JSON.stringify({ profiles: [] }), { status: 200 })) as typeof fetch;
-    assert.equal(
-      await discoverKiroProfileArn("tok", "https://q.eu-central-1.amazonaws.com", "eu-central-1"),
-      undefined
-    );
-
-    globalThis.fetch = (async () => new Response("nope", { status: 403 })) as typeof fetch;
-    assert.equal(
-      await discoverKiroProfileArn("tok", "https://q.eu-central-1.amazonaws.com", "eu-central-1"),
-      undefined
-    );
-  } finally {
-    globalThis.fetch = originalFetch;
-  }
-});
-
-// Regression: when a Kiro account added via Google/GitHub social-auth (authMethod "imported"
-// with provider "Google" or "Github" — set by /api/oauth/kiro/social-exchange/route.ts) has its
-// token rejected by the AWS CodeWhisperer quota API (401/403), surface a clear "auth expired,
-// chat may still work" message instead of throwing a generic upstream-error blob.
-test("getKiroUsage returns a friendly auth-expired message for social-auth Kiro on 401/403", async () => {
-  const originalFetch = globalThis.fetch;
-  // First call (ListAvailableProfiles for ARN discovery) succeeds with an ARN so we proceed
-  // to GetUsageLimits, which then returns 401. The friendly branch only applies when the
-  // GetUsageLimits call returned an auth-shaped error.
-  let callIdx = 0;
-  globalThis.fetch = (async (_url: string, init?: RequestInit) => {
-    callIdx += 1;
-    const target = String((init?.headers as Record<string, string> | undefined)?.["x-amz-target"] || "");
-    if (target.endsWith("ListAvailableProfiles")) {
-      return new Response(
-        JSON.stringify({ profiles: [{ arn: "arn:aws:codewhisperer:us-east-1:1:profile/SOCIAL" }] }),
-        { status: 200, headers: { "Content-Type": "application/json" } }
-      );
-    }
-    // GetUsageLimits → simulate the social-auth token rejection
-    return new Response(JSON.stringify({ __type: "AccessDeniedException" }), {
-      status: 401,
-      headers: { "Content-Type": "application/json" },
-    });
-  }) as typeof fetch;
-  try {
-    const result = (await getKiroUsage("social-tok", {
-      authMethod: "imported",
-      provider: "Google",
-    })) as { message?: string; quotas?: Record<string, unknown> };
-    assert.ok(result, "should resolve, not throw");
-    assert.ok(
-      typeof result.message === "string" && /authentication expired/i.test(result.message),
-      `expected an auth-expired message, got: ${JSON.stringify(result)}`
-    );
-    assert.deepEqual(result.quotas ?? {}, {});
-    assert.ok(callIdx >= 2, "GetUsageLimits should have been called after profile discovery");
-  } finally {
-    globalThis.fetch = originalFetch;
-  }
-});
-
-// IAM Identity Center / Builder-ID accounts must keep the existing throw-on-failure behavior so
-// transient upstream errors don't get silently masked as "auth expired".
-test("getKiroUsage still throws on 401/403 for non-social Kiro accounts (Builder-ID/IDC)", async () => {
-  const originalFetch = globalThis.fetch;
-  globalThis.fetch = (async (_url: string, init?: RequestInit) => {
-    const target = String((init?.headers as Record<string, string> | undefined)?.["x-amz-target"] || "");
-    if (target.endsWith("ListAvailableProfiles")) {
-      return new Response(
-        JSON.stringify({ profiles: [{ arn: "arn:aws:codewhisperer:us-east-1:1:profile/BID" }] }),
-        { status: 200, headers: { "Content-Type": "application/json" } }
-      );
-    }
-    return new Response("denied", { status: 401 });
-  }) as typeof fetch;
-  try {
-    await assert.rejects(
-      () => getKiroUsage("builder-tok", { authMethod: "builder-id" }),
-      /Failed to fetch Kiro usage/i
-    );
-  } finally {
-    globalThis.fetch = originalFetch;
-  }
-});
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  __testing,
+  buildKiroUsageResult,
+  discoverKiroProfileArn,
+} from "@omniroute/open-sse/services/usage.ts";
+
+const { getKiroUsage } = __testing;
+
+// Real-world shape returned by GetUsageLimits for an AWS IAM Identity Center ("KIRO POWER")
+// account — the usage is reported under resourceType "CREDIT" (not "AGENTIC_REQUEST").
+const IAM_CREDIT_RESPONSE = {
+  daysUntilReset: 0,
+  nextDateReset: 1.782864e9,
+  subscriptionInfo: { subscriptionTitle: "KIRO POWER", type: "Q_DEVELOPER_STANDALONE_POWER" },
+  usageBreakdownList: [
+    {
+      currency: "USD",
+      currentUsage: 3670,
+      currentUsageWithPrecision: 3670.9,
+      displayName: "Credit",
+      resourceType: "CREDIT",
+      unit: "INVOCATIONS",
+      usageLimit: 10000,
+      usageLimitWithPrecision: 10000.0,
+    },
+  ],
+};
+
+test("buildKiroUsageResult parses the IAM CREDIT breakdown into non-zero usage", () => {
+  const result = buildKiroUsageResult(IAM_CREDIT_RESPONSE) as {
+    plan: string;
+    quotas: Record<string, { used: number; total: number; remaining: number }>;
+  };
+  assert.ok("quotas" in result, "must return quotas for a CREDIT breakdown");
+  assert.equal(result.plan, "KIRO POWER");
+  const credit = result.quotas.credit;
+  assert.ok(credit, "CREDIT resource should map to a 'credit' quota key");
+  assert.equal(credit.used, 3670.9);
+  assert.equal(credit.total, 10000);
+  assert.equal(credit.remaining, 10000 - 3670.9);
+});
+
+test("discoverKiroProfileArn prefers the region-matched profile ARN", async () => {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = (async () =>
+    new Response(
+      JSON.stringify({
+        profiles: [
+          { arn: "arn:aws:codewhisperer:us-east-1:111111111111:profile/AAAA" },
+          { arn: "arn:aws:codewhisperer:eu-central-1:820374639727:profile/RX4VNUHGHGAQ" },
+        ],
+      }),
+      { status: 200, headers: { "Content-Type": "application/json" } }
+    )) as typeof fetch;
+  try {
+    const arn = await discoverKiroProfileArn(
+      "tok",
+      "https://q.eu-central-1.amazonaws.com",
+      "eu-central-1"
+    );
+    assert.equal(arn, "arn:aws:codewhisperer:eu-central-1:820374639727:profile/RX4VNUHGHGAQ");
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("discoverKiroProfileArn sends tokentype for API-key auth", async () => {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = (async (_url: string, init?: RequestInit) => {
+    const headers = init?.headers as Record<string, string>;
+    assert.equal(headers.tokentype, "API_KEY");
+    return new Response(
+      JSON.stringify({
+        profiles: [{ arn: "arn:aws:codewhisperer:us-east-1:1:profile/APIKEY" }],
+      }),
+      { status: 200, headers: { "Content-Type": "application/json" } }
+    );
+  }) as typeof fetch;
+  try {
+    const arn = await discoverKiroProfileArn(
+      "api-key",
+      "https://codewhisperer.us-east-1.amazonaws.com",
+      "us-east-1",
+      "api_key"
+    );
+    assert.equal(arn, "arn:aws:codewhisperer:us-east-1:1:profile/APIKEY");
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("discoverKiroProfileArn falls back to the first profile when no region match", async () => {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = (async () =>
+    new Response(
+      JSON.stringify({ profiles: [{ arn: "arn:aws:codewhisperer:us-east-1:1:profile/X" }] }),
+      { status: 200, headers: { "Content-Type": "application/json" } }
+    )) as typeof fetch;
+  try {
+    const arn = await discoverKiroProfileArn(
+      "tok",
+      "https://q.eu-west-1.amazonaws.com",
+      "eu-west-1"
+    );
+    assert.equal(arn, "arn:aws:codewhisperer:us-east-1:1:profile/X");
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("discoverKiroProfileArn returns undefined for empty profiles or non-ok response", async () => {
+  const originalFetch = globalThis.fetch;
+  try {
+    globalThis.fetch = (async () =>
+      new Response(JSON.stringify({ profiles: [] }), { status: 200 })) as typeof fetch;
+    assert.equal(
+      await discoverKiroProfileArn("tok", "https://q.eu-central-1.amazonaws.com", "eu-central-1"),
+      undefined
+    );
+
+    globalThis.fetch = (async () => new Response("nope", { status: 403 })) as typeof fetch;
+    assert.equal(
+      await discoverKiroProfileArn("tok", "https://q.eu-central-1.amazonaws.com", "eu-central-1"),
+      undefined
+    );
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+// Regression: when a Kiro account added via Google/GitHub social-auth (authMethod "imported"
+// with provider "Google" or "Github" — set by /api/oauth/kiro/social-exchange/route.ts) has its
+// token rejected by the AWS CodeWhisperer quota API (401/403), surface a clear "auth expired,
+// chat may still work" message instead of throwing a generic upstream-error blob.
+test("getKiroUsage returns a friendly auth-expired message for social-auth Kiro on 401/403", async () => {
+  const originalFetch = globalThis.fetch;
+  // First call (ListAvailableProfiles for ARN discovery) succeeds with an ARN so we proceed
+  // to GetUsageLimits, which then returns 401. The friendly branch only applies when the
+  // GetUsageLimits call returned an auth-shaped error.
+  let callIdx = 0;
+  globalThis.fetch = (async (_url: string, init?: RequestInit) => {
+    callIdx += 1;
+    const target = String(
+      (init?.headers as Record<string, string> | undefined)?.["x-amz-target"] || ""
+    );
+    if (target.endsWith("ListAvailableProfiles")) {
+      return new Response(
+        JSON.stringify({ profiles: [{ arn: "arn:aws:codewhisperer:us-east-1:1:profile/SOCIAL" }] }),
+        { status: 200, headers: { "Content-Type": "application/json" } }
+      );
+    }
+    // GetUsageLimits → simulate the social-auth token rejection
+    return new Response(JSON.stringify({ __type: "AccessDeniedException" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" },
+    });
+  }) as typeof fetch;
+  try {
+    const result = (await getKiroUsage("social-tok", {
+      authMethod: "imported",
+      provider: "Google",
+    })) as { message?: string; quotas?: Record<string, unknown> };
+    assert.ok(result, "should resolve, not throw");
+    assert.ok(
+      typeof result.message === "string" && /authentication expired/i.test(result.message),
+      `expected an auth-expired message, got: ${JSON.stringify(result)}`
+    );
+    assert.deepEqual(result.quotas ?? {}, {});
+    assert.ok(callIdx >= 2, "GetUsageLimits should have been called after profile discovery");
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("getKiroUsage sends tokentype for API-key quota requests", async () => {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = (async (_url: string, init?: RequestInit) => {
+    const headers = init?.headers as Record<string, string>;
+    assert.equal(headers.tokentype, "API_KEY");
+    return new Response(
+      JSON.stringify({
+        usageBreakdownList: [
+          {
+            resourceType: "AGENTIC_REQUEST",
+            currentUsageWithPrecision: 1,
+            usageLimitWithPrecision: 10,
+          },
+        ],
+      }),
+      { status: 200, headers: { "Content-Type": "application/json" } }
+    );
+  }) as typeof fetch;
+  try {
+    const result = (await getKiroUsage("api-key", {
+      authMethod: "api_key",
+      profileArn: "arn:aws:codewhisperer:us-east-1:1:profile/APIKEY",
+      region: "us-east-1",
+    })) as { quotas?: Record<string, { used: number }> };
+    assert.equal(result.quotas?.agentic_request.used, 1);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("getKiroUsage returns a friendly rejected-token message on repeated 401/403", async () => {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = (async () => {
+    return new Response("denied", { status: 401 });
+  }) as typeof fetch;
+  try {
+    const result = (await getKiroUsage("builder-tok", {
+      authMethod: "builder-id",
+      profileArn: "arn:aws:codewhisperer:us-east-1:1:profile/BID",
+    })) as { message?: string; quotas?: Record<string, unknown> };
+    assert.match(
+      result.message || "",
+      /quota API rejected the current token/i,
+      `expected friendly rejected-token message, got: ${JSON.stringify(result)}`
+    );
+    assert.deepEqual(result.quotas ?? {}, {});
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
diff --git a/tests/unit/kiro-idc-cross-region.test.ts b/tests/unit/kiro-idc-cross-region.test.ts
new file mode 100644
index 0000000000..6e34c44bb9
--- /dev/null
+++ b/tests/unit/kiro-idc-cross-region.test.ts
@@ -0,0 +1,267 @@
+/**
+ * Regression: Kiro enterprise IAM Identity Center accounts whose IdC instance lives OUTSIDE the
+ * two Amazon Q Developer profile regions (us-east-1 / eu-central-1) — e.g. eu-north-1 (Stockholm),
+ * start URL https://d-XXXX.awsapps.com/start.
+ *
+ * Root cause fixed here: the backend used the IdC/OIDC token region (eu-north-1) for every
+ * CodeWhisperer runtime call, hitting q.eu-north-1.amazonaws.com — a host that does not exist as a
+ * Q Developer runtime endpoint. Result: profileArn discovery failed (Limits showed nothing) and
+ * generateAssistantResponse failed (every request 502). AWS hosts the Q Developer PROFILE (and its
+ * runtime) only in us-east-1 / eu-central-1, regardless of the IdC region.
+ *
+ * The fix: the RUNTIME region is derived from the profileArn (us-east-1 / eu-central-1), and
+ * profileArn discovery probes those profile regions with the cross-region SSO token — never the
+ * IdC region.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  resolveKiroRuntimeRegion,
+  buildKiroProfileDiscoveryRegions,
+  discoverKiroProfileArnAcrossRegions,
+  kiroRuntimeHost,
+  regionFromKiroProfileArn,
+  KIRO_PROFILE_REGIONS,
+} from "../../open-sse/services/kiroRegion.ts";
+import { resolveKiroRegion as resolveExecutorRegion } from "../../open-sse/executors/kiro.ts";
+import { kiro } from "@/lib/oauth/providers/kiro";
+import { __testing } from "@omniroute/open-sse/services/usage.ts";
+
+const { getKiroUsage } = __testing;
+
+const EU_CENTRAL_ARN = "arn:aws:codewhisperer:eu-central-1:820374639727:profile/RX4VNUHGHGAQ";
+
+test("KIRO_PROFILE_REGIONS is exactly us-east-1 and eu-central-1", () => {
+  assert.deepEqual([...KIRO_PROFILE_REGIONS], ["us-east-1", "eu-central-1"]);
+});
+
+test("regionFromKiroProfileArn extracts the region from a CodeWhisperer ARN", () => {
+  assert.equal(regionFromKiroProfileArn(EU_CENTRAL_ARN), "eu-central-1");
+  assert.equal(
+    regionFromKiroProfileArn("arn:aws:codewhisperer:us-east-1:1:profile/X"),
+    "us-east-1"
+  );
+  assert.equal(regionFromKiroProfileArn(undefined), undefined);
+  assert.equal(regionFromKiroProfileArn("not-an-arn"), undefined);
+});
+
+test("resolveKiroRuntimeRegion: profileArn region beats the IdC (eu-north-1) stored region", () => {
+  // The exact failing scenario: IdC token region eu-north-1, profile in eu-central-1.
+  assert.equal(
+    resolveKiroRuntimeRegion({ region: "eu-north-1", profileArn: EU_CENTRAL_ARN }),
+    "eu-central-1"
+  );
+});
+
+test("resolveKiroRuntimeRegion: an IdC region that is not a Q profile region is ignored for runtime", () => {
+  // No profileArn yet, IdC region eu-north-1 → must NOT route to q.eu-north-1; fall back to us-east-1.
+  assert.equal(resolveKiroRuntimeRegion({ region: "eu-north-1" }), "us-east-1");
+  assert.equal(resolveKiroRuntimeRegion({ region: "us-west-1" }), "us-east-1");
+});
+
+test("resolveKiroRuntimeRegion: a valid stored profile region is honored, defaults to us-east-1", () => {
+  assert.equal(resolveKiroRuntimeRegion({ region: "eu-central-1" }), "eu-central-1");
+  assert.equal(resolveKiroRuntimeRegion({ region: "us-east-1" }), "us-east-1");
+  assert.equal(resolveKiroRuntimeRegion({}), "us-east-1");
+  assert.equal(resolveKiroRuntimeRegion(null), "us-east-1");
+});
+
+test("the executor's resolveKiroRegion routes an eu-north-1 IdC account to the profile region", () => {
+  assert.equal(
+    resolveExecutorRegion({
+      providerSpecificData: { region: "eu-north-1", profileArn: EU_CENTRAL_ARN },
+    }),
+    "eu-central-1"
+  );
+  // generateAssistantResponse must therefore target the real Q host, not q.eu-north-1.
+  assert.equal(kiroRuntimeHost("eu-central-1"), "https://q.eu-central-1.amazonaws.com");
+});
+
+test("buildKiroProfileDiscoveryRegions: EU IdC probes the profile regions first, then the IdC region", () => {
+  const regions = buildKiroProfileDiscoveryRegions("eu-north-1");
+  assert.deepEqual(regions, ["eu-central-1", "us-east-1", "eu-north-1"]);
+  // The profile regions (fast path) are tried BEFORE the IdC-region fallback.
+  assert.ok(regions.indexOf("eu-central-1") < regions.indexOf("eu-north-1"));
+  assert.ok(regions.indexOf("us-east-1") < regions.indexOf("eu-north-1"));
+  // Another EMEA IdC region → still EU-first, IdC region appended as fallback.
+  assert.deepEqual(buildKiroProfileDiscoveryRegions("me-central-1"), [
+    "eu-central-1",
+    "us-east-1",
+    "me-central-1",
+  ]);
+});
+
+test("buildKiroProfileDiscoveryRegions: non-EU IdC probes us-east-1 first, then the IdC region", () => {
+  assert.deepEqual(buildKiroProfileDiscoveryRegions("us-west-2"), [
+    "us-east-1",
+    "eu-central-1",
+    "us-west-2",
+  ]);
+  assert.deepEqual(buildKiroProfileDiscoveryRegions("ap-southeast-2"), [
+    "us-east-1",
+    "eu-central-1",
+    "ap-southeast-2",
+  ]);
+  // No stored region → just the two profile regions.
+  assert.deepEqual(buildKiroProfileDiscoveryRegions(undefined), ["us-east-1", "eu-central-1"]);
+});
+
+test("buildKiroProfileDiscoveryRegions: a stored profile region is probed first", () => {
+  assert.deepEqual(buildKiroProfileDiscoveryRegions("eu-central-1"), ["eu-central-1", "us-east-1"]);
+  assert.deepEqual(buildKiroProfileDiscoveryRegions("us-east-1"), ["us-east-1", "eu-central-1"]);
+});
+
+test("discoverKiroProfileArnAcrossRegions: eu-north-1 IdC finds the eu-central-1 profile, skips q.eu-north-1", async () => {
+  const requested: string[] = [];
+  const fetchImpl = (async (input: RequestInfo | URL) => {
+    const url = String(input);
+    requested.push(url);
+    // Simulate reality: q.eu-north-1 does not exist (network failure); eu-central-1 hosts the profile.
+    if (url.includes("eu-north-1")) throw new Error("ENOTFOUND q.eu-north-1.amazonaws.com");
+    if (url.includes("eu-central-1")) {
+      return new Response(JSON.stringify({ profiles: [{ arn: EU_CENTRAL_ARN }] }), { status: 200 });
+    }
+    // us-east-1 has no profile for this identity.
+    return new Response(JSON.stringify({ profiles: [] }), { status: 200 });
+  }) as unknown as typeof fetch;
+
+  const arn = await discoverKiroProfileArnAcrossRegions("sso-token", "eu-north-1", fetchImpl);
+  assert.equal(arn, EU_CENTRAL_ARN);
+  assert.ok(
+    requested.every((u) => !u.includes("eu-north-1")),
+    `must never probe q.eu-north-1, got: ${JSON.stringify(requested)}`
+  );
+  assert.ok(
+    requested.some((u) => u.startsWith("https://q.eu-central-1.amazonaws.com/")),
+    "must probe the eu-central-1 Q Developer host"
+  );
+});
+
+test("discoverKiroProfileArnAcrossRegions: a non-EU (ap-southeast-2) IdC resolves a us-east-1 profile", async () => {
+  // Proves the fix is general, not eu-north-1-specific: an APAC IdC's profile lives in a Q
+  // profile region (us-east-1 here) and is found via the cross-region SSO token.
+  const US_EAST_ARN = "arn:aws:codewhisperer:us-east-1:111111111111:profile/APAC";
+  const requested: string[] = [];
+  const fetchImpl = (async (input: RequestInfo | URL) => {
+    const url = String(input);
+    requested.push(url);
+    if (url.includes("us-east-1")) {
+      return new Response(JSON.stringify({ profiles: [{ arn: US_EAST_ARN }] }), { status: 200 });
+    }
+    return new Response(JSON.stringify({ profiles: [] }), { status: 200 });
+  }) as unknown as typeof fetch;
+
+  const arn = await discoverKiroProfileArnAcrossRegions("sso-token", "ap-southeast-2", fetchImpl);
+  assert.equal(arn, US_EAST_ARN);
+  assert.equal(
+    resolveKiroRuntimeRegion({ region: "ap-southeast-2", profileArn: arn }),
+    "us-east-1"
+  );
+  // The us-east-1 profile region is probed before the ap-southeast-2 IdC-region fallback.
+  assert.ok(requested.some((u) => u.startsWith("https://codewhisperer.us-east-1.amazonaws.com/")));
+});
+
+test("discoverKiroProfileArnAcrossRegions: no token / no profile yields undefined without throwing", async () => {
+  assert.equal(await discoverKiroProfileArnAcrossRegions("", "eu-north-1"), undefined);
+  const emptyFetch = (async () =>
+    new Response(JSON.stringify({ profiles: [] }), { status: 200 })) as unknown as typeof fetch;
+  assert.equal(
+    await discoverKiroProfileArnAcrossRegions("tok", "eu-north-1", emptyFetch),
+    undefined
+  );
+});
+
+test("kiro.postExchange (login) discovers the eu-central-1 profile for an eu-north-1 IdC token", async () => {
+  const originalFetch = global.fetch;
+  const requested: string[] = [];
+  global.fetch = (async (input: RequestInfo | URL) => {
+    const url = String(input);
+    requested.push(url);
+    if (url.includes("eu-north-1")) throw new Error("ENOTFOUND");
+    if (url.includes("eu-central-1")) {
+      return new Response(JSON.stringify({ profiles: [{ arn: EU_CENTRAL_ARN }] }), { status: 200 });
+    }
+    return new Response(JSON.stringify({ profiles: [] }), { status: 200 });
+  }) as typeof fetch;
+
+  try {
+    const extra = await kiro.postExchange({ access_token: "sso-token", _region: "eu-north-1" });
+    assert.deepEqual(extra, { profileArn: EU_CENTRAL_ARN });
+    assert.ok(requested.every((u) => !u.includes("eu-north-1")));
+  } finally {
+    global.fetch = originalFetch;
+  }
+});
+
+test("kiro.mapTokens keeps region=eu-north-1 (for OIDC refresh) AND stores the eu-central-1 profileArn", () => {
+  const mapped = kiro.mapTokens(
+    { access_token: "at", refresh_token: "rt", expires_in: 3600, _region: "eu-north-1" },
+    { profileArn: EU_CENTRAL_ARN }
+  );
+  // region stays the IdC/OIDC region so token refresh hits oidc.eu-north-1.amazonaws.com …
+  assert.equal(mapped.providerSpecificData.region, "eu-north-1");
+  // … while the profileArn carries the eu-central-1 runtime region for CodeWhisperer calls.
+  assert.equal(mapped.providerSpecificData.profileArn, EU_CENTRAL_ARN);
+});
+
+test("getKiroUsage: eu-north-1 IdC account resolves quota via the eu-central-1 profile", async () => {
+  const originalFetch = globalThis.fetch;
+  const requested: string[] = [];
+  globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const url = String(input);
+    const target = String(
+      (init?.headers as Record<string, string> | undefined)?.["x-amz-target"] || ""
+    );
+    requested.push(`${target} ${url}`);
+    // q.eu-north-1 must never be contacted.
+    if (url.includes("eu-north-1")) throw new Error("ENOTFOUND q.eu-north-1");
+    if (target.endsWith("ListAvailableProfiles")) {
+      if (url.includes("eu-central-1")) {
+        return new Response(JSON.stringify({ profiles: [{ arn: EU_CENTRAL_ARN }] }), {
+          status: 200,
+        });
+      }
+      return new Response(JSON.stringify({ profiles: [] }), { status: 200 });
+    }
+    // GetUsageLimits at the eu-central-1 host → real IAM CREDIT breakdown.
+    return new Response(
+      JSON.stringify({
+        subscriptionInfo: { subscriptionTitle: "KIRO POWER" },
+        usageBreakdownList: [
+          {
+            resourceType: "CREDIT",
+            currentUsageWithPrecision: 12,
+            usageLimitWithPrecision: 1000,
+          },
+        ],
+      }),
+      { status: 200, headers: { "Content-Type": "application/json" } }
+    );
+  }) as typeof fetch;
+
+  try {
+    // No persisted profileArn (the broken state), IdC region eu-north-1.
+    const result = (await getKiroUsage("sso-token", {
+      authMethod: "idc",
+      region: "eu-north-1",
+    })) as {
+      plan?: string;
+      quotas?: Record<string, { used: number; total: number }>;
+      message?: string;
+    };
+    assert.ok(result.quotas, `expected quotas, got: ${JSON.stringify(result)}`);
+    assert.equal(result.plan, "KIRO POWER");
+    assert.equal(result.quotas!.credit.used, 12);
+    assert.equal(result.quotas!.credit.total, 1000);
+    // GetUsageLimits must have gone to the eu-central-1 runtime host, never q.eu-north-1.
+    assert.ok(
+      requested.some((r) => r.includes("GetUsageLimits") && r.includes("eu-central-1")),
+      `GetUsageLimits should hit eu-central-1, got: ${JSON.stringify(requested)}`
+    );
+    assert.ok(requested.every((r) => !r.includes("eu-north-1")));
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
diff --git a/tests/unit/kiro-windows-auto-import-3363.test.ts b/tests/unit/kiro-windows-auto-import-3363.test.ts
index b3bbf12cfd..184a25a30a 100644
--- a/tests/unit/kiro-windows-auto-import-3363.test.ts
+++ b/tests/unit/kiro-windows-auto-import-3363.test.ts
@@ -24,6 +24,7 @@ const core = await import("../../src/lib/db/core.ts");
 const { GET } = await import("../../src/app/api/oauth/kiro/auto-import/route.ts");
 
 const ORIGINAL_HOME = process.env.HOME;
+const ORIGINAL_USERPROFILE = process.env.USERPROFILE;
 const ORIGINAL_APPDATA = process.env.APPDATA;
 const ORIGINAL_FETCH = globalThis.fetch;
 
@@ -37,12 +38,21 @@ test.beforeEach(() => {
   fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
   // Override HOME so homedir() returns a temp dir where no kiro-cli DB exists.
   process.env.HOME = tmpHome;
+  // On Windows os.homedir() reads USERPROFILE (not HOME), so isolate it too —
+  // otherwise the probe reads the real ~/.aws/sso/cache and can find an actual
+  // (e.g. external_idp organization) Kiro login on the test host.
+  process.env.USERPROFILE = tmpHome;
   // Ensure APPDATA is unset by default; individual tests that need it set it.
   delete process.env.APPDATA;
 });
 
 test.afterEach(() => {
   process.env.HOME = ORIGINAL_HOME;
+  if (ORIGINAL_USERPROFILE !== undefined) {
+    process.env.USERPROFILE = ORIGINAL_USERPROFILE;
+  } else {
+    delete process.env.USERPROFILE;
+  }
   if (ORIGINAL_APPDATA !== undefined) {
     process.env.APPDATA = ORIGINAL_APPDATA;
   } else {
diff --git a/tests/unit/ladder-engine-maps-6533.test.ts b/tests/unit/ladder-engine-maps-6533.test.ts
new file mode 100644
index 0000000000..8f1312634b
--- /dev/null
+++ b/tests/unit/ladder-engine-maps-6533.test.ts
@@ -0,0 +1,54 @@
+// Regression guard for #6533: the adaptive-compression ladder's AGGRESSIVENESS and
+// REDUCTION_FACTOR maps must cover every REAL registered catalog engine, not just the
+// 7 engines that ship in DEFAULT_LADDER. An engine missing from these maps falls back
+// to aggressivenessOf() === 0 (same as "off") and expectedReductionFactor() === 0.9
+// (the generic default), which breaks floor-mode escalation ranking for any ladder
+// (default or override) that includes it.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  aggressivenessOf,
+  expectedReductionFactor,
+} from "@omniroute/open-sse/services/compression/adaptiveCompression/ladder.ts";
+import { registerBuiltinCompressionEngines } from "@omniroute/open-sse/services/compression/engines/index.ts";
+import { listCompressionEngines } from "@omniroute/open-sse/services/compression/engines/registry.ts";
+
+registerBuiltinCompressionEngines();
+
+// Drive the assertion straight from the real, registered engine catalog so this test
+// stays in sync automatically if a new engine is added later.
+const REAL_ENGINE_IDS = listCompressionEngines().map((e) => e.id);
+
+test("every registered catalog engine has an aggressivenessOf() rank above the 'off' default", () => {
+  assert.ok(REAL_ENGINE_IDS.length > 0, "sanity: builtin engines must be registered");
+  const offRank = aggressivenessOf("off");
+  for (const id of REAL_ENGINE_IDS) {
+    assert.ok(
+      aggressivenessOf(id) > offRank,
+      `engine "${id}" must rank above "off" (got ${aggressivenessOf(id)}) — it is missing from AGGRESSIVENESS`
+    );
+  }
+});
+
+test("every registered catalog engine has a non-default expectedReductionFactor()", () => {
+  // The lookup's fallback for an unmapped engine is the generic 0.9 default. A real
+  // engine that is missing from REDUCTION_FACTOR would silently return exactly 0.9,
+  // which we can detect for every catalog id that isn't legitimately tuned to 0.9.
+  for (const id of REAL_ENGINE_IDS) {
+    const factor = aggressivenessOf(id) > 0 ? expectedReductionFactor(id) : null;
+    assert.ok(factor !== null, `engine "${id}" must be rankable`);
+    assert.ok(factor! > 0 && factor! < 1, `expectedReductionFactor("${id}") must be in (0,1)`);
+  }
+});
+
+test("aggressivenessOf ranks are internally consistent with described engine severity", () => {
+  // Structural/reversible engines (session-dedup, ccr) must rank below the prose-rewriting
+  // tier (caveman/aggressive/ultra).
+  assert.ok(aggressivenessOf("ccr") < aggressivenessOf("caveman"));
+  assert.ok(aggressivenessOf("session-dedup") < aggressivenessOf("ccr") || aggressivenessOf("session-dedup") <= aggressivenessOf("ccr"));
+  // Semantic-pruning engines (llmlingua, llm) must rank at/above "aggressive" and below/at "ultra".
+  assert.ok(aggressivenessOf("llmlingua") >= aggressivenessOf("aggressive"));
+  assert.ok(aggressivenessOf("llmlingua") <= aggressivenessOf("ultra"));
+  assert.ok(aggressivenessOf("llm") >= aggressivenessOf("llmlingua"));
+  assert.ok(aggressivenessOf("llm") <= aggressivenessOf("ultra"));
+});
diff --git a/tests/unit/list-uncovered-commits.test.ts b/tests/unit/list-uncovered-commits.test.ts
index a49cbcecfa..5ed0d1fe4b 100644
--- a/tests/unit/list-uncovered-commits.test.ts
+++ b/tests/unit/list-uncovered-commits.test.ts
@@ -2,7 +2,15 @@ import test from "node:test";
 import assert from "node:assert/strict";
 
 const mod = await import("../../scripts/release/list-uncovered-commits.mjs");
-const { refsOf, typeOf, computeUncovered, changelogRefWindow } = mod;
+const {
+  refsOf,
+  typeOf,
+  computeUncovered,
+  changelogRefWindow,
+  fragmentFilenameRef,
+  fragmentRefs,
+  collectChangelogRefs,
+} = mod;
 
 test("refsOf extracts every #N from a subject", () => {
   assert.deepEqual(refsOf("fix(x): thing (#5842) (#5901)"), [5842, 5901]);
@@ -61,3 +69,62 @@ test("changelogRefWindow scans [Unreleased] + the version section but not older
   assert.ok(refs.has(20), "picks up the target version refs");
   assert.ok(!refs.has(999), "does NOT bleed into the previous version");
 });
+
+// ── changelog.d fragment coverage (#6857) ────────────────────────────────────
+// Since fragments-first (#6783) a merged PR's changelog entry usually lives in
+// changelog.d/{features,fixes,maintenance}/<PR>-<slug>.md, NOT in CHANGELOG.md yet.
+// A commit whose #N only exists in a fragment must count as covered.
+
+test("fragmentFilenameRef reads the leading <N>- PR number from a fragment filename", () => {
+  assert.equal(fragmentFilenameRef("6708-gemma4-thinkingconfig-guard.md"), 6708);
+  assert.equal(fragmentFilenameRef("features/6072-ws-server.md"), 6072);
+  assert.equal(fragmentFilenameRef("README.md"), null, "non-numeric prefix → null");
+  assert.equal(fragmentFilenameRef(".gitkeep"), null);
+});
+
+test("fragmentRefs unions filename PR numbers with every #N in the body", () => {
+  const fragments = [
+    // no #N in the body — the ref lives ONLY in the filename (real case: 6708)
+    { name: "6708-gemma4-thinkingconfig-guard.md", body: "- **fix(sse):** skip thinkingConfig\n" },
+    // body cites additional refs beyond the filename
+    { name: "6709-xai-responses.md", body: "- **feat:** xAI (#6710 relates #6711)\n" },
+  ];
+  const refs = fragmentRefs(fragments);
+  assert.ok(refs.has(6708), "filename-only PR number is covered");
+  assert.ok(refs.has(6709), "filename PR number of a body-ref fragment");
+  assert.ok(refs.has(6710), "body #N is covered");
+  assert.ok(refs.has(6711), "every body #N is covered");
+});
+
+test("collectChangelogRefs unions the CHANGELOG window with changelog.d fragment refs", () => {
+  const cl = `# Changelog
+
+## [Unreleased]
+
+## [3.9.0] — x
+
+- **fix(a):** landed ([#20](u))
+
+---
+`;
+  const fragments = [{ name: "6708-gemma4.md", body: "- **fix(sse):** guard\n" }];
+  const refs = collectChangelogRefs(cl, "3.9.0", fragments);
+  assert.ok(refs.has(20), "still includes CHANGELOG.md refs");
+  assert.ok(refs.has(6708), "ALSO includes fragment-only refs (the #6857 bug)");
+});
+
+test("computeUncovered: a fragment-only ref counts as covered (end-to-end #6857)", () => {
+  // Repro: PR 6708 merged with a fragment (no #N in body, no CHANGELOG bullet yet).
+  const cl = "# Changelog\n\n## [Unreleased]\n\n## [3.9.0] — x\n\n---\n";
+  const fragments = [{ name: "6708-gemma4.md", body: "- **fix(sse):** guard\n" }];
+  const commits = [{ hash: "aa", subject: "fix(sse): gemma thinkingConfig guard (#6708)" }];
+
+  // BEFORE the fix, only the CHANGELOG window is scanned → the commit looks uncovered.
+  const windowOnly = computeUncovered(commits, changelogRefWindow(cl, "3.9.0"));
+  assert.equal(windowOnly.covered, 0, "sanity: CHANGELOG alone does not cover the fragment PR");
+
+  // AFTER the fix, the fragment ref set covers it.
+  const withFragments = computeUncovered(commits, collectChangelogRefs(cl, "3.9.0", fragments));
+  assert.equal(withFragments.covered, 1, "fragment ref makes the commit covered");
+  assert.equal(withFragments.uncovered.length, 0);
+});
diff --git a/tests/unit/live-ws-public-url.test.ts b/tests/unit/live-ws-public-url.test.ts
index 3595e43370..deff8cb926 100644
--- a/tests/unit/live-ws-public-url.test.ts
+++ b/tests/unit/live-ws-public-url.test.ts
@@ -68,7 +68,7 @@ test("handshake response includes publicUrl when NEXT_PUBLIC_LIVE_WS_PUBLIC_URL
   );
 
   assert.equal(response.status, 200);
-  const body = (await response.json()) as any;
+  const body = await response.json();
   assert.equal(body.live.publicUrl, "wss://ws.my-ai.com/live-ws");
 });
 
@@ -82,7 +82,7 @@ test("handshake response includes null publicUrl when NEXT_PUBLIC_LIVE_WS_PUBLIC
   );
 
   assert.equal(response.status, 200);
-  const body = (await response.json()) as any;
+  const body = await response.json();
   assert.equal(body.live.publicUrl, null);
 });
 
@@ -92,7 +92,7 @@ test("protocol.live.publicUrl reflects env set after module import (lazy read)",
   const response = await wsRoute.GET(new Request("http://localhost/api/v1/ws"));
 
   assert.equal(response.status, 426);
-  const body = (await response.json()) as any;
+  const body = await response.json();
   assert.equal(body.protocol.live.publicUrl, "wss://custom.example.com/ws");
 });
 
@@ -106,13 +106,13 @@ test("publicUrl with non-WebSocket scheme is rejected (null)", async () => {
   );
 
   assert.equal(response.status, 200);
-  const body = (await response.json()) as any;
+  const body = await response.json();
   assert.equal(body.live.publicUrl, null);
   assert.equal(body.protocol.live.publicUrl, null);
 });
 
 test("publicUrl with ws:// scheme is accepted", async () => {
-  process.env.NEXT_PUBLIC_LIVE_WS_PUBLIC_URL = "ws://lan-host:20129/live-ws";
+  process.env.NEXT_PUBLIC_LIVE_WS_PUBLIC_URL = "ws://lan-host:20132/live-ws";
 
   const response = await wsRoute.GET(
     new Request("http://localhost/api/v1/ws?handshake=1", {
@@ -121,6 +121,34 @@ test("publicUrl with ws:// scheme is accepted", async () => {
   );
 
   assert.equal(response.status, 200);
-  const body = (await response.json()) as any;
-  assert.equal(body.live.publicUrl, "ws://lan-host:20129/live-ws");
+  const body = await response.json();
+  assert.equal(body.live.publicUrl, "ws://lan-host:20132/live-ws");
+});
+
+test("handshake path is derived from NEXT_PUBLIC_LIVE_WS_PUBLIC_URL pathname", async () => {
+  process.env.NEXT_PUBLIC_LIVE_WS_PUBLIC_URL = "wss://ws.my-ai.com/my-custom-ws";
+
+  const response = await wsRoute.GET(
+    new Request("http://localhost/api/v1/ws?handshake=1", {
+      headers: { origin: "http://localhost" },
+    })
+  );
+
+  assert.equal(response.status, 200);
+  const body = await response.json();
+  assert.equal(body.live.path, "/my-custom-ws");
+});
+
+test("handshake path defaults to /live-ws when NEXT_PUBLIC_LIVE_WS_PUBLIC_URL is unset", async () => {
+  delete process.env.NEXT_PUBLIC_LIVE_WS_PUBLIC_URL;
+
+  const response = await wsRoute.GET(
+    new Request("http://localhost/api/v1/ws?handshake=1", {
+      headers: { origin: "http://localhost" },
+    })
+  );
+
+  assert.equal(response.status, 200);
+  const body = await response.json();
+  assert.equal(body.live.path, "/live-ws");
 });
diff --git a/tests/unit/livews-forward-backoff-4604.test.ts b/tests/unit/livews-forward-backoff-4604.test.ts
index d7fe6a2026..9b2e100585 100644
--- a/tests/unit/livews-forward-backoff-4604.test.ts
+++ b/tests/unit/livews-forward-backoff-4604.test.ts
@@ -6,7 +6,7 @@ import {
   __resetLiveWsForwardingState,
 } from "../../open-sse/handlers/chatCore/telemetryHelpers.ts";
 
-// #4604 — In single-port Docker deployments the live-WS sidecar (port 20129) is
+// #4604 — In single-port Docker deployments the live-WS sidecar (port 20132) is
 // not running, but forwardDashboardEventToLiveWs POSTed to it on every compression
 // event. Because the global fetch is proxyFetch, each ECONNREFUSED logged a
 // "[ProxyFetch] Undici dispatcher failed" warning — 272 times in 42 minutes. The
@@ -35,7 +35,7 @@ test("backs off after consecutive failures and stops calling fetch", async () =>
   let calls = 0;
   const fail = async () => {
     calls++;
-    throw new Error("connect ECONNREFUSED 127.0.0.1:20129");
+    throw new Error("connect ECONNREFUSED 127.0.0.1:20132");
   };
   const clock = makeClock();
   // First N attempts go through (and fail); after the threshold the forwarder
diff --git a/tests/unit/lmarena-provider.test.ts b/tests/unit/lmarena-provider.test.ts
index 96cae4d18e..3fb8081b3e 100644
--- a/tests/unit/lmarena-provider.test.ts
+++ b/tests/unit/lmarena-provider.test.ts
@@ -12,15 +12,59 @@ import {
   requiresWebSessionCredential,
   hasUsableWebSessionCredential,
 } from "../../src/shared/providers/webSessionCredentials.ts";
-import { LMArenaExecutor, parseArenaSSE } from "../../open-sse/executors/lmarena.ts";
+import {
+  LMArenaExecutor,
+  markLMArenaCatalogModelDead,
+  normalizeLMArenaModelsForCatalog,
+  parseArenaSSE,
+  parseLMArenaInitialModels,
+  pickLMArenaModelId,
+} from "../../open-sse/executors/lmarena.ts";
+import { clearLMArenaDeadCatalogModels } from "../../open-sse/executors/lmarena/models.ts";
+import { __setTlsFetchOverrideForTesting } from "../../open-sse/services/lmarenaTlsClient.ts";
+
+const TEST_ARENA_MODEL_ID = "019e080d-c29d-7d9a-aa54-faed41da0763";
+const UUID_V7_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+/** Protected BaseExecutor methods exercised by unit tests without `any`. */
+type LMArenaExecutorTestAccess = {
+  provider: string;
+  buildUrl: (model: string, credentials: unknown) => string;
+  buildHeaders: (model: string, credentials: unknown, body: unknown) => Record<string, string>;
+  transformRequest: (
+    body: unknown,
+    model: string,
+    credentials?: unknown
+  ) => {
+    id: string;
+    mode: string;
+    modality: string;
+    modelAId: string;
+    modelBId?: string;
+    userMessageId: string;
+    modelAMessageId: string;
+    modelBMessageId?: string;
+    recaptchaV3Token: string | null;
+    userMessage: {
+      content: string;
+      experimental_attachments: unknown[];
+      metadata: Record<string, unknown>;
+    };
+  };
+};
+
+function access(executor: LMArenaExecutor): LMArenaExecutorTestAccess {
+  return executor as unknown as LMArenaExecutorTestAccess;
+}
 
 describe("LMArena Provider Definition", () => {
   it("is registered in WEB_COOKIE_PROVIDERS", () => {
     assert.ok(WEB_COOKIE_PROVIDERS.lmarena, "lmarena should be in WEB_COOKIE_PROVIDERS");
     assert.equal(WEB_COOKIE_PROVIDERS.lmarena.id, "lmarena");
     assert.equal(WEB_COOKIE_PROVIDERS.lmarena.alias, "lma");
-    assert.equal(WEB_COOKIE_PROVIDERS.lmarena.name, "LMArena (Free)");
-    assert.equal(WEB_COOKIE_PROVIDERS.lmarena.website, "https://lmarena.ai");
+    assert.equal(WEB_COOKIE_PROVIDERS.lmarena.name, "Arena (Free)");
+    assert.equal(WEB_COOKIE_PROVIDERS.lmarena.textIcon, "AR");
+    assert.equal(WEB_COOKIE_PROVIDERS.lmarena.website, "https://arena.ai");
     assert.equal(WEB_COOKIE_PROVIDERS.lmarena.hasFree, true);
     assert.equal(WEB_COOKIE_PROVIDERS.lmarena.riskNoticeVariant, "webCookie");
   });
@@ -28,6 +72,7 @@ describe("LMArena Provider Definition", () => {
   it("has correct metadata", () => {
     const provider = WEB_COOKIE_PROVIDERS.lmarena;
     assert.ok(provider.freeNote, "Should have freeNote");
+    assert.ok(provider.freeNote.includes("formerly LMArena"), "Should note rebrand");
     assert.ok(provider.authHint, "Should have authHint");
     assert.ok(provider.icon, "Should have icon");
     assert.ok(provider.color, "Should have color");
@@ -44,10 +89,12 @@ describe("LMArena Credential Requirements", () => {
     const req = getWebSessionCredentialRequirement("lmarena");
     assert.ok(req, "Should have credential requirement");
     assert.equal(req.kind, "cookie");
-    // #3810: lmarena.ai's real auth cookie is `arena-auth-prod-v1`, not `session`
-    assert.equal(req.credentialName, "arena-auth-prod-v1");
+    // #3810: arena.ai's real auth cookie is `arena-auth-prod-v1`, not `session`;
+    // #4271: it is now split into Supabase SSR chunks.
+    assert.ok(req.credentialName.includes("arena-auth-prod-v1.0"));
+    assert.ok(req.credentialName.includes("arena-auth-prod-v1.1"));
     assert.ok(req.placeholder.includes("arena-auth-prod-v1"));
-    assert.ok(req.placeholder.includes("lmarena.ai"));
+    assert.ok(req.placeholder.includes("arena.ai"));
     assert.equal(req.acceptsFullCookieHeader, true);
     assert.ok(req.storageKeys.includes("cookie"));
     assert.ok(req.storageKeys.includes("arena-auth-prod-v1"));
@@ -71,19 +118,22 @@ describe("LMArena Executor", () => {
 
   it("has correct provider ID", () => {
     const executor = new LMArenaExecutor();
-    assert.equal((executor as any).provider, "lmarena");
+    assert.equal(access(executor).provider, "lmarena");
   });
 
-  it("builds correct URL (arena.ai/nextjs-api/stream)", () => {
+  it("builds correct URL (arena.ai/nextjs-api/stream/create-evaluation)", () => {
     const executor = new LMArenaExecutor();
-    const url = (executor as any).buildUrl("gpt-4", {});
+    const url = access(executor).buildUrl("gpt-4", {});
     assert.ok(url.includes("arena.ai"), "URL should include arena.ai");
-    assert.ok(url.includes("/nextjs-api/stream"), "URL should include /nextjs-api/stream");
+    assert.ok(
+      url.includes("/nextjs-api/stream/create-evaluation"),
+      "URL should include /nextjs-api/stream/create-evaluation"
+    );
   });
 
   it("builds headers with cookie", () => {
     const executor = new LMArenaExecutor();
-    const headers = (executor as any).buildHeaders("gpt-4", { cookie: "session=abc123" }, {});
+    const headers = access(executor).buildHeaders("gpt-4", { cookie: "session=abc123" }, {});
     assert.ok(headers.Cookie, "Should have Cookie header");
     assert.equal(headers.Cookie, "session=abc123");
     assert.equal(headers["Content-Type"], "application/json");
@@ -92,35 +142,28 @@ describe("LMArena Executor", () => {
 
   it("builds headers without cookie when not provided", () => {
     const executor = new LMArenaExecutor();
-    const headers = (executor as any).buildHeaders("gpt-4", {}, {});
+    const headers = access(executor).buildHeaders("gpt-4", {}, {});
     assert.ok(!headers.Cookie, "Should not have Cookie header when no cookie provided");
   });
 
   it("reads cookie from credentials correctly", () => {
     const executor = new LMArenaExecutor();
+    const ex = access(executor);
 
     // Direct cookie field
-    let headers = (executor as any).buildHeaders("gpt-4", { cookie: "session=abc" }, {});
+    let headers = ex.buildHeaders("gpt-4", { cookie: "session=abc" }, {});
     assert.equal(headers.Cookie, "session=abc");
 
     // apiKey field (dashboard form)
-    headers = (executor as any).buildHeaders("gpt-4", { apiKey: "session=def" }, {});
+    headers = ex.buildHeaders("gpt-4", { apiKey: "session=def" }, {});
     assert.equal(headers.Cookie, "session=def");
 
     // providerSpecificData.cookie
-    headers = (executor as any).buildHeaders(
-      "gpt-4",
-      { providerSpecificData: { cookie: "session=ghi" } },
-      {}
-    );
+    headers = ex.buildHeaders("gpt-4", { providerSpecificData: { cookie: "session=ghi" } }, {});
     assert.equal(headers.Cookie, "session=ghi");
 
     // Priority: direct > apiKey > providerSpecificData
-    headers = (executor as any).buildHeaders(
-      "gpt-4",
-      { cookie: "session=abc", apiKey: "session=def" },
-      {}
-    );
+    headers = ex.buildHeaders("gpt-4", { cookie: "session=abc", apiKey: "session=def" }, {});
     assert.equal(headers.Cookie, "session=abc");
   });
 
@@ -133,6 +176,15 @@ describe("LMArena Executor", () => {
     assert.equal(result.content, "Hello, world!");
   });
 
+  it("parses bare AI SDK text events (0: prefix)", () => {
+    const textEvent = '0:"Hello, world!"';
+    const result = parseArenaSSE(textEvent);
+
+    assert.ok(result, "Should parse text event");
+    assert.equal(result.type, "text");
+    assert.equal(result.content, "Hello, world!");
+  });
+
   it("parses LMArena SSE thinking events (ag: prefix)", () => {
     const thinkingEvent = 'ag:{"thinking":"Let me analyze this..."}';
     const result = parseArenaSSE(thinkingEvent);
@@ -142,6 +194,15 @@ describe("LMArena Executor", () => {
     assert.equal(result.content, "Let me analyze this...");
   });
 
+  it("parses bare AI SDK reasoning events (g: prefix)", () => {
+    const thinkingEvent = 'g:"Let me analyze this..."';
+    const result = parseArenaSSE(thinkingEvent);
+
+    assert.ok(result, "Should parse reasoning event");
+    assert.equal(result.type, "thinking");
+    assert.equal(result.content, "Let me analyze this...");
+  });
+
   it("parses LMArena SSE error events (a3: and ae: prefixes)", () => {
     const errorEvent1 = 'a3:{"error":"Rate limit exceeded"}';
     const result1 = parseArenaSSE(errorEvent1);
@@ -156,6 +217,15 @@ describe("LMArena Executor", () => {
     assert.equal(result2.content, "Invalid session");
   });
 
+  it("parses bare AI SDK error events (3: prefix)", () => {
+    const errorEvent = '3:"Rate limit exceeded"';
+    const result = parseArenaSSE(errorEvent);
+
+    assert.ok(result, "Should parse error event");
+    assert.equal(result.type, "error");
+    assert.equal(result.content, "Rate limit exceeded");
+  });
+
   it("parses LMArena SSE done event (ad: prefix)", () => {
     const doneEvent = "ad:{}";
     const result = parseArenaSSE(doneEvent);
@@ -164,6 +234,14 @@ describe("LMArena Executor", () => {
     assert.equal(result.type, "done");
   });
 
+  it("parses bare AI SDK finish events (d: prefix)", () => {
+    const doneEvent = 'd:{"finishReason":"stop"}';
+    const result = parseArenaSSE(doneEvent);
+
+    assert.ok(result, "Should parse done event");
+    assert.equal(result.type, "done");
+  });
+
   it("handles malformed SSE events gracefully", () => {
     const malformedEvent = "invalid:data";
     const result = parseArenaSSE(malformedEvent);
@@ -171,9 +249,9 @@ describe("LMArena Executor", () => {
     assert.equal(result, null, "Should return null for malformed events");
   });
 
-  it("transforms OpenAI messages to LMArena format", () => {
+  it("transforms OpenAI messages to LMArena create-evaluation format", () => {
     const executor = new LMArenaExecutor();
-    const transformRequest = (executor as any).transformRequest.bind(executor);
+    const transformRequest = access(executor).transformRequest.bind(access(executor));
 
     const openaiBody = {
       messages: [
@@ -189,9 +267,253 @@ describe("LMArena Executor", () => {
     const arenaBody = transformRequest(openaiBody, "gpt-4");
 
     assert.ok(arenaBody, "Should transform request body");
-    assert.ok(arenaBody.messages, "Should have messages array");
-    assert.equal(arenaBody.model, "gpt-4", "Should preserve model");
-    assert.equal(arenaBody.stream, true, "Should preserve stream flag");
+    assert.match(arenaBody.id, UUID_V7_RE, "Should have UUIDv7 evaluation session id");
+    assert.match(arenaBody.userMessageId, UUID_V7_RE, "Should have UUIDv7 user message id");
+    assert.match(arenaBody.modelAMessageId, UUID_V7_RE, "Should have UUIDv7 model message id");
+    assert.equal(arenaBody.mode, "direct-battle");
+    assert.equal(arenaBody.modality, "chat");
+    assert.equal(arenaBody.modelAId, "gpt-4", "Should set modelAId");
+    assert.equal(arenaBody.modelBId, undefined, "Should not set modelBId for direct mode");
+    assert.equal(arenaBody.modelBMessageId, undefined, "Should not set modelBMessageId");
+    assert.equal(arenaBody.recaptchaV3Token, null);
+    assert.deepEqual(arenaBody.userMessage.experimental_attachments, []);
+    assert.deepEqual(arenaBody.userMessage.metadata, {});
+    assert.ok(
+      arenaBody.userMessage.content.includes("You are a helpful assistant."),
+      "Should preserve system context in first prompt"
+    );
+    assert.ok(
+      arenaBody.userMessage.content.includes("How are you?"),
+      "Should preserve latest user prompt"
+    );
+  });
+
+  it("handles null request bodies when transforming requests", () => {
+    const executor = new LMArenaExecutor();
+    const arenaBody = access(executor).transformRequest(null, "gpt-4");
+
+    assert.equal(arenaBody.modelAId, "gpt-4");
+    assert.equal(arenaBody.userMessage.content, "");
+  });
+
+  it("maps display model names to Arena internal model ids", () => {
+    const models = [
+      {
+        id: "019e080d-c29d-7d9a-aa54-faed41da0763",
+        publicName: "gemini-3.1-pro-preview",
+        name: "gemini-3.1-pro-preview",
+        displayName: "Gemini 3.1 Pro Preview",
+        userSelectable: true,
+        capabilities: {
+          inputCapabilities: { text: true },
+          outputCapabilities: { text: true },
+        },
+        rankByModality: { chat: 18 },
+      },
+    ];
+
+    assert.equal(
+      pickLMArenaModelId("gemini-3.1-pro-preview", models),
+      "019e080d-c29d-7d9a-aa54-faed41da0763"
+    );
+    assert.equal(
+      pickLMArenaModelId("lmarena/Gemini 3.1 Pro Preview", models),
+      "019e080d-c29d-7d9a-aa54-faed41da0763"
+    );
+  });
+
+  it("prefers chat-capable ranked variants when public names are duplicated", () => {
+    const models = [
+      {
+        id: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+        publicName: "gemini-3.1-pro-preview",
+        displayName: "gemini-3.1-pro-preview",
+        userSelectable: true,
+        capabilities: {
+          inputCapabilities: { text: true },
+          outputCapabilities: { web: true },
+        },
+        rankByModality: { webdev: 29 },
+      },
+      {
+        id: "019e080d-c29d-7d9a-aa54-faed41da0763",
+        publicName: "gemini-3.1-pro-preview",
+        displayName: "gemini-3.1-pro-preview",
+        userSelectable: true,
+        capabilities: {
+          inputCapabilities: { text: true, image: true },
+          outputCapabilities: { text: true, web: true },
+        },
+        rankByModality: { chat: 18, webdev: 29 },
+      },
+    ];
+
+    assert.equal(
+      pickLMArenaModelId("gemini-3.1-pro-preview", models),
+      "019e080d-c29d-7d9a-aa54-faed41da0763"
+    );
+  });
+
+  it("drops unranked sentinel rows (huge chat rank) that usually 404 on probe", () => {
+    const models = [
+      {
+        id: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+        publicName: "mimo-v2.5-pro",
+        displayName: "mimo-v2.5-pro",
+        userSelectable: true,
+        capabilities: {
+          inputCapabilities: { text: true },
+          outputCapabilities: { text: true, web: true },
+        },
+        rankByModality: { chat: Number.MAX_SAFE_INTEGER },
+      },
+      {
+        id: "11111111-2222-3333-4444-555555555555",
+        name: "mimo-v2.5-pro",
+        publicName: "mimo-v2.5-pro",
+        displayName: "mimo-v2.5-pro",
+        organization: "xiaomi",
+        provider: "xiaomiV1",
+        userSelectable: true,
+        capabilities: {
+          inputCapabilities: { text: true },
+          outputCapabilities: { text: true, web: true },
+        },
+        rankByModality: { chat: 42 },
+      },
+    ];
+
+    assert.equal(
+      pickLMArenaModelId("mimo-v2.5-pro", models),
+      "11111111-2222-3333-4444-555555555555"
+    );
+    assert.deepEqual(normalizeLMArenaModelsForCatalog(models), [
+      {
+        id: "mimo-v2.5-pro",
+        name: "mimo-v2.5-pro",
+        owned_by: "xiaomi",
+        apiFormat: "chat-completions",
+        supportedEndpoints: ["chat"],
+      },
+    ]);
+  });
+
+  it("normalizes live initialModels into unique chat catalog ids", () => {
+    const models = [
+      {
+        id: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+        publicName: "gemini-3.1-pro-preview",
+        displayName: "gemini-3.1-pro-preview",
+        userSelectable: true,
+        capabilities: {
+          inputCapabilities: { text: true },
+          outputCapabilities: { web: true },
+        },
+        rankByModality: { webdev: 29 },
+      },
+      {
+        id: "019e080d-c29d-7d9a-aa54-faed41da0763",
+        publicName: "gemini-3.1-pro-preview",
+        displayName: "gemini-3.1-pro-preview",
+        organization: "google",
+        userSelectable: true,
+        capabilities: {
+          inputCapabilities: { text: true, image: true },
+          outputCapabilities: { text: true, web: true },
+        },
+        rankByModality: { chat: 18, webdev: 29 },
+      },
+      {
+        id: "99999999-9999-9999-9999-999999999999",
+        publicName: "hidden-model",
+        displayName: "Hidden Model",
+        userSelectable: false,
+        capabilities: {
+          inputCapabilities: { text: true },
+          outputCapabilities: { text: true },
+        },
+        rankByModality: { chat: 1 },
+      },
+    ];
+
+    assert.deepEqual(normalizeLMArenaModelsForCatalog(models), [
+      {
+        id: "gemini-3.1-pro-preview",
+        name: "gemini-3.1-pro-preview",
+        owned_by: "google",
+        supportsVision: true,
+        apiFormat: "chat-completions",
+        supportedEndpoints: ["chat"],
+      },
+    ]);
+  });
+
+  it("soft-excludes models marked dead after 404/502 probes", () => {
+    clearLMArenaDeadCatalogModels();
+    const models = [
+      {
+        id: "019e080d-c29d-7d9a-aa54-faed41da0763",
+        publicName: "gemini-3.1-pro-preview",
+        displayName: "gemini-3.1-pro-preview",
+        organization: "google",
+        userSelectable: true,
+        capabilities: {
+          inputCapabilities: { text: true, image: true },
+          outputCapabilities: { text: true },
+        },
+        rankByModality: { chat: 18 },
+      },
+    ];
+    assert.equal(normalizeLMArenaModelsForCatalog(models).length, 1);
+    markLMArenaCatalogModelDead("gemini-3.1-pro-preview");
+    assert.equal(normalizeLMArenaModelsForCatalog(models).length, 0);
+    clearLMArenaDeadCatalogModels();
+  });
+
+  it("keeps raw Arena ids unchanged when no model mapping is needed", () => {
+    assert.equal(pickLMArenaModelId(TEST_ARENA_MODEL_ID, []), TEST_ARENA_MODEL_ID);
+  });
+
+  it("resolves catalog public names via static Direct-chat allowlist (no arena.ai fetch)", async () => {
+    const executor = new LMArenaExecutor();
+    let arenaHomeFetches = 0;
+    __setTlsFetchOverrideForTesting(async (url) => {
+      if (url === "https://arena.ai/" || /arena\.ai\/?$/.test(url)) {
+        arenaHomeFetches++;
+        return { status: 200, headers: new Headers(), text: "<html></html>", body: null };
+      }
+      return {
+        status: 200,
+        headers: new Headers({ "Content-Type": "text/event-stream" }),
+        text: '0:"ok"\nd:{"finishReason":"stop"}\n',
+        body: null,
+      };
+    });
+
+    try {
+      const result = await executor.execute({
+        model: "gemini-3.1-pro-preview",
+        body: { messages: [{ role: "user", content: "Hello" }] },
+        credentials: { cookie: "session=test" },
+        signal: new AbortController().signal,
+        log: console,
+      });
+      assert.equal(result.response.status, 200);
+      // Model resolution must not scrape arena.ai home for initialModels.
+      assert.equal(arenaHomeFetches, 0);
+      // create-evaluation should receive the scraped Arena UUID, not the public name.
+      const body = result.transformedBody as { modelAId?: string };
+      assert.match(String(body.modelAId || ""), /^[0-9a-f-]{36}$/i);
+    } finally {
+      __setTlsFetchOverrideForTesting(null);
+    }
+  });
+
+  it("returns an empty model list when initialModels end marker is before the array", () => {
+    assert.deepEqual(
+      parseLMArenaInitialModels('"initialModelAId"],"initialModels":[{"id":"bad"}]'),
+      []
+    );
   });
 
   it("returns 401 when cookie is missing", async () => {
@@ -213,23 +535,27 @@ describe("LMArena Executor", () => {
 
   it("handles streaming response correctly", async () => {
     const executor = new LMArenaExecutor();
-
     const mockSSE = [
       'data: a0:{"text":"Hello"}\n\n',
       'data: a0:{"text":", world!"}\n\n',
       "data: ad:{}\n\n",
     ].join("");
 
-    const originalFetch = global.fetch;
-    global.fetch = async () =>
-      new Response(mockSSE, {
-        status: 200,
-        headers: { "Content-Type": "text/event-stream" },
-      });
+    __setTlsFetchOverrideForTesting(async () => ({
+      status: 200,
+      headers: new Headers({ "Content-Type": "text/event-stream" }),
+      text: null,
+      body: new ReadableStream({
+        start(controller) {
+          controller.enqueue(new TextEncoder().encode(mockSSE));
+          controller.close();
+        },
+      }),
+    }));
 
     try {
       const result = await executor.execute({
-        model: "gpt-4",
+        model: TEST_ARENA_MODEL_ID,
         body: { messages: [{ role: "user", content: "Hello" }], stream: true },
         credentials: { cookie: "session=test" },
         signal: new AbortController().signal,
@@ -239,28 +565,22 @@ describe("LMArena Executor", () => {
       assert.equal(result.response.status, 200, "Should return 200 for successful streaming");
       assert.ok(result.response.body, "Should have response body for streaming");
     } finally {
-      global.fetch = originalFetch;
+      __setTlsFetchOverrideForTesting(null);
     }
   });
 
   it("handles error response from LMArena API", async () => {
     const executor = new LMArenaExecutor();
-
-    const originalFetch = global.fetch;
-    global.fetch = async () =>
-      new Response(
-        JSON.stringify({
-          error: { message: "Rate limit exceeded" },
-        }),
-        {
-          status: 429,
-          headers: { "Content-Type": "application/json" },
-        }
-      );
+    __setTlsFetchOverrideForTesting(async () => ({
+      status: 429,
+      headers: new Headers({ "Content-Type": "application/json" }),
+      text: JSON.stringify({ error: { message: "Rate limit exceeded" } }),
+      body: null,
+    }));
 
     try {
       const result = await executor.execute({
-        model: "gpt-4",
+        model: TEST_ARENA_MODEL_ID,
         body: { messages: [{ role: "user", content: "Hello" }] },
         credentials: { cookie: "session=test" },
         signal: new AbortController().signal,
@@ -271,7 +591,43 @@ describe("LMArena Executor", () => {
       const errorBody = await result.response.json();
       assert.ok(errorBody.error, "Should have error object");
     } finally {
-      global.fetch = originalFetch;
+      __setTlsFetchOverrideForTesting(null);
+    }
+  });
+
+  it("forwards optional browser reCAPTCHA token from credentials", () => {
+    const executor = new LMArenaExecutor();
+    const body = access(executor).transformRequest(
+      { messages: [{ role: "user", content: "Hi" }] },
+      "gpt-4",
+      { cookie: "x=1", providerSpecificData: { recaptchaV3Token: "tok_abc" } }
+    );
+    assert.equal(body.recaptchaV3Token, "tok_abc");
+  });
+
+  it("surfaces Cloudflare challenge as bot-management error", async () => {
+    const executor = new LMArenaExecutor();
+    __setTlsFetchOverrideForTesting(async () => ({
+      status: 403,
+      headers: new Headers({ "Content-Type": "text/html" }),
+      text: "<html>Just a moment... challenges.cloudflare.com</html>",
+      body: null,
+    }));
+
+    try {
+      const result = await executor.execute({
+        model: TEST_ARENA_MODEL_ID,
+        body: { messages: [{ role: "user", content: "Hello" }] },
+        credentials: { cookie: "session=test" },
+        signal: new AbortController().signal,
+        log: console,
+      });
+      assert.equal(result.response.status, 403);
+      const err = await result.response.json();
+      assert.match(err.error.message, /Cloudflare|bot|recaptcha/i);
+      assert.equal(err.error.code, "cloudflare_or_bot");
+    } finally {
+      __setTlsFetchOverrideForTesting(null);
     }
   });
 });
diff --git a/tests/unit/lmarena-split-cookie-4271.test.ts b/tests/unit/lmarena-split-cookie-4271.test.ts
index 80b3049282..85c4350f50 100644
--- a/tests/unit/lmarena-split-cookie-4271.test.ts
+++ b/tests/unit/lmarena-split-cookie-4271.test.ts
@@ -17,10 +17,7 @@
 
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
-import {
-  LMArenaExecutor,
-  reconstructLMArenaCookie,
-} from "../../open-sse/executors/lmarena.ts";
+import { LMArenaExecutor, reconstructLMArenaCookie } from "../../open-sse/executors/lmarena.ts";
 import { getWebSessionCredentialRequirement } from "../../src/shared/providers/webSessionCredentials.ts";
 
 function cookieHeaderFor(credentials: unknown): string | undefined {
@@ -85,6 +82,28 @@ describe("LMArena split Supabase SSR cookie (#4271)", () => {
     assert.ok(reconstructed.includes("sidebar=open"), "should keep sidebar");
   });
 
+  it("reconstructs from separately stored providerSpecificData chunk keys", () => {
+    const header = cookieHeaderFor({
+      providerSpecificData: {
+        "arena-auth-prod-v1.0": "base64-eyJABC",
+        "arena-auth-prod-v1.1": "DEF.ghi",
+      },
+    });
+
+    assert.ok(header, "should set a Cookie header");
+    assert.equal(header, "arena-auth-prod-v1=base64-eyJABCDEF.ghi");
+  });
+
+  it("reconstructs from separately stored top-level chunk keys", () => {
+    const header = cookieHeaderFor({
+      "arena-auth-prod-v1.0": "base64-eyJABC",
+      "arena-auth-prod-v1.1": "DEF.ghi",
+    });
+
+    assert.ok(header, "should set a Cookie header");
+    assert.equal(header, "arena-auth-prod-v1=base64-eyJABCDEF.ghi");
+  });
+
   it("treats an empty base with no chunks as no usable session (returned as-is)", () => {
     const raw = "arena-auth-prod-v1=";
     const reconstructed = reconstructLMArenaCookie(raw);
diff --git a/tests/unit/logger-write-after-datadir-removed-6360.test.ts b/tests/unit/logger-write-after-datadir-removed-6360.test.ts
new file mode 100644
index 0000000000..26c6c2858c
--- /dev/null
+++ b/tests/unit/logger-write-after-datadir-removed-6360.test.ts
@@ -0,0 +1,109 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import pino from "pino";
+
+// Issue #6360: under CI load, unit-test FILES intermittently fail with
+//   "A resource generated asynchronous activity after the test ended ...
+//    ENOENT: no such file or directory, open '.../logs/application/app.log'"
+// even though every subtest in the file passed. Root cause: the pino file
+// transport is a worker-thread stream (`pino.transport()`, a `ThreadStream`)
+// that opens/writes its destination asynchronously. `pino({ transport: {...} })`
+// builds that stream internally but never attaches an `error` listener to it.
+// When a test's `after()` hook removes the tmp DATA_DIR the log file lives
+// under (as every test file's teardown already does) while the worker's
+// open()/write() is still in flight, the worker reports the failure back as
+// an `error` event on the main-thread stream — and since nothing is
+// listening, Node's EventEmitter re-throws it as an uncaughtException. node:test
+// then blames whichever file happens to be running when the async round-trip
+// lands, which is why the failure moves between files on every rerun.
+//
+// We reproduce the exact mechanism deterministically (rather than racing real
+// worker-thread timing, which is what makes the bug flaky in the first place):
+// grab the real transport stream pino built via the public `pino.symbols.streamSym`
+// handle and emit the same `error` event the worker would emit on a real ENOENT,
+// after removing the tmp DATA_DIR exactly like a test teardown does.
+//
+// Configure file logging BEFORE importing the logger (buildLogger runs at import time).
+const dir = mkdtempSync(join(tmpdir(), "omniroute-logger-6360-"));
+const logFile = join(dir, "logs", "application", "app.log");
+process.env.NODE_ENV = "production"; // JSON to file, simplest single-target-per-destination path
+process.env.APP_LOG_TO_FILE = "true";
+process.env.APP_LOG_FILE_PATH = logFile;
+process.env.APP_LOG_LEVEL = "debug";
+
+const { logger } = await import("../../src/shared/utils/logger.ts");
+
+function flushLogger(): Promise<void> {
+  return new Promise((resolveFlush) => {
+    try {
+      logger.flush(() => resolveFlush());
+    } catch {
+      resolveFlush();
+    }
+  });
+}
+
+test("logger's file transport stream carries an error listener (never an unhandled worker error)", () => {
+  const stream = (logger as unknown as Record<symbol, unknown>)[pino.symbols.streamSym] as {
+    listenerCount(event: string): number;
+  };
+  assert.ok(stream, "expected to retrieve the pino transport stream via pino.symbols.streamSym");
+  assert.ok(
+    stream.listenerCount("error") > 0,
+    "the file-transport stream must have an 'error' listener attached — otherwise a worker " +
+      "write failure (e.g. ENOENT after DATA_DIR is removed) re-throws as an uncaughtException (#6360)"
+  );
+});
+
+test("logger must not crash the process when its worker transport reports a write failure after DATA_DIR is removed (#6360)", async () => {
+  let uncaught: unknown = null;
+  const onUncaughtException = (err: unknown) => {
+    uncaught = err;
+  };
+  process.on("uncaughtException", onUncaughtException);
+
+  try {
+    logger.info({ phase: "before-removal" }, "line before DATA_DIR removal");
+
+    // Simulate the teardown every test file already does: rip out DATA_DIR
+    // while the logger's worker-thread transport is still alive.
+    rmSync(dir, { recursive: true, force: true });
+    assert.equal(existsSync(dir), false, "sanity: DATA_DIR must actually be gone");
+
+    // Simulate the worker thread reporting the resulting write failure back to
+    // the main thread — exactly what sonic-boom/thread-stream does on a real
+    // ENOENT from a vanished destination directory.
+    const stream = (logger as unknown as Record<symbol, unknown>)[pino.symbols.streamSym] as {
+      emit(event: string, ...args: unknown[]): boolean;
+    };
+    stream.emit(
+      "error",
+      Object.assign(new Error(`ENOENT: no such file or directory, open '${logFile}'`), {
+        code: "ENOENT",
+      })
+    );
+
+    // Give any (mis)handling a tick to surface as an uncaughtException before
+    // we assert — this is exactly the window in which #6360 fired "after the
+    // test ended".
+    await new Promise((r) => setTimeout(r, 50));
+
+    assert.equal(
+      uncaught,
+      null,
+      `logger transport write failure after DATA_DIR removal must not raise an uncaughtException: ${String(uncaught)}`
+    );
+  } finally {
+    process.removeListener("uncaughtException", onUncaughtException);
+  }
+});
+
+test.after(async () => {
+  await flushLogger();
+  if (existsSync(dir)) {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
diff --git a/tests/unit/management-auth-hardening.test.ts b/tests/unit/management-auth-hardening.test.ts
index 455e54c5b9..85116bb96e 100644
--- a/tests/unit/management-auth-hardening.test.ts
+++ b/tests/unit/management-auth-hardening.test.ts
@@ -98,6 +98,34 @@ test("provider validation routes require management authentication before readin
   }
 });
 
+test("provider param-filters route requires management authentication on GET/PUT/DELETE (#6649)", () => {
+  const routePath = "src/app/api/providers/[id]/param-filters/route.ts";
+  const content = fs.readFileSync(routePath, "utf8");
+
+  assert.ok(content.includes('from "@/lib/api/requireManagementAuth"'));
+
+  // GET, PUT, and DELETE must each gate on requireManagementAuth() before
+  // touching the param filter config.
+  const handlers = ["GET", "PUT", "DELETE"];
+  for (const handler of handlers) {
+    const handlerStart = content.indexOf(`export async function ${handler}(`);
+    assert.ok(handlerStart >= 0, `${routePath} is missing a ${handler} handler`);
+    const nextHandlerStart = content.indexOf("export async function", handlerStart + 1);
+    const handlerBody = content.slice(
+      handlerStart,
+      nextHandlerStart === -1 ? content.length : nextHandlerStart
+    );
+    assert.ok(
+      handlerBody.includes("const authError = await requireManagementAuth(request);"),
+      `${routePath} ${handler} handler must call requireManagementAuth(request)`
+    );
+    assert.ok(
+      handlerBody.includes("if (authError) return authError;"),
+      `${routePath} ${handler} handler must short-circuit on authError`
+    );
+  }
+});
+
 test("Antigravity CLI (agy) credential import routes require management authentication before reading the body", () => {
   // Routes that parse a JSON body — auth MUST run before request.json().
   const jsonBodyRoutes = [
@@ -221,6 +249,7 @@ test("management routes sanitize error.message before returning it to clients",
     "src/app/api/evals/[suiteId]/route.ts",
     "src/app/api/providers/[id]/models/route.ts",
     "src/app/api/providers/[id]/sync-models/route.ts",
+    "src/app/api/providers/[id]/param-filters/route.ts",
     "src/app/api/sessions/route.ts",
     "src/app/api/storage/health/route.ts",
     "src/app/api/sync/cloud/route.ts",
diff --git a/tests/unit/masked-200-exhaustion-fallback-6427.test.ts b/tests/unit/masked-200-exhaustion-fallback-6427.test.ts
new file mode 100644
index 0000000000..531c3401a3
--- /dev/null
+++ b/tests/unit/masked-200-exhaustion-fallback-6427.test.ts
@@ -0,0 +1,211 @@
+/**
+ * Issue #6427 — a `priority` combo must fail over to the next target when the
+ * first target returns HTTP 200 OK whose body masks credit/quota exhaustion:
+ * either a top-level OpenAI-shape `error` object, or a known exhaustion phrase
+ * living in the error envelope (`error.message`/top-level `message`/`detail`).
+ *
+ * Before this fix, `validateResponseQuality` (open-sse/services/combo/validateQuality.ts)
+ * only inspected `json.error` when `choices` was ALSO missing/empty — a masked 200
+ * that echoes a non-empty `choices` stub alongside the error slipped through as
+ * "valid" and the combo kept returning the dead target's response instead of
+ * failing over (#3424 already covers the narrower empty-`choices` case).
+ *
+ * Control case: a normal, valid completion whose assistant text merely MENTIONS
+ * "quota" in prose must NOT be misclassified as an upstream failure — the check
+ * only looks at the error envelope, never at `choices[].message.content`.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-masked200-6427-"));
+const ORIGINAL_DATA_DIR = process.env.DATA_DIR;
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const { handleComboChat } = await import("../../open-sse/services/combo.ts");
+const core = await import("../../src/lib/db/core.ts");
+const settingsDb = await import("../../src/lib/db/settings.ts");
+const { resetAllComboMetrics } = await import("../../open-sse/services/comboMetrics.ts");
+const { resetAllCircuitBreakers } = await import("../../src/shared/utils/circuitBreaker.ts");
+const { resetAll: resetAllSemaphores } = await import("../../open-sse/services/rateLimitSemaphore.ts");
+const { _resetAllDecks } = await import("../../src/shared/utils/shuffleDeck.ts");
+const { clearSessions } = await import("../../open-sse/services/sessionManager.ts");
+
+function createLog() {
+  const entries: unknown[] = [];
+  return {
+    info: (tag: unknown, msg: unknown) => entries.push({ level: "info", tag, msg }),
+    warn: (tag: unknown, msg: unknown) => entries.push({ level: "warn", tag, msg }),
+    error: (tag: unknown, msg: unknown) => entries.push({ level: "error", tag, msg }),
+    debug: (tag: unknown, msg: unknown) => entries.push({ level: "debug", tag, msg }),
+    entries,
+  };
+}
+
+function jsonResponse(body: unknown) {
+  return new Response(JSON.stringify(body), {
+    status: 200,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+async function cleanupTestDataDir() {
+  let lastError: unknown;
+  for (let attempt = 0; attempt < 5; attempt += 1) {
+    try {
+      core.resetDbInstance();
+      fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+      return;
+    } catch (error: unknown) {
+      lastError = error;
+      await new Promise((resolve) => setTimeout(resolve, 25));
+    }
+  }
+  if (lastError) throw lastError;
+}
+
+test.beforeEach(async () => {
+  resetAllComboMetrics();
+  resetAllCircuitBreakers();
+  resetAllSemaphores();
+  _resetAllDecks();
+  clearSessions();
+  await cleanupTestDataDir();
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+  await settingsDb.resetAllPricing();
+  settingsDb.clearAllLKGP();
+});
+
+test.after(async () => {
+  resetAllComboMetrics();
+  resetAllCircuitBreakers();
+  resetAllSemaphores();
+  _resetAllDecks();
+  settingsDb.clearAllLKGP();
+  if (ORIGINAL_DATA_DIR === undefined) {
+    delete process.env.DATA_DIR;
+  } else {
+    process.env.DATA_DIR = ORIGINAL_DATA_DIR;
+  }
+  await cleanupTestDataDir();
+  core.resetDbInstance();
+});
+
+test("#6427 priority combo falls back when the first target's 200 body carries a structured `error` object", async () => {
+  const calls: string[] = [];
+  const result = await handleComboChat({
+    body: {},
+    combo: {
+      name: "priority-masked-200-error",
+      strategy: "priority",
+      models: ["deadprovider/exhausted-model", "healthyprovider/backup-model"],
+      config: { maxRetries: 0, retryDelayMs: 0, fallbackDelayMs: 0 },
+    },
+    handleSingleModel: async (_body: unknown, modelStr: string) => {
+      calls.push(modelStr);
+      if (modelStr === "deadprovider/exhausted-model") {
+        // Masked 200: HTTP OK, with a NON-EMPTY stub `choices[0].message.content`
+        // (so the pre-existing #3424 empty-content check alone would call this
+        // "valid") AND a structured OpenAI-shape error object reporting
+        // exhaustion. Only the #6427 envelope check catches this.
+        return jsonResponse({
+          choices: [{ message: { role: "assistant", content: "Request could not be completed." } }],
+          error: { message: "Insufficient credits balance", type: "insufficient_quota" },
+        });
+      }
+      return jsonResponse({ choices: [{ message: { role: "assistant", content: "real answer" } }] });
+    },
+    isModelAvailable: async () => true,
+    log: createLog(),
+    settings: null,
+    allCombos: null,
+  });
+
+  assert.equal(result.ok, true, "combo must ultimately succeed via the fallback target");
+  assert.deepEqual(
+    calls,
+    ["deadprovider/exhausted-model", "healthyprovider/backup-model"],
+    "combo must fail over past the masked-200 target instead of returning it"
+  );
+  const bodyText = await result.clone().text();
+  assert.match(bodyText, /real answer/, "the returned body must be the fallback target's real answer");
+});
+
+test("#6427 priority combo falls back when the first target's 200 body carries a known exhaustion phrase (no structured error)", async () => {
+  const calls: string[] = [];
+  const result = await handleComboChat({
+    body: {},
+    combo: {
+      name: "priority-masked-200-phrase",
+      strategy: "priority",
+      models: ["deadprovider/exhausted-model", "healthyprovider/backup-model"],
+      config: { maxRetries: 0, retryDelayMs: 0, fallbackDelayMs: 0 },
+    },
+    handleSingleModel: async (_body: unknown, modelStr: string) => {
+      calls.push(modelStr);
+      if (modelStr === "deadprovider/exhausted-model") {
+        // Masked 200: NON-EMPTY stub choice content, no `error` object, but a
+        // top-level `message` field (a shape some providers use instead of the
+        // OpenAI `error` envelope) carries a recognizable exhaustion phrase.
+        return jsonResponse({
+          choices: [{ message: { role: "assistant", content: "Request could not be completed." } }],
+          message: "Quota exceeded for this account",
+        });
+      }
+      return jsonResponse({ choices: [{ message: { role: "assistant", content: "real answer" } }] });
+    },
+    isModelAvailable: async () => true,
+    log: createLog(),
+    settings: null,
+    allCombos: null,
+  });
+
+  assert.equal(result.ok, true, "combo must ultimately succeed via the fallback target");
+  assert.deepEqual(
+    calls,
+    ["deadprovider/exhausted-model", "healthyprovider/backup-model"],
+    "combo must fail over past the masked-200 target instead of returning it"
+  );
+});
+
+test("#6427 control: a normal 200 completion that merely mentions 'quota' in assistant prose is returned, not misclassified", async () => {
+  const calls: string[] = [];
+  const result = await handleComboChat({
+    body: {},
+    combo: {
+      name: "priority-quota-in-prose-control",
+      strategy: "priority",
+      models: ["healthyprovider/primary-model", "healthyprovider/backup-model"],
+      config: { maxRetries: 0, retryDelayMs: 0, fallbackDelayMs: 0 },
+    },
+    handleSingleModel: async (_body: unknown, modelStr: string) => {
+      calls.push(modelStr);
+      return jsonResponse({
+        choices: [
+          {
+            message: {
+              role: "assistant",
+              content:
+                "Sure — here is an explanation of API quota exceeded errors and insufficient credits handling in general.",
+            },
+          },
+        ],
+      });
+    },
+    isModelAvailable: async () => true,
+    log: createLog(),
+    settings: null,
+    allCombos: null,
+  });
+
+  assert.equal(result.ok, true, "combo must succeed on the first target");
+  assert.deepEqual(
+    calls,
+    ["healthyprovider/primary-model"],
+    "a legitimate completion mentioning 'quota'/'credits' in prose must NOT trigger a false-positive fallback"
+  );
+  const bodyText = await result.clone().text();
+  assert.match(bodyText, /quota exceeded/i, "the real assistant prose must be returned unchanged");
+});
diff --git a/tests/unit/mcp-tool-count-dedup-6854.test.ts b/tests/unit/mcp-tool-count-dedup-6854.test.ts
new file mode 100644
index 0000000000..f578a761cb
--- /dev/null
+++ b/tests/unit/mcp-tool-count-dedup-6854.test.ts
@@ -0,0 +1,83 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+// Regression for #6854: TOTAL_MCP_TOOL_COUNT (open-sse/mcp-server/server.ts) was a
+// plain additive sum across all registered tool collections. Three tools
+// (omniroute_agent_skills_list/get/coverage) are intentionally defined in BOTH
+// MCP_TOOLS (open-sse/mcp-server/schemas/tools.ts) and agentSkillTools
+// (open-sse/mcp-server/tools/agentSkillTools.ts), so the additive sum reported 99
+// while only 96 distinct tool names actually exist. countUniqueMcpTools
+// (open-sse/mcp-server/toolCount.ts) fixes this by unioning tool names into a Set
+// before counting, so a tool present in multiple collections is only counted once.
+
+const { countUniqueMcpTools } = await import("../../open-sse/mcp-server/toolCount.ts");
+const { MCP_TOOLS } = await import("../../open-sse/mcp-server/schemas/tools.ts");
+const { memoryTools } = await import("../../open-sse/mcp-server/tools/memoryTools.ts");
+const { skillTools } = await import("../../open-sse/mcp-server/tools/skillTools.ts");
+const { agentSkillTools } = await import("../../open-sse/mcp-server/tools/agentSkillTools.ts");
+const { githubSkillTools } = await import("../../open-sse/mcp-server/tools/githubSkillTools.ts");
+const { poolTools } = await import("../../open-sse/mcp-server/tools/poolTools.ts");
+const { gamificationTools } = await import("../../open-sse/mcp-server/tools/gamificationTools.ts");
+const { pluginTools } = await import("../../open-sse/mcp-server/tools/pluginTools.ts");
+const { notionTools } = await import("../../open-sse/mcp-server/tools/notionTools.ts");
+const { obsidianTools } = await import("../../open-sse/mcp-server/tools/obsidianTools.ts");
+
+type NamedTool = { name: string };
+
+function namesOf(collection: readonly NamedTool[] | Record<string, NamedTool>): string[] {
+  return Array.isArray(collection)
+    ? collection.map((t) => t.name)
+    : Object.values(collection).map((t) => t.name);
+}
+
+test("#6854: countUniqueMcpTools de-duplicates tools registered in multiple collections", () => {
+  // The agent-skills trio is intentionally present in both MCP_TOOLS and agentSkillTools.
+  const mcpToolsNames = namesOf(MCP_TOOLS as unknown as NamedTool[]);
+  const agentSkillNames = namesOf(agentSkillTools as unknown as Record<string, NamedTool>);
+  const overlap = mcpToolsNames.filter((n) => agentSkillNames.includes(n));
+  assert.ok(
+    overlap.length > 0,
+    "expected MCP_TOOLS and agentSkillTools to still share the agent-skills tool names " +
+      "(if this fails because the overlap was removed instead, this test's premise no " +
+      "longer applies and it should be revisited)"
+  );
+
+  const collections = {
+    MCP_TOOLS: MCP_TOOLS as unknown as NamedTool[],
+    memoryTools: memoryTools as unknown as Record<string, NamedTool>,
+    skillTools: skillTools as unknown as Record<string, NamedTool>,
+    agentSkillTools: agentSkillTools as unknown as Record<string, NamedTool>,
+    githubSkillTools: githubSkillTools as unknown as Record<string, NamedTool>,
+    poolTools: poolTools as unknown as Record<string, NamedTool>,
+    gamificationTools: gamificationTools as unknown as NamedTool[],
+    pluginTools: pluginTools as unknown as NamedTool[],
+    notionTools: notionTools as unknown as NamedTool[],
+    obsidianTools: obsidianTools as unknown as NamedTool[],
+  };
+
+  const total = countUniqueMcpTools(collections);
+
+  // Independently compute the "true" unique count by unioning every collection's
+  // tool names into a Set — this must equal countUniqueMcpTools's own result AND
+  // must be strictly less than the naive additive sum whenever there is overlap.
+  const uniqueNames = new Set<string>();
+  for (const collection of Object.values(collections)) {
+    for (const name of namesOf(collection)) uniqueNames.add(name);
+  }
+
+  const naiveAdditiveSum = Object.values(collections).reduce(
+    (sum, collection) => sum + namesOf(collection).length,
+    0
+  );
+
+  assert.equal(total, uniqueNames.size, "countUniqueMcpTools must equal the unique-name count");
+  assert.equal(
+    total,
+    naiveAdditiveSum - overlap.length,
+    "unique count must be exactly the additive sum minus the double-counted overlap"
+  );
+  assert.ok(
+    total < naiveAdditiveSum,
+    "unique count must be strictly less than the naive additive sum given a known overlap"
+  );
+});
diff --git a/tests/unit/merge-train-plan.test.ts b/tests/unit/merge-train-plan.test.ts
new file mode 100644
index 0000000000..770434d22d
--- /dev/null
+++ b/tests/unit/merge-train-plan.test.ts
@@ -0,0 +1,59 @@
+// Guards scripts/release/merge-train.sh (merge-gates.md §7 — batch validation of N
+// queued PRs as one merged result, replacing O(N²) per-PR CI re-runs). Only the
+// side-effect-free surface is testable in unit scope: --plan mode (no worktree, no
+// network) and argument validation.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const pExecFile = promisify(execFile);
+const SCRIPT = join(dirname(fileURLToPath(import.meta.url)), "../../scripts/release/merge-train.sh");
+
+async function run(args: string[]) {
+  try {
+    const { stdout, stderr } = await pExecFile("bash", [SCRIPT, ...args]);
+    return { code: 0, stdout, stderr };
+  } catch (err) {
+    const e = err as { code?: number; stdout?: string; stderr?: string };
+    return { code: e.code ?? -1, stdout: e.stdout ?? "", stderr: e.stderr ?? "" };
+  }
+}
+
+test("--plan prints the full step plan without touching anything and exits 0", async () => {
+  const { code, stdout } = await run(["--plan", "release/v9.9.9", "111", "222"]);
+  assert.equal(code, 0);
+  assert.match(stdout, /PLAN — base=origin\/release\/v9\.9\.9 prs=111 222/);
+  assert.match(stdout, /worktree add \.claude\/worktrees\/merge-train-/);
+  assert.match(stdout, /pull\/111\/head/);
+  assert.match(stdout, /pull\/222\/head/);
+  // the parity suite is fully enumerated in the plan
+  for (const gate of [
+    "typecheck:core",
+    "check-file-size.mjs",
+    "check-complexity.mjs",
+    "check-cognitive-complexity.mjs",
+    "check-changelog-integrity.mjs",
+    "TEST_SHARD=1/2",
+    "TEST_SHARD=2/2",
+    "test:vitest",
+  ]) {
+    assert.ok(stdout.includes(gate), `plan must include ${gate}`);
+  }
+  assert.match(stdout, /--admin evidence/);
+  assert.match(stdout, /teardown: git worktree remove/);
+});
+
+test("usage error without enough args", async () => {
+  const { code, stderr } = await run(["--plan", "release/v9.9.9"]);
+  assert.equal(code, 1);
+  assert.match(stderr, /usage:/);
+});
+
+test("rejects a non-numeric PR ref", async () => {
+  const { code, stderr } = await run(["--plan", "release/v9.9.9", "12a"]);
+  assert.equal(code, 1);
+  assert.match(stderr, /not numeric/);
+});
diff --git a/tests/unit/middleware-hooks-error-sanitization.test.ts b/tests/unit/middleware-hooks-error-sanitization.test.ts
new file mode 100644
index 0000000000..39aa6d534d
--- /dev/null
+++ b/tests/unit/middleware-hooks-error-sanitization.test.ts
@@ -0,0 +1,40 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+
+/**
+ * Hard Rule #12: catch-block error responses must route through
+ * `sanitizeErrorMessage()` (or `buildErrorBody()`), never return raw
+ * `err.message`. See docs/security/ERROR_SANITIZATION.md.
+ *
+ * These two routes wrap DB writes + registry `registerHook`, whose
+ * SQLite failures can surface with internal path fragments (e.g.
+ * "SQLITE_ERROR: near /var/lib/omniroute/..."). Guard against
+ * regression by asserting the raw `error?.message ||` pattern is
+ * absent and `sanitizeErrorMessage` is imported.
+ */
+
+const ROUTES = [
+  "src/app/api/middleware/hooks/route.ts",
+  "src/app/api/middleware/hooks/[name]/route.ts",
+];
+
+for (const path of ROUTES) {
+  test(`${path} imports sanitizeErrorMessage from open-sse/utils/error`, () => {
+    const source = readFileSync(path, "utf8");
+    assert.ok(
+      /import\s*\{[^}]*\bsanitizeErrorMessage\b[^}]*\}\s*from\s*["']@omniroute\/open-sse\/utils\/error["']/.test(
+        source
+      ),
+      `expected ${path} to import sanitizeErrorMessage from "@omniroute/open-sse/utils/error"`
+    );
+  });
+
+  test(`${path} does not return raw error?.message in NextResponse.json`, () => {
+    const source = readFileSync(path, "utf8");
+    assert.ok(
+      !/error\?\.message\s*\|\|/.test(source),
+      `expected ${path} to have no raw \`error?.message ||\` fallback (Hard Rule #12)`
+    );
+  });
+}
diff --git a/tests/unit/mimocode-executor.test.ts b/tests/unit/mimocode-executor.test.ts
index d56a499887..3c01022c31 100644
--- a/tests/unit/mimocode-executor.test.ts
+++ b/tests/unit/mimocode-executor.test.ts
@@ -485,3 +485,143 @@ describe("mimocode per-account proxy", () => {
     assert.strictEqual((testExec as any).proxyUrlMap.get(fp), "socks5://second.proxy:1080");
   });
 });
+
+// #2101/#4976 regression guard: a 400 from MiMoCode must be classified by body text
+// before deciding whether to rotate accounts. A rate-limit-style 400 (throttling
+// disguised as a 400, #4976) is rotation-worthy; a genuinely malformed 400 (#2101)
+// must fail fast on the FIRST account instead of being retried identically on every
+// account (which would waste N round-trips, cooldown every account, and hide the
+// real upstream diagnostic behind a generic "all accounts exhausted" error).
+interface TestAccountState {
+  fingerprint: string;
+  jwt: string;
+  expiresAt: number;
+  cooldownUntil: number;
+  consecutiveFails: number;
+}
+
+interface ExecutorAccountAccess {
+  accounts: TestAccountState[];
+  nextAccountIdx: number;
+}
+
+function accountAccess(exec: MimocodeExecutor): ExecutorAccountAccess {
+  return exec as unknown as ExecutorAccountAccess;
+}
+
+describe("mimocode 400 classification (#2101/#4976)", () => {
+  function makeJwt(): string {
+    const header = Buffer.from(JSON.stringify({ alg: "none" })).toString("base64url");
+    const payload = Buffer.from(
+      JSON.stringify({ exp: Math.floor(Date.now() / 1000) + 3600 })
+    ).toString("base64url");
+    return `${header}.${payload}.sig`;
+  }
+
+  function twoAccountExecutor(): MimocodeExecutor {
+    const exec = new MimocodeExecutor();
+    const access = accountAccess(exec);
+    access.accounts = [
+      { fingerprint: "acct-a", jwt: "", expiresAt: 0, cooldownUntil: 0, consecutiveFails: 0 },
+      { fingerprint: "acct-b", jwt: "", expiresAt: 0, cooldownUntil: 0, consecutiveFails: 0 },
+    ];
+    access.nextAccountIdx = 0;
+    return exec;
+  }
+
+  it("rotates to the next account on a rate-limit-text 400 (#4976)", async () => {
+    const testExec = twoAccountExecutor();
+    let chatCalls = 0;
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = (async (url: unknown) => {
+      const urlStr = String(url);
+      if (urlStr.includes("/api/free-ai/bootstrap")) {
+        return new Response(JSON.stringify({ jwt: makeJwt() }), { status: 200 });
+      }
+      if (urlStr.includes("/api/free-ai/openai/chat")) {
+        chatCalls++;
+        if (chatCalls === 1) {
+          // MiMoCode's non-standard rate-limit signal on a 400 status (#4976).
+          return new Response(
+            JSON.stringify({
+              error: { message: "Detected high-frequency non-compliant requests from you." },
+            }),
+            { status: 400 }
+          );
+        }
+        return new Response(JSON.stringify({ id: "ok", choices: [] }), { status: 200 });
+      }
+      throw new Error(`unexpected fetch: ${urlStr}`);
+    }) as typeof fetch;
+
+    try {
+      const result = await testExec.execute({
+        model: "mimo-auto",
+        body: { messages: [{ role: "user", content: "hi" }], stream: false },
+        stream: false,
+        signal: null,
+        credentials: {},
+        log: { debug: () => {}, info: () => {}, warn: () => {}, error: () => {} },
+      });
+
+      assert.strictEqual(chatCalls, 2, "should retry on the next account after the 400");
+      assert.strictEqual(result.response.status, 200);
+      const acctA = accountAccess(testExec).accounts[0];
+      assert.ok(acctA.cooldownUntil > Date.now(), "first account should be in cooldown");
+      assert.strictEqual(acctA.consecutiveFails, 1);
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+
+  it("fails fast without rotating on a malformed/generic 400 (#2101)", async () => {
+    const testExec = twoAccountExecutor();
+    let chatCalls = 0;
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = (async (url: unknown) => {
+      const urlStr = String(url);
+      if (urlStr.includes("/api/free-ai/bootstrap")) {
+        return new Response(JSON.stringify({ jwt: makeJwt() }), { status: 200 });
+      }
+      if (urlStr.includes("/api/free-ai/openai/chat")) {
+        chatCalls++;
+        return new Response(
+          JSON.stringify({ error: { message: "Invalid field: foo is not a recognized field" } }),
+          { status: 400 }
+        );
+      }
+      throw new Error(`unexpected fetch: ${urlStr}`);
+    }) as typeof fetch;
+
+    try {
+      const result = await testExec.execute({
+        model: "mimo-auto",
+        body: { messages: [{ role: "user", content: "hi" }], stream: false },
+        stream: false,
+        signal: null,
+        credentials: {},
+        log: { debug: () => {}, info: () => {}, warn: () => {}, error: () => {} },
+      });
+
+      assert.strictEqual(chatCalls, 1, "must NOT rotate to another account on a malformed 400");
+      const acctA = accountAccess(testExec).accounts[0];
+      assert.strictEqual(acctA.cooldownUntil, 0, "malformed 400 must not trigger cooldown");
+      assert.strictEqual(acctA.consecutiveFails, 0);
+
+      const response = result.response;
+      assert.strictEqual(response.status, 400);
+      const parsed = (await response.json()) as { error: { message: string; code?: string } };
+      assert.notStrictEqual(
+        parsed.error.code,
+        "NO_ACCOUNTS",
+        "must surface the real upstream 400, not a generic exhaustion error"
+      );
+      assert.ok(
+        parsed.error.message.toLowerCase().includes("invalid field"),
+        `expected the real upstream diagnostic in the error message, got: ${parsed.error.message}`
+      );
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+});
diff --git a/tests/unit/model-alias-provider-resolution.test.ts b/tests/unit/model-alias-provider-resolution.test.ts
index d300e08cad..32ef346b29 100644
--- a/tests/unit/model-alias-provider-resolution.test.ts
+++ b/tests/unit/model-alias-provider-resolution.test.ts
@@ -19,82 +19,82 @@ import assert from "node:assert/strict";
 
 import { getModelInfoCore } from "../../open-sse/services/model.ts";
 
-// ── Scenario A: direct exact alias "gpt-5.4" → "cx/gpt-5.4" ─────────────────
-// When aliases contain { "gpt-5.4": "cx/gpt-5.4" }, the request for "gpt-5.4"
+// ── Scenario A: direct exact alias "gpt-5.6-sol" → "cx/gpt-5.6-sol" ─────────
+// When aliases contain { "gpt-5.6-sol": "cx/gpt-5.6-sol" }, the request for "gpt-5.6-sol"
 // must resolve to provider "codex" (cx = codex alias), NOT "openai".
 
-test("A: custom alias gpt-5.4 → cx/gpt-5.4 resolves to codex, not openai", async () => {
-  const aliases = { "gpt-5.4": "cx/gpt-5.4" };
-  const result = await getModelInfoCore("gpt-5.4", aliases);
+test("A: custom alias gpt-5.6-sol → cx/gpt-5.6-sol resolves to codex, not openai", async () => {
+  const aliases = { "gpt-5.6-sol": "cx/gpt-5.6-sol" };
+  const result = await getModelInfoCore("gpt-5.6-sol", aliases);
   assert.strictEqual(
     result.provider,
     "codex",
     `Expected provider "codex" but got "${result.provider}" — alias was overridden by provider inference`
   );
-  assert.strictEqual(result.model, "gpt-5.4");
+  assert.strictEqual(result.model, "gpt-5.6-sol");
 });
 
-test("A: custom alias gpt-5.4 → cx/gpt-5.4 with async getter also resolves to codex", async () => {
-  const aliases = { "gpt-5.4": "cx/gpt-5.4" };
-  const result = await getModelInfoCore("gpt-5.4", async () => aliases);
+test("A: custom alias gpt-5.6-sol → cx/gpt-5.6-sol with async getter resolves to codex", async () => {
+  const aliases = { "gpt-5.6-sol": "cx/gpt-5.6-sol" };
+  const result = await getModelInfoCore("gpt-5.6-sol", async () => aliases);
   assert.strictEqual(result.provider, "codex");
-  assert.strictEqual(result.model, "gpt-5.4");
+  assert.strictEqual(result.model, "gpt-5.6-sol");
 });
 
-test("A: without alias, gpt-5.4 still resolves to openai via inference (baseline)", async () => {
+test("A: without alias, gpt-5.6-sol resolves to openai via inference (baseline)", async () => {
   // Ensure that inference still works when no alias is configured.
-  const result = await getModelInfoCore("gpt-5.4", {});
+  const result = await getModelInfoCore("gpt-5.6-sol", {});
   assert.strictEqual(result.provider, "openai");
-  assert.strictEqual(result.model, "gpt-5.4");
+  assert.strictEqual(result.model, "gpt-5.6-sol");
 });
 
-// ── Scenario B: wildcard alias "*gpt-5.4*" → "cx/gpt-5.4" ───────────────────
+// ── Scenario B: wildcard alias "*gpt-5.6*" → "cx/gpt-5.6-sol" ───────────────
 // Glob patterns are also supported via resolveWildcardAlias.
 
-test("B: wildcard alias *gpt-5.4* → cx/gpt-5.4 resolves to codex", async () => {
-  const aliases = { "*gpt-5.4*": "cx/gpt-5.4" };
-  const result = await getModelInfoCore("gpt-5.4", aliases);
+test("B: wildcard alias *gpt-5.6* → cx/gpt-5.6-sol resolves to codex", async () => {
+  const aliases = { "*gpt-5.6*": "cx/gpt-5.6-sol" };
+  const result = await getModelInfoCore("gpt-5.6-sol", aliases);
   assert.strictEqual(result.provider, "codex");
-  assert.strictEqual(result.model, "gpt-5.4");
+  assert.strictEqual(result.model, "gpt-5.6-sol");
 });
 
-test("B: wildcard alias *gpt-5* → cx/gpt-5.4 resolves to codex for gpt-5.4", async () => {
-  const aliases = { "*gpt-5*": "cx/gpt-5.4" };
-  const result = await getModelInfoCore("gpt-5.4", aliases);
+test("B: wildcard alias *gpt-5* → cx/gpt-5.6-sol resolves to codex", async () => {
+  const aliases = { "*gpt-5*": "cx/gpt-5.6-sol" };
+  const result = await getModelInfoCore("gpt-5.6-sol", aliases);
   assert.strictEqual(result.provider, "codex");
 });
 
-// ── Scenario C: explicit provider prefix "openai/gpt-5.4" ────────────────────
-// When the client sends "openai/gpt-5.4" explicitly, parseModel returns
+// ── Scenario C: explicit provider prefix "openai/gpt-5.6-sol" ────────────────
+// When the client sends "openai/gpt-5.6-sol" explicitly, parseModel returns
 // isAlias=false. This bypasses the alias lookup in getModelInfoCore (by design —
-// explicit provider prefixes override aliases). The alias "gpt-5.4 → cx/gpt-5.4"
+// explicit provider prefixes override aliases). The alias "gpt-5.6-sol → cx/gpt-5.6-sol"
 // should NOT apply here; this is intentional behavior.
-// NOTE: Aliases for "openai/gpt-5.4" → "cx/gpt-5.4" are a distinct key and
+// NOTE: Aliases for "openai/gpt-5.6-sol" → "cx/gpt-5.6-sol" are a distinct key and
 // must be configured explicitly if desired.
 
-test("C: explicit openai/gpt-5.4 resolves to openai regardless of bare alias", async () => {
-  // The alias is for bare "gpt-5.4", NOT for "openai/gpt-5.4".
+test("C: explicit openai/gpt-5.6-sol resolves to openai regardless of bare alias", async () => {
+  // The alias is for bare "gpt-5.6-sol", NOT for "openai/gpt-5.6-sol".
   // An explicit provider prefix takes precedence over aliases on the bare name.
-  const aliases = { "gpt-5.4": "cx/gpt-5.4" };
-  const result = await getModelInfoCore("openai/gpt-5.4", aliases);
+  const aliases = { "gpt-5.6-sol": "cx/gpt-5.6-sol" };
+  const result = await getModelInfoCore("openai/gpt-5.6-sol", aliases);
   assert.strictEqual(result.provider, "openai");
-  assert.strictEqual(result.model, "gpt-5.4");
+  assert.strictEqual(result.model, "gpt-5.6-sol");
 });
 
-test("C: explicit provider prefix alias openai/gpt-5.4 → cx/gpt-5.4 is NOT applied (isAlias=false path)", async () => {
+test("C: explicit openai/gpt-5.6-sol alias is not applied on the isAlias=false path", async () => {
   // A slashful input is NOT treated as an alias key by getModelInfoCore.
   // The alias lookup only runs when isAlias=true (bare model name).
-  // Users wanting to override openai/gpt-5.4 must configure cx/gpt-5.4 explicitly.
-  const aliases = { "openai/gpt-5.4": "cx/gpt-5.4" };
-  const result = await getModelInfoCore("openai/gpt-5.4", aliases);
-  // The slashful input is parsed as provider=openai, model=gpt-5.4 — alias not consulted
+  // Users wanting Codex must send cx/gpt-5.6-sol explicitly.
+  const aliases = { "openai/gpt-5.6-sol": "cx/gpt-5.6-sol" };
+  const result = await getModelInfoCore("openai/gpt-5.6-sol", aliases);
+  // The slashful input is parsed as provider=openai, model=gpt-5.6-sol — alias not consulted.
   assert.strictEqual(result.provider, "openai");
 });
 
 // ── Scenario D: non-gpt aliases are unaffected ───────────────────────────────
 
 test("D: unrelated models with no alias still route by inference", async () => {
-  const aliases = { "gpt-5.4": "cx/gpt-5.4" };
+  const aliases = { "gpt-5.6-sol": "cx/gpt-5.6-sol" };
   const result = await getModelInfoCore("gpt-4o", aliases);
   assert.strictEqual(result.provider, "openai");
   assert.strictEqual(result.model, "gpt-4o");
@@ -102,7 +102,10 @@ test("D: unrelated models with no alias still route by inference", async () => {
 
 test("D: claude model alias routes to requested provider", async () => {
   // Explicit alias for a multi-provider model wins over inference
-  const aliases = { "gpt-5.4": "cx/gpt-5.4", "my-claude": "anthropic/claude-opus-4-7" };
+  const aliases = {
+    "gpt-5.6-sol": "cx/gpt-5.6-sol",
+    "my-claude": "anthropic/claude-opus-4-7",
+  };
   const result = await getModelInfoCore("my-claude", aliases);
   assert.strictEqual(result.provider, "anthropic");
   assert.strictEqual(result.model, "claude-opus-4-7");
diff --git a/tests/unit/model-capability-overrides.test.ts b/tests/unit/model-capability-overrides.test.ts
new file mode 100644
index 0000000000..2857327e8f
--- /dev/null
+++ b/tests/unit/model-capability-overrides.test.ts
@@ -0,0 +1,83 @@
+import { describe, it, beforeEach, after } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const moduleDataDir = fs.mkdtempSync(path.join(os.tmpdir(), "omni-model-capability-overrides-"));
+process.env.DATA_DIR = moduleDataDir;
+
+const coreDb = await import("../../src/lib/db/core.ts");
+const caps = await import("../../src/lib/modelCapabilities.ts");
+const overrides = await import("../../src/lib/db/modelCapabilityOverrides.ts");
+
+beforeEach(() => {
+  coreDb.resetDbInstance();
+  fs.rmSync(moduleDataDir, { recursive: true, force: true });
+  fs.mkdirSync(moduleDataDir, { recursive: true });
+  coreDb.getDbInstance();
+});
+
+after(() => {
+  coreDb.resetDbInstance();
+  fs.rmSync(moduleDataDir, { recursive: true, force: true });
+});
+
+describe("model capability overrides", () => {
+  it("stores, lists, removes, and applies a provider/model max_token override", () => {
+    const withoutOverride = caps.getResolvedModelCapabilities({
+      provider: "openai",
+      model: "gpt-4o",
+    }).maxOutputTokens;
+    const distinct = (withoutOverride ?? 0) + 12345;
+
+    assert.equal(
+      overrides.setModelCapabilityOverride("openai/gpt-4o", "max_token", distinct),
+      true
+    );
+    assert.deepEqual(
+      overrides.listModelCapabilityOverrides().map((entry) => ({
+        target: entry.target,
+        key: entry.key,
+        value: entry.value,
+      })),
+      [{ target: "openai/gpt-4o", key: "max_token", value: distinct }]
+    );
+
+    assert.equal(
+      caps.getResolvedModelCapabilities({ provider: "openai", model: "gpt-4o" }).maxOutputTokens,
+      distinct
+    );
+    assert.notEqual(
+      caps.getResolvedModelCapabilities({ provider: "anthropic", model: "gpt-4o" }).maxOutputTokens,
+      distinct,
+      "override must be scoped by provider/model, not bare model id"
+    );
+
+    assert.equal(overrides.removeModelCapabilityOverride("openai/gpt-4o", "max_token"), true);
+    assert.equal(
+      caps.getResolvedModelCapabilities({ provider: "openai", model: "gpt-4o" }).maxOutputTokens,
+      withoutOverride
+    );
+  });
+
+  it("applies overrides stored under provider-scoped model aliases", () => {
+    assert.equal(
+      overrides.setModelCapabilityOverride("github/claude-opus-4.5", "max_token", 77777),
+      true
+    );
+
+    assert.equal(
+      caps.getResolvedModelCapabilities({ provider: "github", model: "claude-opus-4.5" })
+        .maxOutputTokens,
+      77777
+    );
+  });
+
+  it("rejects invalid targets and non-positive values", () => {
+    assert.equal(overrides.setModelCapabilityOverride("gpt-4o", "max_token", 1000), false);
+    assert.equal(overrides.setModelCapabilityOverride("openai/gpt-4o", "max_token", 0), false);
+    assert.equal(overrides.setModelCapabilityOverride("openai/gpt-4o", "max_token", 1.5), false);
+    assert.deepEqual(overrides.listModelCapabilityOverrides(), []);
+  });
+});
diff --git a/tests/unit/model-connid-prefix-normalization-6772.test.ts b/tests/unit/model-connid-prefix-normalization-6772.test.ts
new file mode 100644
index 0000000000..de9b1c5107
--- /dev/null
+++ b/tests/unit/model-connid-prefix-normalization-6772.test.ts
@@ -0,0 +1,86 @@
+/**
+ * PROBE for issue #6772 — custom OpenAI-compat <connId>/<listedModelId> 400s when the
+ * connection has a user-defined `prefix` and the listed model id (from /api/models)
+ * already carries that prefix baked in ("fta/vova/gpt-5.5").
+ *
+ * Root cause hypothesis: in src/sse/services/model.ts getModelInfo(), when a client
+ * addresses the connection by its raw internal node id (`<connId>/...`), the matching
+ * branch finds the node via `node.id === prefixToCheck` but returns `parsed.model`
+ * UNSTRIPPED of the node's own `prefix` — so `<connId>/<prefix>/<rawModelId>` resolves
+ * to `{ provider: connId, model: "<prefix>/<rawModelId>" }` instead of stripping the
+ * redundant prefix down to the actual registered custom model id `<rawModelId>`.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-probe-6772-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const modelsDb = await import("../../src/lib/db/models.ts");
+const { getModelInfo } = await import("../../src/sse/services/model.ts");
+
+const CONN_ID = "openai-compatible-chat-97b0e595-probe6772";
+const PREFIX = "fta";
+const RAW_MODEL_ID = "vova/gpt-5.5"; // upstream's own model id already has a slash
+
+test.before(async () => {
+  await providersDb.createProviderNode({
+    id: CONN_ID,
+    type: "openai-compatible",
+    name: "freetheai (probe)",
+    prefix: PREFIX,
+    baseUrl: "https://proxy.example.com",
+    chatPath: "/v1/chat/completions",
+    modelsPath: "/v1/models",
+  });
+  await modelsDb.addCustomModel(
+    CONN_ID,
+    RAW_MODEL_ID,
+    "vova gpt-5.5",
+    "manual",
+    "chat-completions",
+    ["chat"]
+  );
+});
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("#6772 baseline: bare alias form `fta/vova/gpt-5.5` resolves to the raw model id", async () => {
+  const info = (await getModelInfo(`${PREFIX}/${RAW_MODEL_ID}`)) as {
+    provider?: string;
+    model?: string;
+  };
+  assert.equal(info.provider, CONN_ID, "must resolve to the custom node via its prefix");
+  assert.equal(info.model, RAW_MODEL_ID, "model must be the raw registered custom model id");
+});
+
+test("#6772 baseline: `<connId>/vova/gpt-5.5` (no namespace) resolves to the raw model id", async () => {
+  const info = (await getModelInfo(`${CONN_ID}/${RAW_MODEL_ID}`)) as {
+    provider?: string;
+    model?: string;
+  };
+  assert.equal(info.provider, CONN_ID, "must resolve to the custom node via its internal id");
+  assert.equal(info.model, RAW_MODEL_ID, "model must be the raw registered custom model id");
+});
+
+test("#6772 RED: `<connId>/<prefix>/<rawModelId>` (naive owned_by+id concat) must normalize to the raw model id, not double-prefix", async () => {
+  const info = (await getModelInfo(`${CONN_ID}/${PREFIX}/${RAW_MODEL_ID}`)) as {
+    provider?: string;
+    model?: string;
+  };
+  assert.equal(info.provider, CONN_ID, "must resolve to the custom node via its internal id");
+  assert.equal(
+    info.model,
+    RAW_MODEL_ID,
+    `model must strip the node's own prefix "${PREFIX}/" so it matches the registered custom model id ` +
+      `"${RAW_MODEL_ID}" — got "${info.model}" instead (double-namespaced, will 400 upstream)`
+  );
+});
diff --git a/tests/unit/model-output-cap-synced-fallthrough-6714.test.ts b/tests/unit/model-output-cap-synced-fallthrough-6714.test.ts
new file mode 100644
index 0000000000..378a9914c5
--- /dev/null
+++ b/tests/unit/model-output-cap-synced-fallthrough-6714.test.ts
@@ -0,0 +1,130 @@
+/**
+ * #6714 follow-up — `getExplicitModelOutputCap` must fall through to the
+ * registry/spec output cap when a `synced` capability row exists but its
+ * `limit_output` is not a number.
+ *
+ * Root cause: the function used to short-circuit to `null` on ANY truthy
+ * `synced` row:
+ *
+ *   if (synced) return typeof synced.limit_output === "number" ? synced.limit_output : null;
+ *
+ * models.dev rows commonly omit `limit_output` (it stays `null`) even when
+ * the model itself has a well-known output cap registered in
+ * `providerRegistry.ts`. In that case the old code returned `null` instead
+ * of falling through — silently disabling the reasoning-token-buffer
+ * clamp added by #6714 (`clampReasoningTokensToOutputCap` in
+ * open-sse/services/combo.ts) for any model that happens to have a synced
+ * row without an output limit.
+ *
+ * The fix mirrors the `??`-chain precedence already used by
+ * `getResolvedModelCapabilities().maxOutputTokens`:
+ *
+ *   synced?.limit_output ?? registryModel?.maxOutputTokens ?? spec?.maxOutputTokens ?? null
+ *
+ * i.e. only return the synced value when it actually IS a number; otherwise
+ * fall through to the registry cap, then the static spec cap.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-output-cap-synced-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const modelsDevSync = await import("../../src/lib/modelsDevSync.ts");
+const modelCapabilities = await import("../../src/lib/modelCapabilities.ts");
+const { PROVIDER_MODELS } = await import("../../open-sse/config/providerModels.ts");
+
+// Pick a real registry model that has a known, positive maxOutputTokens so the
+// test proves the fallthrough resolves an ACTUAL registry cap, not a fixture.
+function findRegistryModelWithOutputCap() {
+  for (const [provider, models] of Object.entries(PROVIDER_MODELS)) {
+    for (const model of models as Array<{ id: string; maxOutputTokens?: number | null }>) {
+      if (typeof model.maxOutputTokens === "number" && model.maxOutputTokens > 0) {
+        return { provider, modelId: model.id, maxOutputTokens: model.maxOutputTokens };
+      }
+    }
+  }
+  throw new Error("no registry model with maxOutputTokens found — fixture assumption broke");
+}
+
+const { provider, modelId, maxOutputTokens } = findRegistryModelWithOutputCap();
+
+function buildCapability(overrides: Record<string, unknown> = {}) {
+  return {
+    tool_call: null,
+    reasoning: null,
+    attachment: null,
+    structured_output: null,
+    temperature: null,
+    modalities_input: "[]",
+    modalities_output: "[]",
+    knowledge_cutoff: null,
+    release_date: null,
+    last_updated: null,
+    status: null,
+    family: null,
+    open_weights: null,
+    limit_context: null,
+    limit_input: null,
+    limit_output: null,
+    interleaved_field: null,
+    ...overrides,
+  };
+}
+
+function resetStorage() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+  // The synced-capabilities module keeps an in-memory cache across DB resets
+  // (`cachedCapabilitiesLoadedAll`) — clear it too so each test starts from a
+  // truly empty synced-capability set instead of leaking the previous test's row.
+  modelsDevSync.clearModelsDevCapabilities();
+}
+
+test.beforeEach(() => {
+  resetStorage();
+});
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("#6714 synced row present but limit_output missing falls through to the registry output cap", () => {
+  // Seed a synced capability row for this exact provider/model with
+  // limit_output left null (mirrors real models.dev rows that omit it).
+  modelsDevSync.saveModelsDevCapabilities({
+    [provider]: {
+      [modelId]: buildCapability({ limit_output: null, status: "stable" }),
+    },
+  });
+
+  const cap = modelCapabilities.getExplicitModelOutputCap(`${provider}/${modelId}`);
+  assert.equal(
+    cap,
+    maxOutputTokens,
+    "must fall through to the registry maxOutputTokens, not short-circuit to null"
+  );
+});
+
+test("#6714 synced row with a real numeric limit_output still wins over the registry cap", () => {
+  const syncedOutputCap = maxOutputTokens + 1234;
+  modelsDevSync.saveModelsDevCapabilities({
+    [provider]: {
+      [modelId]: buildCapability({ limit_output: syncedOutputCap, status: "stable" }),
+    },
+  });
+
+  const cap = modelCapabilities.getExplicitModelOutputCap(`${provider}/${modelId}`);
+  assert.equal(cap, syncedOutputCap, "a real numeric synced limit_output must take precedence");
+});
+
+test("#6714 no synced row at all still resolves the registry output cap (no regression)", () => {
+  const cap = modelCapabilities.getExplicitModelOutputCap(`${provider}/${modelId}`);
+  assert.equal(cap, maxOutputTokens);
+});
diff --git a/tests/unit/model-parse.test.ts b/tests/unit/model-parse.test.ts
index cc2a950713..7f05dbf2d5 100644
--- a/tests/unit/model-parse.test.ts
+++ b/tests/unit/model-parse.test.ts
@@ -22,10 +22,10 @@ test("[1m] suffix: works with provider prefix", () => {
 });
 
 test("parseModel trims provider prefix and model id", () => {
-  const result = parseModel("  cx / gpt-5.4  ");
+  const result = parseModel("  cx / gpt-5.6-sol  ");
   assert.strictEqual(result.providerAlias, "cx");
   assert.strictEqual(result.provider, "codex");
-  assert.strictEqual(result.model, "gpt-5.4");
+  assert.strictEqual(result.model, "gpt-5.6-sol");
 });
 
 test("parseModel treats exact slashful model ids as models, not provider prefixes", () => {
diff --git a/tests/unit/model-sync-custom-preservation.test.ts b/tests/unit/model-sync-custom-preservation.test.ts
new file mode 100644
index 0000000000..c8f8fc7e67
--- /dev/null
+++ b/tests/unit/model-sync-custom-preservation.test.ts
@@ -0,0 +1,78 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+const TEST_DATA_DIR = fs.mkdtempSync(
+  path.join(os.tmpdir(), "omniroute-model-sync-custom-preservation-")
+);
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET ||= `test-model-sync-custom-${Date.now()}`;
+
+const core = await import("../../src/lib/db/core.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const modelsDb = await import("../../src/lib/db/models.ts");
+const modelSyncRoute = await import("../../src/app/api/providers/[id]/sync-models/route.ts");
+const scheduler = await import("../../src/shared/services/modelSyncScheduler.ts");
+
+const originalFetch = globalThis.fetch;
+
+test.after(() => {
+  globalThis.fetch = originalFetch;
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("model sync preserves response-only custom models during discovery", async () => {
+  const connection = await providersDb.createProviderConnection({
+    provider: "codex",
+    authType: "oauth",
+    name: "Codex Custom Preservation",
+    accessToken: "test-codex-token",
+    providerSpecificData: { workspaceId: "workspace-custom-preservation" },
+  });
+  await modelsDb.addCustomModel(
+    "codex",
+    "operator-private-codex",
+    "Operator Private Codex",
+    "manual",
+    "responses",
+    ["responses"],
+    "openai-responses",
+    { inputTokenLimit: 123456, outputTokenLimit: 6543 }
+  );
+  const before = await modelsDb.getCustomModels("codex");
+
+  globalThis.fetch = async (input) => {
+    const url = new URL(String(input));
+    if (url.pathname.includes("__readiness_probe__")) {
+      return new Response(null, { status: 404 });
+    }
+    if (url.pathname === `/api/providers/${connection.id}/models`) {
+      const models = [{ id: "future-codex-experimental", name: "Future Codex" }];
+      if (url.searchParams.get("excludeCustom") !== "true") {
+        models.push({ id: "operator-private-codex", name: "Operator Private Codex" });
+      }
+      return Response.json({ models, source: "api" });
+    }
+    throw new Error(`Unexpected fetch in custom preservation test: ${url.href}`);
+  };
+
+  const response = await modelSyncRoute.POST(
+    new Request(`http://localhost/api/providers/${connection.id}/sync-models?quiet=1`, {
+      method: "POST",
+      headers: scheduler.buildModelSyncInternalHeaders(),
+    }),
+    { params: { id: connection.id } }
+  );
+
+  assert.equal(response.status, 200);
+  assert.deepEqual(await modelsDb.getCustomModels("codex"), before);
+  assert.deepEqual(
+    (await modelsDb.getSyncedAvailableModelsForConnection("codex", connection.id)).map(
+      (model) => model.id
+    ),
+    ["future-codex-experimental"]
+  );
+});
diff --git a/tests/unit/model-sync-route.test.ts b/tests/unit/model-sync-route.test.ts
index ed62050236..0e71b96c17 100644
--- a/tests/unit/model-sync-route.test.ts
+++ b/tests/unit/model-sync-route.test.ts
@@ -74,7 +74,7 @@ test("model sync route skips success log when fetched models do not change store
     if (String(url).includes("__readiness_probe__")) return new Response(null, { status: 404 });
     assert.equal(
       String(url),
-      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true`
+      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true&excludeCustom=true`
     );
     return Response.json({
       models: [{ id: "custom-model-1", name: "Custom Model 1" }],
@@ -119,7 +119,7 @@ test("model sync route stores the real provider while keeping the account label"
     if (String(url).includes("__readiness_probe__")) return new Response(null, { status: 404 });
     assert.equal(
       String(url),
-      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true`
+      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true&excludeCustom=true`
     );
     return Response.json({
       models: [{ id: "custom-model-2", name: "Custom Model 2" }],
@@ -204,7 +204,7 @@ test("model sync route propagates upstream failures and records an error log ent
     if (String(url).includes("__readiness_probe__")) return new Response(null, { status: 404 });
     assert.equal(
       String(url),
-      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true`
+      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true&excludeCustom=true`
     );
     return Response.json({ error: "Provider upstream unavailable" }, { status: 502 });
   };
@@ -241,7 +241,7 @@ test("model sync route falls back to the upstream HTTP status when the models pa
     if (String(url).includes("__readiness_probe__")) return new Response(null, { status: 404 });
     assert.equal(
       String(url),
-      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true`
+      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true&excludeCustom=true`
     );
     return Response.json({}, { status: 429 });
   };
@@ -277,7 +277,7 @@ test("model sync route reports invalid JSON /models responses without losing ups
     if (String(url).includes("__readiness_probe__")) return new Response(null, { status: 404 });
     assert.equal(
       String(url),
-      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true`
+      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true&excludeCustom=true`
     );
     return new Response("<html>bad gateway</html>", {
       status: 200,
@@ -325,7 +325,7 @@ test("model sync route preserves previously synced models when the upstream omit
     if (String(url).includes("__readiness_probe__")) return new Response(null, { status: 404 });
     assert.equal(
       String(url),
-      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true`
+      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true&excludeCustom=true`
     );
     return Response.json({});
   };
@@ -369,7 +369,7 @@ test("model sync route writes synced available models for Gemini connections", a
     if (String(url).includes("__readiness_probe__")) return new Response(null, { status: 404 });
     assert.equal(
       String(url),
-      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true`
+      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true&excludeCustom=true`
     );
     return Response.json({
       models: [
@@ -433,7 +433,7 @@ test("model sync route writes synced available models for non-Gemini providers t
     if (String(url).includes("__readiness_probe__")) return new Response(null, { status: 404 });
     assert.equal(
       String(url),
-      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true`
+      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true&excludeCustom=true`
     );
     return Response.json({
       models: [
@@ -489,7 +489,7 @@ test("model sync route import mode merges discovered models without deleting man
     if (String(url).includes("__readiness_probe__")) return new Response(null, { status: 404 });
     assert.equal(
       String(url),
-      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true`
+      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true&excludeCustom=true`
     );
     return Response.json({
       models: [{ id: "router-v4", name: "Router V4" }],
@@ -555,7 +555,7 @@ test("model sync route import mode ignores supported endpoint ordering changes",
     if (String(url).includes("__readiness_probe__")) return new Response(null, { status: 404 });
     assert.equal(
       String(url),
-      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true`
+      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true&excludeCustom=true`
     );
     return Response.json({
       models: [
@@ -619,7 +619,7 @@ test("model sync route import mode reports updates without counting them as new
     if (String(url).includes("__readiness_probe__")) return new Response(null, { status: 404 });
     assert.equal(
       String(url),
-      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true`
+      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true&excludeCustom=true`
     );
     return Response.json({
       models: [
@@ -693,7 +693,7 @@ test("model sync route records added, removed, and updated model diffs with fall
     if (String(url).includes("__readiness_probe__")) return new Response(null, { status: 404 });
     assert.equal(
       String(url),
-      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true`
+      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true&excludeCustom=true`
     );
     return Response.json({
       models: [
@@ -772,7 +772,7 @@ test("model sync route forwards cookies, filters built-ins, and syncs aliases fo
     if (String(url).includes("__readiness_probe__")) return new Response(null, { status: 404 });
     assert.equal(
       String(url),
-      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true`
+      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true&excludeCustom=true`
     );
     assert.equal(init.headers.cookie, "session=test-cookie");
     assert.equal(
@@ -837,7 +837,7 @@ test("model sync route reports synced managed models separately from preserved m
     if (String(url).includes("__readiness_probe__")) return new Response(null, { status: 404 });
     assert.equal(
       String(url),
-      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true`
+      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true&excludeCustom=true`
     );
     return Response.json({
       models: [{ id: "router-v4", name: "Router V4" }],
@@ -902,7 +902,7 @@ test("model sync route uses provider-node prefixes when syncing compatible-provi
     if (String(url).includes("__readiness_probe__")) return new Response(null, { status: 404 });
     assert.equal(
       String(url),
-      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true`
+      `http://127.0.0.1:20128/api/providers/${connection.id}/models?refresh=true&excludeCustom=true`
     );
     return Response.json({
       models: [{ id: "sonnet-4-6", name: "Sonnet 4.6" }],
@@ -957,7 +957,7 @@ test("model sync route falls back to in-process discovery when internal self-fet
 
     fetchCalls.push(urlString);
 
-    if (urlString === `http://localhost/api/providers/${connection.id}/models?refresh=true`) {
+    if (urlString.includes("/models?refresh=true&excludeCustom=true")) {
       throw new Error("fetch failed");
     }
 
@@ -1004,7 +1004,7 @@ test("model sync route falls back to in-process discovery when internal self-fet
   // Route forces IPv4 origin (http://127.0.0.1:PORT) — never "localhost" — to avoid
   // ::1 (IPv6) resolution issues in containers. PORT defaults to 20128 when env unset.
   const expectedPort = process.env.OMNIROUTE_PORT || process.env.PORT || "20128";
-  const selfFetchUrl = `http://127.0.0.1:${expectedPort}/api/providers/${connection.id}/models?refresh=true`;
+  const selfFetchUrl = `http://127.0.0.1:${expectedPort}/api/providers/${connection.id}/models?refresh=true&excludeCustom=true`;
   assert.equal(
     fetchCalls.slice(0, 3).every((u) => u === selfFetchUrl),
     true,
diff --git a/tests/unit/model-sync-scheduler.test.ts b/tests/unit/model-sync-scheduler.test.ts
index 1204666683..449c91475b 100644
--- a/tests/unit/model-sync-scheduler.test.ts
+++ b/tests/unit/model-sync-scheduler.test.ts
@@ -130,6 +130,157 @@ test("modelSyncScheduler: internal auth headers validate only for scheduler requ
   assert.equal(isModelSyncInternalRequest(externalRequest), false);
 });
 
+test("modelSyncScheduler resolves only loopback origins and uses the dashboard port", async () => {
+  const previous = {
+    OMNIROUTE_PORT: process.env.OMNIROUTE_PORT,
+    PORT: process.env.PORT,
+    DASHBOARD_PORT: process.env.DASHBOARD_PORT,
+    BASE_URL: process.env.BASE_URL,
+    NEXT_PUBLIC_BASE_URL: process.env.NEXT_PUBLIC_BASE_URL,
+    NEXT_PUBLIC_APP_URL: process.env.NEXT_PUBLIC_APP_URL,
+    OMNIROUTE_BASE_PATH: process.env.OMNIROUTE_BASE_PATH,
+    OMNIROUTE_INTERNAL_SCHEME: process.env.OMNIROUTE_INTERNAL_SCHEME,
+    OMNIROUTE_TLS_CERT: process.env.OMNIROUTE_TLS_CERT,
+    OMNIROUTE_TLS_KEY: process.env.OMNIROUTE_TLS_KEY,
+  };
+  process.env.OMNIROUTE_PORT = "20128";
+  process.env.PORT = "22128";
+  process.env.DASHBOARD_PORT = "22128";
+  process.env.BASE_URL = "https://attacker.example";
+  delete process.env.NEXT_PUBLIC_BASE_URL;
+  delete process.env.NEXT_PUBLIC_APP_URL;
+  process.env.OMNIROUTE_BASE_PATH = "/omniroute/";
+  delete process.env.OMNIROUTE_INTERNAL_SCHEME;
+  delete process.env.OMNIROUTE_TLS_CERT;
+  delete process.env.OMNIROUTE_TLS_KEY;
+
+  try {
+    const scheduler = await loadScheduler("trusted-loopback-origin");
+    assert.equal(scheduler.getModelSyncInternalBaseUrl(), "http://127.0.0.1:22128/omniroute");
+    assert.equal(
+      scheduler.resolveModelSyncInternalBaseUrl("https://attacker.example/steal"),
+      "http://127.0.0.1:22128/omniroute"
+    );
+    assert.equal(
+      scheduler.resolveModelSyncInternalBaseUrl("http://127.0.0.1:7777/nested/path"),
+      "http://127.0.0.1:22128/omniroute"
+    );
+    assert.equal(
+      scheduler.resolveModelSyncInternalBaseUrl("http://0.0.0.0:7777/nested/path"),
+      "http://127.0.0.1:22128/omniroute"
+    );
+    assert.equal(
+      scheduler.resolveModelSyncInternalBaseUrl("http://user:pass@localhost:7777"),
+      "http://127.0.0.1:22128/omniroute"
+    );
+  } finally {
+    for (const [key, value] of Object.entries(previous)) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+  }
+});
+
+test("modelSyncScheduler does not infer the internal listener scheme from public URLs", async () => {
+  const previous = {
+    DASHBOARD_PORT: process.env.DASHBOARD_PORT,
+    BASE_URL: process.env.BASE_URL,
+    NEXT_PUBLIC_BASE_URL: process.env.NEXT_PUBLIC_BASE_URL,
+    NEXT_PUBLIC_APP_URL: process.env.NEXT_PUBLIC_APP_URL,
+    OMNIROUTE_INTERNAL_SCHEME: process.env.OMNIROUTE_INTERNAL_SCHEME,
+    OMNIROUTE_TLS_CERT: process.env.OMNIROUTE_TLS_CERT,
+    OMNIROUTE_TLS_KEY: process.env.OMNIROUTE_TLS_KEY,
+  };
+  process.env.DASHBOARD_PORT = "22128";
+  process.env.BASE_URL = "https://attacker.example";
+  process.env.NEXT_PUBLIC_BASE_URL = "file:///tmp/not-http";
+  process.env.NEXT_PUBLIC_APP_URL = "https://localhost:7777/ignored";
+  delete process.env.OMNIROUTE_INTERNAL_SCHEME;
+  delete process.env.OMNIROUTE_TLS_CERT;
+  delete process.env.OMNIROUTE_TLS_KEY;
+
+  try {
+    const scheduler = await loadScheduler("safe-loopback-fallback");
+    assert.equal(scheduler.getModelSyncInternalBaseUrl(), "http://127.0.0.1:22128");
+  } finally {
+    for (const [key, value] of Object.entries(previous)) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+  }
+});
+
+test("modelSyncScheduler uses the listener-declared TLS scheme without trusting candidates", async () => {
+  const previous = {
+    DASHBOARD_PORT: process.env.DASHBOARD_PORT,
+    BASE_URL: process.env.BASE_URL,
+    NEXT_PUBLIC_BASE_URL: process.env.NEXT_PUBLIC_BASE_URL,
+    NEXT_PUBLIC_APP_URL: process.env.NEXT_PUBLIC_APP_URL,
+    OMNIROUTE_BASE_PATH: process.env.OMNIROUTE_BASE_PATH,
+    OMNIROUTE_INTERNAL_SCHEME: process.env.OMNIROUTE_INTERNAL_SCHEME,
+    OMNIROUTE_TLS_CERT: process.env.OMNIROUTE_TLS_CERT,
+    OMNIROUTE_TLS_KEY: process.env.OMNIROUTE_TLS_KEY,
+  };
+  process.env.DASHBOARD_PORT = "22128";
+  process.env.BASE_URL = "https://attacker.example";
+  delete process.env.NEXT_PUBLIC_BASE_URL;
+  delete process.env.NEXT_PUBLIC_APP_URL;
+  process.env.OMNIROUTE_BASE_PATH = "/omniroute";
+  process.env.OMNIROUTE_INTERNAL_SCHEME = "https";
+  delete process.env.OMNIROUTE_TLS_CERT;
+  delete process.env.OMNIROUTE_TLS_KEY;
+
+  try {
+    const scheduler = await loadScheduler("trusted-native-tls");
+    assert.equal(
+      scheduler.resolveModelSyncInternalBaseUrl("https://attacker.example:7777/steal"),
+      "https://localhost:22128/omniroute"
+    );
+    assert.equal(
+      scheduler.resolveModelSyncInternalBaseUrl("https://127.0.0.1:7777/nested/path"),
+      "https://localhost:22128/omniroute"
+    );
+  } finally {
+    for (const [key, value] of Object.entries(previous)) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+  }
+});
+
+test("modelSyncScheduler pins HTTPS transport to IPv4 while retaining localhost SNI", async () => {
+  const scheduler = await loadScheduler("pinned-loopback-tls-connector");
+  let forwardedOptions: Record<string, unknown> | undefined;
+  const connector = scheduler.createPinnedModelSyncTlsConnector((options, callback) => {
+    forwardedOptions = options;
+    callback(new Error("stop before socket creation"), null);
+  });
+
+  connector(
+    {
+      hostname: "localhost",
+      host: "localhost:22128",
+      protocol: "https:",
+      port: "22128",
+    },
+    () => undefined
+  );
+
+  assert.equal(forwardedOptions?.hostname, "127.0.0.1");
+  assert.equal(forwardedOptions?.servername, "localhost");
+});
+
+test("runtime launchers publish the actual internal listener scheme", () => {
+  const runNext = fs.readFileSync(path.join(process.cwd(), "scripts/dev/run-next.mjs"), "utf8");
+  const standalone = fs.readFileSync(
+    path.join(process.cwd(), "scripts/dev/standalone-server-ws.mjs"),
+    "utf8"
+  );
+
+  assert.match(runNext, /OMNIROUTE_INTERNAL_SCHEME\s*=\s*["']http["']/);
+  assert.match(standalone, /OMNIROUTE_INTERNAL_SCHEME\s*=\s*tlsOptions\s*\?\s*["']https["']/);
+});
+
 test("initCloudSync: startup initialization also starts model sync scheduler", () => {
   const filePath = path.join(process.cwd(), "src/lib/initCloudSync.ts");
   const source = fs.readFileSync(filePath, "utf8");
@@ -224,8 +375,10 @@ test("modelSyncScheduler starts once, honors env interval and syncs only active
     await timers.timeouts[0].fn();
 
     assert.equal(fetchCalls.length, 1);
+    assert.match(fetchCalls[0].url, /^http:\/\/127\.0\.0\.1:20128\//);
     assert.match(fetchCalls[0].url, /\/api\/providers\/.*\/sync-models$/);
     assert.equal(fetchCalls[0].options.method, "POST");
+    assert.equal(fetchCalls[0].options.redirect, "error");
     assert.equal(fetchCalls[0].options.headers["Content-Type"], "application/json");
     assert.equal(
       fetchCalls[0].options.headers[scheduler.getModelSyncInternalAuthHeaderName()],
diff --git a/tests/unit/model-test-runner-compression-off-6240.test.ts b/tests/unit/model-test-runner-compression-off-6240.test.ts
new file mode 100644
index 0000000000..b1f410e46d
--- /dev/null
+++ b/tests/unit/model-test-runner-compression-off-6240.test.ts
@@ -0,0 +1,23 @@
+// #6240 — the "Test model" internal request builders must always send
+// `X-OmniRoute-Compression: off` so a globally-enabled Output Style (e.g. "Ultra terse") never
+// leaks a system-prompt injection into a plain connection test.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  buildInternalChatRequest,
+  buildInternalRerankRequest,
+} from "@/lib/api/modelTestRunner.ts";
+
+test("buildInternalChatRequest sends X-OmniRoute-Compression: off", () => {
+  const controller = new AbortController();
+  const request = buildInternalChatRequest({ model: "openai/gpt-4" }, controller.signal);
+  assert.equal(request.headers.get("X-OmniRoute-Compression"), "off");
+  assert.equal(request.headers.get("X-OmniRoute-No-Cache"), "true");
+});
+
+test("buildInternalRerankRequest sends X-OmniRoute-Compression: off", () => {
+  const controller = new AbortController();
+  const request = buildInternalRerankRequest({ model: "openai/rerank-1" }, controller.signal);
+  assert.equal(request.headers.get("X-OmniRoute-Compression"), "off");
+  assert.equal(request.headers.get("X-OmniRoute-No-Cache"), "true");
+});
diff --git a/tests/unit/models-catalog-hide-paid.test.ts b/tests/unit/models-catalog-hide-paid.test.ts
index 5700cc4bd1..4f2f8db674 100644
--- a/tests/unit/models-catalog-hide-paid.test.ts
+++ b/tests/unit/models-catalog-hide-paid.test.ts
@@ -64,3 +64,28 @@ test("hidePaidModels default is false + toggles the catalog filter", async () =>
   const leaked = on.filter(isPaidChat).map((m) => m.id);
   assert.deepEqual(leaked, [], `paid OpenAI chat aliases leaked: ${leaked.join(", ")}`);
 });
+
+// #6328 (follow-up to #6495) — the paid filter must also apply to the
+// *custom* (user-defined) model loop, not just the built-in PROVIDER_MODELS
+// loop the original #6495 test covers. `openai` has no curated free roster, so
+// a pricing-less custom model on it is paid-tier and must disappear when the
+// toggle is on. Regression guard for the added `shouldHidePaid()` call in the
+// custom-rows loop (src/app/api/v1/models/catalog.ts).
+test("#6328 hidePaidModels also filters user-defined custom model rows", async () => {
+  const modelsDb = await import("../../src/lib/db/models.ts");
+  // openai connection already created by the previous test; ensure the custom model exists.
+  await modelsDb.addCustomModel("openai", "my-custom-paid-6328", "My Custom Paid 6328");
+
+  const hasCustom = (list: Array<{ id: string }>) =>
+    list.some((m) => m.id.includes("my-custom-paid-6328"));
+
+  await settingsDb.updateSettings({ hidePaidModels: false });
+  assert.equal(hasCustom(await fetchCatalog()), true, "custom model visible when toggle is off");
+
+  await settingsDb.updateSettings({ hidePaidModels: true });
+  assert.equal(
+    hasCustom(await fetchCatalog()),
+    false,
+    "custom paid model must be hidden when hidePaidModels is on (#6328)"
+  );
+});
diff --git a/tests/unit/muse-spark-web-continuation.test.ts b/tests/unit/muse-spark-web-continuation.test.ts
index a190d7a66d..d72adfae96 100644
--- a/tests/unit/muse-spark-web-continuation.test.ts
+++ b/tests/unit/muse-spark-web-continuation.test.ts
@@ -323,3 +323,26 @@ test("muse-spark-web: empty latestUserContent (no `user` role) falls back to fre
     globalThis.fetch = original;
   }
 });
+
+test(
+  "muse-spark-web: outgoing variables must NOT declare 'attachments' " +
+    "(AttachmentInput type removed upstream, regression for #6935)",
+  async () => {
+    __resetMuseSparkConversationCacheForTesting();
+    const executor = new MuseSparkWebExecutor();
+    const original = globalThis.fetch;
+    const { fetchFn, captured } = captureFetch(() => metaAiSseResponse("pong"));
+    globalThis.fetch = fetchFn;
+    try {
+      await executor.execute(executeInputs([{ role: "user", content: "hi" }]));
+      const sentVars = (captured[0].body as { variables: Record<string, unknown> }).variables;
+      assert.equal(
+        Object.prototype.hasOwnProperty.call(sentVars, "attachments"),
+        false,
+        "variables must omit 'attachments' entirely — Meta removed AttachmentInput from schema"
+      );
+    } finally {
+      globalThis.fetch = original;
+    }
+  }
+);
diff --git a/tests/unit/next-config.test.ts b/tests/unit/next-config.test.ts
index e3bd946643..29821fa4ec 100644
--- a/tests/unit/next-config.test.ts
+++ b/tests/unit/next-config.test.ts
@@ -271,6 +271,23 @@ test("next-intl webpack hook preserves caller config and filters known extractor
   );
 });
 
+test("turbopack.ignoreIssue suppresses the agentSkills over-bundling warning (#6582)", async () => {
+  // src/lib/agentSkills/generator.ts joins process.cwd() with a runtime
+  // `outputDir` parameter — not a compile-time literal — so Turbopack's
+  // file-tracing analyzer can't narrow it and emits an "Overly broad
+  // patterns..." warning per entry point importing the module. The fs access
+  // is legitimate and bounded, so it's suppressed via turbopack.ignoreIssue
+  // rather than fought. This guards the config shape so the suppression rule
+  // isn't silently dropped in a future edit.
+  const { default: nextConfig } = await loadNextConfig("ignore-issue");
+  const rules = nextConfig.turbopack?.ignoreIssue;
+
+  assert.ok(Array.isArray(rules), "expected turbopack.ignoreIssue to be an array");
+  const agentSkillsRule = rules.find((rule) => String(rule.path).includes("agentSkills"));
+  assert.ok(agentSkillsRule, "expected an ignoreIssue rule targeting src/lib/agentSkills/**");
+  assert.match(String(agentSkillsRule.description), /Overly broad patterns/);
+});
+
 test("optimizePackageImports excludes the internal @omniroute/open-sse workspace (build-OOM guard)", async () => {
   // Regression guard: adding the internal `@omniroute/open-sse` workspace to
   // optimizePackageImports makes Next.js resolve its entire barrel at build
diff --git a/tests/unit/nvidia-passthrough-models-6773.test.ts b/tests/unit/nvidia-passthrough-models-6773.test.ts
new file mode 100644
index 0000000000..915b541413
--- /dev/null
+++ b/tests/unit/nvidia-passthrough-models-6773.test.ts
@@ -0,0 +1,79 @@
+/**
+ * Regression test for #6773 — NVIDIA NIM models listed available:true but 404 at router.
+ *
+ * Root cause: the `nvidia` provider registry entry multiplexes many distinct
+ * third-party vendor models (z-ai/, minimaxai/, deepseek-ai/, qwen/,
+ * mistralai/, stepfun-ai/, moonshotai/, openai/, nvidia/) behind ONE base URL
+ * and ONE API key connection — architecturally identical to `modelscope`,
+ * `synthetic`, and `kilo-gateway`, which all set `passthroughModels: true` so
+ * that a single model's 404/429 stays scoped to that model instead of cooling
+ * down the whole connection (see accountFallback.ts `hasPerModelQuota` doc
+ * comment). Without the flag, a single upstream 404 for one (possibly
+ * stale/renamed) model poisons ALL nvidia models for the connection-cooldown
+ * duration — matching the issue's "All 17 behave the same" symptom.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const accountFallback = await import("../../open-sse/services/accountFallback.ts");
+const providerRegistry = await import("../../open-sse/config/providerRegistry.ts");
+
+test("#6773: nvidia registry entry sets passthroughModels", () => {
+  const entry = providerRegistry.getRegistryEntry("nvidia");
+  assert.equal(
+    entry?.passthroughModels,
+    true,
+    "nvidia multiplexes many third-party vendor models behind one connection " +
+      "(z-ai/, minimaxai/, deepseek-ai/, qwen/, mistralai/, stepfun-ai/, " +
+      "moonshotai/, openai/, nvidia/) — it should set passthroughModels: true " +
+      "like modelscope/synthetic/kilo-gateway, so a single stale model 404 " +
+      "does not cool down the whole connection for all other models"
+  );
+});
+
+test("#6773: hasPerModelQuota('nvidia') is true, so a 404 on one nvidia model is model-scoped", () => {
+  assert.equal(
+    accountFallback.hasPerModelQuota("nvidia", "z-ai/glm-5.2"),
+    true,
+    "expected nvidia to use per-model lockout (like gemini/github/codex/compatible " +
+      "providers) so a 404 on one model doesn't cool down the other nvidia models"
+  );
+});
+
+test("#6773: checkFallbackError + lockModelIfPerModelQuota scope a single-model 404 to just that model for nvidia", () => {
+  // A plain upstream 404 (e.g. one stale/renamed nvidia model id) falls through
+  // checkFallbackError's generic catch-all: shouldFallback=true with a non-zero
+  // connection cooldown. With hasPerModelQuota=true, lockModelIfPerModelQuota
+  // now scopes that cooldown to just the one failing model instead of the
+  // whole connection.
+  const result = accountFallback.checkFallbackError(
+    404,
+    "Not Found",
+    0,
+    "z-ai/glm-5.2",
+    "nvidia",
+    null,
+    null,
+    null
+  );
+  assert.equal(result.shouldFallback, true, "404 triggers a connection-level fallback/cooldown");
+  assert.ok(
+    (result.cooldownMs ?? 0) > 0,
+    "the connection-level cooldown is non-zero, so it also blocks the other nvidia models" +
+      " unless it gets scoped to just this model below"
+  );
+
+  const locked = accountFallback.lockModelIfPerModelQuota(
+    "nvidia",
+    "conn-6773",
+    "z-ai/glm-5.2",
+    "unknown",
+    result.cooldownMs ?? 30_000
+  );
+  assert.equal(
+    locked,
+    true,
+    "expected the 404 to be scoped to just this one model (per-model lockout), " +
+      "not the whole connection"
+  );
+});
diff --git a/tests/unit/oauth-providers-config.test.ts b/tests/unit/oauth-providers-config.test.ts
index 7637b3e051..54a1a4150f 100644
--- a/tests/unit/oauth-providers-config.test.ts
+++ b/tests/unit/oauth-providers-config.test.ts
@@ -64,6 +64,7 @@ const EXPECTED_PROVIDER_KEYS = [
   "trae",
   "kilocode",
   "cline",
+  "clinepass",
   "windsurf",
   "devin-cli",
   "grok-cli",
@@ -72,6 +73,13 @@ const EXPECTED_PROVIDER_KEYS = [
   "zed-hosted",
 ];
 
+const browserUrl = "http://localhost:20128/callback";
+const publicBaseEnv = {
+  NEXT_PUBLIC_BASE_URL: "https://omniroute.example.com",
+  ANTIGRAVITY_OAUTH_CLIENT_ID: "custom-antigravity.apps.googleusercontent.com",
+  ANTIGRAVITY_OAUTH_CLIENT_SECRET: "custom-antigravity-secret",
+};
+
 const EXPECTED_CONFIG_BY_PROVIDER = {
   claude: CLAUDE_CONFIG,
   codex: CODEX_CONFIG,
@@ -87,6 +95,7 @@ const EXPECTED_CONFIG_BY_PROVIDER = {
   cursor: CURSOR_CONFIG,
   kilocode: KILOCODE_CONFIG,
   cline: CLINE_CONFIG,
+  clinepass: CLINE_CONFIG, // reuses the Cline WorkOS flow (clinepass: cline in providers/index.ts)
   windsurf: WINDSURF_CONFIG,
   "devin-cli": WINDSURF_CONFIG,
   trae: TRAE_CONFIG,
@@ -96,6 +105,17 @@ const EXPECTED_CONFIG_BY_PROVIDER = {
   "zed-hosted": ZED_HOSTED_CONFIG,
 };
 
+const KIRO_REQUIRED_FIELDS = [
+  "registerClientUrl",
+  "deviceAuthUrl",
+  "tokenUrl",
+  "socialAuthEndpoint",
+  "socialLoginUrl",
+  "socialTokenUrl",
+  "socialRefreshUrl",
+  "authMethods",
+];
+
 const REQUIRED_FIELDS_BY_PROVIDER = {
   claude: ["authorizeUrl", "tokenUrl", "redirectUri", "scopes", "clientId"],
   codex: ["authorizeUrl", "tokenUrl", "scope", "clientId"],
@@ -115,29 +135,12 @@ const REQUIRED_FIELDS_BY_PROVIDER = {
     "codeChallengeMethod",
     "clientId",
   ],
-  kiro: [
-    "registerClientUrl",
-    "deviceAuthUrl",
-    "tokenUrl",
-    "socialAuthEndpoint",
-    "socialLoginUrl",
-    "socialTokenUrl",
-    "socialRefreshUrl",
-    "authMethods",
-  ],
-  "amazon-q": [
-    "registerClientUrl",
-    "deviceAuthUrl",
-    "tokenUrl",
-    "socialAuthEndpoint",
-    "socialLoginUrl",
-    "socialTokenUrl",
-    "socialRefreshUrl",
-    "authMethods",
-  ],
+  kiro: KIRO_REQUIRED_FIELDS,
+  "amazon-q": KIRO_REQUIRED_FIELDS,
   cursor: ["apiEndpoint", "api3Endpoint", "agentEndpoint", "agentNonPrivacyEndpoint", "dbKeys"],
   kilocode: ["apiBaseUrl", "initiateUrl", "pollUrlBase"],
   cline: ["appBaseUrl", "apiBaseUrl", "authorizeUrl", "tokenExchangeUrl", "refreshUrl"],
+  clinepass: ["appBaseUrl", "apiBaseUrl", "authorizeUrl", "tokenExchangeUrl", "refreshUrl"],
   windsurf: ["authorizeUrl", "apiServerUrl", "exchangePath", "inferenceUrl"],
   "devin-cli": ["authorizeUrl", "apiServerUrl", "exchangePath", "inferenceUrl"],
   trae: ["apiEndpoint", "chatEndpoint", "webUrl"],
@@ -336,10 +339,6 @@ test("browser-based providers expose buildAuthUrl and return provider-specific a
   assert.equal(clineUrl.origin, "https://api.cline.bot");
 });
 
-// zed-hosted's buildAuthUrl deliberately returns an object (authUrl + codeVerifier +
-// redirectUri) instead of a bare string — generateAuthData() in providers.ts special-
-// cases this shape to thread an RSA private-key verifier through the existing PKCE
-// codeVerifier slot (see src/lib/oauth/providers/zed-hosted.ts header comment).
 test("zed-hosted buildAuthUrl returns {authUrl, codeVerifier, redirectUri} carrying a fresh RSA keypair", () => {
   const built = PROVIDERS["zed-hosted"].buildAuthUrl(ZED_HOSTED_CONFIG);
   assert.equal(typeof built, "object");
@@ -358,8 +357,6 @@ test("generateAuthData honors an object-returning buildAuthUrl (zed-hosted) with
   assert.ok(zedAuthData.codeVerifier.startsWith("zed-rsa-pkcs1:"));
   assert.ok(zedAuthData.redirectUri.startsWith("http://127.0.0.1:"));
 
-  // A string-returning provider (cline) must still get the plain PKCE codeVerifier,
-  // not be affected by the object-return branch added for zed-hosted.
   const clineAuthData = oauthHelpers.generateAuthData("cline", "http://localhost:20128/callback");
   assert.equal(typeof clineAuthData.authUrl, "string");
   assert.equal(clineAuthData.redirectUri, "http://localhost:20128/callback");
@@ -367,15 +364,10 @@ test("generateAuthData honors an object-returning buildAuthUrl (zed-hosted) with
   assert.ok(!clineAuthData.codeVerifier.startsWith("zed-rsa-pkcs1:"));
 });
 
-// Regression for #3861: GitLab Duo needs an operator-registered OAuth client_id.
-// When it's missing, buildAuthUrl must return null (like Qoder) so the authorize route
-// can surface a clear "configure it" message — it previously THREW, which the route
-// swallowed into an opaque "Internal server error" 500 at the Add Connection step.
 test("gitlab-duo buildAuthUrl returns null (not throw) when client_id is unconfigured (#3861)", () => {
-  const redirectUri = "http://localhost:20128/callback";
   const unconfigured = PROVIDERS["gitlab-duo"].buildAuthUrl(
     { ...GITLAB_DUO_CONFIG, clientId: "" },
-    redirectUri,
+    browserUrl,
     "state-x",
     "challenge-y"
   );
@@ -383,22 +375,14 @@ test("gitlab-duo buildAuthUrl returns null (not throw) when client_id is unconfi
 
   // Configured: returns a real authorize URL carrying the client_id + PKCE challenge.
   const configured = new URL(
-    PROVIDERS["gitlab-duo"].buildAuthUrl(GITLAB_DUO_CONFIG, redirectUri, "state-x", "challenge-y")
+    PROVIDERS["gitlab-duo"].buildAuthUrl(GITLAB_DUO_CONFIG, browserUrl, "state-x", "challenge-y")
   );
   assert.equal(configured.searchParams.get("client_id"), GITLAB_DUO_CONFIG.clientId);
   assert.equal(configured.searchParams.get("code_challenge"), "challenge-y");
 });
 
 test("custom Google OAuth credentials switch Antigravity remote callbacks to NEXT_PUBLIC_BASE_URL", () => {
-  const redirectUri = resolveBrowserOAuthRedirectUri(
-    "antigravity",
-    "http://localhost:20128/callback",
-    {
-      NEXT_PUBLIC_BASE_URL: "https://omniroute.example.com/",
-      ANTIGRAVITY_OAUTH_CLIENT_ID: "custom-antigravity.apps.googleusercontent.com",
-      ANTIGRAVITY_OAUTH_CLIENT_SECRET: "custom-antigravity-secret",
-    }
-  );
+  const redirectUri = resolveBrowserOAuthRedirectUri("antigravity", browserUrl, publicBaseEnv);
 
   assert.equal(redirectUri, "https://omniroute.example.com/callback");
 });
@@ -407,32 +391,28 @@ test("custom Google OAuth callbacks preserve the requested callback path and que
   const redirectUri = resolveBrowserOAuthRedirectUri(
     "antigravity",
     "http://127.0.0.1:20128/auth/callback?source=popup",
-    {
-      NEXT_PUBLIC_BASE_URL: "https://omniroute.example.com/base",
-      ANTIGRAVITY_OAUTH_CLIENT_ID: "custom-antigravity.apps.googleusercontent.com",
-      ANTIGRAVITY_OAUTH_CLIENT_SECRET: "custom-antigravity-secret",
-    }
+    { ...publicBaseEnv, NEXT_PUBLIC_BASE_URL: "https://omniroute.example.com/base" }
   );
 
   assert.equal(redirectUri, "https://omniroute.example.com/base/auth/callback?source=popup");
 });
 
 test("custom Google OAuth credentials switch IPv6 loopback callbacks to public base URL", () => {
-  const redirectUri = resolveBrowserOAuthRedirectUri("antigravity", "http://[::1]:20128/callback", {
-    NEXT_PUBLIC_BASE_URL: "https://omniroute.example.com",
-    ANTIGRAVITY_OAUTH_CLIENT_ID: "custom-antigravity.apps.googleusercontent.com",
-    ANTIGRAVITY_OAUTH_CLIENT_SECRET: "custom-antigravity-secret",
-  });
+  const redirectUri = resolveBrowserOAuthRedirectUri(
+    "antigravity",
+    "http://[::1]:20128/callback",
+    publicBaseEnv
+  );
 
   assert.equal(redirectUri, "https://omniroute.example.com/callback");
 });
 
 test("custom Google OAuth callbacks default root loopback paths to callback path", () => {
-  const redirectUri = resolveBrowserOAuthRedirectUri("antigravity", "http://127.0.0.1:20128", {
-    NEXT_PUBLIC_BASE_URL: "https://omniroute.example.com",
-    ANTIGRAVITY_OAUTH_CLIENT_ID: "custom-antigravity.apps.googleusercontent.com",
-    ANTIGRAVITY_OAUTH_CLIENT_SECRET: "custom-antigravity-secret",
-  });
+  const redirectUri = resolveBrowserOAuthRedirectUri(
+    "antigravity",
+    "http://127.0.0.1:20128",
+    publicBaseEnv
+  );
 
   assert.equal(redirectUri, "https://omniroute.example.com/callback");
 });
diff --git a/tests/unit/oauth-providers-error-handling.test.ts b/tests/unit/oauth-providers-error-handling.test.ts
index c899866ed7..dd34d14272 100644
--- a/tests/unit/oauth-providers-error-handling.test.ts
+++ b/tests/unit/oauth-providers-error-handling.test.ts
@@ -109,7 +109,51 @@ test("P1: GitHub Copilot sub-token is refreshed by tokenHealthCheck", async () =
 test("P1: tokenHealthCheck checks copilotTokenExpiresAt before refreshing", async () => {
   const src = await read("src/lib/tokenHealthCheck.ts");
   assert.match(src, /copilotTokenExpiresAt/, "must check copilotTokenExpiresAt");
-  assert.match(src, /conn\.provider\s*===\s*["']github["']/, "must be gated on github provider");
+  assert.match(src, /toLowerCase\(\)\s*===\s*["']github["']/, "must be gated on github provider");
+});
+
+// ─── P1: case-insensitive provider comparisons (regression for #6947) ────────
+//
+// tokenHealthCheck.checkConnection() gates two decisions on `conn.provider`:
+//   1. ROTATING_REFRESH_PROVIDERS.has(conn.provider) — skips the fixed-interval
+//      refresh sweep for single-use-refresh-token providers (codex/openai/etc).
+//   2. conn.provider === "github" — gates the Copilot sub-token refresh.
+// Both membership tests were case-sensitive while `conn.provider` can be stored
+// in mixed case (e.g. "OpenAI", "Github"), silently disabling the guard. These
+// assertions are scoped to the exact statement (not a whole-file scan), so they
+// fail against the unfixed source — verified against
+// `git show origin/release/v3.8.47:src/lib/tokenHealthCheck.ts` (lines 535/758).
+
+test("P1: ROTATING_REFRESH_PROVIDERS.has() normalizes conn.provider case before lookup", async () => {
+  const src = await read("src/lib/tokenHealthCheck.ts");
+  const assignMatch = src.match(
+    /const\s+isRotatingProvider\s*=\s*ROTATING_REFRESH_PROVIDERS\.has\(\s*([\s\S]{0,80}?)\s*\);/
+  );
+  assert.ok(assignMatch, "isRotatingProvider assignment not found");
+  const arg = assignMatch[1];
+  assert.match(
+    arg,
+    /String\(\s*conn\.provider\s*\|\|\s*["']["']\s*\)\.toLowerCase\(\)/,
+    "ROTATING_REFRESH_PROVIDERS.has() must lowercase-normalize conn.provider before the lookup " +
+      "(bare `conn.provider` fails for 'OpenAI'/'Github' since the Set is all-lowercase)"
+  );
+});
+
+test("P1: GitHub Copilot sub-token guard normalizes conn.provider case", async () => {
+  const src = await read("src/lib/tokenHealthCheck.ts");
+  // Scope the match to the Copilot sub-token refresh block via its own comment,
+  // not an arbitrary occurrence elsewhere in the file.
+  const blockMatch = src.match(
+    /GitHub Copilot sub-token refresh[\s\S]{0,600}?if\s*\(([\s\S]{0,80}?)\)\s*\{/
+  );
+  assert.ok(blockMatch, "Copilot sub-token refresh block not found");
+  const condition = blockMatch[1];
+  assert.match(
+    condition,
+    /String\(\s*conn\.provider\s*\|\|\s*["']["']\s*\)\.toLowerCase\(\)\s*===\s*["']github["']/,
+    "the Copilot sub-token refresh guard must lowercase-normalize conn.provider before comparing " +
+      "to 'github' (bare `conn.provider === \"github\"` fails for mixed-case values like 'Github')"
+  );
 });
 
 // ─── P2: Google invalid_grant ─────────────────────────────────────────────────
diff --git a/tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts b/tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts
new file mode 100644
index 0000000000..cd95d85ea1
--- /dev/null
+++ b/tests/unit/ollama-cloud-weekly-quota-cooldown-3709.test.ts
@@ -0,0 +1,103 @@
+/**
+ * Issue #3709 — Ollama Cloud free-tier accounts have a hard WEEKLY request
+ * cap. On cap the upstream returns 429 with a body like:
+ *   "you (<account>) have reached your weekly usage limit"
+ *
+ * ollama-cloud is an apikey-category provider (not oauth), so the existing
+ * oauth-only `shouldUseQuotaSignal` gate in checkFallbackError skips the
+ * generic subscription-quota-text branch (Issue #2321) for its 429s. Without
+ * a dedicated, ungated weekly check the account fell through to the generic
+ * 429 backoff (starts ~1s, caps at 2min) and got retried every few minutes
+ * for the rest of the week — one account took 285x429 in 48h.
+ *
+ * This test proves: (1) the weekly-usage-limit text is classified as
+ * QUOTA_EXHAUSTED with a cooldown far longer than the generic backoff cap,
+ * for BOTH oauth and apikey provider categories, and (2) a sibling
+ * under-quota connection is unaffected (multi-account: only the exhausted
+ * connection's checkFallbackError call is affected — selection filtering
+ * lives in auth.ts and is exercised by other suites).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { checkFallbackError } = await import("../../open-sse/services/accountFallback.ts");
+const { isWeeklyUsageLimitText, buildWeeklyQuotaFallback } = await import(
+  "../../open-sse/services/quotaTextCooldowns.ts"
+);
+const { RateLimitReason, BACKOFF_CONFIG } = await import("../../open-sse/config/constants.ts");
+const { BACKOFF_CONFIG: ERROR_BACKOFF_CONFIG } = await import("../../open-sse/config/errorConfig.ts");
+
+const WEEKLY_BODY = "you (acme-corp) have reached your weekly usage limit";
+
+test("#3709 isWeeklyUsageLimitText matches the ollama-cloud 429 body", () => {
+  assert.equal(isWeeklyUsageLimitText(WEEKLY_BODY.toLowerCase()), true);
+  assert.equal(isWeeklyUsageLimitText("weekly limit reached, try later"), true);
+  assert.equal(isWeeklyUsageLimitText("rate_limit_exceeded: too many requests"), false);
+});
+
+test("#3709 buildWeeklyQuotaFallback returns a 24h QUOTA_EXHAUSTED cooldown, far above the generic backoff cap", () => {
+  const result = buildWeeklyQuotaFallback(WEEKLY_BODY);
+  assert.ok(result, "expected a non-null fallback for weekly-usage-limit text");
+  assert.equal(result!.reason, RateLimitReason.QUOTA_EXHAUSTED);
+  assert.equal(result!.cooldownMs, 24 * 60 * 60 * 1000);
+  // The generic 429 backoff caps at 2 minutes — the weekly cooldown must be
+  // far longer, otherwise the account keeps getting retried every few
+  // minutes for the rest of the week (the exact bug reported in #3709).
+  assert.ok(result!.cooldownMs > (ERROR_BACKOFF_CONFIG.max ?? BACKOFF_CONFIG.max));
+});
+
+test("#3709 buildWeeklyQuotaFallback returns null for unrelated error text", () => {
+  assert.equal(buildWeeklyQuotaFallback("rate_limit_exceeded: too many requests"), null);
+  assert.equal(buildWeeklyQuotaFallback("Usage Limit Reached"), null);
+});
+
+test("#3709 checkFallbackError: apikey-category provider (ollama-cloud) 429 weekly-limit body → QUOTA_EXHAUSTED, 24h cooldown", () => {
+  // Regression guard for the actual bug: without the fix, ollama-cloud (an
+  // apikey-category provider) 429s skip quota-text classification entirely
+  // (shouldUseQuotaSignal is oauth-only) and fall through to the generic
+  // ~1s->2min exponential backoff.
+  const out = checkFallbackError(
+    429,
+    WEEKLY_BODY,
+    0, // backoffLevel
+    null, // model
+    "ollama-cloud", // provider (apikey category)
+    null, // headers
+    null, // profileOverride
+    null // structuredError
+  );
+
+  assert.equal(out.shouldFallback, true);
+  assert.equal(out.reason, RateLimitReason.QUOTA_EXHAUSTED);
+  assert.equal(out.cooldownMs, 24 * 60 * 60 * 1000);
+  assert.ok(
+    out.cooldownMs > 5 * 60 * 1000,
+    `expected cooldown far longer than the old 5-minute retry storm window, got ${out.cooldownMs}ms`
+  );
+});
+
+test("#3709 checkFallbackError: oauth-category provider with weekly-limit text also gets the long cooldown", () => {
+  // The weekly check is generic (not ollama-specific) and runs unconditionally,
+  // so an oauth provider using the same wording is covered too.
+  const out = checkFallbackError(429, WEEKLY_BODY, 0, null, "claude", null, null, null);
+  assert.equal(out.reason, RateLimitReason.QUOTA_EXHAUSTED);
+  assert.equal(out.cooldownMs, 24 * 60 * 60 * 1000);
+});
+
+test("#3709 checkFallbackError: ollama-cloud generic rate-limit body is unaffected (no false positive)", () => {
+  const out = checkFallbackError(
+    429,
+    "rate_limit_exceeded: too many requests",
+    0,
+    null,
+    "ollama-cloud",
+    null,
+    null,
+    null
+  );
+  assert.equal(out.reason, RateLimitReason.RATE_LIMIT_EXCEEDED);
+  assert.ok(
+    out.cooldownMs <= 2 * 60 * 1000,
+    "generic rate limit text must keep the normal short backoff, not the 24h weekly cooldown"
+  );
+});
diff --git a/tests/unit/openai-gpt56-catalog.test.ts b/tests/unit/openai-gpt56-catalog.test.ts
new file mode 100644
index 0000000000..b928d6f7c5
--- /dev/null
+++ b/tests/unit/openai-gpt56-catalog.test.ts
@@ -0,0 +1,57 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { getModelsByProviderId } from "../../open-sse/config/providerModels.ts";
+import { getModelSpec } from "../../src/shared/constants/modelSpecs.ts";
+import { getPricingForModel } from "../../src/shared/constants/pricing.ts";
+
+const EXPECTED_MODELS = ["gpt-5.6", "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"];
+
+test("OpenAI API catalog exposes the public GPT-5.6 family and keeps GPT-5.4", () => {
+  const models = getModelsByProviderId("openai");
+
+  assert.deepEqual(
+    models.slice(0, EXPECTED_MODELS.length).map((model) => model.id),
+    EXPECTED_MODELS
+  );
+
+  for (const modelId of EXPECTED_MODELS) {
+    const model = models.find((entry) => entry.id === modelId);
+    assert.ok(model, `openai must expose ${modelId}`);
+    assert.equal(model.contextLength, 1050000);
+    assert.equal(model.maxInputTokens, 922000);
+    assert.equal(model.maxOutputTokens, 128000);
+    assert.equal(model.toolCalling, true);
+    assert.equal(model.supportsReasoning, true);
+    assert.equal(model.supportsVision, true);
+
+    const spec = getModelSpec(modelId);
+    assert.equal(spec?.contextWindow, 1050000);
+    assert.equal(spec?.maxOutputTokens, 128000);
+  }
+
+  for (const retainedModelId of ["gpt-5.4", "gpt-5.4-pro", "gpt-5.4-mini", "gpt-5.4-nano"]) {
+    assert.ok(
+      models.some((model) => model.id === retainedModelId),
+      `${retainedModelId} must remain`
+    );
+  }
+});
+
+test("OpenAI API GPT-5.6 pricing matches the published standard tier", () => {
+  const expectedPricing = {
+    "gpt-5.6": { input: 5, cached: 0.5, cache_creation: 6.25, output: 30 },
+    "gpt-5.6-sol": { input: 5, cached: 0.5, cache_creation: 6.25, output: 30 },
+    "gpt-5.6-terra": { input: 2.5, cached: 0.25, cache_creation: 3.125, output: 15 },
+    "gpt-5.6-luna": { input: 1, cached: 0.1, cache_creation: 1.25, output: 6 },
+  };
+
+  for (const [modelId, expected] of Object.entries(expectedPricing)) {
+    const pricing = getPricingForModel("openai", modelId);
+    assert.ok(pricing, `missing openai pricing for ${modelId}`);
+    assert.equal(pricing.input, expected.input, `${modelId} input`);
+    assert.equal(pricing.cached, expected.cached, `${modelId} cached`);
+    assert.equal(pricing.cache_creation, expected.cache_creation, `${modelId} cache creation`);
+    assert.equal(pricing.output, expected.output, `${modelId} output`);
+  }
+});
diff --git a/tests/unit/openai-responses-reasoning-effort.test.ts b/tests/unit/openai-responses-reasoning-effort.test.ts
index 9b8151bf15..a8a2927d64 100644
--- a/tests/unit/openai-responses-reasoning-effort.test.ts
+++ b/tests/unit/openai-responses-reasoning-effort.test.ts
@@ -68,5 +68,5 @@ test("Chat -> Responses already wraps reasoning_effort into reasoning.effort", (
       {}
     )
   );
-  assert.deepEqual(out.reasoning, { effort: "high" });
+  assert.deepEqual(out.reasoning, { effort: "high", summary: "auto" });
 });
diff --git a/tests/unit/openai-responses-subagent-strip-2446.test.ts b/tests/unit/openai-responses-subagent-strip-2446.test.ts
new file mode 100644
index 0000000000..1eb04f98d1
--- /dev/null
+++ b/tests/unit/openai-responses-subagent-strip-2446.test.ts
@@ -0,0 +1,57 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+// Regression guard for the Cursor `Subagent` tool call carrying the cloud-only
+// optional field `cloud_base_branch` as an empty string. Cursor rejects the call
+// ("cloud_base_branch may only be specified when environment equals cloud") when a
+// local subagent tool call includes the field at all. The Responses->Chat translator
+// strips empty-string/empty-array optional fields, but that cleanup was scoped to
+// Claude Code's `Read` tool only; it must also cover Cursor's `Subagent` tool.
+// Ported from decolua/9router#2446.
+
+const LEAF = "../../open-sse/translator/response/openai-responses/pureHelpers.ts";
+
+test("Subagent tool: strips empty-string cloud_base_branch, keeps populated fields", async () => {
+  const { stripEmptyOptionalToolArgs } = await import(LEAF);
+  const raw = JSON.stringify({
+    description: "subagent connectivity test",
+    prompt: "hello",
+    readonly: true,
+    subagent_type: "generalPurpose",
+    file_attachments: [],
+    environment: "local",
+    cloud_base_branch: "",
+    interrupt: false,
+    run_in_background: false,
+  });
+
+  const cleaned = JSON.parse(stripEmptyOptionalToolArgs(raw, "Subagent"));
+
+  // The offending empty optional field must be gone.
+  assert.equal("cloud_base_branch" in cleaned, false);
+  // Empty array optional also dropped (same rule as Read).
+  assert.equal("file_attachments" in cleaned, false);
+  // Populated / meaningful fields preserved — including falsy booleans.
+  assert.equal(cleaned.description, "subagent connectivity test");
+  assert.equal(cleaned.prompt, "hello");
+  assert.equal(cleaned.readonly, true);
+  assert.equal(cleaned.subagent_type, "generalPurpose");
+  assert.equal(cleaned.environment, "local");
+  assert.equal(cleaned.interrupt, false);
+  assert.equal(cleaned.run_in_background, false);
+});
+
+test("Read tool cleanup remains intact (no regression)", async () => {
+  const { stripEmptyOptionalToolArgs } = await import(LEAF);
+  const raw = JSON.stringify({ file_path: "/a.ts", pages: "" });
+  const cleaned = JSON.parse(stripEmptyOptionalToolArgs(raw, "Read"));
+  assert.equal("pages" in cleaned, false);
+  assert.equal(cleaned.file_path, "/a.ts");
+});
+
+test("arbitrary tools keep empty strings/arrays (unchanged pass-through)", async () => {
+  const { stripEmptyOptionalToolArgs } = await import(LEAF);
+  const raw = JSON.stringify({ query: "", tags: [] });
+  // Not on the allowlist -> returned verbatim.
+  assert.equal(stripEmptyOptionalToolArgs(raw, "SomeOtherTool"), raw);
+});
diff --git a/tests/unit/openai-style-providers-4239-4155-3841.test.ts b/tests/unit/openai-style-providers-4239-4155-3841.test.ts
index aad137e22a..4783262345 100644
--- a/tests/unit/openai-style-providers-4239-4155-3841.test.ts
+++ b/tests/unit/openai-style-providers-4239-4155-3841.test.ts
@@ -22,10 +22,44 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
+// #6967 — every top-level `await` and every `test.after()` registration MUST
+// happen BEFORE the first `test()` call in this file. Node's test runner
+// starts executing already-registered top-level tests as soon as module
+// evaluation yields on an `await` — it does not wait for the rest of the
+// module to finish registering subtests first. When the DB setup (dynamic
+// imports + `test.after()`) previously sat *between* the two SPECS loops
+// below, the runner would already be mid-flight on the first DB-touching
+// subtest by the time `test.after()` ran, so it bound the cleanup hook to
+// that in-progress test's own lifecycle instead of the file root. The hook
+// then fired while `modelsRoute.GET()` was still executing inside that
+// subtest — closing the shared DB singleton and rm -rf'ing TEST_DATA_DIR out
+// from under it — surfaced nondeterministically as "Nenhum driver SQLite
+// disponível" / "Cannot open database because the directory does not exist"
+// 500s (#6967). Doing every await + `test.after()` up front, before any
+// `test()` call, guarantees the runner has no subtest running yet when the
+// hook is registered, so it binds to the file root as intended.
 const { APIKEY_PROVIDERS } = await import("../../src/shared/constants/providers.ts");
 const { PROVIDER_ENDPOINTS } = await import("../../src/shared/constants/config.ts");
 const { REGISTRY: providerRegistry } = await import("../../open-sse/config/providerRegistry.ts");
 
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-providers-batch-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const modelsRoute = await import("../../src/app/api/providers/[id]/models/route.ts");
+
+function resetStorage() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
 interface ProviderSpec {
   id: string;
   alias: string;
@@ -105,24 +139,6 @@ for (const spec of SPECS) {
 
 // ── Live /models discovery + fallback (the NAMED_OPENAI_STYLE_PROVIDERS branch) ──
 
-const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-providers-batch-"));
-process.env.DATA_DIR = TEST_DATA_DIR;
-
-const core = await import("../../src/lib/db/core.ts");
-const providersDb = await import("../../src/lib/db/providers.ts");
-const modelsRoute = await import("../../src/app/api/providers/[id]/models/route.ts");
-
-function resetStorage() {
-  core.resetDbInstance();
-  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
-  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
-}
-
-test.after(() => {
-  core.resetDbInstance();
-  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
-});
-
 interface ModelsBody {
   provider: string;
   models: Array<{ id: string }>;
diff --git a/tests/unit/openai-to-claude-bare-tool.test.ts b/tests/unit/openai-to-claude-bare-tool.test.ts
new file mode 100644
index 0000000000..848d0c75e5
--- /dev/null
+++ b/tests/unit/openai-to-claude-bare-tool.test.ts
@@ -0,0 +1,65 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { openaiToClaudeRequest } = await import(
+  "../../open-sse/translator/request/openai-to-claude.ts"
+);
+
+// Regression: some OpenAI-shape clients send a tool as a BARE
+// `{ function: { name, description, parameters } }` object, omitting the
+// spec-required `type: "function"` parent wrapper. Before this fix, the
+// tools-mapping in openai-to-claude.ts only unwrapped `tool.function` when
+// `tool.type === "function"` was ALSO true, so a bare-function tool fell
+// through with `toolData === tool` (the wrapper itself, which has no
+// `.name`) — `originalName` came out empty and the tool was silently
+// dropped from the translated request (worse than a 400: the caller has no
+// idea the tool never made it upstream).
+
+test("openaiToClaudeRequest: bare {function:{...}} tool (no parent type) is NOT dropped", () => {
+  const request = {
+    messages: [{ role: "user", content: "hi" }],
+    tools: [
+      {
+        function: {
+          name: "get_weather",
+          description: "Get the current weather",
+          parameters: { type: "object", properties: { city: { type: "string" } } },
+        },
+      },
+    ],
+  };
+
+  const translated = openaiToClaudeRequest("claude-sonnet-4", request, false);
+
+  assert.ok(Array.isArray(translated.tools), "expected translated.tools to be an array");
+  assert.equal(translated.tools.length, 1, "expected the bare-function tool to survive translation");
+
+  const tool = translated.tools[0];
+  assert.match(tool.name, /get_weather$/, "expected the original tool name to be preserved (prefixed)");
+  assert.equal(tool.description, "Get the current weather");
+  assert.deepEqual(tool.input_schema, {
+    type: "object",
+    properties: { city: { type: "string" } },
+  });
+});
+
+test("openaiToClaudeRequest: spec-shape {type:'function', function:{...}} tool still converts (no regression)", () => {
+  const request = {
+    messages: [{ role: "user", content: "hi" }],
+    tools: [
+      {
+        type: "function",
+        function: {
+          name: "get_weather",
+          description: "Get the current weather",
+          parameters: { type: "object", properties: { city: { type: "string" } } },
+        },
+      },
+    ],
+  };
+
+  const translated = openaiToClaudeRequest("claude-sonnet-4", request, false);
+
+  assert.equal(translated.tools.length, 1);
+  assert.match(translated.tools[0].name, /get_weather$/);
+});
diff --git a/tests/unit/openai-to-claude-file-attachments.test.ts b/tests/unit/openai-to-claude-file-attachments.test.ts
new file mode 100644
index 0000000000..727044251c
--- /dev/null
+++ b/tests/unit/openai-to-claude-file-attachments.test.ts
@@ -0,0 +1,70 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { openaiToClaudeRequest } =
+  await import("../../open-sse/translator/request/openai-to-claude.ts");
+
+function userBlocks(model: string, content: unknown) {
+  const translated = openaiToClaudeRequest(model, { messages: [{ role: "user", content }] }, false);
+  const userMsg = translated.messages.find((m) => m.role === "user");
+  assert.ok(userMsg && Array.isArray(userMsg.content), "expected a translated user message");
+  return userMsg.content;
+}
+
+test("openaiToClaudeRequest maps an OpenAI file (PDF) block to a Claude document block", () => {
+  const blocks = userBlocks("claude-sonnet-4", [
+    { type: "text", text: "summarize" },
+    {
+      type: "file",
+      file: { filename: "edital.pdf", file_data: "data:application/pdf;base64,JVBERiAtMQ==" },
+    },
+  ]);
+  const doc = blocks.find((b) => b.type === "document");
+  assert.ok(doc, "PDF file block must become a Claude document block, not be dropped");
+  assert.equal(doc.source.type, "base64");
+  assert.equal(doc.source.media_type, "application/pdf");
+  assert.equal(doc.source.data, "JVBERiAtMQ==");
+  assert.equal(doc.title, "edital.pdf");
+});
+
+test("openaiToClaudeRequest maps an OpenAI file (image mime) block to a Claude image block", () => {
+  const blocks = userBlocks("claude-sonnet-4", [
+    {
+      type: "file",
+      file: { filename: "shot.png", file_data: "data:image/png;base64,iVBORw0KGgo=" },
+    },
+  ]);
+  const img = blocks.find((b) => b.type === "image");
+  assert.ok(img, "image-mime file block must become a Claude image block");
+  assert.equal(img.source.type, "base64");
+  assert.equal(img.source.media_type, "image/png");
+  assert.equal(img.source.data, "iVBORw0KGgo=");
+});
+
+test("openaiToClaudeRequest maps a remote file (PDF url) block to a Claude document url block", () => {
+  const blocks = userBlocks("claude-sonnet-4", [
+    { type: "file", file: { filename: "remote.pdf", file_data: "https://example.com/a.pdf" } },
+  ]);
+  const doc = blocks.find((b) => b.type === "document");
+  assert.ok(doc, "remote PDF file block must become a Claude document url block");
+  assert.equal(doc.source.type, "url");
+  assert.equal(doc.source.url, "https://example.com/a.pdf");
+});
+
+test("openaiToClaudeRequest skips a video file block (Claude has no native video input)", () => {
+  const blocks = userBlocks("claude-sonnet-4", [
+    { type: "text", text: "watch this" },
+    { type: "file", file: { filename: "clip.mp4", file_data: "data:video/mp4;base64,AAAAIGZ0" } },
+  ]);
+  const doc = blocks.find((b) => b.type === "document");
+  const img = blocks.find((b) => b.type === "image");
+  assert.ok(
+    !doc && !img,
+    "a video file must not be mislabeled as a Claude document or image block"
+  );
+  // the text part is still forwarded
+  assert.ok(
+    blocks.some((b) => b.type === "text"),
+    "the accompanying text part must still be forwarded"
+  );
+});
diff --git a/tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts b/tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts
new file mode 100644
index 0000000000..3037a0c0e3
--- /dev/null
+++ b/tests/unit/openai-to-claude-glm-split-tool-name-2077.test.ts
@@ -0,0 +1,120 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { openaiToClaudeResponse } from "../../open-sse/translator/response/openai-to-claude.ts";
+
+// Regression guard for GLM 5.2 (and similar OpenAI-compatible upstreams) that stream a
+// tool call's `id` and `function.name` across SEPARATE SSE delta chunks. The Claude SSE
+// protocol cannot patch a `content_block_start` after it is emitted, so the translator
+// must DEFER `content_block_start` until the tool name has arrived. Previously the block
+// was emitted immediately on the id-only chunk with an empty name, and the later
+// name-only chunk was silently dropped — Claude Code then rejected the tool_use with
+// "No such tool available:" / empty tool name. Ported from decolua/9router#2077.
+
+function createState() {
+  return { toolCalls: new Map() };
+}
+
+function flatten(items) {
+  return items.flatMap((item) => item || []);
+}
+
+test("#2077: GLM streams tool id then name in separate chunks — content_block_start carries the real name", () => {
+  const state = createState();
+
+  // Chunk 1: id only, no function.name yet (GLM 5.2 behavior).
+  const c1 = openaiToClaudeResponse(
+    {
+      id: "chatcmpl-glm",
+      model: "glm/glm-5.2",
+      choices: [
+        { index: 0, delta: { tool_calls: [{ index: 0, id: "call_glm_1", type: "function" }] }, finish_reason: null },
+      ],
+    },
+    state
+  );
+  // Chunk 2: function.name only, no id, no arguments.
+  const c2 = openaiToClaudeResponse(
+    {
+      id: "chatcmpl-glm",
+      model: "glm/glm-5.2",
+      choices: [
+        { index: 0, delta: { tool_calls: [{ index: 0, function: { name: "get_weather" } }] }, finish_reason: null },
+      ],
+    },
+    state
+  );
+  // Chunk 3: arguments.
+  const c3 = openaiToClaudeResponse(
+    {
+      id: "chatcmpl-glm",
+      model: "glm/glm-5.2",
+      choices: [
+        {
+          index: 0,
+          delta: { tool_calls: [{ index: 0, function: { arguments: '{"city":"SP"}' } }] },
+          finish_reason: null,
+        },
+      ],
+    },
+    state
+  );
+  const cEnd = openaiToClaudeResponse(
+    {
+      id: "chatcmpl-glm",
+      model: "glm/glm-5.2",
+      choices: [{ index: 0, delta: {}, finish_reason: "tool_calls" }],
+    },
+    state
+  );
+
+  const events = flatten([c1, c2, c3, cEnd]);
+  const starts = events.filter((e) => e?.type === "content_block_start" && e.content_block?.type === "tool_use");
+
+  assert.equal(starts.length, 1, "exactly one tool_use content_block_start");
+  assert.equal(starts[0].content_block.name, "get_weather", "tool name must be captured (not empty)");
+  assert.equal(starts[0].content_block.id, "call_glm_1", "tool id preserved");
+
+  // Arguments must still be delivered (the name-only chunk must not swallow them).
+  const argDeltas = events
+    .filter((e) => e?.type === "content_block_delta" && e.delta?.type === "input_json_delta")
+    .map((e) => e.delta.partial_json)
+    .join("");
+  assert.equal(argDeltas, '{"city":"SP"}');
+});
+
+test("#2077 no-regression: id+name+arguments in one chunk still emits a single named start", () => {
+  const state = createState();
+  const c1 = openaiToClaudeResponse(
+    {
+      id: "chatcmpl-x",
+      model: "openai/gpt-4",
+      choices: [
+        {
+          index: 0,
+          delta: {
+            tool_calls: [
+              { index: 0, id: "call_1", type: "function", function: { name: "search", arguments: '{"q":"hi"}' } },
+            ],
+          },
+          finish_reason: null,
+        },
+      ],
+    },
+    state
+  );
+  const cEnd = openaiToClaudeResponse(
+    { id: "chatcmpl-x", model: "openai/gpt-4", choices: [{ index: 0, delta: {}, finish_reason: "tool_calls" }] },
+    state
+  );
+  const events = flatten([c1, cEnd]);
+  const starts = events.filter((e) => e?.type === "content_block_start" && e.content_block?.type === "tool_use");
+  assert.equal(starts.length, 1);
+  assert.equal(starts[0].content_block.name, "search");
+  assert.equal(starts[0].content_block.id, "call_1");
+  const args = events
+    .filter((e) => e?.type === "content_block_delta" && e.delta?.type === "input_json_delta")
+    .map((e) => e.delta.partial_json)
+    .join("");
+  assert.equal(args, '{"q":"hi"}');
+});
diff --git a/tests/unit/openai-to-gemini-gemma-thinking.test.ts b/tests/unit/openai-to-gemini-gemma-thinking.test.ts
new file mode 100644
index 0000000000..3bed5678ac
--- /dev/null
+++ b/tests/unit/openai-to-gemini-gemma-thinking.test.ts
@@ -0,0 +1,74 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+// Regression guard for the OpenAI→Gemini translation of Gemma models.
+// claude-to-gemini.ts already guards against sending `thinkingConfig` for
+// gemma-4-* models (Gemma does not support it — Vertex returns 400:
+// "Thinking budget is not supported for this model"). openai-to-gemini.ts
+// lacked the same guard, so OpenAI-shape clients hitting a vertex
+// `gemma-4-*` model still triggered the 400.
+// Port of the thinkingConfig-guard half of decolua/9router#2480 (the
+// signature-replay half of that PR is out of scope and NOT ported here).
+const { openaiToGeminiRequest } = await import(
+  "../../open-sse/translator/request/openai-to-gemini.ts"
+);
+
+type GeminiRequestResult = {
+  generationConfig?: { thinkingConfig?: unknown };
+};
+
+test("gemma-4 model: reasoning_effort does NOT produce a thinkingConfig", () => {
+  const result = openaiToGeminiRequest(
+    "gemma-4-31b-it",
+    {
+      model: "gemma-4-31b-it",
+      messages: [{ role: "user", content: "hi" }],
+      reasoning_effort: "high",
+      stream: false,
+    },
+    false
+  ) as GeminiRequestResult;
+
+  assert.equal(
+    result.generationConfig?.thinkingConfig,
+    undefined,
+    "gemma-4 models must never receive thinkingConfig (Vertex returns 400)"
+  );
+});
+
+test("gemma-4 model: Claude-style thinking.budget_tokens does NOT produce a thinkingConfig", () => {
+  const result = openaiToGeminiRequest(
+    "gemma-4-31b-it",
+    {
+      model: "gemma-4-31b-it",
+      messages: [{ role: "user", content: "hi" }],
+      thinking: { type: "enabled", budget_tokens: 4096 },
+      stream: false,
+    },
+    false
+  ) as GeminiRequestResult;
+
+  assert.equal(
+    result.generationConfig?.thinkingConfig,
+    undefined,
+    "gemma-4 models must never receive thinkingConfig even via the Claude-shape thinking field"
+  );
+});
+
+test("non-gemma gemini model: reasoning_effort STILL produces a thinkingConfig (no regression)", () => {
+  const result = openaiToGeminiRequest(
+    "gemini-2.5-flash",
+    {
+      model: "gemini-2.5-flash",
+      messages: [{ role: "user", content: "hi" }],
+      reasoning_effort: "high",
+      stream: false,
+    },
+    false
+  ) as GeminiRequestResult;
+
+  assert.ok(
+    result.generationConfig?.thinkingConfig,
+    "non-gemma Gemini models must keep receiving thinkingConfig"
+  );
+});
diff --git a/tests/unit/openvecta-provider-registration.test.ts b/tests/unit/openvecta-provider-registration.test.ts
new file mode 100644
index 0000000000..58734a3c9b
--- /dev/null
+++ b/tests/unit/openvecta-provider-registration.test.ts
@@ -0,0 +1,119 @@
+/**
+ * Coverage for the OpenVecta (https://openvecta.com/) provider registration.
+ *
+ * Validates the seven wiring points established in the feat/openvecta-provider
+ * branch:
+ *   1. APIKEY_PROVIDERS.openvecta — catalog entry (id, alias, name, website, hasFree)
+ *   2. providerRegistry.openvecta — format=openai / executor=default / apikey / bearer
+ *   3. PROVIDER_ENDPOINTS — chat completions baseUrl
+ *   4. providerModelsConfig — live /v1/models discovery URL
+ *   5. NAMED_OPENAI_STYLE_PROVIDERS — openvecta classified for live-fetch
+ *   6. Seeded registry catalog — non-empty, unique ids, includes a curated LLM subset
+ *   7. Schema validation — Zod validateProviders(APIKEY_PROVIDERS) passes (the import
+ *      would throw at module-load time if any entry were malformed)
+ *
+ * Rule #18 (TDD/VPS gate) — this test exists to keep the seven wiring points
+ * in sync; if any one drifts, the relevant assertion fails immediately.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { APIKEY_PROVIDERS } = await import(
+  "../../src/shared/constants/providers.ts"
+);
+const { REGISTRY: providerRegistry } = await import(
+  "../../open-sse/config/providerRegistry.ts"
+);
+const { NAMED_OPENAI_STYLE_PROVIDERS, isNamedOpenAIStyleProvider } = await import(
+  "../../src/app/api/providers/[id]/models/discovery/providerSets.ts"
+);
+const { PROVIDER_MODELS_CONFIG } = await import(
+  "../../src/app/api/providers/[id]/models/discovery/providerModelsConfig.ts"
+);
+
+const SPEC = {
+  id: "openvecta",
+  alias: "openvecta",
+  name: "OpenVecta",
+  website: "https://openvecta.com",
+  chatUrl: "https://api.openvecta.com/v1/chat/completions",
+  modelsUrl: "https://api.openvecta.com/v1/models",
+  expectedSeedIds: [
+    "glm-4.7-flash",
+    "claude-sonnet-4.6",
+    "deepseek-v4-flash",
+    "gpt-oss-120b",
+    "gemma-4-31b",
+    "kimi-k2.6",
+    "llama-3.3-70b-instruct",
+    "llama-4-maverick",
+    "nemotron-3-super-120b",
+  ],
+};
+
+test("APIKEY_PROVIDERS.openvecta is registered with the canonical identity", () => {
+  const entry = APIKEY_PROVIDERS[SPEC.id];
+  assert.ok(entry, `APIKEY_PROVIDERS.${SPEC.id} must be defined`);
+  assert.equal(entry.id, SPEC.id);
+  assert.equal(entry.alias, SPEC.alias);
+  assert.equal(entry.name, SPEC.name);
+  assert.equal(entry.website, SPEC.website);
+  assert.equal(typeof entry.textIcon, "string");
+  assert.equal(entry.hasFree, true, "OpenVecta advertises free signup credits");
+  assert.equal(typeof entry.freeNote, "string");
+  assert.match(entry.color, /^#[0-9A-Fa-f]{6}$/);
+});
+
+test("providerRegistry exposes the OpenAI-compatible chat completions URL", () => {
+  // Note: `PROVIDER_ENDPOINTS` in src/shared/constants/config.ts is a hand-curated
+  // *display-only* map (a subset of providers shown in the UI), so we don't
+  // require openvecta to be listed there — the source-of-truth chat URL lives
+  // on the registry entry, generated by `generateLegacyProviders()`.
+  assert.equal(providerRegistry[SPEC.id].baseUrl, SPEC.chatUrl);
+});
+
+test("PROVIDER_MODELS_CONFIG exposes the live /v1/models discovery URL", () => {
+  const cfg = PROVIDER_MODELS_CONFIG[SPEC.id];
+  assert.ok(cfg, `PROVIDER_MODELS_CONFIG.${SPEC.id} must be defined`);
+  assert.equal(cfg.url, SPEC.modelsUrl);
+  assert.equal(cfg.method, "GET");
+  assert.equal(cfg.authHeader, "Authorization");
+  assert.equal(cfg.authPrefix, "Bearer ");
+  assert.equal(typeof cfg.parseResponse, "function");
+});
+
+test("providerRegistry.openvecta uses OpenAI format with bearer apikey auth", () => {
+  const entry = providerRegistry[SPEC.id];
+  assert.ok(entry, `providerRegistry.${SPEC.id} must be defined`);
+  assert.equal(entry.id, SPEC.id);
+  assert.equal(entry.alias, SPEC.alias);
+  assert.equal(entry.format, "openai");
+  assert.equal(entry.executor, "default");
+  assert.equal(entry.authType, "apikey");
+  assert.equal(entry.authHeader, "bearer");
+  assert.equal(entry.baseUrl, SPEC.chatUrl);
+});
+
+test("openvecta is classified as a named OpenAI-style provider (live-fetch path)", () => {
+  assert.ok(
+    NAMED_OPENAI_STYLE_PROVIDERS.has(SPEC.id),
+    "openvecta must be in NAMED_OPENAI_STYLE_PROVIDERS for live /v1/models fetch",
+  );
+  assert.equal(isNamedOpenAIStyleProvider(SPEC.id), true);
+});
+
+test("openvecta ships a non-empty unique seed catalog covering curated LLMs", () => {
+  const models = providerRegistry[SPEC.id].models;
+  assert.ok(Array.isArray(models), "registry models must be an array");
+  assert.ok(models.length >= 5, "seed list must be non-empty for the offline fallback");
+  const ids = models.map((m: { id: string }) => m.id);
+  assert.equal(new Set(ids).size, ids.length, "seed model ids must be unique");
+  for (const expected of SPEC.expectedSeedIds) {
+    assert.ok(ids.includes(expected), `seed list must include ${expected}`);
+  }
+  for (const m of models) {
+    assert.equal(typeof m.id, "string");
+    assert.ok(m.id.length > 0);
+    assert.equal(typeof m.name, "string");
+  }
+});
\ No newline at end of file
diff --git a/tests/unit/param-filters-apply.test.ts b/tests/unit/param-filters-apply.test.ts
new file mode 100644
index 0000000000..7626490cc4
--- /dev/null
+++ b/tests/unit/param-filters-apply.test.ts
@@ -0,0 +1,48 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+// Static import — this module does NOT depend on the DB (tests applyConfigFilters
+// directly, which is a pure function; the DB-backed parent function stripUnsupportedParams
+// is only tested for its non-DB code paths here).
+import {
+  stripUnsupportedParams,
+  applyConfigFilters,
+} from "../../open-sse/translator/paramSupport.ts";
+
+// ---------------------------------------------------------------------------
+// stripUnsupportedParams — hardcoded STRIP_RULES (regression guard)
+// ---------------------------------------------------------------------------
+
+test("stripUnsupportedParams strips known hardcoded fields from body", () => {
+  const body = { model: "claude-opus-4", temperature: 0.7, max_tokens: 100 };
+  const result = stripUnsupportedParams("anthropic", "claude-opus-4-20250514", body);
+  assert.equal((result as Record<string, unknown>).temperature, undefined);
+  assert.equal((result as Record<string, unknown>).max_tokens, 100);
+});
+
+test("stripUnsupportedParams leaves unrelated models alone", () => {
+  const body = { model: "gpt-4", temperature: 0.7 };
+  const result = stripUnsupportedParams("openai", "gpt-4", body);
+  assert.equal((result as Record<string, unknown>).temperature, 0.7);
+});
+
+test("stripUnsupportedParams returns body unchanged for null/undefined args", () => {
+  const body = { model: "gpt-4" };
+  assert.equal(stripUnsupportedParams(null, null, body), body);
+  assert.equal(stripUnsupportedParams("test", null, body), body);
+  assert.equal(stripUnsupportedParams("test", "", body), body);
+});
+
+// ---------------------------------------------------------------------------
+// applyConfigFilters — config-driven denylist + allowlist (direct, no DB)
+// ---------------------------------------------------------------------------
+
+test("applyConfigFilters no-op when provider undefined or null", () => {
+  const body1 = { thinking: "enabled", max_tokens: 100 };
+  applyConfigFilters("nonexistent-provider", "my-model", body1, { ...body1 });
+  assert.deepEqual(body1, { thinking: "enabled", max_tokens: 100 });
+
+  const body2 = { thinking: "enabled" };
+  applyConfigFilters(null, "my-model", body2, { ...body2 });
+  assert.deepEqual(body2, { thinking: "enabled" });
+});
diff --git a/tests/unit/param-filters-auto-learn.test.ts b/tests/unit/param-filters-auto-learn.test.ts
new file mode 100644
index 0000000000..53d1125094
--- /dev/null
+++ b/tests/unit/param-filters-auto-learn.test.ts
@@ -0,0 +1,68 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+// This file tests the regex/matching logic of detectUnsupportedParam and the
+// UNSUPPORTED_PARAM_RE constant. These are pure functions with no DB dependency.
+// DB-backed persistence tests (addParamToBlocklist) live in param-filters-db.test.ts.
+import {
+  UNSUPPORTED_PARAM_RE,
+  detectUnsupportedParam,
+} from "../../open-sse/config/providerFieldStrips.ts";
+
+// ---------------------------------------------------------------------------
+// UNSUPPORTED_PARAM_RE
+// ---------------------------------------------------------------------------
+
+test("UNSUPPORTED_PARAM_RE matches NIM-style 'Unsupported parameter(s): thinking'", () => {
+  const m = UNSUPPORTED_PARAM_RE.exec("Unsupported parameter(s): thinking");
+  assert.notEqual(m, null);
+  assert.equal(m![1], "thinking");
+});
+
+test("UNSUPPORTED_PARAM_RE matches 'Unsupported parameter: max_tokens'", () => {
+  const m = UNSUPPORTED_PARAM_RE.exec("Unsupported parameter: max_tokens");
+  assert.notEqual(m, null);
+  assert.equal(m![1], "max_tokens");
+});
+
+test("UNSUPPORTED_PARAM_RE matches 'Unsupported parameter 'reasoning_budget''", () => {
+  const m = UNSUPPORTED_PARAM_RE.exec("Unsupported parameter 'reasoning_budget'");
+  assert.notEqual(m, null);
+  assert.equal(m![1], "reasoning_budget");
+});
+
+test("UNSUPPORTED_PARAM_RE matches case-insensitively", () => {
+  const m = UNSUPPORTED_PARAM_RE.exec("unsupported parameter(s): thinking");
+  assert.notEqual(m, null);
+  assert.equal(m![1], "thinking");
+});
+
+test("UNSUPPORTED_PARAM_RE does not match unrelated error text", () => {
+  assert.equal(UNSUPPORTED_PARAM_RE.exec("rate limit exceeded"), null);
+  assert.equal(UNSUPPORTED_PARAM_RE.exec("Internal server error"), null);
+  assert.equal(UNSUPPORTED_PARAM_RE.exec(""), null);
+});
+
+// ---------------------------------------------------------------------------
+// detectUnsupportedParam
+// ---------------------------------------------------------------------------
+
+test("detectUnsupportedParam extracts param name from NIM-style errors", () => {
+  assert.equal(detectUnsupportedParam("Unsupported parameter(s): thinking"), "thinking");
+  assert.equal(
+    detectUnsupportedParam("Unsupported parameter: reasoning_budget"),
+    "reasoning_budget"
+  );
+  assert.equal(detectUnsupportedParam("Unsupported parameter 'max_tokens'"), "max_tokens");
+});
+
+test("detectUnsupportedParam returns null for non-matching text", () => {
+  assert.equal(detectUnsupportedParam("all good"), null);
+  assert.equal(detectUnsupportedParam(""), null);
+  assert.equal(detectUnsupportedParam("400 Bad Request"), null);
+});
+
+test("detectUnsupportedParam returns null for null/undefined", () => {
+  assert.equal(detectUnsupportedParam(null as unknown as string), null);
+  assert.equal(detectUnsupportedParam(undefined as unknown as string), null);
+});
diff --git a/tests/unit/param-filters-db.test.ts b/tests/unit/param-filters-db.test.ts
new file mode 100644
index 0000000000..2b6f83b77f
--- /dev/null
+++ b/tests/unit/param-filters-db.test.ts
@@ -0,0 +1,255 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// Set DATA_DIR BEFORE any DB modules are imported so core.ts uses the temp dir.
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-pf-db-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+// Dynamic imports — these modules initialize SQLite on load, so DATA_DIR must be
+// set first.
+const core = await import("../../src/lib/db/core.ts");
+const {
+  setParamFilterConfig,
+  getParamFilterConfig,
+  deleteParamFilterConfig,
+  loadParamFilterConfigs,
+  addParamToBlocklist,
+  isAutoLearnGloballyEnabled,
+  setGlobalAutoLearnEnabled,
+} = await import("../../src/lib/db/paramFilters.ts");
+const { stripUnsupportedParams } = await import("../../open-sse/translator/paramSupport.ts");
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+// ---------------------------------------------------------------------------
+// setParamFilterConfig / getParamFilterConfig
+// ---------------------------------------------------------------------------
+
+test("setParamFilterConfig stores and getParamFilterConfig retrieves a config", () => {
+  const config = {
+    block: ["thinking", "reasoning_budget"],
+    allow: [],
+    autoLearn: true,
+  };
+  setParamFilterConfig("test-provider", config);
+  const retrieved = getParamFilterConfig("test-provider");
+  assert.notEqual(retrieved, null);
+  assert.deepEqual(retrieved!.block, ["thinking", "reasoning_budget"]);
+  assert.deepEqual(retrieved!.allow, []);
+  assert.equal(retrieved!.autoLearn, true);
+});
+
+test("getParamFilterConfig returns null for unconfigured provider", () => {
+  assert.equal(getParamFilterConfig("nonexistent"), null);
+});
+
+test("getParamFilterConfig returns null for empty provider", () => {
+  assert.equal(getParamFilterConfig(""), null);
+});
+
+test("setParamFilterConfig with model overrides stores correctly", () => {
+  const config = {
+    block: ["thinking"],
+    allow: [],
+    models: {
+      "deepseek-r1": { block: ["max_tokens"] },
+      "deepseek-r2": { block: ["temperature"], allow: ["reasoning"] },
+    },
+    autoLearn: false,
+  };
+  setParamFilterConfig("nvidia", config);
+  const retrieved = getParamFilterConfig("nvidia");
+  assert.notEqual(retrieved, null);
+  assert.deepEqual(retrieved!.models?.["deepseek-r1"]?.block, ["max_tokens"]);
+  assert.deepEqual(retrieved!.models?.["deepseek-r2"]?.block, ["temperature"]);
+  assert.deepEqual(retrieved!.models?.["deepseek-r2"]?.allow, ["reasoning"]);
+});
+
+// ---------------------------------------------------------------------------
+// deleteParamFilterConfig
+// ---------------------------------------------------------------------------
+
+test("deleteParamFilterConfig removes config and getParamFilterConfig returns null", () => {
+  setParamFilterConfig("ephemeral", { block: ["param1"], allow: [], autoLearn: false });
+  assert.notEqual(getParamFilterConfig("ephemeral"), null);
+  deleteParamFilterConfig("ephemeral");
+  assert.equal(getParamFilterConfig("ephemeral"), null);
+});
+
+test("deleteParamFilterConfig is a no-op for unconfigured provider", () => {
+  deleteParamFilterConfig("nothing-here");
+});
+
+// ---------------------------------------------------------------------------
+// loadParamFilterConfigs
+// ---------------------------------------------------------------------------
+
+test("loadParamFilterConfigs returns all configured providers", () => {
+  setParamFilterConfig("provider-a", { block: ["a"], allow: [], autoLearn: false });
+  setParamFilterConfig("provider-b", { block: ["b"], allow: [], autoLearn: true });
+  const all = loadParamFilterConfigs();
+  assert.equal(all.has("provider-a"), true);
+  assert.equal(all.has("provider-b"), true);
+  assert.equal(all.get("provider-a")!.block[0], "a");
+  assert.equal(all.get("provider-b")!.autoLearn, true);
+});
+
+// ---------------------------------------------------------------------------
+// addParamToBlocklist
+// ---------------------------------------------------------------------------
+
+test("addParamToBlocklist adds param to provider-level block list", () => {
+  setParamFilterConfig("test", { block: ["thinking"], allow: [], autoLearn: false });
+  addParamToBlocklist("test", "reasoning_budget");
+  const config = getParamFilterConfig("test");
+  assert.deepEqual(config!.block, ["thinking", "reasoning_budget"]);
+});
+
+test("addParamToBlocklist is idempotent — does not add duplicate", () => {
+  setParamFilterConfig("test-dup", { block: ["thinking"], allow: [], autoLearn: false });
+  addParamToBlocklist("test-dup", "thinking");
+  addParamToBlocklist("test-dup", "thinking");
+  const config = getParamFilterConfig("test-dup");
+  assert.deepEqual(config!.block, ["thinking"]);
+});
+
+test("addParamToBlocklist creates config if none exists", () => {
+  addParamToBlocklist("fresh-provider", "thinking");
+  const config = getParamFilterConfig("fresh-provider");
+  assert.notEqual(config, null);
+  assert.deepEqual(config!.block, ["thinking"]);
+  assert.equal(config!.autoLearn, false);
+});
+
+test("addParamToBlocklist with model param adds to model-level block list", () => {
+  setParamFilterConfig("test-model", { block: [], allow: [], autoLearn: false });
+  addParamToBlocklist("test-model", "temperature", "deepseek-r1");
+  const config = getParamFilterConfig("test-model");
+  assert.deepEqual(config!.models?.["deepseek-r1"]?.block, ["temperature"]);
+});
+
+// ---------------------------------------------------------------------------
+// Global auto-learn flag
+// ---------------------------------------------------------------------------
+
+test("isAutoLearnGloballyEnabled returns false by default", () => {
+  assert.equal(isAutoLearnGloballyEnabled(), false);
+});
+
+test("setGlobalAutoLearnEnabled(true) enables global auto-learn", () => {
+  setGlobalAutoLearnEnabled(true);
+  assert.equal(isAutoLearnGloballyEnabled(), true);
+});
+
+test("setGlobalAutoLearnEnabled(false) disables global auto-learn", () => {
+  setGlobalAutoLearnEnabled(true);
+  assert.equal(isAutoLearnGloballyEnabled(), true);
+  setGlobalAutoLearnEnabled(false);
+  assert.equal(isAutoLearnGloballyEnabled(), false);
+});
+
+test("setGlobalAutoLearnEnabled does not affect per-provider configs", () => {
+  setParamFilterConfig("test-global-safe", { block: ["thinking"], allow: [], autoLearn: false });
+  setGlobalAutoLearnEnabled(true);
+  const config = getParamFilterConfig("test-global-safe");
+  assert.deepEqual(config!.block, ["thinking"]);
+  assert.equal(config!.autoLearn, false);
+  // Global is independent
+  assert.equal(isAutoLearnGloballyEnabled(), true);
+});
+
+// ---------------------------------------------------------------------------
+// Full pipeline: DB config → stripUnsupportedParams
+// ---------------------------------------------------------------------------
+
+test("stripUnsupportedParams strips config-driven provider-level denylist", () => {
+  setParamFilterConfig("nvidia", {
+    block: ["thinking", "reasoning_budget"],
+    allow: [],
+    autoLearn: false,
+  });
+  loadParamFilterConfigs();
+
+  const body = { model: "deepseek-r1", thinking: "enabled", max_tokens: 100 };
+  const result = stripUnsupportedParams("nvidia", "deepseek-r1", body);
+  assert.equal((result as Record<string, unknown>).thinking, undefined);
+  assert.equal((result as Record<string, unknown>).reasoning_budget, undefined);
+  assert.equal((result as Record<string, unknown>).max_tokens, 100);
+});
+
+test("stripUnsupportedParams strips config-driven model-level denylist (stricter)", () => {
+  setParamFilterConfig("nvidia", {
+    block: ["thinking"],
+    allow: [],
+    models: { "deepseek-r1": { block: ["max_tokens"] } },
+    autoLearn: false,
+  });
+  loadParamFilterConfigs();
+
+  const body = { model: "deepseek-r1", thinking: "enabled", max_tokens: 100, temperature: 0.7 };
+  const result = stripUnsupportedParams("nvidia", "deepseek-r1", body);
+  assert.equal((result as Record<string, unknown>).thinking, undefined);
+  assert.equal((result as Record<string, unknown>).max_tokens, undefined);
+  assert.equal((result as Record<string, unknown>).temperature, 0.7);
+});
+
+test("stripUnsupportedParams allowlist restores a denied param from original body", () => {
+  setParamFilterConfig("nvidia", {
+    block: ["thinking", "reasoning_budget"],
+    allow: ["thinking"],
+    autoLearn: false,
+  });
+  loadParamFilterConfigs();
+
+  const body = { model: "deepseek-r1", thinking: "enabled", max_tokens: 100 };
+  const result = stripUnsupportedParams("nvidia", "deepseek-r1", body);
+  assert.equal((result as Record<string, unknown>).thinking, "enabled");
+  assert.equal((result as Record<string, unknown>).reasoning_budget, undefined);
+  assert.equal((result as Record<string, unknown>).max_tokens, 100);
+});
+
+test("stripUnsupportedParams allowlist does not introduce params not in original body", () => {
+  setParamFilterConfig("nvidia", {
+    block: [],
+    allow: ["nonexistent_param"],
+    autoLearn: false,
+  });
+  loadParamFilterConfigs();
+
+  const body = { model: "deepseek-r1", thinking: "enabled" };
+  const result = stripUnsupportedParams("nvidia", "deepseek-r1", body);
+  assert.equal((result as Record<string, unknown>).nonexistent_param, undefined);
+});
+
+test("stripUnsupportedParams model-level denylist overrides provider-level allowlist", () => {
+  setParamFilterConfig("nvidia", {
+    block: ["thinking"],
+    allow: ["thinking"],
+    models: { "deepseek-r1": { block: ["thinking"] } },
+    autoLearn: false,
+  });
+  loadParamFilterConfigs();
+
+  // Provider allowlist re-adds thinking, but model-level denylist strips it again
+  const body = { model: "deepseek-r1", thinking: "enabled", max_tokens: 100 };
+  const result = stripUnsupportedParams("nvidia", "deepseek-r1", body);
+  assert.equal(
+    (result as Record<string, unknown>).thinking,
+    undefined,
+    "model denylist should win over provider allowlist"
+  );
+  assert.equal((result as Record<string, unknown>).max_tokens, 100);
+});
+
+test("stripUnsupportedParams no-op when no DB config exists (default behavior)", () => {
+  const body = { model: "deepseek-r1", thinking: "enabled", max_tokens: 100 };
+  const result = stripUnsupportedParams("unknown", "deepseek-r1", body);
+  assert.equal((result as Record<string, unknown>).thinking, "enabled");
+  assert.equal((result as Record<string, unknown>).max_tokens, 100);
+});
diff --git a/tests/unit/playground-model-selection-3731.test.ts b/tests/unit/playground-model-selection-3731.test.ts
index b59254c617..63be0684ea 100644
--- a/tests/unit/playground-model-selection-3731.test.ts
+++ b/tests/unit/playground-model-selection-3731.test.ts
@@ -3,6 +3,7 @@ import assert from "node:assert/strict";
 import {
   pickDefaultModel,
   resolveModelFilterKey,
+  filterModelsByQuery,
 } from "../../src/app/(dashboard)/dashboard/playground/components/modelSelection.ts";
 
 // Regression guards for #3731 (dup #3009): the Playground model selector was unusable
@@ -48,3 +49,26 @@ test("pickDefaultModel: a current model not in the list is replaced by the first
 test("pickDefaultModel: a valid current model is kept (no redundant update)", () => {
   assert.equal(pickDefaultModel("b", ["a", "b"]), null);
 });
+
+// Regression guards for #4086: search/filter on the raw Playground model <select>.
+
+test("filterModelsByQuery: empty query returns the full list unchanged", () => {
+  const models = ["openai/gpt-4o", "anthropic/claude-3"];
+  assert.deepEqual(filterModelsByQuery(models, ""), models);
+  assert.deepEqual(filterModelsByQuery(models, "   "), models);
+});
+
+test("filterModelsByQuery: matches case-insensitively on substring", () => {
+  const models = ["openai/gpt-4o", "anthropic/claude-3", "openrouter/mistral-large"];
+  assert.deepEqual(filterModelsByQuery(models, "GPT"), ["openai/gpt-4o"]);
+  assert.deepEqual(filterModelsByQuery(models, "claude"), ["anthropic/claude-3"]);
+});
+
+test("filterModelsByQuery: matches provider/namespace prefix", () => {
+  const models = ["openai/gpt-4o", "anthropic/claude-3", "openrouter/mistral-large"];
+  assert.deepEqual(filterModelsByQuery(models, "openrouter"), ["openrouter/mistral-large"]);
+});
+
+test("filterModelsByQuery: no matches returns an empty list", () => {
+  assert.deepEqual(filterModelsByQuery(["a", "b"], "zzz"), []);
+});
diff --git a/tests/unit/playground-reasoning-controls-6241.test.ts b/tests/unit/playground-reasoning-controls-6241.test.ts
index 318eb1e2b2..3dda9effce 100644
--- a/tests/unit/playground-reasoning-controls-6241.test.ts
+++ b/tests/unit/playground-reasoning-controls-6241.test.ts
@@ -4,7 +4,7 @@ import {
   resolveReasoningControls,
   buildReasoningRequestFields,
   type ReasoningControlSpec,
-} from "../../src/app/(dashboard)/dashboard/playground/components/reasoningControls.ts";
+} from "../../src/app/(dashboard)/dashboard/playground/components/reasoningControlUtils.ts";
 import { CANONICAL_EFFORT_VALUES } from "../../src/shared/reasoning/effortStandardization.ts";
 
 // #6241: the Playground effort selector + thinking toggle read a model's `supportsThinking` /
diff --git a/tests/unit/pricing-sync-cross-instance.test.ts b/tests/unit/pricing-sync-cross-instance.test.ts
new file mode 100644
index 0000000000..fb3658918e
--- /dev/null
+++ b/tests/unit/pricing-sync-cross-instance.test.ts
@@ -0,0 +1,80 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// ─── Regression test for #6325 ───────────────────────────────────────────
+//
+// In production, `instrumentation-node.ts` (background periodic sync) and
+// `src/app/api/pricing/sync/route.ts` (dashboard status endpoint) each
+// `await import("@/lib/pricingSync")` from SEPARATE Next.js standalone
+// webpack entries, producing SEPARATE module instances with independent
+// top-level (`lastSyncTime`, `lastSyncModelCount`, `syncTimer`) state.
+//
+// This test simulates that scenario by importing the module twice under
+// distinct specifiers (cache-busted via a query string), so each import
+// gets its own top-level module state while both share the same on-disk
+// SQLite DB (as they do in production). It asserts that a status read from
+// a FRESH module instance still reflects a sync performed by a DIFFERENT
+// module instance — i.e. sync status must be derived from persisted state,
+// not from in-memory module-level variables.
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-pricing-sync-xinst-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+
+const originalFetch = globalThis.fetch;
+
+function buildLiteLLMFixture() {
+  return {
+    "openai/gpt-4o": {
+      input_cost_per_token: 0.0000025,
+      output_cost_per_token: 0.00001,
+      litellm_provider: "openai",
+      mode: "chat",
+    },
+  };
+}
+
+test.after(async () => {
+  globalThis.fetch = originalFetch;
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("getSyncStatus reflects a sync performed by a different module instance", async () => {
+  globalThis.fetch = async () =>
+    new Response(JSON.stringify(buildLiteLLMFixture()), {
+      status: 200,
+      headers: { "content-type": "application/json" },
+    });
+
+  // Instance A: simulates the background periodic-sync module instance.
+  const pricingSyncA = await import("../../src/lib/pricingSync.ts?instance=A");
+  const result = await pricingSyncA.syncPricingFromSources({
+    sources: ["litellm"],
+    dryRun: false,
+  });
+  assert.equal(result.success, true);
+
+  // Instance B: simulates the dashboard API-route module instance — a
+  // genuinely fresh module scope that never called syncPricingFromSources
+  // itself, and whose own `syncTimer`/`lastSyncTime` module vars are unset.
+  const pricingSyncB = await import("../../src/lib/pricingSync.ts?instance=B");
+  const status = pricingSyncB.getSyncStatus();
+
+  assert.equal(
+    status.lastSyncModelCount,
+    result.modelCount,
+    "should read model count from persisted state"
+  );
+  assert.ok(status.lastSyncModelCount > 0, "persisted model count should be non-zero");
+  assert.notEqual(status.lastSync, null, "should read lastSync from persisted state");
+  assert.notEqual(
+    status.nextSync,
+    null,
+    "nextSync must be computed from persisted state, not the local (unset) syncTimer"
+  );
+});
diff --git a/tests/unit/probe-6409-turbopack-memory-doc.test.ts b/tests/unit/probe-6409-turbopack-memory-doc.test.ts
new file mode 100644
index 0000000000..592cd17d31
--- /dev/null
+++ b/tests/unit/probe-6409-turbopack-memory-doc.test.ts
@@ -0,0 +1,46 @@
+/**
+ * Probe for #6409 — "npm run build requires >14 GB RAM".
+ *
+ * Root cause: PR #6283 (merged 2026-07-05, one day before this issue was filed)
+ * made Turbopack the default bundler for `npm run build` (previously opt-in via
+ * OMNIROUTE_USE_TURBOPACK=1). OmniRoute pins `next@^16.2.6` (resolved 16.2.9),
+ * a version line where Turbopack *production* builds are known upstream to use
+ * dramatically more memory than webpack on large module graphs (Vercel reported
+ * ~21.5 GB on their own dashboard app before the memory-eviction fix landed in
+ * Next 16.3 — not yet stable on npm as of this triage, only canary/preview).
+ * OmniRoute's own module graph is large (open-sse workspace, thousands of
+ * modules), matching the class of app that hits this.
+ *
+ * A working escape hatch already exists (`OMNIROUTE_USE_TURBOPACK=0` reverts to
+ * webpack), but docs/reference/ENVIRONMENT.md documents it only as a fix for
+ * "native binding / bundler-compat" issues on Windows — it says nothing about
+ * memory, so a RAM-constrained contributor building from source (exactly this
+ * reporter's scenario) has no signal to reach for it before their build balloons
+ * past 14 GB.
+ *
+ * This probe proves the informational gap: the ENVIRONMENT.md row for
+ * OMNIROUTE_USE_TURBOPACK does not mention memory/RAM at all.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+
+test("#6409 ENVIRONMENT.md documents the memory tradeoff of the Turbopack build default", () => {
+  const envDocPath = path.join(repoRoot, "docs/reference/ENVIRONMENT.md");
+  const doc = fs.readFileSync(envDocPath, "utf-8");
+  const lines = doc.split("\n");
+  const row = lines.find((l) => l.includes("OMNIROUTE_USE_TURBOPACK"));
+  assert.ok(row, "ENVIRONMENT.md must document OMNIROUTE_USE_TURBOPACK");
+
+  const mentionsMemory = /\b(memory|RAM|GB)\b/i.test(row ?? "");
+  assert.ok(
+    mentionsMemory,
+    "OMNIROUTE_USE_TURBOPACK row must mention the memory/RAM tradeoff so contributors on " +
+      "memory-constrained machines know the webpack fallback (=0) exists BEFORE `npm run build` " +
+      "balloons past 14 GB (#6409), not just the Windows/native-binding-compat reason currently documented"
+  );
+});
diff --git a/tests/unit/provider-apikey-cap-6715.test.ts b/tests/unit/provider-apikey-cap-6715.test.ts
new file mode 100644
index 0000000000..e831f8963c
--- /dev/null
+++ b/tests/unit/provider-apikey-cap-6715.test.ts
@@ -0,0 +1,65 @@
+// Regression guard for #6715 — the provider connection `apiKey` field was
+// hard-capped at 10,000 chars in the Zod save schemas:
+//   src/shared/validation/schemas/provider.ts
+//     createProviderSchema            (add connection)
+//     bulkCreateProviderSchema        (bulk import)
+//     updateProviderConnectionSchema  (edit connection)
+//
+// That `apiKey` field is reused as the raw `Cookie:` header value for cookie-
+// based web providers (Gemini Business, Copilot M365, ChatGPT Web, Claude Web,
+// …). Real multi-cookie session headers (many `__Secure-*` entries, large
+// session tokens) legitimately exceed 10,000 chars. The provider's own
+// `validate` schema (validateProviderApiKeySchema) has NO cap, so the cookie
+// validated as OK — then `save` rejected it with HTTP 400
+// "Too big: expected string to have <=10000 characters".
+//
+// Fix: raise the ceiling to MAX_PROVIDER_CREDENTIAL_LENGTH (100_000) — still a
+// sane anti-abuse bound (well under the 10 MB default request-body limit and
+// unconstrained SQLite TEXT storage), just wide enough for real cookie headers.
+// Same fix shape as #6562 (priority cap raised to 100_000).
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { createProviderSchema, bulkCreateProviderSchema, updateProviderConnectionSchema } =
+  await import("../../src/shared/validation/schemas.ts");
+
+// A realistic large cookie-header value: > 10_000 chars, < the new 100_000 cap.
+const LARGE_COOKIE = "__Secure-session=" + "a".repeat(20_000);
+// Beyond the new ceiling — must still be rejected (anti-abuse bound preserved).
+const OVERSIZE_COOKIE = "x".repeat(100_001);
+
+test("createProviderSchema accepts a >10000-char cookie apiKey (#6715)", () => {
+  const result = createProviderSchema.safeParse({
+    provider: "gemini-business",
+    name: "Gemini Business (cookie)",
+    apiKey: LARGE_COOKIE,
+  });
+  assert.equal(result.success, true, JSON.stringify(result.error?.issues));
+});
+
+test("bulkCreateProviderSchema accepts a >10000-char cookie apiKey (#6715)", () => {
+  const result = bulkCreateProviderSchema.safeParse({
+    provider: "gemini-business",
+    entries: [{ name: "cookie-1", apiKey: LARGE_COOKIE }],
+  });
+  assert.equal(result.success, true, JSON.stringify(result.error?.issues));
+});
+
+test("updateProviderConnectionSchema accepts a >10000-char cookie apiKey (#6715)", () => {
+  const result = updateProviderConnectionSchema.safeParse({ apiKey: LARGE_COOKIE });
+  assert.equal(result.success, true, JSON.stringify(result.error?.issues));
+});
+
+test("createProviderSchema still rejects an oversize apiKey past the new ceiling (control)", () => {
+  const result = createProviderSchema.safeParse({
+    provider: "gemini-business",
+    name: "too big",
+    apiKey: OVERSIZE_COOKIE,
+  });
+  assert.equal(result.success, false);
+});
+
+test("updateProviderConnectionSchema still rejects an oversize apiKey past the new ceiling (control)", () => {
+  const result = updateProviderConnectionSchema.safeParse({ apiKey: OVERSIZE_COOKIE });
+  assert.equal(result.success, false);
+});
diff --git a/tests/unit/provider-icon-arena-themed.test.ts b/tests/unit/provider-icon-arena-themed.test.ts
new file mode 100644
index 0000000000..8ccd0546a4
--- /dev/null
+++ b/tests/unit/provider-icon-arena-themed.test.ts
@@ -0,0 +1,30 @@
+/**
+ * Arena (lmarena) theme-aware provider icons must stay wired to the static SVGs
+ * under public/providers/arena-{light,dark}.svg.
+ */
+import assert from "node:assert/strict";
+import { readFileSync, existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { test } from "node:test";
+
+const root = join(dirname(fileURLToPath(import.meta.url)), "../..");
+const providerIconSrc = readFileSync(join(root, "src/shared/components/ProviderIcon.tsx"), "utf8");
+
+test("ProviderIcon maps lmarena (and lma) to arena light/dark SVGs", () => {
+  assert.ok(
+    providerIconSrc.includes('light: "/providers/arena-light.svg"'),
+    "must reference arena-light.svg"
+  );
+  assert.ok(
+    providerIconSrc.includes('dark: "/providers/arena-dark.svg"'),
+    "must reference arena-dark.svg"
+  );
+  assert.ok(providerIconSrc.includes("lmarena:"), "must register wire id lmarena");
+  assert.ok(providerIconSrc.includes("lma:"), "must register alias lma");
+});
+
+test("arena theme SVG assets exist under public/providers/", () => {
+  assert.ok(existsSync(join(root, "public/providers/arena-light.svg")));
+  assert.ok(existsSync(join(root, "public/providers/arena-dark.svg")));
+});
diff --git a/tests/unit/provider-models-context-window-override-4125.test.ts b/tests/unit/provider-models-context-window-override-4125.test.ts
new file mode 100644
index 0000000000..f7488cd04e
--- /dev/null
+++ b/tests/unit/provider-models-context-window-override-4125.test.ts
@@ -0,0 +1,138 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// #4125: manual per-model context-window override.
+//
+// Custom-model rows already carried an inputTokenLimit/outputTokenLimit set at
+// creation time, but there was no way to *edit* the real context window afterwards
+// when a provider's own /models endpoint misreports it (e.g. reports 1M when the
+// real limit is 128K), and combo routing would drop the model once a too-small
+// value made it into the catalog / models.dev sync.
+//
+// This reuses the Feature-5004 `model_context_overrides` table (source="manual"),
+// which already wins over the catalog in `getModelContextLimit()` — the same
+// resolver combo routing consults — so no new priority-0 source is needed in
+// modelCapabilities.ts. This test proves the API round trip end-to-end: PUT sets
+// the override, GET surfaces it back on the model row, and getModelContextLimit()
+// (the function combo.ts calls) picks it up.
+
+const TEST_DATA_DIR = fs.mkdtempSync(
+  path.join(os.tmpdir(), "omniroute-provider-model-context-override-4125-")
+);
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const modelsDb = await import("../../src/lib/db/models.ts");
+const contextOverrides = await import("../../src/lib/db/modelContextOverrides.ts");
+const modelCapabilities = await import("../../src/lib/modelCapabilities.ts");
+const providerModelsRoute = await import("../../src/app/api/provider-models/route.ts");
+
+async function resetStorage() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(async () => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+function buildRequest(method: string, body: unknown) {
+  return new Request("http://localhost/api/provider-models", {
+    method,
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+test("PUT with contextWindowOverride persists a manual override that wins over the catalog", async () => {
+  await modelsDb.addCustomModel(
+    "openai-compatible-demo",
+    "misreported-model",
+    "Misreported Model",
+    "manual",
+    "chat-completions",
+    ["chat"],
+    undefined,
+    { inputTokenLimit: 1_000_000 } // provider misreports 1M
+  );
+
+  const putRes = await providerModelsRoute.PUT(
+    buildRequest("PUT", {
+      provider: "openai-compatible-demo",
+      modelId: "misreported-model",
+      contextWindowOverride: 131072, // real window per the operator
+    })
+  );
+  const putBody = (await putRes.json()) as { contextWindowOverride?: number | null };
+
+  assert.equal(putRes.status, 200);
+  assert.equal(putBody.contextWindowOverride, 131072);
+
+  // Persisted as a "manual" source in the Feature-5004 table.
+  const record = contextOverrides.getModelContextOverrideRecord(
+    "openai-compatible-demo",
+    "misreported-model"
+  );
+  assert.ok(record, "override record should exist");
+  assert.equal(record!.realContext, 131072);
+  assert.equal(record!.source, "manual");
+
+  // getModelContextLimit is what combo.ts's context-window filter reads — the
+  // manual override must win over the (wrong) 1M value on the custom-model row.
+  const limit = modelCapabilities.getModelContextLimit(
+    "openai-compatible-demo",
+    "misreported-model"
+  );
+  assert.equal(limit, 131072);
+});
+
+test("GET surfaces contextWindowOverride on the custom model row", async () => {
+  await modelsDb.addCustomModel("openai-compatible-demo", "m1", "M1");
+  contextOverrides.setModelContextOverride("openai-compatible-demo", "m1", 200000, "manual");
+
+  const getRes = await providerModelsRoute.GET(
+    new Request("http://localhost/api/provider-models?provider=openai-compatible-demo")
+  );
+  const body = (await getRes.json()) as {
+    models: Array<{ id?: string; contextWindowOverride?: number; contextWindowOverrideSource?: string }>;
+  };
+
+  const row = body.models.find((m) => m.id === "m1");
+  assert.ok(row, "model row should be present");
+  assert.equal(row!.contextWindowOverride, 200000);
+  assert.equal(row!.contextWindowOverrideSource, "manual");
+});
+
+test("PUT with contextWindowOverride: null clears a previously set override", async () => {
+  await modelsDb.addCustomModel("openai-compatible-demo", "m2", "M2");
+  contextOverrides.setModelContextOverride("openai-compatible-demo", "m2", 50000, "manual");
+
+  const putRes = await providerModelsRoute.PUT(
+    buildRequest("PUT", {
+      provider: "openai-compatible-demo",
+      modelId: "m2",
+      contextWindowOverride: null,
+    })
+  );
+  assert.equal(putRes.status, 200);
+
+  const record = contextOverrides.getModelContextOverrideRecord("openai-compatible-demo", "m2");
+  assert.equal(record, null);
+});
+
+test("default behavior unchanged: no override means getModelContextLimit falls back to the catalog", async () => {
+  await modelsDb.addCustomModel("openai-compatible-demo", "m3", "M3");
+  const limit = modelCapabilities.getModelContextLimit("openai-compatible-demo", "m3");
+  // No override, no catalog entry for this unknown custom model → null (not dropped
+  // by the combo prefilter, which treats unknown context as "include to be safe").
+  assert.equal(limit, null);
+});
diff --git a/tests/unit/provider-models-custom-merge-6247.test.ts b/tests/unit/provider-models-custom-merge-6247.test.ts
index 85e15fcf77..b7cc0904b2 100644
--- a/tests/unit/provider-models-custom-merge-6247.test.ts
+++ b/tests/unit/provider-models-custom-merge-6247.test.ts
@@ -98,3 +98,24 @@ test("per-connection models route includes user-added custom models on the local
   assert.ok(custom, "user-added custom model must appear in the per-connection catalog");
   assert.equal(custom.owned_by, "aimlapi", "custom model must be stamped owned_by = provider");
 });
+
+test("per-connection models route can exclude response-only custom models for sync", async () => {
+  const connection = await seedConnection("aimlapi", { apiKey: "aiml-key" });
+
+  await modelsDb.addCustomModel("aimlapi", "my-org/custom-model-sync", "My Custom Sync");
+  globalThis.fetch = (async () => new Response("upstream down", { status: 500 })) as typeof fetch;
+
+  const response = await callRoute(connection.id, "?excludeCustom=true");
+  const body = (await response.json()) as {
+    source?: string;
+    models?: Array<{ id: string }>;
+  };
+
+  assert.equal(response.status, 200);
+  assert.equal(body.source, "local_catalog");
+  assert.equal(
+    (body.models || []).some((model) => model.id === "my-org/custom-model-sync"),
+    false,
+    "internal model-sync discovery must not reclassify response-only custom rows"
+  );
+});
diff --git a/tests/unit/provider-models-discovery-split.test.ts b/tests/unit/provider-models-discovery-split.test.ts
index 26da4cfe14..9dd3502575 100644
--- a/tests/unit/provider-models-discovery-split.test.ts
+++ b/tests/unit/provider-models-discovery-split.test.ts
@@ -1,8 +1,8 @@
 // Split-guard for the provider-models discovery route decomposition
 // (refactor: extract 4 pure leaves — helpers / normalizers / providerModelsConfig /
 // providerSets — out of src/app/api/providers/[id]/models/route.ts). The leaves are
-// DB-free and state-free; this guard pins their public surface, the host wiring, and
-// the #5570 cablyai→aimlapi swap so a future edit that silently breaks the split fails.
+// DB-free and state-free; this guard pins their public surface and the host wiring
+// so a future edit that silently breaks the split fails.
 
 import test from "node:test";
 import assert from "node:assert/strict";
@@ -24,6 +24,23 @@ import {
   isNamedOpenAIStyleProvider,
 } from "../../src/app/api/providers/[id]/models/discovery/providerSets.ts";
 import { PROVIDER_MODELS_CONFIG } from "../../src/app/api/providers/[id]/models/discovery/providerModelsConfig.ts";
+import { isCodexDiscoveryModelExcluded as isSharedCodexDiscoveryModelExcluded } from "../../src/shared/services/codexDiscoveryPolicy.ts";
+import {
+  applyCodexDiscoveryFilters,
+  buildCodexDiscoveryCatalog,
+  buildCodexModelsUrl,
+  CODEX_GITHUB_MODELS_URL,
+  CODEX_MODELS_URL,
+  clearCodexGithubCatalogCacheForTests,
+  enrichCodexModelsFromGithubCatalog,
+  fetchCodexDiscoveryModels,
+  fetchCodexGithubCatalogModels,
+  isCodexDiscoveryModelExcluded,
+  mergeCodexLiveModelsWithLocalCatalog,
+  normalizeCodexGithubCatalogResponse,
+  normalizeCodexModelsResponse,
+  reconcileCuratedCodexCatalog,
+} from "../../src/app/api/providers/[id]/models/discovery/codex.ts";
 
 // ── helpers leaf ─────────────────────────────────────────────────────────────
 
@@ -117,12 +134,11 @@ test("providerSets.isNamedOpenAIStyleProvider matches Set membership", () => {
 
 test("providerModelsConfig.PROVIDER_MODELS_CONFIG keeps core provider entries", () => {
   assert.equal(PROVIDER_MODELS_CONFIG.claude.url, "https://api.anthropic.com/v1/models");
-  assert.equal(PROVIDER_MODELS_CONFIG["qwen-web"].url, "https://chat.qwen.ai/api/v2/models");
+  assert.equal(PROVIDER_MODELS_CONFIG["qwen-web"].url, "https://chat.qwen.ai/api/v2/models/");
 });
 
-test("providerModelsConfig aimlapi entry replaced the removed cablyai entry (#5570)", () => {
+test("providerModelsConfig keeps the aimlapi live catalog entry", () => {
   assert.equal(PROVIDER_MODELS_CONFIG.aimlapi.url, "https://api.aimlapi.com/models");
-  assert.equal(PROVIDER_MODELS_CONFIG.cablyai, undefined);
 });
 
 test("providerModelsConfig aimlapi.parseResponse keeps only chat-completion models when present", () => {
@@ -133,6 +149,435 @@ test("providerModelsConfig aimlapi.parseResponse keeps only chat-completion mode
   assert.deepEqual(parsed, [{ id: "chat-1", name: "Chat 1" }]);
 });
 
+// ── codex discovery leaf ────────────────────────────────────────────────────
+
+test.beforeEach(() => {
+  clearCodexGithubCatalogCacheForTests();
+});
+
+test("codex.normalizeCodexModelsResponse maps data/models/map payloads to response models", () => {
+  assert.deepEqual(normalizeCodexModelsResponse({ data: [{ id: "gpt-5.5", name: "GPT 5.5" }] }), [
+    {
+      id: "gpt-5.5",
+      name: "GPT 5.5",
+      owned_by: "codex",
+      apiFormat: "responses",
+      supportedEndpoints: ["responses"],
+    },
+  ]);
+
+  assert.deepEqual(
+    normalizeCodexModelsResponse({
+      "gpt-5.4": { title: "GPT 5.4" },
+      invalid: null,
+    }).map((m) => ({ id: m.id, name: m.name })),
+    [{ id: "gpt-5.4", name: "GPT 5.4" }]
+  );
+});
+
+test("codex.normalizeCodexModelsResponse parses the Codex live catalog shape", () => {
+  const parsed = normalizeCodexModelsResponse({
+    models: [
+      {
+        slug: "codex-auto-review",
+        display_name: "Codex Auto Review",
+        visibility: "hide",
+        supported_in_api: true,
+      },
+      {
+        slug: "gpt-5.4",
+        display_name: "GPT-5.4",
+        visibility: "list",
+        supported_in_api: true,
+        context_length: 400000,
+        max_output_tokens: 128000,
+        service_tiers: [{ id: "priority", name: "Fast" }],
+        additional_speed_tiers: ["fast"],
+      },
+      {
+        slug: "gpt-5.5",
+        display_name: "GPT-5.5",
+        visibility: "list",
+        supported_in_api: true,
+        max_input_tokens: 272000,
+        top_provider: { max_completion_tokens: 64000 },
+      },
+      {
+        slug: "internal-only",
+        display_name: "Internal Only",
+        visibility: "list",
+        supported_in_api: false,
+      },
+    ],
+  });
+
+  assert.deepEqual(
+    parsed.map((m) => ({ id: m.id, name: m.name })),
+    [
+      { id: "gpt-5.4", name: "GPT-5.4" },
+      { id: "gpt-5.5", name: "GPT-5.5" },
+    ]
+  );
+  assert.equal(parsed.find((model) => model.id === "gpt-5.4")?.inputTokenLimit, 400000);
+  assert.equal(parsed.find((model) => model.id === "gpt-5.4")?.outputTokenLimit, 128000);
+  assert.equal(parsed.find((model) => model.id === "gpt-5.5")?.inputTokenLimit, 272000);
+  assert.equal(parsed.find((model) => model.id === "gpt-5.5")?.outputTokenLimit, 64000);
+});
+
+test("codex.normalizeCodexGithubCatalogResponse parses current client catalog metadata", () => {
+  const parsed = normalizeCodexGithubCatalogResponse({
+    models: [
+      {
+        slug: "gpt-5.6-sol",
+        display_name: "GPT-5.6-Sol",
+        description: "Latest frontier agentic coding model.",
+        visibility: "list",
+        supported_in_api: true,
+        minimal_client_version: "0.144.0",
+        context_window: 372000,
+        input_modalities: ["text", "image"],
+        supported_reasoning_levels: [{ effort: "low" }, { effort: "ultra" }],
+      },
+      {
+        slug: "future-model",
+        display_name: "Future Model",
+        visibility: "list",
+        supported_in_api: true,
+        minimal_client_version: "999.0.0",
+      },
+      {
+        slug: "codex-auto-review",
+        display_name: "Codex Auto Review",
+        visibility: "hide",
+        supported_in_api: true,
+      },
+    ],
+  });
+
+  assert.deepEqual(
+    parsed.map((model) => model.id),
+    ["gpt-5.6-sol"]
+  );
+  assert.equal(parsed[0]?.description, "Latest frontier agentic coding model.");
+  assert.equal(parsed[0]?.inputTokenLimit, 372000);
+  assert.equal(parsed[0]?.supportsThinking, true);
+  assert.equal(parsed[0]?.supportsVision, true);
+});
+
+test("codex.enrichCodexModelsFromGithubCatalog keeps live entitlement list authoritative", () => {
+  const enriched = enrichCodexModelsFromGithubCatalog(
+    [
+      {
+        id: "gpt-5.6-sol",
+        name: "Live Sol",
+        owned_by: "codex",
+        apiFormat: "responses",
+        supportedEndpoints: ["responses"],
+      },
+    ],
+    [
+      {
+        id: "gpt-5.6-sol",
+        name: "GitHub Sol",
+        owned_by: "codex",
+        apiFormat: "responses",
+        supportedEndpoints: ["responses"],
+        inputTokenLimit: 372000,
+        supportsVision: true,
+      },
+      {
+        id: "gpt-5.6-luna",
+        name: "GitHub Luna",
+        owned_by: "codex",
+        apiFormat: "responses",
+        supportedEndpoints: ["responses"],
+      },
+    ]
+  );
+
+  assert.deepEqual(
+    enriched.map((model) => model.id),
+    ["gpt-5.6-sol"]
+  );
+  assert.equal(enriched[0]?.name, "Live Sol");
+  assert.equal(enriched[0]?.inputTokenLimit, 372000);
+  assert.equal(enriched[0]?.supportsVision, true);
+});
+
+test("codex.mergeCodexLiveModelsWithLocalCatalog auto-includes remote-only models", () => {
+  const merged = mergeCodexLiveModelsWithLocalCatalog(
+    [
+      {
+        id: "future-codex-model",
+        name: "Future Codex Model",
+        owned_by: "codex",
+        apiFormat: "responses",
+        supportedEndpoints: ["responses"],
+      },
+      {
+        id: "gpt-5.6-sol",
+        name: "Live Sol",
+        owned_by: "codex",
+        apiFormat: "responses",
+        supportedEndpoints: ["responses"],
+        inputTokenLimit: 999999,
+        supportsVision: true,
+      },
+    ],
+    [
+      {
+        id: "gpt-5.6-sol",
+        name: "GPT 5.6 Sol",
+        contextLength: 500000,
+        maxInputTokens: 372000,
+        maxOutputTokens: 128000,
+      },
+      { id: "gpt-5.6-sol-low", name: "GPT 5.6 Sol (Low)", contextLength: 500000 },
+    ]
+  );
+
+  const ids = merged.map((model) => model.id);
+  assert.ok(ids.includes("future-codex-model"));
+  assert.ok(ids.includes("gpt-5.6-sol"));
+  assert.ok(ids.includes("gpt-5.6-sol-low"));
+  const sol = merged.find((model) => model.id === "gpt-5.6-sol");
+  // Local catalog enriches known IDs; live fields win on overlap via merge order.
+  assert.equal(sol?.inputTokenLimit, 999999);
+  assert.equal(sol?.supportsVision, true);
+  assert.equal(sol?.outputTokenLimit, 128000);
+});
+
+test("codex discovery filters drop the GPT-5.4 family but keep other remote models", () => {
+  assert.equal(isCodexDiscoveryModelExcluded({ id: "gpt-5.4", name: "x" }), true);
+  assert.equal(isCodexDiscoveryModelExcluded({ id: "gpt-5.4-mini", name: "x" }), true);
+  assert.equal(isCodexDiscoveryModelExcluded({ id: "gpt-5.6-sol", name: "x" }), false);
+
+  const filtered = applyCodexDiscoveryFilters([
+    { id: "gpt-5.4", name: "Retired" },
+    { id: "gpt-5.4-pro", name: "Retired Pro" },
+    { id: "future-codex-model", name: "Future" },
+    { id: "gpt-5.6-sol", name: "Sol" },
+  ]);
+  assert.deepEqual(
+    filtered.map((model) => model.id),
+    ["future-codex-model", "gpt-5.6-sol"]
+  );
+});
+
+test("shared Codex discovery policy only matches explicit GPT-5.4 family boundaries", () => {
+  for (const id of ["GPT-5.4", "gpt-5.4-mini", "gpt-5.4_preview", "gpt-5.4.1"]) {
+    assert.equal(isSharedCodexDiscoveryModelExcluded({ id }), true, id);
+  }
+  for (const id of ["gpt-5.40", "gpt-5.4x", "future-codex-model"]) {
+    assert.equal(isSharedCodexDiscoveryModelExcluded({ id }), false, id);
+  }
+});
+
+test("codex.buildCodexDiscoveryCatalog merges then filters in one step", () => {
+  const catalog = buildCodexDiscoveryCatalog(
+    [
+      { id: "gpt-5.4", name: "Retired Live" },
+      { id: "brand-new-codex", name: "Brand New" },
+      {
+        id: "gpt-5.6-sol",
+        name: "Live Sol",
+        inputTokenLimit: 111,
+        supportsVision: true,
+      },
+    ],
+    [
+      {
+        id: "gpt-5.6-sol",
+        name: "GPT 5.6 Sol",
+        maxInputTokens: 372000,
+        maxOutputTokens: 128000,
+      },
+      { id: "gpt-5.6-sol-max", name: "GPT 5.6 Sol Max" },
+    ]
+  );
+  const ids = catalog.map((model) => model.id);
+  assert.ok(ids.includes("brand-new-codex"));
+  assert.ok(ids.includes("gpt-5.6-sol"));
+  assert.ok(ids.includes("gpt-5.6-sol-max"));
+  assert.equal(
+    ids.some((id) => String(id).startsWith("gpt-5.4")),
+    false
+  );
+
+  // Optional curated helper still available for diagnostics only.
+  const curated = reconcileCuratedCodexCatalog(
+    [{ id: "brand-new-codex", name: "Brand New" }],
+    [{ id: "gpt-5.6-sol", name: "GPT 5.6 Sol" }]
+  );
+  assert.deepEqual(
+    curated.models.map((model) => model.id),
+    ["gpt-5.6-sol"]
+  );
+  assert.deepEqual(
+    curated.candidateModels.map((model) => model.id),
+    ["brand-new-codex"]
+  );
+});
+
+test("codex.normalizeCodexModelsResponse drops entries without an id", () => {
+  const parsed = normalizeCodexModelsResponse({ models: [{ name: "" }, { model: "gpt-5.4" }] });
+  assert.deepEqual(
+    parsed.map((m) => m.id),
+    ["gpt-5.4"]
+  );
+});
+
+test("codex.fetchCodexDiscoveryModels returns null for missing token, auth failure, empty, or network error", async () => {
+  assert.equal(
+    await fetchCodexDiscoveryModels({
+      accessToken: null,
+      fetchImpl: async () => Response.json({ data: [{ id: "never-called" }] }),
+    }),
+    null
+  );
+
+  assert.equal(
+    await fetchCodexDiscoveryModels({
+      accessToken: "tok",
+      fetchImpl: async () => new Response("unauthorized", { status: 401 }),
+    }),
+    null
+  );
+
+  assert.equal(
+    await fetchCodexDiscoveryModels({
+      accessToken: "tok",
+      fetchImpl: async () => Response.json({ data: [] }),
+    }),
+    null
+  );
+
+  assert.equal(
+    await fetchCodexDiscoveryModels({
+      accessToken: "tok",
+      fetchImpl: async () => {
+        throw new Error("network down");
+      },
+    }),
+    null
+  );
+});
+
+test("codex.fetchCodexDiscoveryModels calls the Codex models endpoint with Codex bearer headers", async () => {
+  let seenUrl = "";
+  let seenAuthorization = "";
+  let seenWorkspace = "";
+  let seenOriginator = "";
+  const models = await fetchCodexDiscoveryModels({
+    accessToken: "codex-access",
+    providerSpecificData: { chatgptAccountId: "account-123" },
+    fetchImpl: async (url, init) => {
+      seenUrl = url;
+      seenAuthorization = init.headers.Authorization;
+      seenWorkspace = init.headers["chatgpt-account-id"];
+      seenOriginator = init.headers.originator;
+      return Response.json({ models: [{ slug: "gpt-5.6", display_name: "GPT 5.6" }] });
+    },
+  });
+
+  assert.equal(CODEX_MODELS_URL, "https://chatgpt.com/backend-api/codex/models");
+  assert.equal(seenUrl, buildCodexModelsUrl());
+  assert.equal(seenAuthorization, "Bearer codex-access");
+  assert.equal(seenWorkspace, "account-123");
+  assert.equal(seenOriginator, "codex_cli_rs");
+  assert.deepEqual(
+    models?.map((m) => m.id),
+    ["gpt-5.6"]
+  );
+});
+
+test("codex.fetchCodexGithubCatalogModels fetches the OpenAI Codex repo catalog", async () => {
+  let seenUrl = "";
+  const models = await fetchCodexGithubCatalogModels({
+    fetchImpl: async (url) => {
+      seenUrl = url;
+      return Response.json({
+        models: [
+          {
+            slug: "gpt-5.6-terra",
+            display_name: "GPT-5.6-Terra",
+            visibility: "list",
+            supported_in_api: true,
+            minimal_client_version: "0.144.0",
+          },
+        ],
+      });
+    },
+  });
+
+  assert.equal(
+    CODEX_GITHUB_MODELS_URL,
+    "https://raw.githubusercontent.com/openai/codex/refs/heads/main/codex-rs/models-manager/models.json"
+  );
+  assert.equal(seenUrl, CODEX_GITHUB_MODELS_URL);
+  assert.deepEqual(
+    models?.map((model) => model.id),
+    ["gpt-5.6-terra"]
+  );
+});
+
+test("codex.fetchCodexGithubCatalogModels reuses cached catalog with ETags", async () => {
+  const calls: Array<{ url: string; ifNoneMatch?: string }> = [];
+  const first = await fetchCodexGithubCatalogModels({
+    now: 1000,
+    cacheTtlMs: 100,
+    fetchImpl: async (url, init) => {
+      calls.push({ url, ifNoneMatch: init.headers["If-None-Match"] });
+      return Response.json(
+        {
+          models: [
+            {
+              slug: "gpt-5.6-luna",
+              display_name: "GPT-5.6-Luna",
+              visibility: "list",
+              supported_in_api: true,
+              minimal_client_version: "0.144.0",
+            },
+          ],
+        },
+        { headers: { etag: "catalog-v1" } }
+      );
+    },
+  });
+  const second = await fetchCodexGithubCatalogModels({
+    now: 1050,
+    cacheTtlMs: 100,
+    fetchImpl: async () => {
+      throw new Error("cache hit should not fetch");
+    },
+  });
+  const third = await fetchCodexGithubCatalogModels({
+    now: 1200,
+    cacheTtlMs: 100,
+    fetchImpl: async (url, init) => {
+      calls.push({ url, ifNoneMatch: init.headers["If-None-Match"] });
+      return new Response(null, { status: 304 });
+    },
+  });
+
+  assert.deepEqual(
+    first?.map((model) => model.id),
+    ["gpt-5.6-luna"]
+  );
+  assert.deepEqual(
+    second?.map((model) => model.id),
+    ["gpt-5.6-luna"]
+  );
+  assert.deepEqual(
+    third?.map((model) => model.id),
+    ["gpt-5.6-luna"]
+  );
+  assert.deepEqual(calls, [
+    { url: CODEX_GITHUB_MODELS_URL, ifNoneMatch: undefined },
+    { url: CODEX_GITHUB_MODELS_URL, ifNoneMatch: "catalog-v1" },
+  ]);
+});
+
 // ── host wiring guard ────────────────────────────────────────────────────────
 
 test("route.ts imports the discovery leaves and no longer declares the moved consts", () => {
@@ -140,7 +585,7 @@ test("route.ts imports the discovery leaves and no longer declares the moved con
     path.join("src", "app", "api", "providers", "[id]", "models", "route.ts"),
     "utf-8"
   );
-  for (const leaf of ["helpers", "normalizers", "providerSets", "providerModelsConfig"]) {
+  for (const leaf of ["helpers", "normalizers", "providerSets", "providerModelsConfig", "codex"]) {
     assert.match(
       route,
       new RegExp(`from "\\./discovery/${leaf}"`),
diff --git a/tests/unit/provider-models-route-codex.test.ts b/tests/unit/provider-models-route-codex.test.ts
new file mode 100644
index 0000000000..c9b3824793
--- /dev/null
+++ b/tests/unit/provider-models-route-codex.test.ts
@@ -0,0 +1,385 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(
+  path.join(os.tmpdir(), "omniroute-provider-model-routes-codex-")
+);
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const modelsDb = await import("../../src/lib/db/models.ts");
+const providerModelsRoute = await import("../../src/app/api/providers/[id]/models/route.ts");
+const codexDiscovery = await import("../../src/app/api/providers/[id]/models/discovery/codex.ts");
+
+type RouteModel = {
+  id: string;
+  name?: string;
+  apiFormat?: string;
+  supportedEndpoints?: string[];
+  inputTokenLimit?: number;
+  outputTokenLimit?: number;
+  [key: string]: unknown;
+};
+
+type RouteBody = {
+  provider?: string;
+  models?: RouteModel[];
+  source?: string;
+  warning?: string;
+  intentional?: boolean;
+  discoveredCandidateCount?: number;
+};
+
+type ProviderOverrides = {
+  authType?: string;
+  apiKey?: string | null;
+  accessToken?: string | null;
+  providerSpecificData?: Record<string, unknown>;
+};
+
+const originalFetch = globalThis.fetch;
+
+async function resetStorage() {
+  globalThis.fetch = originalFetch;
+  codexDiscovery.clearCodexGithubCatalogCacheForTests();
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+async function seedCodexConnection(overrides: ProviderOverrides = {}) {
+  return providersDb.createProviderConnection({
+    provider: "codex",
+    authType: overrides.authType || "oauth",
+    name: `codex-${Math.random().toString(16).slice(2, 8)}`,
+    apiKey: overrides.apiKey,
+    accessToken: overrides.accessToken,
+    isActive: true,
+    testStatus: "active",
+    providerSpecificData: overrides.providerSpecificData || {},
+  });
+}
+
+async function callRoute(connectionId: string, search = "") {
+  return providerModelsRoute.GET(
+    new Request(`http://localhost/api/providers/${connectionId}/models${search}`),
+    { params: { id: connectionId } }
+  );
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(async () => {
+  globalThis.fetch = originalFetch;
+  codexDiscovery.clearCodexGithubCatalogCacheForTests();
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("provider models route merges live Codex models with the local catalog then filters denylist", async () => {
+  const connection = await seedCodexConnection({
+    accessToken: "codex-access-token",
+    providerSpecificData: { chatgptAccountId: "account-123" },
+  });
+  await modelsDb.replaceSyncedAvailableModelsForConnection("codex", connection.id, [
+    { id: "stale-codex-model", name: "Stale Codex Model", source: "imported" },
+  ]);
+  const seenRequests: Array<Record<string, string | null>> = [];
+
+  globalThis.fetch = async (url, init) => {
+    const requestUrl = String(url);
+    const headers = new Headers(init?.headers as HeadersInit | undefined);
+    seenRequests.push({
+      url: requestUrl,
+      authorization: headers.get("authorization"),
+      workspaceId: headers.get("chatgpt-account-id"),
+      originator: headers.get("originator"),
+      userAgent: headers.get("user-agent"),
+    });
+    if (requestUrl.includes("raw.githubusercontent.com/openai/codex")) {
+      return Response.json({
+        models: [
+          {
+            slug: "gpt-5.6-sol",
+            display_name: "GPT 5.6 Sol GitHub",
+            visibility: "list",
+            supported_in_api: true,
+            minimal_client_version: "0.144.0",
+            context_window: 372000,
+            input_modalities: ["text", "image"],
+            supported_reasoning_levels: [{ effort: "low" }, { effort: "high" }],
+          },
+          {
+            slug: "gpt-5.4",
+            display_name: "Retired GPT 5.4 GitHub",
+            visibility: "list",
+            supported_in_api: true,
+          },
+        ],
+      });
+    }
+    return Response.json({
+      models: [
+        { slug: "codex-auto-review", visibility: "hide", supported_in_api: true },
+        {
+          slug: "gpt-5.6-sol",
+          display_name: "GPT 5.6 Sol Live",
+          visibility: "list",
+          supported_in_api: true,
+          max_input_tokens: 999999,
+          max_output_tokens: 999999,
+        },
+        {
+          slug: "gpt-5.4",
+          display_name: "Retired GPT 5.4 Live",
+          visibility: "list",
+          supported_in_api: true,
+        },
+        { id: "", name: "missing-id" },
+      ],
+    });
+  };
+
+  const response = await callRoute(connection.id, "?refresh=true");
+  const body = (await response.json()) as RouteBody;
+  const modelIds = new Set(body.models?.map((model) => model.id));
+  const liveModel = body.models?.find((model) => model.id === "gpt-5.6-sol");
+  const syncedModels = await modelsDb.getSyncedAvailableModelsForConnection("codex", connection.id);
+  const syncedIds = new Set(syncedModels.map((model) => model.id));
+
+  assert.equal(response.status, 200);
+  assert.equal(body.provider, "codex");
+  assert.equal(body.source, "api");
+  assert.equal(body.discoveredCandidateCount, undefined);
+  assert.deepEqual(seenRequests, [
+    {
+      url: "https://chatgpt.com/backend-api/codex/models?client_version=0.144.1",
+      authorization: "Bearer codex-access-token",
+      workspaceId: "account-123",
+      originator: "codex_cli_rs",
+      userAgent: "codex-cli/0.144.1 (Windows 10.0.26200; x64)",
+    },
+    {
+      url: "https://raw.githubusercontent.com/openai/codex/refs/heads/main/codex-rs/models-manager/models.json",
+      authorization: null,
+      workspaceId: null,
+      originator: null,
+      userAgent: null,
+    },
+  ]);
+  assert.ok(modelIds.has("gpt-5.6-sol"));
+  assert.ok(modelIds.has("gpt-5.6-sol-ultra"));
+  assert.ok(modelIds.has("gpt-5.6-sol-max"));
+  // Live payload wins on overlapping fields; local catalog supplies local-only variants.
+  assert.equal(liveModel?.name, "GPT 5.6 Sol Live");
+  assert.equal(liveModel?.inputTokenLimit, 999999);
+  assert.equal(liveModel?.outputTokenLimit, 999999);
+  assert.equal(liveModel?.apiFormat, "responses");
+  assert.deepEqual(liveModel?.supportedEndpoints, ["responses"]);
+  assert.equal(liveModel?.supportsThinking, true);
+  assert.equal(liveModel?.supportsVision, true);
+  assert.ok(modelIds.has("gpt-5.5-low"));
+  assert.equal(
+    [...modelIds].some((id) => String(id).startsWith("gpt-5.4")),
+    false
+  );
+  assert.ok(syncedIds.has("gpt-5.6-sol"));
+  assert.ok(syncedIds.has("gpt-5.5-low"));
+  assert.equal(
+    [...syncedIds].some((id) => String(id).startsWith("gpt-5.4")),
+    false
+  );
+  // Stale cache-only ids are replaced when a fresh discovery response is persisted.
+  assert.equal(modelIds.has("stale-codex-model"), false);
+  assert.equal(syncedIds.has("stale-codex-model"), false);
+});
+
+test("provider models route uses the GitHub Codex catalog when live discovery fails", async () => {
+  const connection = await seedCodexConnection({ accessToken: "codex-access-token" });
+  const seenUrls: string[] = [];
+
+  globalThis.fetch = async (url) => {
+    const requestUrl = String(url);
+    seenUrls.push(requestUrl);
+    if (requestUrl.includes("raw.githubusercontent.com/openai/codex")) {
+      return Response.json({
+        models: [
+          {
+            slug: "gpt-5.6-sol",
+            display_name: "GPT-5.6-Sol",
+            visibility: "list",
+            supported_in_api: true,
+            minimal_client_version: "0.144.0",
+            context_window: 372000,
+          },
+          {
+            slug: "gpt-5.4",
+            display_name: "Retired GPT-5.4",
+            visibility: "list",
+            supported_in_api: true,
+          },
+        ],
+      });
+    }
+    return new Response("upstream unavailable", { status: 503 });
+  };
+
+  const response = await callRoute(connection.id, "?refresh=true");
+  const body = (await response.json()) as RouteBody;
+  const modelIds = new Set((body.models || []).map((model) => model.id));
+
+  assert.equal(response.status, 200);
+  assert.equal(body.provider, "codex");
+  assert.equal(body.source, "api");
+  assert.equal(body.intentional, undefined);
+  assert.equal(body.warning, "Codex live catalog unavailable — using GitHub model catalog");
+  assert.equal(body.discoveredCandidateCount, undefined);
+  assert.ok(seenUrls.some((url) => url.includes("backend-api/codex/models")));
+  assert.ok(seenUrls.some((url) => url.includes("raw.githubusercontent.com/openai/codex")));
+  assert.ok(modelIds.has("gpt-5.6-sol"));
+  assert.ok(modelIds.has("gpt-5.5-low"));
+  assert.equal(
+    [...modelIds].some((id) => String(id).startsWith("gpt-5.4")),
+    false
+  );
+});
+
+test("provider models route returns cached Codex models when refresh discovery fails", async () => {
+  const connection = await seedCodexConnection({ accessToken: "codex-access-token" });
+  await modelsDb.replaceSyncedAvailableModelsForConnection("codex", connection.id, [
+    {
+      id: "gpt-5.4",
+      name: "Retired Cached GPT 5.4",
+      source: "imported",
+      apiFormat: "responses",
+      supportedEndpoints: ["responses"],
+    },
+    {
+      id: "gpt-5.6-sol",
+      name: "Cached GPT 5.6 Sol",
+      source: "imported",
+      apiFormat: "responses",
+      supportedEndpoints: ["responses"],
+    },
+  ]);
+
+  globalThis.fetch = async () => new Response("upstream unavailable", { status: 503 });
+
+  const response = await callRoute(connection.id, "?refresh=true");
+  const body = (await response.json()) as RouteBody;
+
+  assert.equal(response.status, 200);
+  assert.equal(body.provider, "codex");
+  assert.equal(body.source, "cache");
+  assert.equal(body.warning, "Codex live catalog unavailable — using cached catalog");
+  assert.equal(body.discoveredCandidateCount, undefined);
+  const modelIds = new Set((body.models || []).map((model) => model.id));
+  assert.ok(modelIds.has("gpt-5.6-sol"));
+  assert.ok(modelIds.has("gpt-5.6-sol-ultra"));
+  assert.equal(
+    [...modelIds].some((id) => String(id).startsWith("gpt-5.4")),
+    false
+  );
+  const syncedModels = await modelsDb.getSyncedAvailableModelsForConnection("codex", connection.id);
+  const syncedIds = new Set(syncedModels.map((model) => model.id));
+  assert.ok(syncedIds.has("gpt-5.6-sol-ultra"));
+  assert.equal(syncedIds.has("gpt-5.4"), false);
+});
+
+test("provider models route auto-includes remote-only Codex models after merge", async () => {
+  const connection = await seedCodexConnection({ accessToken: "codex-access-token" });
+
+  globalThis.fetch = async (url) => {
+    const requestUrl = String(url);
+    if (requestUrl.includes("raw.githubusercontent.com/openai/codex")) {
+      return Response.json({ models: [] });
+    }
+    return Response.json({
+      models: [
+        {
+          slug: "future-codex-experimental",
+          display_name: "Future Codex Experimental",
+          visibility: "list",
+          supported_in_api: true,
+        },
+        {
+          slug: "gpt-5.6-sol",
+          display_name: "GPT 5.6 Sol Live",
+          visibility: "list",
+          supported_in_api: true,
+        },
+        {
+          slug: "gpt-5.4",
+          display_name: "Retired GPT 5.4 Live",
+          visibility: "list",
+          supported_in_api: true,
+        },
+      ],
+    });
+  };
+
+  const response = await callRoute(connection.id, "?refresh=true");
+  const body = (await response.json()) as RouteBody;
+  const modelIds = new Set((body.models || []).map((model) => model.id));
+  const syncedModels = await modelsDb.getSyncedAvailableModelsForConnection("codex", connection.id);
+  const syncedIds = new Set(syncedModels.map((model) => model.id));
+
+  assert.equal(response.status, 200);
+  assert.equal(body.source, "api");
+  assert.ok(modelIds.has("future-codex-experimental"));
+  assert.ok(modelIds.has("gpt-5.6-sol"));
+  assert.equal(modelIds.has("gpt-5.4"), false);
+  assert.ok(syncedIds.has("future-codex-experimental"));
+  assert.equal(syncedIds.has("gpt-5.4"), false);
+});
+
+test("provider models route falls back to local Codex catalog when live and GitHub fail", async () => {
+  const connection = await seedCodexConnection({ accessToken: "codex-access-token" });
+
+  globalThis.fetch = async () => new Response("upstream unavailable", { status: 503 });
+
+  const response = await callRoute(connection.id, "?refresh=true");
+  const body = (await response.json()) as RouteBody;
+
+  assert.equal(response.status, 200);
+  assert.equal(body.provider, "codex");
+  assert.equal(body.source, "local_catalog");
+  assert.equal(body.intentional, true);
+  assert.equal(body.warning, "Codex live and GitHub catalogs unavailable — using local catalog");
+  assert.ok(body.models?.some((model) => model.id === "gpt-5.6-sol"));
+  assert.ok(body.models?.some((model) => model.id === "gpt-5.5"));
+  assert.equal(
+    body.models?.some((model) => model.id.startsWith("gpt-5.4")),
+    false
+  );
+});
+
+test("provider models route returns curated GPT-5.6 variants when auto-fetch is disabled", async () => {
+  const connection = await seedCodexConnection({
+    apiKey: null,
+    accessToken: "codex-access",
+    providerSpecificData: { autoFetchModels: false },
+  });
+
+  const response = await callRoute(connection.id);
+  const body = (await response.json()) as RouteBody;
+  const modelIds = new Set((body.models || []).map((model) => model.id));
+
+  assert.equal(response.status, 200);
+  assert.equal(body.provider, "codex");
+  assert.equal(body.source, "local_catalog");
+  assert.ok(modelIds.has("gpt-5.6-sol-ultra"));
+  assert.ok(modelIds.has("gpt-5.6-sol-max"));
+  assert.ok(modelIds.has("gpt-5.6-terra-ultra"));
+  assert.ok(modelIds.has("gpt-5.6-luna-max"));
+  assert.equal(
+    [...modelIds].some((id) => String(id).startsWith("gpt-5.4")),
+    false
+  );
+});
diff --git a/tests/unit/provider-models-route-lan-guard.test.ts b/tests/unit/provider-models-route-lan-guard.test.ts
new file mode 100644
index 0000000000..276399904c
--- /dev/null
+++ b/tests/unit/provider-models-route-lan-guard.test.ts
@@ -0,0 +1,143 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// #6939 — model-list fetch for a LAN-local OpenAI-compatible provider (e.g. LM Studio on
+// 192.168.x.x) was rejected by the SSRF guard even though the connection test for the same
+// host succeeds, under the default (local-first) settings. Root cause: the models route used
+// getProviderOutboundGuard() (only "none" | "public-only", never consults the local-first
+// default) instead of getProviderValidationGuard() (used by the test-connection path, which
+// resolves to "block-metadata" — allow LAN, still block cloud-metadata/link-local — when
+// local-first is ON, which is the default).
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-lan-guard-models-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const providerModelsRoute = await import("../../src/app/api/providers/[id]/models/route.ts");
+const outboundUrlGuard = await import("../../src/shared/network/outboundUrlGuard.ts");
+
+const originalFetch = globalThis.fetch;
+const originalAllowPrivateProviderUrls = process.env.OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS;
+const originalAllowLocalProviderUrls = process.env.OMNIROUTE_ALLOW_LOCAL_PROVIDER_URLS;
+
+async function resetStorage() {
+  globalThis.fetch = originalFetch;
+  if (originalAllowPrivateProviderUrls === undefined) {
+    delete process.env.OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS;
+  } else {
+    process.env.OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS = originalAllowPrivateProviderUrls;
+  }
+  if (originalAllowLocalProviderUrls === undefined) {
+    delete process.env.OMNIROUTE_ALLOW_LOCAL_PROVIDER_URLS;
+  } else {
+    process.env.OMNIROUTE_ALLOW_LOCAL_PROVIDER_URLS = originalAllowLocalProviderUrls;
+  }
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+async function seedConnection(provider: string, overrides: Record<string, unknown> = {}) {
+  return providersDb.createProviderConnection({
+    provider,
+    authType: (overrides.authType as string) || "apikey",
+    name: (overrides.name as string) || `${provider}-${Math.random().toString(16).slice(2, 8)}`,
+    apiKey: overrides.apiKey as string | undefined,
+    accessToken: overrides.accessToken as string | undefined,
+    isActive: (overrides.isActive as boolean) ?? true,
+    testStatus: (overrides.testStatus as string) || "active",
+    providerSpecificData: (overrides.providerSpecificData as Record<string, unknown>) || {},
+  });
+}
+
+async function callRoute(connectionId: string, search = "") {
+  return providerModelsRoute.GET(
+    new Request(`http://localhost/api/providers/${connectionId}/models${search}`),
+    { params: { id: connectionId } }
+  );
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(async () => {
+  globalThis.fetch = originalFetch;
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("#6939: getProviderOutboundGuard() and getProviderValidationGuard() agree for LAN hosts under the default local-first setting", () => {
+  // Default settings: OMNIROUTE_ALLOW_LOCAL_PROVIDER_URLS unset (ON by default),
+  // OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS unset (OFF by default).
+  delete process.env.OMNIROUTE_ALLOW_LOCAL_PROVIDER_URLS;
+  delete process.env.OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS;
+
+  const validationGuard = outboundUrlGuard.getProviderValidationGuard();
+  assert.equal(validationGuard, "block-metadata");
+
+  // The models route must resolve a guard for LAN-local model discovery that is at least as
+  // permissive as the validation (test-connection) guard — "public-only" would reject LAN.
+  assert.notEqual(
+    validationGuard,
+    "public-only",
+    "sanity: validation guard should allow LAN under the local-first default"
+  );
+});
+
+test("#6939: LM Studio (LAN host, local OpenAI-compatible provider) model-list fetch is not SSRF-blocked under default settings", async () => {
+  delete process.env.OMNIROUTE_ALLOW_LOCAL_PROVIDER_URLS;
+  delete process.env.OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS;
+
+  const connection = await seedConnection("lm-studio", {
+    providerSpecificData: { baseUrl: "http://192.168.1.50:1234/v1" },
+  });
+
+  let fetchCalled = false;
+  globalThis.fetch = async () => {
+    fetchCalled = true;
+    return Response.json({ data: [{ id: "llama-3-8b-instruct" }] });
+  };
+
+  const response = await callRoute(connection.id);
+  const body = (await response.json()) as Record<string, unknown>;
+
+  // RED before the fix: the guard blocked the LAN host before the fetch mock ever ran,
+  // surfacing a 400 "Blocked private or local provider URL" — even though the equivalent
+  // test-connection call for the same host succeeds under the same default settings.
+  assert.ok(
+    fetchCalled,
+    `expected the LAN model-list fetch to reach the network layer, got status=${response.status} body=${JSON.stringify(body)}`
+  );
+  assert.notEqual(response.status, 400);
+  assert.ok(
+    !String(body?.error || "").includes(outboundUrlGuard.PROVIDER_URL_BLOCKED_MESSAGE),
+    `LAN host must not be SSRF-blocked by default: ${JSON.stringify(body)}`
+  );
+});
+
+test("#6939: LAN model-list fetch is still blocked when the local-first default is explicitly disabled", async () => {
+  delete process.env.OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS;
+  process.env.OMNIROUTE_ALLOW_LOCAL_PROVIDER_URLS = "false";
+
+  const connection = await seedConnection("lm-studio", {
+    providerSpecificData: { baseUrl: "http://192.168.1.50:1234/v1" },
+  });
+
+  let fetchCalled = false;
+  globalThis.fetch = async () => {
+    fetchCalled = true;
+    return Response.json({ data: [{ id: "llama-3-8b-instruct" }] });
+  };
+
+  const response = await callRoute(connection.id);
+  const body = (await response.json()) as Record<string, unknown>;
+
+  assert.equal(fetchCalled, false, "guard should block before the network layer is reached");
+  assert.equal(response.status, 400);
+  assert.equal(body.error, outboundUrlGuard.PROVIDER_URL_BLOCKED_MESSAGE);
+});
diff --git a/tests/unit/provider-models-route.test.ts b/tests/unit/provider-models-route.test.ts
index ed8e5d5e8d..6a604f2305 100644
--- a/tests/unit/provider-models-route.test.ts
+++ b/tests/unit/provider-models-route.test.ts
@@ -120,23 +120,6 @@ test("provider models route falls back to the local AI/ML API catalog when the l
   assert.ok(body.models.length > 0);
 });
 
-test("cablyai is flagged deprecated (domain NXDOMAIN) and no longer 500s on model import (#5568)", async () => {
-  const { APIKEY_PROVIDERS_GATEWAYS } =
-    await import("../../src/shared/constants/providers/apikey/gateways.ts");
-  const cablyai = (APIKEY_PROVIDERS_GATEWAYS as Record<string, any>).cablyai;
-  assert.equal(cablyai?.deprecated, true, "cablyai must be marked deprecated (domain is NXDOMAIN)");
-  assert.ok(
-    typeof cablyai?.deprecationReason === "string" && cablyai.deprecationReason.length > 0,
-    "cablyai must carry a deprecationReason"
-  );
-
-  // Removed from PROVIDER_MODELS_CONFIG → no live fetch to the dead domain → a
-  // controlled 400 instead of an unhandled 500 crash.
-  const connection = await seedConnection("cablyai", { apiKey: "dead-key" });
-  const response = await callRoute(connection.id);
-  assert.notEqual(response.status, 500, "cablyai must not 500-crash on a dead domain");
-});
-
 test("provider models route returns 404 for unknown connections", async () => {
   const response = await callRoute("missing-connection");
 
@@ -171,8 +154,12 @@ test("provider models route rejects OpenAI-compatible providers without a base U
   });
 });
 
-test("provider models route blocks private OpenAI-compatible base URLs", async () => {
+// #6939: model-list discovery must match the test-connection guard tier (local-first ON by
+// default allows LAN/loopback hosts) — see provider-models-route-lan-guard.test.ts for the
+// disabled-default (still-blocked) counterpart.
+test("provider models route allows private/LAN OpenAI-compatible base URLs under the local-first default (#6939)", async () => {
   delete process.env.OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS;
+  delete process.env.OMNIROUTE_ALLOW_LOCAL_PROVIDER_URLS;
 
   const connection = await seedConnection("openai-compatible-private", {
     apiKey: "sk-openai-compatible",
@@ -189,11 +176,8 @@ test("provider models route blocks private OpenAI-compatible base URLs", async (
 
   const response = await callRoute(connection.id);
 
-  assert.equal(response.status, 400);
-  assert.deepEqual(await response.json(), {
-    error: "Blocked private or local provider URL",
-  });
-  assert.equal(called, false);
+  assert.equal(response.status, 200);
+  assert.equal(called, true);
 });
 
 test("provider models route returns auth failures from OpenAI-compatible upstreams", async () => {
@@ -557,7 +541,14 @@ test("provider models route returns the local catalog for built-in image provide
   assert.equal(response.status, 200);
   assert.equal(body.provider, "topaz");
   assert.ok(Array.isArray(body.models));
-  assert.deepEqual(body.models, [{ id: "topaz-enhance", name: "topaz-enhance" }]);
+  assert.deepEqual(body.models, [
+    {
+      id: "topaz-enhance",
+      name: "topaz-enhance",
+      apiFormat: "images",
+      supportedEndpoints: ["images"],
+    },
+  ]);
 });
 
 test("provider models route prefers the remote OpenRouter /models API over static image models", async () => {
@@ -700,27 +691,6 @@ test("provider models route returns the updated local catalog for GitHub Copilot
   );
 });
 
-test("provider models route returns codex gpt-5.4 effort variants in the local catalog", async () => {
-  const connection = await seedConnection("codex", {
-    authType: "oauth",
-    apiKey: null,
-    accessToken: "codex-access",
-  });
-
-  const response = await callRoute(connection.id);
-  const body = (await response.json()) as any;
-  const modelIds = new Set((body.models || []).map((model: any) => model.id));
-
-  assert.equal(response.status, 200);
-  assert.equal(body.provider, "codex");
-  assert.equal(body.source, "local_catalog");
-  assert.ok(modelIds.has("gpt-5.4"));
-  assert.ok(modelIds.has("gpt-5.4-low"));
-  assert.ok(modelIds.has("gpt-5.4-medium"));
-  assert.ok(modelIds.has("gpt-5.4-high"));
-  assert.ok(modelIds.has("gpt-5.4-xhigh"));
-});
-
 test("provider models route returns the expanded local catalog for Kiro", async () => {
   const connection = await seedConnection("kiro", {
     authType: "oauth",
@@ -735,7 +705,11 @@ test("provider models route returns the expanded local catalog for Kiro", async
   assert.equal(body.provider, "kiro");
   assert.equal(body.source, "local_catalog");
   const kiroIds = new Set(body.models.map((model) => model.id)); // #6170: real upstream lineup
-  assert.ok(kiroIds.has("claude-sonnet-5") && kiroIds.has("claude-sonnet-4.5") && kiroIds.has("claude-haiku-4.5"));
+  assert.ok(
+    kiroIds.has("claude-sonnet-5") &&
+      kiroIds.has("claude-sonnet-4.5") &&
+      kiroIds.has("claude-haiku-4.5")
+  );
   assert.equal(kiroIds.has("claude-opus-4.7") || kiroIds.has("claude-sonnet-4.6"), false); // fabricated ids removed
 });
 
diff --git a/tests/unit/provider-onboarding-wizard.test.ts b/tests/unit/provider-onboarding-wizard.test.ts
index adc78f768c..688b738022 100644
--- a/tests/unit/provider-onboarding-wizard.test.ts
+++ b/tests/unit/provider-onboarding-wizard.test.ts
@@ -12,8 +12,11 @@ test("provider onboarding catalog exposes API-key and OAuth providers for the wi
 
   assert.ok(apiKeyOptions.some((option) => option.id === "openai"));
   assert.ok(apiKeyOptions.some((option) => option.id === "openrouter"));
+  assert.ok(!apiKeyOptions.some((option) => option.id === "kiro"));
+  assert.ok(!apiKeyOptions.some((option) => option.id === "amazon-q"));
   assert.ok(oauthOptions.some((option) => option.id === "claude"));
   assert.ok(oauthOptions.some((option) => option.id === "kiro"));
+  assert.ok(oauthOptions.some((option) => option.id === "amazon-q"));
   assert.ok(oauthOptions.some((option) => option.id === "cursor"));
   assert.ok(!oauthOptions.some((option) => option.id === "zed"));
   assert.ok(!oauthOptions.some((option) => option.id === "windsurf"));
diff --git a/tests/unit/provider-page-helpers-3501.test.ts b/tests/unit/provider-page-helpers-3501.test.ts
index 762272aa9d..fdb2740818 100644
--- a/tests/unit/provider-page-helpers-3501.test.ts
+++ b/tests/unit/provider-page-helpers-3501.test.ts
@@ -172,8 +172,7 @@ test("getProtoSlice returns custom compat over override", () => {
 
 test("CODEX_REASONING_STRENGTH_OPTIONS has expected values", () => {
   const values = CODEX_REASONING_STRENGTH_OPTIONS.map((o) => o.value);
-  assert.ok(values.includes("none"));
-  assert.ok(values.includes("high"));
+  assert.deepEqual(values, ["none", "low", "medium", "high", "xhigh", "max"]);
 });
 
 test("CODEX_ACCOUNT_SERVICE_TIER_VALUES contains expected tiers", () => {
diff --git a/tests/unit/provider-specific-data-schema.test.ts b/tests/unit/provider-specific-data-schema.test.ts
index 85536f305d..e00a9ca395 100644
--- a/tests/unit/provider-specific-data-schema.test.ts
+++ b/tests/unit/provider-specific-data-schema.test.ts
@@ -117,6 +117,22 @@ test("provider schemas accept Codex default priority and flex service tiers", ()
   }
 });
 
+test("provider schemas accept max but reject ultra as a server-side Codex default", () => {
+  const max = updateProviderConnectionSchema.safeParse({
+    providerSpecificData: {
+      requestDefaults: { reasoningEffort: "max" },
+    },
+  });
+  const ultra = updateProviderConnectionSchema.safeParse({
+    providerSpecificData: {
+      requestDefaults: { reasoningEffort: "ultra" },
+    },
+  });
+
+  assert.equal(max.success, true);
+  assert.equal(ultra.success, false);
+});
+
 test("provider schemas reject unknown Codex service tiers", () => {
   const created = createProviderSchema.safeParse({
     provider: "codex",
diff --git a/tests/unit/provider-validation-specialty.test.ts b/tests/unit/provider-validation-specialty.test.ts
index e1afca203e..a9317bcb38 100644
--- a/tests/unit/provider-validation-specialty.test.ts
+++ b/tests/unit/provider-validation-specialty.test.ts
@@ -26,7 +26,7 @@ test.afterEach(() => {
   __setGrokTlsFetchOverride(null);
 });
 
-function toPlainHeaders(headers: any) {
+function toPlainHeaders(headers: HeadersInit | undefined) {
   if (headers instanceof Headers) return Object.fromEntries(headers.entries());
   return Object.fromEntries(
     Object.entries(headers || {}).map(([key, value]) => [key, String(value)])
@@ -57,6 +57,129 @@ data:
 `;
 }
 
+test("Kiro API key validator resolves profiles with bearer auth", async () => {
+  const calls: Array<{ url: string; headers: Record<string, string> }> = [];
+  globalThis.fetch = async (url, init = {}) => {
+    const headers = toPlainHeaders(init.headers);
+    calls.push({ url: String(url), headers });
+
+    assert.equal(String(url), "https://codewhisperer.us-east-1.amazonaws.com");
+    assert.equal(headers.Authorization, "Bearer ksk-valid");
+    assert.equal(headers["x-amz-target"], "AmazonCodeWhispererService.ListAvailableProfiles");
+    assert.equal(headers.Accept, "application/json");
+
+    return new Response(
+      JSON.stringify({
+        profiles: [{ arn: "arn:aws:codewhisperer:us-east-1:123:profile/API" }],
+      }),
+      { status: 200 }
+    );
+  };
+
+  const result = await validateProviderApiKey({
+    provider: "kiro",
+    apiKey: "ksk-valid",
+    providerSpecificData: { region: "us-east-1" },
+  });
+
+  assert.equal(result.valid, true);
+  assert.equal(result.error, null);
+  assert.equal(result.method, "kiro_list_available_profiles");
+  assert.equal(calls.length, 1);
+});
+
+test("Kiro API key validator accepts API keys that cannot list profiles", async () => {
+  const calls: Array<{
+    url: string;
+    headers: Record<string, string>;
+    body?: Record<string, unknown>;
+  }> = [];
+  globalThis.fetch = async () => new Response("unexpected", { status: 500 });
+
+  globalThis.fetch = async (url, init = {}) => {
+    const headers = toPlainHeaders(init.headers);
+    const body = init.body ? JSON.parse(String(init.body)) : undefined;
+    calls.push({ url: String(url), headers, body });
+
+    if (calls.length === 1) {
+      return new Response(
+        JSON.stringify({
+          __type: "com.amazon.aws.codewhisperer#AccessDeniedException",
+          message: "API key authentication is not supported for this operation.",
+        }),
+        { status: 403 }
+      );
+    }
+
+    assert.equal(
+      String(url),
+      "https://codewhisperer.us-east-1.amazonaws.com/generateAssistantResponse"
+    );
+    assert.equal(headers.Authorization, "Bearer ksk-valid-without-profile-list");
+    assert.equal(headers.tokentype, "API_KEY");
+    assert.equal(
+      headers["X-Amz-Target"] || headers["x-amz-target"],
+      "AmazonCodeWhispererStreamingService.GenerateAssistantResponse"
+    );
+    assert.equal(body.conversationState.currentMessage.userInputMessage.modelId, "auto");
+    assert.equal(body.inferenceConfig.maxTokens, 1);
+    return new Response(new ReadableStream(), { status: 200 });
+  };
+
+  const result = await validateProviderApiKey({
+    provider: "kiro",
+    apiKey: "ksk-valid-without-profile-list",
+    providerSpecificData: { region: "us-east-1" },
+  });
+
+  assert.equal(result.valid, true);
+  assert.equal(result.error, null);
+  assert.equal(result.method, "kiro_generate_assistant_response");
+  assert.equal(calls.length, 2);
+});
+
+test("Kiro API key validator rejects runtime auth failures after profile lookup is unsupported", async () => {
+  let calls = 0;
+  globalThis.fetch = async () => {
+    calls++;
+    if (calls === 1) {
+      return new Response(
+        JSON.stringify({
+          __type: "com.amazon.aws.codewhisperer#AccessDeniedException",
+          message: "API key authentication is not supported for this operation.",
+        }),
+        { status: 403 }
+      );
+    }
+    return new Response(JSON.stringify({ message: "bearer token is invalid" }), { status: 403 });
+  };
+
+  const result = await validateProviderApiKey({
+    provider: "kiro",
+    apiKey: "ksk-runtime-invalid",
+    providerSpecificData: { region: "us-east-1" },
+  });
+
+  assert.equal(result.valid, false);
+  assert.equal(result.error, "Invalid Kiro API key or AWS region");
+  assert.equal(calls, 2);
+});
+
+test("Kiro API key validator fails as invalid instead of unsupported", async () => {
+  globalThis.fetch = async () =>
+    new Response(JSON.stringify({ message: "Access denied" }), { status: 403 });
+
+  const result = await validateProviderApiKey({
+    provider: "kiro",
+    apiKey: "ksk-invalid",
+    providerSpecificData: { region: "us-east-1" },
+  });
+
+  assert.equal(result.valid, false);
+  assert.equal(result.unsupported, false);
+  assert.match(result.error || "", /Failed to list profiles/);
+});
+
 test("specialty provider validators cover Deepgram, AssemblyAI, ElevenLabs and Inworld branches", async () => {
   globalThis.fetch = async (url, init = {}) => {
     const target = String(url);
@@ -711,7 +834,7 @@ test("grok-web validator: Cloudflare challenge page is detected and reported", a
 const { __setTlsFetchOverrideForTesting } =
   await import("../../open-sse/services/chatgptTlsClient.ts");
 
-function makeTlsResponse(status: number, body: string, headers: Record<string, string> = {}): any {
+function makeTlsResponse(status: number, body: string, headers: Record<string, string> = {}) {
   const h = new Headers();
   for (const [k, v] of Object.entries(headers)) h.set(k, v);
   return { status, headers: h, text: body, body: null };
@@ -722,7 +845,7 @@ test.afterEach(() => {
 });
 
 test("chatgpt-web validator: accepts a valid session response with accessToken", async () => {
-  let captured: { url: string; opts: any } | null = null;
+  let captured: { url: string; opts: unknown } | null = null;
   __setTlsFetchOverrideForTesting(async (url, opts) => {
     captured = { url, opts };
     return makeTlsResponse(
@@ -2165,7 +2288,12 @@ test("specialty validator rejects invalid Runway credentials", async () => {
 });
 
 test("validateCommandCodeProvider sends Command Code probe URL, headers, and wrapper body", async () => {
-  const calls: any[] = [];
+  const calls: Array<{
+    url: string;
+    method?: string;
+    headers?: HeadersInit;
+    body?: BodyInit | null;
+  }> = [];
   globalThis.fetch = async (url, init = {}) => {
     calls.push({
       url: String(url),
@@ -2230,18 +2358,14 @@ test("validateCommandCodeProvider rejects auth failures and provider outages", a
 const { __setTlsFetchOverrideForTesting: __setClaudeTlsFetchOverride } =
   await import("../../open-sse/services/claudeTlsClient.ts");
 
-function makeClaudeTlsResponse(
-  status: number,
-  body: string,
-  headers: Record<string, string> = {}
-): any {
+function makeClaudeTlsResponse(status: number, body: string, headers: Record<string, string> = {}) {
   const h = new Headers();
   for (const [k, v] of Object.entries(headers)) h.set(k, v);
   return { status, ok: status >= 200 && status < 300, headers: h, text: body, body: null };
 }
 
 test("claude-web validator: 200 from /api/organizations → valid", async () => {
-  let captured: { url: string; opts: any } | null = null;
+  let captured: { url: string; opts: unknown } | null = null;
   __setClaudeTlsFetchOverride(async (url, opts) => {
     captured = { url, opts };
     return makeClaudeTlsResponse(200, JSON.stringify({ orgs: [] }));
@@ -2576,7 +2700,7 @@ test("llama-cpp is classified as a self-hosted chat provider", async () => {
 // ─── Gitlawb Opengateway specialty validators ──────────────────────────────
 
 test("gitlawb validator: accepts valid API key via chat/completions probe", async () => {
-  const calls: any[] = [];
+  const calls: Array<{ url: string; headers?: HeadersInit; body?: BodyInit | null }> = [];
   globalThis.fetch = async (url, init = {}) => {
     calls.push({ url: String(url), headers: init.headers || {}, body: init.body });
     assert.equal(String(url), "https://opengateway.gitlawb.com/v1/xiaomi-mimo/chat/completions");
@@ -2661,7 +2785,7 @@ test("gitlawb validator: accepts custom baseUrl override", async () => {
 // ─── Gitlawb-GMI (GMI Cloud) ─────────────────────────────────────────────
 
 test("gitlawb-gmi validator: accepts valid API key via chat/completions probe", async () => {
-  const calls: any[] = [];
+  const calls: Array<{ url: string; headers?: HeadersInit }> = [];
   globalThis.fetch = async (url, init = {}) => {
     calls.push({ url: String(url), headers: init.headers || {} });
     assert.equal(String(url), "https://opengateway.gitlawb.com/v1/gmi-cloud/chat/completions");
@@ -2766,7 +2890,7 @@ test("gitlawb-gmi validator: accepts custom baseUrl override", async () => {
 test("isSecurityBlockError: public-host redirect block is NOT a security block", () => {
   const publicRedirect = new SafeOutboundFetchError("Redirect blocked", {
     code: "REDIRECT_BLOCKED",
-    url: "https://chat.qwen.ai/api/v2/models",
+    url: "https://chat.qwen.ai/api/v2/models/",
     method: "GET",
     attempts: 1,
     status: 307,
diff --git a/tests/unit/provider-validation-ssrf-guard.test.ts b/tests/unit/provider-validation-ssrf-guard.test.ts
new file mode 100644
index 0000000000..555693d0de
--- /dev/null
+++ b/tests/unit/provider-validation-ssrf-guard.test.ts
@@ -0,0 +1,54 @@
+/**
+ * QA P0 (security) — provider-validation SSRF guard.
+ *
+ * `directHttpsRequest` (used by web-cookie / NVIDIA / Z.AI validation, all of
+ * which accept a caller-controllable baseUrl) previously ran with
+ * `guard: "none"` + `allowRedirect: true`, i.e. an open relay to cloud-metadata
+ * endpoints. It now runs with `getProviderValidationGuard()` (default
+ * "block-metadata") + `allowRedirect: false`. These tests assert the guard
+ * rejects IMDS / link-local targets BEFORE any network call, while ordinary
+ * public hosts still pass the guard.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { directHttpsRequest } = await import("../../src/lib/providers/validation/headers.ts");
+
+const METADATA_TARGETS = [
+  "http://169.254.169.254/latest/meta-data/", // AWS/GCP IMDS
+  "http://[fd00:ec2::254]/latest/meta-data/", // AWS IMDSv6
+  "http://metadata.google.internal/computeMetadata/v1/", // GCP metadata host
+];
+
+for (const url of METADATA_TARGETS) {
+  test(`SSRF: directHttpsRequest blocks cloud-metadata target ${url}`, async () => {
+    await assert.rejects(
+      () => directHttpsRequest(url, { method: "GET" }, 2000),
+      (err: unknown) => {
+        const msg = String((err as Error)?.message ?? err);
+        // Must be a guard rejection, not a network timeout/connect error — i.e.
+        // the request was refused before any socket was opened.
+        assert.match(msg, /guard|metadata|blocked|not allowed|URL/i, `expected guard block, got: ${msg}`);
+        return true;
+      }
+    );
+  });
+}
+
+test("SSRF: a normal public provider host is NOT blocked by the guard", async () => {
+  // block-metadata permits public + LAN hosts; only IMDS/link-local are refused.
+  // We use an unroutable TEST-NET-1 address (RFC 5737) so no real traffic leaves,
+  // and assert the failure is a network error (guard passed), never a guard block.
+  await assert.rejects(
+    () => directHttpsRequest("http://192.0.2.1:9/models", { method: "GET" }, 1500),
+    (err: unknown) => {
+      const msg = String((err as Error)?.message ?? err);
+      assert.doesNotMatch(
+        msg,
+        /url_guard_blocked|guard blocked|metadata/i,
+        `public host must pass the guard, got a guard block: ${msg}`
+      );
+      return true;
+    }
+  );
+});
diff --git a/tests/unit/providers-autosync-ssrf-323.test.ts b/tests/unit/providers-autosync-ssrf-323.test.ts
index 1df4c4dcf2..2d9eb921a4 100644
--- a/tests/unit/providers-autosync-ssrf-323.test.ts
+++ b/tests/unit/providers-autosync-ssrf-323.test.ts
@@ -21,6 +21,22 @@ const routeSrc = readFileSync(
   join(import.meta.dirname, "../../src/app/api/providers/route.ts"),
   "utf8"
 );
+const syncInitializeRouteSrc = readFileSync(
+  join(import.meta.dirname, "../../src/app/api/sync/initialize/route.ts"),
+  "utf8"
+);
+const syncModelsRouteSrc = readFileSync(
+  join(import.meta.dirname, "../../src/app/api/providers/[id]/sync-models/route.ts"),
+  "utf8"
+);
+const codexProfileSyncSrc = readFileSync(
+  join(import.meta.dirname, "../../src/lib/cli-helper/codexProfileAutoSync.ts"),
+  "utf8"
+);
+const claudeProfileSyncSrc = readFileSync(
+  join(import.meta.dirname, "../../src/lib/cli-helper/claudeProfileAutoSync.ts"),
+  "utf8"
+);
 
 test("POST /api/providers auto-sync uses the trusted internal origin (not request.url) — #323", () => {
   assert.ok(
@@ -32,4 +48,38 @@ test("POST /api/providers auto-sync uses the trusted internal origin (not reques
     /const\s+internalOrigin\s*=\s*new URL\(request\.url\)\.origin/,
     "auto-sync origin must NOT be derived from the client-controlled request.url/Host (SSRF, CodeQL js/request-forgery #323)"
   );
+  assert.match(
+    routeSrc,
+    /fetchModelSyncInternal\(syncUrl,\s*\{[^}]*redirect:\s*["']error["']/s,
+    "credential-bearing auto-sync self-fetch must reject redirects"
+  );
+});
+
+test("POST /api/sync/initialize never forwards the client Origin to model sync", () => {
+  assert.doesNotMatch(
+    syncInitializeRouteSrc,
+    /request\.headers\.get\(["']origin["']\)/,
+    "client-controlled Origin must not become the credential-bearing model-sync base URL"
+  );
+  assert.doesNotMatch(
+    syncInitializeRouteSrc,
+    /startModelSyncScheduler\(origin\)/,
+    "model-sync scheduler must resolve its own trusted loopback origin"
+  );
+});
+
+test("credential-forwarding CLI profile self-fetches reject redirects", () => {
+  for (const source of [codexProfileSyncSrc, claudeProfileSyncSrc]) {
+    assert.match(source, /redirect:\s*["']error["']/);
+  }
+});
+
+test("nested model-sync self-fetches use the shared dashboard resolver and reject redirects", () => {
+  assert.ok(
+    syncModelsRouteSrc.match(/getModelSyncInternalBaseUrl\(\)/g)?.length >= 2,
+    "readiness and nested model discovery must share the trusted dashboard resolver"
+  );
+  assert.match(syncModelsRouteSrc, /fetchModelSyncInternal\(/);
+  assert.doesNotMatch(syncModelsRouteSrc, /const\s+(?:incomingUrl|loopbackPort)\s*=/);
+  assert.match(syncModelsRouteSrc, /redirect:\s*["']error["']/);
 });
diff --git a/tests/unit/providers-constants-split.test.ts b/tests/unit/providers-constants-split.test.ts
index fcd6a272a9..dd7143b53d 100644
--- a/tests/unit/providers-constants-split.test.ts
+++ b/tests/unit/providers-constants-split.test.ts
@@ -1,8 +1,13 @@
 // Characterization of the providers.ts catalog split (god-file decomposition): the host became a
 // barrel that re-exports 10 data catalogs now living under constants/providers/*, and APIKEY is
 // merged from 6 semantic family files (apikey/<family>.ts). Locks: the public surface (every catalog
-// + helpers still exported), the spread-merge integrity (171 APIKEY entries, no loss/dup), and that
+// + helpers still exported), the spread-merge integrity (167 APIKEY entries, no loss/dup), and that
 // load-time Zod validation still runs. Pure-data move → behavior must be identical.
+// Count was 171 before obsolete provider removals (PR #6675: glhf/kluster/cablyai/inclusionai etc.,
+// 171->167) plus #6126 (ClinePass dual-auth): the API-key-only APIKEY_PROVIDERS_GATEWAYS entry was
+// removed as a duplicate now that clinepass is OAuth-primary (OAUTH_PROVIDERS.clinepass) with its
+// BYOK path admitted through the DUAL_AUTH_APIKEY_PROVIDER_IDS gate instead (167->166), then the
+// OpenVecta inference-gateway addition brought it back to 167.
 import { test } from "node:test";
 import assert from "node:assert/strict";
 
@@ -31,12 +36,12 @@ test("barrel still exports every catalog + key helpers", () => {
   }
 });
 
-test("APIKEY_PROVIDERS merges the 6 family files into 171 entries (no loss / no dup)", async () => {
+test("APIKEY_PROVIDERS merges the 6 family files into 167 entries (no loss / no dup)", async () => {
   const keys = Object.keys((P as Record<string, object>).APIKEY_PROVIDERS);
-  assert.equal(keys.length, 171);
-  assert.equal(new Set(keys).size, 171, "duplicate keys after spread-merge");
+  assert.equal(keys.length, 167);
+  assert.equal(new Set(keys).size, 167, "duplicate keys after spread-merge");
   // the merged object's entry-count equals the sum of the 6 semantic family files; families are a
-  // strict partition (every provider in exactly one), so the sum must be exactly 171.
+  // strict partition (every provider in exactly one), so the sum must be exactly 167.
   const families: [string, string][] = [
     ["gateways", "APIKEY_PROVIDERS_GATEWAYS"],
     ["frontier-labs", "APIKEY_PROVIDERS_FRONTIER"],
@@ -56,7 +61,7 @@ test("APIKEY_PROVIDERS merges the 6 family files into 171 entries (no loss / no
       seen.add(k);
     }
   }
-  assert.equal(famTotal, 171, "families must partition all 171 providers");
+  assert.equal(famTotal, 167, "families must partition all 167 providers");
 });
 
 test("AI_PROVIDERS Proxy aggregates all sections; lookups resolve", () => {
diff --git a/tests/unit/providers-page-utils.test.ts b/tests/unit/providers-page-utils.test.ts
index 17f30b9038..dbc4bc1162 100644
--- a/tests/unit/providers-page-utils.test.ts
+++ b/tests/unit/providers-page-utils.test.ts
@@ -391,7 +391,7 @@ test("static catalog entries resolve local, search, audio, web-cookie and upstre
   const audioProvider = providerPageUtils.resolveDashboardProviderInfo("assemblyai");
   const awsPollyProvider = providerPageUtils.resolveDashboardProviderInfo("aws-polly");
   const webCookieProvider = providerPageUtils.resolveDashboardProviderInfo("grok-web");
-  const apiKeyProvider = providerPageUtils.resolveDashboardProviderInfo("glhf");
+  const apiKeyProvider = providerPageUtils.resolveDashboardProviderInfo("synthetic");
   const gitlabProvider = providerPageUtils.resolveDashboardProviderInfo("gitlab");
   const gitlabDuoProvider = providerPageUtils.resolveDashboardProviderInfo("gitlab-duo");
   const chutesProvider = providerPageUtils.resolveDashboardProviderInfo("chutes");
@@ -437,7 +437,7 @@ test("static catalog entries resolve local, search, audio, web-cookie and upstre
   assert.equal(awsPollyProvider?.name, providers.AUDIO_ONLY_PROVIDERS["aws-polly"].name);
 
   assert.equal(apiKeyProvider?.category, "apikey");
-  assert.equal(apiKeyProvider?.name, providers.APIKEY_PROVIDERS.glhf.name);
+  assert.equal(apiKeyProvider?.name, providers.APIKEY_PROVIDERS.synthetic.name);
   assert.equal(gitlabProvider?.category, "apikey");
   assert.equal(gitlabProvider?.name, providers.APIKEY_PROVIDERS.gitlab.name);
   assert.equal(gitlabDuoProvider?.category, "oauth");
@@ -500,9 +500,8 @@ test("static catalog entries resolve local, search, audio, web-cookie and upstre
 
 test("managed provider connection ids include supported static categories and exclude upstream proxy", () => {
   assert.equal(providerCatalog.isManagedProviderConnectionId("qoder"), true);
-  assert.equal(providerCatalog.isManagedProviderConnectionId("glhf"), true);
+  assert.equal(providerCatalog.isManagedProviderConnectionId("synthetic"), true);
   assert.equal(providerCatalog.isManagedProviderConnectionId("gitlab"), true);
-  assert.equal(providerCatalog.isManagedProviderConnectionId("cablyai"), true);
   assert.equal(providerCatalog.isManagedProviderConnectionId("thebai"), true);
   assert.equal(providerCatalog.isManagedProviderConnectionId("fenayai"), true);
   assert.equal(providerCatalog.isManagedProviderConnectionId("chutes"), true);
@@ -559,10 +558,9 @@ test("grok-web taxonomy stays web-cookie only and does not leak into api-key ent
   assert.equal("blackbox-web" in providers.WEB_COOKIE_PROVIDERS, true);
   assert.equal("muse-spark-web" in providers.APIKEY_PROVIDERS, false);
   assert.equal("muse-spark-web" in providers.WEB_COOKIE_PROVIDERS, true);
-  assert.equal("glhf" in providers.APIKEY_PROVIDERS, true);
+  assert.equal("synthetic" in providers.APIKEY_PROVIDERS, true);
   assert.equal("gitlab" in providers.APIKEY_PROVIDERS, true);
   assert.equal("gitlab-duo" in providers.OAUTH_PROVIDERS, true);
-  assert.equal("cablyai" in providers.APIKEY_PROVIDERS, true);
   assert.equal("thebai" in providers.APIKEY_PROVIDERS, true);
   assert.equal("fenayai" in providers.APIKEY_PROVIDERS, true);
   assert.equal("chutes" in providers.APIKEY_PROVIDERS, true);
@@ -618,17 +616,13 @@ test("grok-web taxonomy stays web-cookie only and does not leak into api-key ent
     false
   );
   assert.equal(
-    apiKeyEntries.some((entry) => entry.providerId === "glhf"),
+    apiKeyEntries.some((entry) => entry.providerId === "synthetic"),
     true
   );
   assert.equal(
     apiKeyEntries.some((entry) => entry.providerId === "gitlab"),
     true
   );
-  assert.equal(
-    apiKeyEntries.some((entry) => entry.providerId === "cablyai"),
-    true
-  );
   assert.equal(
     apiKeyEntries.some((entry) => entry.providerId === "thebai"),
     true
@@ -1077,6 +1071,10 @@ test("connectionMatchesProviderCard counts a dual-auth provider's PAT (apikey) c
     connectionMatchesProviderCard({ provider: "qoder", authType: "apikey" }, "qoder", "oauth"),
     true
   );
+  assert.equal(
+    connectionMatchesProviderCard({ provider: "kiro", authType: "api_key" }, "kiro", "oauth"),
+    true
+  );
   assert.equal(
     connectionMatchesProviderCard({ provider: "qoder", authType: "oauth" }, "qoder", "oauth"),
     true
diff --git a/tests/unit/providers-route-managed-catalog.test.ts b/tests/unit/providers-route-managed-catalog.test.ts
index b56d12004f..ed4a4afd6b 100644
--- a/tests/unit/providers-route-managed-catalog.test.ts
+++ b/tests/unit/providers-route-managed-catalog.test.ts
@@ -31,11 +31,11 @@ test.after(() => {
 test("providers route accepts managed local, audio, web-cookie and search providers", async () => {
   const cases = [
     {
-      provider: "glhf",
+      provider: "synthetic",
       body: {
-        provider: "glhf",
-        apiKey: "glhf-key",
-        name: "GLHF Chat",
+        provider: "synthetic",
+        apiKey: "synthetic-key",
+        name: "Synthetic",
       },
     },
     {
@@ -46,14 +46,6 @@ test("providers route accepts managed local, audio, web-cookie and search provid
         name: "GitLab Duo PAT",
       },
     },
-    {
-      provider: "cablyai",
-      body: {
-        provider: "cablyai",
-        apiKey: "cably-key",
-        name: "CablyAI Primary",
-      },
-    },
     {
       provider: "thebai",
       body: {
@@ -457,9 +449,9 @@ test("DELETE /api/providers batch deletes connections", async () => {
       })
     );
 
-  const r1 = await createReq("glhf", "Conn 1", "key-1");
-  const r2 = await createReq("glhf", "Conn 2", "key-2");
-  const r3 = await createReq("glhf", "Conn 3", "key-3");
+  const r1 = await createReq("synthetic", "Conn 1", "key-1");
+  const r2 = await createReq("synthetic", "Conn 2", "key-2");
+  const r3 = await createReq("synthetic", "Conn 3", "key-3");
   const id1 = (await r1.json()).connection.id;
   const id2 = (await r2.json()).connection.id;
   const id3 = (await r3.json()).connection.id;
diff --git a/tests/unit/proxy-noauth-provider-6272.test.ts b/tests/unit/proxy-noauth-provider-6272.test.ts
new file mode 100644
index 0000000000..9df7217a44
--- /dev/null
+++ b/tests/unit/proxy-noauth-provider-6272.test.ts
@@ -0,0 +1,51 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-6272-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+const ORIGINAL_INITIAL_PASSWORD = process.env.INITIAL_PASSWORD;
+delete process.env.INITIAL_PASSWORD;
+
+const core = await import("../../src/lib/db/core.ts");
+const settingsDb = await import("../../src/lib/db/settings.ts");
+
+test.after(async () => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  if (ORIGINAL_INITIAL_PASSWORD === undefined) delete process.env.INITIAL_PASSWORD;
+  else process.env.INITIAL_PASSWORD = ORIGINAL_INITIAL_PASSWORD;
+});
+
+test("#6272: resolveProxyForConnection('noauth', ...) honors a provider-level proxy assigned to 'mimocode'", async () => {
+  core.getDbInstance();
+  const proxy = { type: "http", host: "127.0.0.1", port: 8888 };
+
+  // Reporter's second symptom: "same thing happen when i set the proxy directly
+  // in the provider menu" -> assign a provider-scoped proxy to the mimocode
+  // provider id, the way Settings -> Providers -> mimocode would persist it.
+  await settingsDb.setProxyForLevel("provider", "mimocode", proxy);
+
+  const resolved = await settingsDb.resolveProxyForConnection("noauth", undefined);
+
+  assert.equal(
+    resolved?.proxy?.host,
+    "127.0.0.1",
+    `expected the mimocode provider-level proxy to be honored, got level=${resolved?.level} proxy=${JSON.stringify(resolved?.proxy)}`
+  );
+  assert.equal(resolved?.level, "provider");
+  assert.equal(resolved?.levelId, "mimocode");
+});
+
+test("control: resolveProxyForConnection('noauth', ...) still honors the GLOBAL proxy when no no-auth provider proxy is set", async () => {
+  core.getDbInstance();
+  await settingsDb.deleteProxyForLevel("provider", "mimocode");
+  const proxy = { type: "http", host: "10.0.0.1", port: 9999 };
+  await settingsDb.setProxyForLevel("global", null, proxy);
+
+  const resolved = await settingsDb.resolveProxyForConnection("noauth", undefined);
+  assert.equal(resolved?.proxy?.host, "10.0.0.1");
+  assert.equal(resolved?.level, "global");
+});
diff --git a/tests/unit/proxy-pool-cloudflare-workers-deployer.test.ts b/tests/unit/proxy-pool-cloudflare-workers-deployer.test.ts
index 6109a52452..2a3c717bfe 100644
--- a/tests/unit/proxy-pool-cloudflare-workers-deployer.test.ts
+++ b/tests/unit/proxy-pool-cloudflare-workers-deployer.test.ts
@@ -87,13 +87,22 @@ test("buildCloudflareWorkerScript blocks loopback / RFC1918 / link-local hosts (
   assert.ok(/169\.254|link-local|fe80/.test(src), "blocks link-local hosts");
 });
 
-test("buildCloudflareWorkerScript uses ESM default-export fetch handler (Workers Modules format)", () => {
-  // Cloudflare's PUT /workers/scripts API expects a module-format worker
-  // (main_module = index.js, content-type application/javascript+module).
-  // The handler must be exposed as `export default { fetch }`.
+test("buildCloudflareWorkerScript uses Service Worker syntax, not an ES module (#6416/#6496)", () => {
+  // Cloudflare's PUT /workers/scripts API parses a plain `application/javascript`
+  // script part as Service Worker syntax regardless of any `main_module`
+  // metadata — `main_module` requires the script to actually be an ES module
+  // (top-level `export`), which rejects the upload with "Unexpected token
+  // 'export'" (#6496). The handler must instead register a `fetch` event
+  // listener (`addEventListener("fetch", ...)`), with no top-level `export`.
   const src = buildCloudflareWorkerScript("tok");
-  assert.ok(/export\s+default/.test(src), "must be an ES module (export default)");
-  assert.ok(/fetch\s*\(/.test(src), "must export a fetch handler");
+  assert.ok(
+    !/^\s*export\s+default/m.test(src),
+    "must not be an ES module (no top-level `export default`)"
+  );
+  assert.ok(
+    /addEventListener\(\s*["']fetch["']/.test(src),
+    "must register a fetch event listener (Service Worker syntax)"
+  );
 });
 
 // --------------------------------------------------------------------------
diff --git a/tests/unit/proxy-registry-manager.test.ts b/tests/unit/proxy-registry-manager.test.ts
index 102f4766b2..9d2ec9798c 100644
--- a/tests/unit/proxy-registry-manager.test.ts
+++ b/tests/unit/proxy-registry-manager.test.ts
@@ -4,14 +4,14 @@ import { parseBulkImportText } from "../../src/app/(dashboard)/dashboard/setting
 
 // ── 2-part auth-less shorthand: host:port ─────────────────────────────────────
 
-test("auth-less host:port produces http entry with generated name", () => {
+test("auth-less host:port produces socks5 entry with generated name (default type changed from http to socks5)", () => {
   const { entries, errors } = parseBulkImportText("127.0.0.1:7897");
   assert.equal(errors.length, 0);
   assert.equal(entries.length, 1);
   const e = entries[0];
   assert.equal(e.host, "127.0.0.1");
   assert.equal(e.port, 7897);
-  assert.equal(e.type, "http");
+  assert.equal(e.type, "socks5");
   assert.equal(e.username, "");
   assert.equal(e.password, "");
   assert.equal(e.status, "active");
@@ -47,6 +47,176 @@ test("auth-less host:port with non-numeric port produces error", () => {
   assert.equal(errors[0].reason, "bulkImportErrorInvalidPort");
 });
 
+// ── 4-part shorthand: ip:port:user:pass ───────────────────────────────────────
+
+test("ip:port:user:pass parses correctly", () => {
+  const { entries, errors } = parseBulkImportText("138.99.147.218:50101:myuser:mypass");
+  assert.equal(errors.length, 0);
+  assert.equal(entries.length, 1);
+  const e = entries[0];
+  assert.equal(e.host, "138.99.147.218");
+  assert.equal(e.port, 50101);
+  assert.equal(e.username, "myuser");
+  assert.equal(e.password, "mypass");
+  assert.equal(e.type, "socks5");
+  assert.match(e.name, /138\.99\.147\.218:50101/);
+});
+
+test("ip:port:user:pass with hostname works", () => {
+  const { entries, errors } = parseBulkImportText("proxy.example.com:3128:user:pass");
+  assert.equal(errors.length, 0);
+  assert.equal(entries.length, 1);
+  assert.equal(entries[0].host, "proxy.example.com");
+  assert.equal(entries[0].username, "user");
+  assert.equal(entries[0].password, "pass");
+});
+
+// ── @-style shorthand: user:pass@ip:port ─────────────────────────────────────
+
+test("user:pass@ip:port parses correctly", () => {
+  const { entries, errors } = parseBulkImportText("myuser:mypass@138.99.147.218:50101");
+  assert.equal(errors.length, 0);
+  assert.equal(entries.length, 1);
+  const e = entries[0];
+  assert.equal(e.host, "138.99.147.218");
+  assert.equal(e.port, 50101);
+  assert.equal(e.username, "myuser");
+  assert.equal(e.password, "mypass");
+  assert.equal(e.type, "socks5");
+});
+
+test("user:pass@hostname:port parses correctly", () => {
+  const { entries, errors } = parseBulkImportText("admin:secret@proxy.example.com:443");
+  assert.equal(errors.length, 0);
+  assert.equal(entries.length, 1);
+  assert.equal(entries[0].host, "proxy.example.com");
+  assert.equal(entries[0].port, 443);
+  assert.equal(entries[0].username, "admin");
+  assert.equal(entries[0].password, "secret");
+});
+
+// ── user:pass:ip:port shorthand ───────────────────────────────────────────────
+
+test("user:pass:ip:port parses correctly", () => {
+  const { entries, errors } = parseBulkImportText("myuser:mypass:138.99.147.218:50101");
+  assert.equal(errors.length, 0);
+  assert.equal(entries.length, 1);
+  const e = entries[0];
+  assert.equal(e.host, "138.99.147.218");
+  assert.equal(e.port, 50101);
+  assert.equal(e.username, "myuser");
+  assert.equal(e.password, "mypass");
+});
+
+// ── protocol:// shorthand ──────────────────────────────────────────────────────
+
+test("protocol://ip:port parses with explicit type", () => {
+  const { entries, errors } = parseBulkImportText("http://10.0.0.50:8080");
+  assert.equal(errors.length, 0);
+  assert.equal(entries.length, 1);
+  const e = entries[0];
+  assert.equal(e.host, "10.0.0.50");
+  assert.equal(e.port, 8080);
+  assert.equal(e.type, "http");
+  assert.equal(e.username, "");
+  assert.equal(e.password, "");
+});
+
+test("socks5://ip:port parses with explicit type", () => {
+  const { entries, errors } = parseBulkImportText("socks5://1.2.3.4:1080");
+  assert.equal(errors.length, 0);
+  assert.equal(entries.length, 1);
+  assert.equal(entries[0].type, "socks5");
+  assert.equal(entries[0].host, "1.2.3.4");
+  assert.equal(entries[0].port, 1080);
+});
+
+test("https://ip:port parses with explicit type", () => {
+  const { entries, errors } = parseBulkImportText("https://proxy.example.com:443");
+  assert.equal(errors.length, 0);
+  assert.equal(entries.length, 1);
+  assert.equal(entries[0].type, "https");
+  assert.equal(entries[0].host, "proxy.example.com");
+  assert.equal(entries[0].port, 443);
+});
+
+test("protocol://user:pass@ip:port parses with auth + explicit type", () => {
+  const { entries, errors } = parseBulkImportText("https://admin:secret123@proxy.example.com:443");
+  assert.equal(errors.length, 0);
+  assert.equal(entries.length, 1);
+  const e = entries[0];
+  assert.equal(e.type, "https");
+  assert.equal(e.host, "proxy.example.com");
+  assert.equal(e.port, 443);
+  assert.equal(e.username, "admin");
+  assert.equal(e.password, "secret123");
+});
+
+test("http://user:pass@ip:port parses correctly", () => {
+  const { entries, errors } = parseBulkImportText("http://user:pass@10.0.0.50:8080");
+  assert.equal(errors.length, 0);
+  assert.equal(entries.length, 1);
+  assert.equal(entries[0].type, "http");
+  assert.equal(entries[0].username, "user");
+  assert.equal(entries[0].password, "pass");
+});
+
+// ── Protocol header mode ───────────────────────────────────────────────────────
+
+test("protocol header sets default type for subsequent shorthand lines", () => {
+  const text = [
+    "http",
+    "1.2.3.4:8080",
+    "5.6.7.8:3128:user:pass",
+    "user:pass@9.10.11.12:443",
+  ].join("\n");
+  const { entries, errors } = parseBulkImportText(text);
+  assert.equal(errors.length, 0);
+  assert.equal(entries.length, 3);
+  assert.equal(entries[0].type, "http");
+  assert.equal(entries[1].type, "http");
+  assert.equal(entries[2].type, "http");
+});
+
+test("protocol:// prefix overrides protocol header default", () => {
+  const text = [
+    "socks5",
+    "http://1.2.3.4:8080",
+    "1.2.3.4:1080",
+  ].join("\n");
+  const { entries, errors } = parseBulkImportText(text);
+  assert.equal(errors.length, 0);
+  assert.equal(entries.length, 2);
+  assert.equal(entries[0].type, "http", "explicit protocol:// must override header");
+  assert.equal(entries[1].type, "socks5", "no-prefix line falls back to header default");
+});
+
+test("protocol header mode with mixed shorthand and pipe formats", () => {
+  const text = [
+    "https",
+    "1.2.3.4:443",
+    "named-proxy|5.6.7.8|8080|||socks5||active|pipe entry keeps own type",
+  ].join("\n");
+  const { entries, errors } = parseBulkImportText(text);
+  assert.equal(errors.length, 0);
+  assert.equal(entries.length, 2);
+  assert.equal(entries[0].type, "https", "shorthand inherits header");
+  assert.equal(entries[1].type, "socks5", "pipe entry keeps its own TYPE field");
+});
+
+test("protocol header only affects lines after it", () => {
+  const text = [
+    "1.2.3.4:1080",
+    "http",
+    "1.2.3.4:8080",
+  ].join("\n");
+  const { entries, errors } = parseBulkImportText(text);
+  assert.equal(errors.length, 0);
+  assert.equal(entries.length, 2);
+  assert.equal(entries[0].type, "socks5", "line before header gets default socks5");
+  assert.equal(entries[1].type, "http", "line after header gets http");
+});
+
 // ── Regression: pipe-delimited full format still works ────────────────────────
 
 test("pipe-delimited NAME|HOST|PORT with all optional fields", () => {
@@ -119,3 +289,52 @@ test("multiple auth-less entries in one block", () => {
   assert.equal(entries[1].port, 3128);
   assert.equal(entries[2].port, 8888);
 });
+
+test("full real-world mixed import block", () => {
+  const text = [
+    "# My proxy list",
+    "socks5",
+    "138.99.147.218:50101:myuser:mypass",
+    "200.234.177.62:50101:otheruser:otherpass",
+    "http://10.0.0.50:8080",
+    "https://admin:secret@proxy.example.com:443",
+    "",
+    "named-proxy|5.6.7.8|3128|user|pass|http|US|active|via pipe",
+  ].join("\n");
+  const { entries, errors, skipped } = parseBulkImportText(text);
+  assert.equal(errors.length, 0);
+  assert.equal(entries.length, 5);
+  assert.equal(skipped, 2); // comment + blank line
+  assert.equal(entries[0].type, "socks5");
+  assert.equal(entries[1].type, "socks5");
+  assert.equal(entries[2].type, "http");
+  assert.equal(entries[3].type, "https");
+  assert.equal(entries[4].type, "http");
+  assert.equal(entries[4].name, "named-proxy");
+});
+
+// ── Edge cases ─────────────────────────────────────────────────────────────────
+
+test("4-colon ambiguous line where part0 is not host-like defaults to user:pass:ip:port", () => {
+  const { entries, errors } = parseBulkImportText("myuser:mypass:1.2.3.4:1080");
+  assert.equal(errors.length, 0);
+  assert.equal(entries.length, 1);
+  assert.equal(entries[0].host, "1.2.3.4");
+  assert.equal(entries[0].port, 1080);
+  assert.equal(entries[0].username, "myuser");
+  assert.equal(entries[0].password, "mypass");
+});
+
+test("single colon without port number produces error", () => {
+  const { entries, errors } = parseBulkImportText("justtext:nonsense");
+  assert.equal(entries.length, 0);
+  assert.equal(errors.length, 1);
+  assert.equal(errors[0].reason, "bulkImportErrorInvalidPort");
+});
+
+test("bare text with no colons or pipes produces error", () => {
+  const { entries, errors } = parseBulkImportText("justtext");
+  assert.equal(entries.length, 0);
+  assert.equal(errors.length, 1);
+  assert.equal(errors[0].reason, "bulkImportErrorMissingHost");
+});
diff --git a/tests/unit/proxy-relay-mappers.test.ts b/tests/unit/proxy-relay-mappers.test.ts
new file mode 100644
index 0000000000..6572aee695
--- /dev/null
+++ b/tests/unit/proxy-relay-mappers.test.ts
@@ -0,0 +1,83 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { encrypt } from "@/lib/db/encryption";
+import {
+  isRelayProxyType,
+  extractRelayAuth,
+  isRelayAuthMissing,
+  relayRepairMode,
+} from "@/lib/db/proxies/mappers";
+
+// A relay deploy writes an encrypted `relayAuthEnc` blob only when encryption is
+// enabled. Flip it on so the "recovered" path has a decryptable blob to test.
+const ORIGINAL_KEY = process.env.STORAGE_ENCRYPTION_KEY;
+process.env.STORAGE_ENCRYPTION_KEY = "test-relay-repair-key";
+
+test.after(() => {
+  if (ORIGINAL_KEY === undefined) delete process.env.STORAGE_ENCRYPTION_KEY;
+  else process.env.STORAGE_ENCRYPTION_KEY = ORIGINAL_KEY;
+});
+
+test("isRelayProxyType recognizes vercel/deno/cloudflare only", () => {
+  assert.equal(isRelayProxyType("vercel"), true);
+  assert.equal(isRelayProxyType("deno"), true);
+  assert.equal(isRelayProxyType("cloudflare"), true);
+  assert.equal(isRelayProxyType("http"), false);
+  assert.equal(isRelayProxyType(123), false);
+});
+
+test("extractRelayAuth prefers decrypted blob over legacy plaintext", () => {
+  const enc = encrypt("secret-token");
+  assert.ok(enc && enc.startsWith("enc:v1:"));
+  const notes = JSON.stringify({ relayAuthEnc: enc });
+  assert.equal(extractRelayAuth(notes), "secret-token");
+});
+
+test("extractRelayAuth falls back to legacy plaintext relayAuth", () => {
+  const notes = JSON.stringify({ relayAuth: "plain-token" });
+  assert.equal(extractRelayAuth(notes), "plain-token");
+});
+
+test("extractRelayAuth returns undefined for non-relay / garbage notes", () => {
+  assert.equal(extractRelayAuth(null), undefined);
+  assert.equal(extractRelayAuth("not json"), undefined);
+  assert.equal(extractRelayAuth(JSON.stringify({})), undefined);
+});
+
+test("isRelayAuthMissing is false for a relay with readable plaintext auth", () => {
+  assert.equal(isRelayAuthMissing(JSON.stringify({ relayAuth: "plain" }), "vercel"), false);
+});
+
+test("isRelayAuthMissing is false when the encrypted blob still decrypts", () => {
+  const enc = encrypt("still-good");
+  assert.equal(isRelayAuthMissing(JSON.stringify({ relayAuthEnc: enc }), "deno"), false);
+});
+
+test("isRelayAuthMissing is true when no auth is present on a relay", () => {
+  assert.equal(isRelayAuthMissing(JSON.stringify({}), "vercel"), true);
+  assert.equal(isRelayAuthMissing(null, "cloudflare"), true);
+});
+
+test("isRelayAuthMissing is always false for non-relay types", () => {
+  assert.equal(isRelayAuthMissing(null, "http"), false);
+  assert.equal(isRelayAuthMissing(JSON.stringify({}), "socks5"), false);
+});
+
+test('relayRepairMode "noop" when plaintext relayAuth already present', () => {
+  assert.equal(relayRepairMode(JSON.stringify({ relayAuth: "plain" }), "vercel"), "noop");
+});
+
+test('relayRepairMode "recovered" when encrypted blob decrypts', () => {
+  const enc = encrypt("recover-me");
+  assert.equal(relayRepairMode(JSON.stringify({ relayAuthEnc: enc }), "deno"), "recovered");
+});
+
+test('relayRepairMode "redeploy" when no recoverable auth exists', () => {
+  assert.equal(relayRepairMode(JSON.stringify({}), "vercel"), "redeploy");
+  assert.equal(relayRepairMode(null, "cloudflare"), "redeploy");
+});
+
+test("relayRepairMode returns null for non-relay types", () => {
+  assert.equal(relayRepairMode(JSON.stringify({}), "http"), null);
+  assert.equal(relayRepairMode(null, "socks5"), null);
+});
diff --git a/tests/unit/proxy-rotation-latency.test.ts b/tests/unit/proxy-rotation-latency.test.ts
new file mode 100644
index 0000000000..e37be50496
--- /dev/null
+++ b/tests/unit/proxy-rotation-latency.test.ts
@@ -0,0 +1,157 @@
+/**
+ * Unit tests for latency-optimized proxy rotation strategy.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-proxy-latency-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = "test-secret";
+process.env.PROXY_LATENCY_WINDOW_HOURS = "6"; // Set custom 6-hour window at startup
+
+const core = await import("../../src/lib/db/core.ts");
+const proxiesDb = await import("../../src/lib/db/proxies.ts");
+
+async function resetStorage() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+let proxySeq = 0;
+async function makeProxy(host: string, port: number) {
+  proxySeq++;
+  const proxy = await proxiesDb.createProxy({
+    name: `Latency proxy ${proxySeq}`,
+    type: "http",
+    host,
+    port,
+    status: "active",
+  });
+  return proxy!;
+}
+
+function insertLog(
+  db: ReturnType<typeof core.getDbInstance>,
+  host: string,
+  port: number,
+  latencyMs: number,
+  timestampIso: string
+) {
+  db.prepare(
+    "INSERT INTO proxy_logs (id, timestamp, proxy_host, proxy_port, latency_ms) VALUES (?, ?, ?, ?, ?)"
+  ).run(`log-${Date.now()}-${Math.random()}`, timestampIso, host, port, latencyMs);
+}
+
+test.after(async () => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("latency strategy chooses proxy with lowest average latency within the window", async () => {
+  await resetStorage();
+  const db = core.getDbInstance();
+
+  const p1 = await makeProxy("10.0.0.1", 8081);
+  const p2 = await makeProxy("10.0.0.2", 8082);
+
+  await proxiesDb.addProxyToScopePool("provider", "openai", p1.id);
+  await proxiesDb.addProxyToScopePool("provider", "openai", p2.id);
+  await proxiesDb.setScopeRotationStrategy("provider", "openai", "latency");
+
+  const now = Date.now();
+  // Insert logs inside the window (e.g. 2 hours ago)
+  const insideWindow = new Date(now - 2 * 60 * 60 * 1000).toISOString();
+
+  // p1 average latency: (100 + 150) / 2 = 125ms
+  insertLog(db, "10.0.0.1", 8081, 100, insideWindow);
+  insertLog(db, "10.0.0.1", 8081, 150, insideWindow);
+
+  // p2 average latency: (200 + 300) / 2 = 250ms
+  insertLog(db, "10.0.0.2", 8082, 200, insideWindow);
+  insertLog(db, "10.0.0.2", 8082, 300, insideWindow);
+
+  const resolved = await proxiesDb.resolveProxyForScopeFromRegistry("provider", "openai");
+  assert.ok(resolved);
+  assert.equal(
+    (resolved as { proxy: { host: string } }).proxy.host,
+    "10.0.0.1",
+    "Should pick the one with lower average latency"
+  );
+});
+
+test("latency strategy prioritizes untested proxies (no logs)", async () => {
+  await resetStorage();
+  const db = core.getDbInstance();
+
+  const p1 = await makeProxy("10.0.0.1", 8081);
+  const p2 = await makeProxy("10.0.0.2", 8082); // untested
+
+  await proxiesDb.addProxyToScopePool("provider", "openai", p1.id);
+  await proxiesDb.addProxyToScopePool("provider", "openai", p2.id);
+  await proxiesDb.setScopeRotationStrategy("provider", "openai", "latency");
+
+  // Insert log for p1 only
+  const insideWindow = new Date(Date.now() - 2 * 60 * 60 * 1000).toISOString();
+  insertLog(db, "10.0.0.1", 8081, 50, insideWindow);
+
+  const resolved = await proxiesDb.resolveProxyForScopeFromRegistry("provider", "openai");
+  assert.ok(resolved);
+  assert.equal(
+    (resolved as { proxy: { host: string } }).proxy.host,
+    "10.0.0.2",
+    "Should prioritize untested proxy over tested one"
+  );
+});
+
+test("latency strategy ignores logs outside the configured time window", async () => {
+  await resetStorage();
+  const db = core.getDbInstance();
+
+  const p1 = await makeProxy("10.0.0.1", 8081);
+  const p2 = await makeProxy("10.0.0.2", 8082);
+
+  await proxiesDb.addProxyToScopePool("provider", "openai", p1.id);
+  await proxiesDb.addProxyToScopePool("provider", "openai", p2.id);
+  await proxiesDb.setScopeRotationStrategy("provider", "openai", "latency");
+
+  const now = Date.now();
+
+  // p1 has 300ms latency log inside 6h window (e.g. 2 hours ago)
+  const insideWindow = new Date(now - 2 * 60 * 60 * 1000).toISOString();
+  insertLog(db, "10.0.0.1", 8081, 300, insideWindow);
+
+  // p2 has 50ms latency log but OUTSIDE 6h window (e.g. 8 hours ago)
+  const outsideWindow = new Date(now - 8 * 60 * 60 * 1000).toISOString();
+  insertLog(db, "10.0.0.2", 8082, 50, outsideWindow);
+
+  // Since p2's log is outside the 6h window, p2 is considered untested within the window.
+  // Untested proxies are prioritized (score -1) over tested ones (score 300).
+  const resolved = await proxiesDb.resolveProxyForScopeFromRegistry("provider", "openai");
+  assert.ok(resolved);
+  assert.equal(
+    (resolved as { proxy: { host: string } }).proxy.host,
+    "10.0.0.2",
+    "p2 should be prioritized as untested within the 6h window"
+  );
+});
+
+test("latency strategy works normally with empty proxy_logs table", async () => {
+  await resetStorage();
+  const p1 = await makeProxy("10.0.0.1", 8081);
+  const p2 = await makeProxy("10.0.0.2", 8082);
+
+  await proxiesDb.addProxyToScopePool("provider", "openai", p1.id);
+  await proxiesDb.addProxyToScopePool("provider", "openai", p2.id);
+  await proxiesDb.setScopeRotationStrategy("provider", "openai", "latency");
+
+  // No logs inserted, both are untested. Should return one of them without crash.
+  const resolved = await proxiesDb.resolveProxyForScopeFromRegistry("provider", "openai");
+  assert.ok(resolved);
+  assert.ok(
+    ["10.0.0.1", "10.0.0.2"].includes((resolved as { proxy: { host: string } }).proxy.host)
+  );
+});
diff --git a/tests/unit/public-api-routes.test.ts b/tests/unit/public-api-routes.test.ts
index e480c528aa..1175bf2168 100644
--- a/tests/unit/public-api-routes.test.ts
+++ b/tests/unit/public-api-routes.test.ts
@@ -20,6 +20,11 @@ test("isPublicApiRoute keeps cloud read/auth routes public but not cloud write r
 });
 
 test("isPublicApiRoute allows readonly health and require-login bootstrap routes", () => {
+  assert.equal(isPublicApiRoute("/api/health/ping", "GET"), true);
+  assert.equal(isPublicApiRoute("/api/health/ping", "HEAD"), true);
+  assert.equal(isPublicApiRoute("/api/health/ping", "OPTIONS"), true);
+  assert.equal(isPublicApiRoute("/api/health/ping", "DELETE"), false);
+
   assert.equal(isPublicApiRoute("/api/monitoring/health", "GET"), true);
   assert.equal(isPublicApiRoute("/api/monitoring/health", "HEAD"), true);
   assert.equal(isPublicApiRoute("/api/monitoring/health", "OPTIONS"), true);
diff --git a/tests/unit/quota-card-expanded-fixed-order-6687.test.ts b/tests/unit/quota-card-expanded-fixed-order-6687.test.ts
new file mode 100644
index 0000000000..6d7f7aec98
--- /dev/null
+++ b/tests/unit/quota-card-expanded-fixed-order-6687.test.ts
@@ -0,0 +1,74 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { parseQuotaData } from "@/app/(dashboard)/dashboard/usage/components/ProviderLimits/quotaParsing";
+import { resolveQuotaDisplayOrder } from "@/app/(dashboard)/dashboard/usage/components/ProviderLimits/parts/QuotaCardExpanded";
+
+interface TestQuota {
+  name: string;
+  [key: string]: unknown;
+}
+
+// Regression for #6687: quotaParsing.ts applies a deterministic CODEX_QUOTA_ORDER
+// (session:0, weekly:1, ...) via sortCodexOrder(). QuotaCardExpanded.tsx used to
+// unconditionally re-sort the already-ordered array by remaining percentage via
+// sortQuotasByRemaining(), discarding the fixed window order. resolveQuotaDisplayOrder()
+// is the fix: it keeps parseQuotaData()'s order for providers with a fixed window
+// order (codex, glm family) and only applies the remaining-% sort elsewhere.
+
+test("#6687 codex: display order stays session-then-weekly regardless of remaining %", () => {
+  const rawCodexData = {
+    quotas: {
+      session: { used: 90, total: 100, remainingPercentage: 10, resetAt: null },
+      weekly: { used: 10, total: 100, remainingPercentage: 90, resetAt: null },
+    },
+  };
+
+  const parsed = parseQuotaData("codex", rawCodexData);
+  // Sanity check: quotaParsing.ts's sortCodexOrder should order session before weekly.
+  assert.deepEqual(
+    parsed.map((q: TestQuota) => q.name),
+    ["session", "weekly"]
+  );
+
+  // The display layer must NOT undo the fixed order, even though weekly
+  // (90% remaining) would sort before session (10% remaining) by percentage.
+  const displayed = resolveQuotaDisplayOrder("codex", parsed);
+  assert.deepEqual(
+    displayed.map((q: TestQuota) => q.name),
+    ["session", "weekly"]
+  );
+});
+
+test("#6687 glm family: display order stays session-then-weekly regardless of remaining %", () => {
+  const rawGlmData = {
+    quotas: {
+      session: { used: 95, total: 100, remainingPercentage: 5, resetAt: null },
+      weekly: { used: 5, total: 100, remainingPercentage: 95, resetAt: null },
+    },
+  };
+
+  const parsed = parseQuotaData("glm", rawGlmData);
+  assert.deepEqual(
+    parsed.map((q: TestQuota) => q.name),
+    ["session", "weekly"]
+  );
+
+  const displayed = resolveQuotaDisplayOrder("glm", parsed);
+  assert.deepEqual(
+    displayed.map((q: TestQuota) => q.name),
+    ["session", "weekly"]
+  );
+});
+
+test("#6687 non-fixed-order providers still sort by remaining percentage descending", () => {
+  const quotas = [
+    { name: "low", remainingPercentage: 10 },
+    { name: "high", remainingPercentage: 90 },
+  ];
+
+  const displayed = resolveQuotaDisplayOrder("openai", quotas);
+  assert.deepEqual(
+    displayed.map((q: TestQuota) => q.name),
+    ["high", "low"]
+  );
+});
diff --git a/tests/unit/quota-card-grid-horizontal-layout.test.ts b/tests/unit/quota-card-grid-horizontal-layout.test.ts
new file mode 100644
index 0000000000..9966034ba9
--- /dev/null
+++ b/tests/unit/quota-card-grid-horizontal-layout.test.ts
@@ -0,0 +1,120 @@
+// #3520 — Provider Quota page should use horizontal whitespace better.
+//
+// QuotaCardGrid previously stacked provider groups vertically via a single
+// `flex flex-col` container and kept cards to a conservative 1/2/3/4-column
+// breakpoint ladder starting at `grid-cols-1`. This regression guard asserts
+// the shipped JSX structure and grouping logic directly:
+//  1. Grouping still produces one header per distinct provider with the
+//     correct account count ("N account(s)").
+//  2. The per-group card grid starts multi-column (`grid-cols-2`), not
+//     single-column, so cards fill horizontal space sooner.
+//  3. Provider groups themselves flow into multiple columns on wide screens
+//     (`columns-*`) instead of an unconditional vertical `flex flex-col`
+//     stack.
+//
+// Note: QuotaCardGrid's sibling QuotaCard pulls in next/image + provider-icon
+// resolution that only works inside the real Next.js runtime, so this file
+// exercises the two testable seams directly instead of full SSR-rendering the
+// tree: (a) the pure grouping function extracted below, mirroring the
+// component's own grouping logic, and (b) the literal className contract of
+// the component's JSX (static string literals, not derived at runtime),
+// parsed from source via the TypeScript compiler API so the assertions track
+// the real shipped markup rather than a hand-copied string.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import ts from "typescript";
+
+const COMPONENT_PATH = path.resolve(
+  import.meta.dirname,
+  "../../src/app/(dashboard)/dashboard/usage/components/ProviderLimits/QuotaCardGrid.tsx"
+);
+
+function groupByProvider<T extends { provider: string }>(connections: T[]): Map<string, T[]> {
+  const groups = new Map<string, T[]>();
+  for (const conn of connections) {
+    const list = groups.get(conn.provider) ?? [];
+    list.push(conn);
+    groups.set(conn.provider, list);
+  }
+  return groups;
+}
+
+test("QuotaCardGrid (#3520) — groups connections by provider with correct counts", () => {
+  const groups = groupByProvider([
+    { id: "conn-a1", provider: "openai" },
+    { id: "conn-a2", provider: "openai" },
+    { id: "conn-b1", provider: "anthropic" },
+  ]);
+  assert.deepEqual([...groups.keys()], ["openai", "anthropic"]);
+  assert.equal(groups.get("openai")!.length, 2);
+  assert.equal(groups.get("anthropic")!.length, 1);
+});
+
+/**
+ * Extract the string literal passed to `className={...}` (or `className="..."`)
+ * for every JSX `<div>` opening element in the component's `return (...)` JSX,
+ * in source order, via the TypeScript compiler API (not a hand-rolled regex —
+ * tracks the real AST so it can't be fooled by comments/whitespace).
+ */
+function extractDivClassNames(sourcePath: string): string[] {
+  const sourceText = fs.readFileSync(sourcePath, "utf8");
+  const sourceFile = ts.createSourceFile(
+    sourcePath,
+    sourceText,
+    ts.ScriptTarget.Latest,
+    true,
+    ts.ScriptKind.TSX
+  );
+  const classNames: string[] = [];
+
+  function visit(node: ts.Node) {
+    if (ts.isJsxOpeningElement(node) || ts.isJsxSelfClosingElement(node)) {
+      const tagName = node.tagName.getText(sourceFile);
+      if (tagName === "div") {
+        for (const attr of node.attributes.properties) {
+          if (ts.isJsxAttribute(attr) && attr.name.getText(sourceFile) === "className") {
+            const init = attr.initializer;
+            if (init && ts.isStringLiteral(init)) {
+              classNames.push(init.text);
+            } else if (
+              init &&
+              ts.isJsxExpression(init) &&
+              init.expression &&
+              ts.isStringLiteral(init.expression)
+            ) {
+              classNames.push(init.expression.text);
+            }
+          }
+        }
+      }
+    }
+    ts.forEachChild(node, visit);
+  }
+  visit(sourceFile);
+  return classNames;
+}
+
+test("QuotaCardGrid (#3520) — outer container flows groups into multiple columns, not a single vertical stack", () => {
+  const [outerClassName] = extractDivClassNames(COMPONENT_PATH);
+  assert.ok(outerClassName, "expected the component to render an outer <div className=...>");
+  assert.match(outerClassName, /\bcolumns-/);
+  assert.notEqual(outerClassName, "flex flex-col gap-6");
+});
+
+test("QuotaCardGrid (#3520) — per-group card grid starts multi-column (grid-cols-2), not single-column", () => {
+  const classNames = extractDivClassNames(COMPONENT_PATH);
+  const cardGridClassName = classNames.find(
+    (c) => /\bgrid\b/.test(c) && /grid-cols-/.test(c)
+  );
+  assert.ok(cardGridClassName, "expected to find the per-group card grid's className");
+  assert.match(cardGridClassName!, /\bgrid-cols-2\b/);
+  assert.doesNotMatch(cardGridClassName!, /\bgrid-cols-1\b/);
+});
+
+test("QuotaCardGrid (#3520) — early-returns null when there are no connections", () => {
+  const sourceText = fs.readFileSync(COMPONENT_PATH, "utf8");
+  assert.match(sourceText, /if\s*\(\s*connections\.length\s*===\s*0\s*\)\s*return\s*null;/);
+});
diff --git a/tests/unit/quota-catalog-filter.test.ts b/tests/unit/quota-catalog-filter.test.ts
index 519f66ea03..d7a0820e25 100644
--- a/tests/unit/quota-catalog-filter.test.ts
+++ b/tests/unit/quota-catalog-filter.test.ts
@@ -12,7 +12,7 @@ import { filterModelsToQuotaPools } from "../../src/lib/quota/quotaCombos.js";
 describe("filterModelsToQuotaPools", () => {
   const models = [
     { id: "qtSd/times/codex/gpt-5.5" },
-    { id: "qtSd/times/codex/gpt-5.4" },
+    { id: "qtSd/times/codex/gpt-5.6-sol" },
     { id: "cx/gpt-5.5" },
     { id: "qtSd/other/codex/m" },
   ];
@@ -21,7 +21,7 @@ describe("filterModelsToQuotaPools", () => {
     const result = filterModelsToQuotaPools(models, ["times"]);
     assert.deepEqual(result, [
       { id: "qtSd/times/codex/gpt-5.5" },
-      { id: "qtSd/times/codex/gpt-5.4" },
+      { id: "qtSd/times/codex/gpt-5.6-sol" },
     ]);
   });
 
@@ -40,7 +40,7 @@ describe("filterModelsToQuotaPools", () => {
     const result = filterModelsToQuotaPools(models, ["times", "other"]);
     assert.deepEqual(result, [
       { id: "qtSd/times/codex/gpt-5.5" },
-      { id: "qtSd/times/codex/gpt-5.4" },
+      { id: "qtSd/times/codex/gpt-5.6-sol" },
       { id: "qtSd/other/codex/m" },
     ]);
   });
@@ -51,9 +51,7 @@ describe("filterModelsToQuotaPools", () => {
       { id: "cx/gpt-5.5", object: "model", owned_by: "cx" },
     ];
     const result = filterModelsToQuotaPools(richModels, ["times"]);
-    assert.deepEqual(result, [
-      { id: "qtSd/times/cx/gpt-5.5", object: "model", owned_by: "combo" },
-    ]);
+    assert.deepEqual(result, [{ id: "qtSd/times/cx/gpt-5.5", object: "model", owned_by: "combo" }]);
   });
 
   it("does not match a model from a different group when only one slug is provided", () => {
diff --git a/tests/unit/quota-fetch-throttle-scope-6911.test.ts b/tests/unit/quota-fetch-throttle-scope-6911.test.ts
new file mode 100644
index 0000000000..06a960b341
--- /dev/null
+++ b/tests/unit/quota-fetch-throttle-scope-6911.test.ts
@@ -0,0 +1,190 @@
+/**
+ * Regression test for #6911: OMNIROUTE_QUOTA_FETCH_MIN_INTERVAL_MS was only
+ * wired into codexQuotaFetcher.ts even though quotaFetchThrottle.ts documents
+ * itself as "used by the provider quota fetchers" (plural). This asserts the
+ * shared throttle is now honored by fetchDeepseekQuota, fetchBailianQuota
+ * (both fetch sites), fetchOpencodeQuota, and fetchCrofUsage — and that cache
+ * hits are never delayed (only genuine upstream network calls are throttled).
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { fetchDeepseekQuota, invalidateDeepseekQuotaCache } from "../../open-sse/services/deepseekQuotaFetcher.ts";
+import { fetchBailianQuota, invalidateBailianQuotaCache } from "../../open-sse/services/bailianQuotaFetcher.ts";
+import { fetchOpencodeQuota, invalidateOpencodeQuotaCache } from "../../open-sse/services/opencodeQuotaFetcher.ts";
+import { fetchCrofUsage, invalidateCrofUsageCache } from "../../open-sse/services/crofUsageFetcher.ts";
+import { resetQuotaFetchThrottle } from "../../open-sse/services/quotaFetchThrottle.ts";
+
+const originalFetch = globalThis.fetch;
+const originalEnv = process.env.OMNIROUTE_QUOTA_FETCH_MIN_INTERVAL_MS;
+
+test.beforeEach(() => {
+  process.env.OMNIROUTE_QUOTA_FETCH_MIN_INTERVAL_MS = "200";
+  resetQuotaFetchThrottle();
+});
+
+test.afterEach(() => {
+  globalThis.fetch = originalFetch;
+  if (originalEnv === undefined) {
+    delete process.env.OMNIROUTE_QUOTA_FETCH_MIN_INTERVAL_MS;
+  } else {
+    process.env.OMNIROUTE_QUOTA_FETCH_MIN_INTERVAL_MS = originalEnv;
+  }
+  resetQuotaFetchThrottle();
+});
+
+const deepseekBody = {
+  is_available: true,
+  balance_infos: [{ currency: "USD", total_balance: "10.00" }],
+};
+
+const bailianBody = {
+  code: "Success",
+  data: {
+    codingPlanInstanceInfos: [
+      {
+        planName: "Qwen3 Coder Next",
+        codingPlanQuotaInfo: {
+          per5HourUsedQuota: 50,
+          per5HourTotalQuota: 100,
+          per5HourQuotaNextRefreshTime: 1718304000,
+          perWeekUsedQuota: 30,
+          perWeekTotalQuota: 100,
+          perWeekQuotaNextRefreshTime: 1718563200,
+          perBillMonthUsedQuota: 20,
+          perBillMonthTotalQuota: 100,
+          perBillMonthQuotaNextRefreshTime: 1719772800,
+        },
+      },
+    ],
+  },
+};
+
+const opencodeBody = {
+  quota: {
+    window_5h: { used: 1, limit: 10 },
+  },
+};
+
+const crofBody = { usable_requests: 99, credits: 1.5 };
+
+async function assertSpacedByThrottle(
+  label: string,
+  responseBody: unknown,
+  fetchTwice: (idA: string, idB: string) => Promise<unknown[]>
+): Promise<void> {
+  const callStarts: number[] = [];
+  const t0 = Date.now();
+  globalThis.fetch = (async () => {
+    callStarts.push(Date.now() - t0);
+    return new Response(JSON.stringify(responseBody), {
+      status: 200,
+      headers: { "content-type": "application/json" },
+    });
+  }) as typeof fetch;
+
+  await fetchTwice(`${label}-a-${Date.now()}`, `${label}-b-${Date.now()}`);
+
+  assert.equal(callStarts.length, 2, `${label}: expected 2 upstream calls`);
+  const spread = Math.abs(callStarts[1] - callStarts[0]);
+  assert.ok(
+    spread >= 180,
+    `${label}: calls were NOT spaced by the shared throttle (spread=${spread}ms, expected >=180ms)`
+  );
+}
+
+test("#6911 fetchDeepseekQuota is spaced by the shared quota-fetch throttle", async () => {
+  await assertSpacedByThrottle("deepseek", deepseekBody, (idA, idB) =>
+    Promise.all([
+      fetchDeepseekQuota(idA, { apiKey: "sk-a" }),
+      fetchDeepseekQuota(idB, { apiKey: "sk-b" }),
+    ])
+  );
+});
+
+test("#6911 fetchBailianQuota (primary site) is spaced by the shared quota-fetch throttle", async () => {
+  await assertSpacedByThrottle("bailian", bailianBody, (idA, idB) =>
+    Promise.all([
+      fetchBailianQuota(idA, { apiKey: "sk-a" }),
+      fetchBailianQuota(idB, { apiKey: "sk-b" }),
+    ])
+  );
+});
+
+test("#6911 fetchOpencodeQuota is spaced by the shared quota-fetch throttle", async () => {
+  await assertSpacedByThrottle("opencode", opencodeBody, (idA, idB) =>
+    Promise.all([
+      fetchOpencodeQuota(idA, { apiKey: "sk-a" }),
+      fetchOpencodeQuota(idB, { apiKey: "sk-b" }),
+    ])
+  );
+});
+
+test("#6911 fetchCrofUsage is spaced by the shared quota-fetch throttle", async () => {
+  await assertSpacedByThrottle("crof", crofBody, (idA, idB) =>
+    Promise.all([
+      fetchCrofUsage(idA, { apiKey: "sk-a" }),
+      fetchCrofUsage(idB, { apiKey: "sk-b" }),
+    ])
+  );
+});
+
+test("#6911 cache hits are never delayed by the shared quota-fetch throttle", async () => {
+  const connectionId = `deepseek-cache-${Date.now()}`;
+  let calls = 0;
+  globalThis.fetch = (async () => {
+    calls += 1;
+    return new Response(JSON.stringify(deepseekBody), {
+      status: 200,
+      headers: { "content-type": "application/json" },
+    });
+  }) as typeof fetch;
+
+  invalidateDeepseekQuotaCache(connectionId);
+  const t0 = Date.now();
+  await fetchDeepseekQuota(connectionId, { apiKey: "sk-cache" });
+  const secondStart = Date.now();
+  const second = await fetchDeepseekQuota(connectionId, { apiKey: "sk-cache" });
+  const secondElapsed = Date.now() - secondStart;
+
+  assert.equal(calls, 1, "second call should be served from cache, not hit the network");
+  assert.ok(second !== null);
+  assert.ok(
+    secondElapsed < 50,
+    `cache-hit path should not be delayed by the throttle (took ${secondElapsed}ms, t0=${t0})`
+  );
+
+  invalidateDeepseekQuotaCache(connectionId);
+});
+
+test("#6911 fetchBailianQuota China-region retry fetch is also throttled", async () => {
+  const callStarts: number[] = [];
+  const t0 = Date.now();
+  let call = 0;
+  globalThis.fetch = (async () => {
+    callStarts.push(Date.now() - t0);
+    call += 1;
+    if (call === 1) {
+      return new Response(JSON.stringify({ code: "ConsoleNeedLogin" }), {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      });
+    }
+    return new Response(JSON.stringify(bailianBody), {
+      status: 200,
+      headers: { "content-type": "application/json" },
+    });
+  }) as typeof fetch;
+
+  const connectionId = `bailian-retry-${Date.now()}`;
+  await fetchBailianQuota(connectionId, { apiKey: "sk-retry" });
+
+  assert.equal(callStarts.length, 2, "expected primary + China-region retry fetch");
+  const spread = Math.abs(callStarts[1] - callStarts[0]);
+  assert.ok(
+    spread >= 180,
+    `China-region retry fetch was NOT spaced by the shared throttle (spread=${spread}ms)`
+  );
+
+  invalidateBailianQuotaCache(connectionId);
+});
diff --git a/tests/unit/quota-parsing-claude-extra-usage.test.ts b/tests/unit/quota-parsing-claude-extra-usage.test.ts
new file mode 100644
index 0000000000..0eba6a6110
--- /dev/null
+++ b/tests/unit/quota-parsing-claude-extra-usage.test.ts
@@ -0,0 +1,98 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { parseQuotaData } from "../../src/app/(dashboard)/dashboard/usage/components/ProviderLimits/utils.tsx";
+
+interface QuotaRow {
+  name: string;
+  isCredits?: boolean;
+  remainingPercentage?: number;
+}
+
+// Reproduces issue #6806: Claude Code "raven_enterprise" plan usage response has an
+// empty `quotas: {}` (no five_hour/seven_day utilization fields returned by Anthropic
+// for this plan) but a fully populated, 100%-exhausted `extraUsage` block. The UI must
+// not fall back to "No quota data" when extraUsage has real, usable data.
+test("#6806: parseQuotaData surfaces Claude extraUsage credits when quotas object is empty", () => {
+  const data = {
+    plan: "default_raven_enterprise",
+    quotas: {},
+    extraUsage: {
+      is_enabled: true,
+      monthly_limit: 120000,
+      used_credits: 120015,
+      utilization: 100,
+      currency: "USD",
+      decimal_places: 2,
+      disabled_reason: null,
+      daily: null,
+      weekly: null,
+    },
+    bootstrap: {
+      account_uuid: "redacted",
+      account_email: "redacted",
+      organization_uuid: "redacted",
+      organization_name: "redacted",
+      organization_type: "claude_enterprise",
+      organization_rate_limit_tier: "default_raven_enterprise",
+    },
+  };
+
+  const parsed = parseQuotaData("claude", data);
+
+  assert.ok(
+    parsed.length > 0,
+    `expected at least one quota row derived from extraUsage, got empty array: ${JSON.stringify(parsed)}`
+  );
+
+  const creditRow = parsed.find((row: QuotaRow) => row.isCredits);
+  assert.ok(creditRow, "expected a credits-style quota row derived from extraUsage");
+  assert.equal(creditRow.remainingPercentage, 0, "utilization 100% means 0% remaining");
+});
+
+test("#6806: parseQuotaData still surfaces extraUsage credits when quotas is also populated", () => {
+  const data = {
+    plan: "pro",
+    quotas: {
+      "session (5h)": { used: 10, total: 100, remainingPercentage: 90, resetAt: null },
+    },
+    extraUsage: {
+      is_enabled: true,
+      monthly_limit: 5000,
+      used_credits: 1000,
+      utilization: 20,
+      currency: "USD",
+      decimal_places: 2,
+      disabled_reason: null,
+      daily: null,
+      weekly: null,
+    },
+  };
+
+  const parsed = parseQuotaData("claude", data);
+
+  assert.equal(parsed.length, 2, `expected session quota + credits row, got: ${JSON.stringify(parsed)}`);
+  const creditRow = parsed.find((row: QuotaRow) => row.isCredits);
+  assert.ok(creditRow, "expected a credits-style quota row derived from extraUsage");
+  assert.equal(creditRow.remainingPercentage, 80, "utilization 20% means 80% remaining");
+});
+
+test("#6806: parseQuotaData does not add a credits row when extraUsage is disabled", () => {
+  const data = {
+    plan: "pro",
+    quotas: {
+      "session (5h)": { used: 10, total: 100, remainingPercentage: 90, resetAt: null },
+    },
+    extraUsage: {
+      is_enabled: false,
+      monthly_limit: 5000,
+      used_credits: 0,
+      utilization: 0,
+    },
+  };
+
+  const parsed = parseQuotaData("claude", data);
+
+  assert.equal(parsed.length, 1, `expected only the session quota, got: ${JSON.stringify(parsed)}`);
+  assert.equal(parsed.some((row: QuotaRow) => row.isCredits), false);
+});
diff --git a/tests/unit/qwen-web-content-array-serialization.test.ts b/tests/unit/qwen-web-content-array-serialization.test.ts
new file mode 100644
index 0000000000..3949f6484b
--- /dev/null
+++ b/tests/unit/qwen-web-content-array-serialization.test.ts
@@ -0,0 +1,83 @@
+// Regression: Qwen Web executor folded structured (array) message content with a
+// bare String(m.content), producing the literal "[object Object]" prompt instead of
+// the real text (reported on the support mesh: "[[object][object]] serialisation error").
+// The executor must flatten OpenAI-style content parts into their text before sending.
+import { describe, it, afterEach } from "node:test";
+import assert from "node:assert/strict";
+
+const mod = await import("../../open-sse/executors/qwen-web.ts");
+
+type FetchCall = { url: string; init: { method?: string; body?: string } };
+const realFetch = globalThis.fetch;
+
+function sseResponse(events: Array<Record<string, unknown>>): Response {
+  const encoder = new TextEncoder();
+  const stream = new ReadableStream({
+    start(controller) {
+      for (const ev of events) {
+        controller.enqueue(encoder.encode(`data: ${JSON.stringify(ev)}\n\n`));
+      }
+      controller.enqueue(encoder.encode("data: [DONE]\n\n"));
+      controller.close();
+    },
+  });
+  return new Response(stream, {
+    status: 200,
+    headers: { "content-type": "text/event-stream" },
+  });
+}
+
+function chatCreatedResponse(id = "chat-arr"): Response {
+  return new Response(JSON.stringify({ success: true, data: { id } }), {
+    status: 200,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+afterEach(() => {
+  globalThis.fetch = realFetch;
+});
+
+describe("QwenWebExecutor — structured (array) content serialization", () => {
+  it("flattens OpenAI-style content parts to text (no '[object Object]')", async () => {
+    const calls: FetchCall[] = [];
+    globalThis.fetch = (async (url: string | URL | Request, init: RequestInit = {}) => {
+      calls.push({ url: String(url), init: init as { method?: string; body?: string } });
+      if (String(url).includes("/api/v2/chats/new")) return chatCreatedResponse();
+      return sseResponse([
+        { choices: [{ delta: { phase: "answer", content: "ok", status: "finished" } }] },
+      ]);
+    }) as typeof fetch;
+
+    const executor = new mod.QwenWebExecutor();
+    await executor.execute({
+      model: "qwen3.7-max",
+      body: {
+        messages: [
+          { role: "system", content: [{ type: "text", text: "You are helpful." }] },
+          {
+            role: "user",
+            content: [
+              { type: "text", text: "First part." },
+              { type: "text", text: "Second part." },
+            ],
+          },
+        ],
+      },
+      stream: false,
+      credentials: { apiKey: "token=jwt-tok; cna=abc" },
+      signal: null,
+    } as unknown as Parameters<typeof executor.execute>[0]);
+
+    const compBody = JSON.parse(calls[1].init.body);
+    const sent = String(compBody.messages[0].content);
+
+    assert.ok(
+      !sent.includes("[object Object]"),
+      `prompt must not contain '[object Object]', got: ${sent}`
+    );
+    assert.ok(sent.includes("First part."), "text of first content part must survive");
+    assert.ok(sent.includes("Second part."), "text of second content part must survive");
+    assert.ok(sent.includes("You are helpful."), "system content part must survive");
+  });
+});
diff --git a/tests/unit/qwen-web-models-discovery-3931.test.ts b/tests/unit/qwen-web-models-discovery-3931.test.ts
index 99e50840f2..3610311767 100644
--- a/tests/unit/qwen-web-models-discovery-3931.test.ts
+++ b/tests/unit/qwen-web-models-discovery-3931.test.ts
@@ -11,7 +11,7 @@
  * streaming endpoint — is a separate upstream/stealth concern, still open.)
  *
  * Fix: add a `qwen-web` PROVIDER_MODELS_CONFIG entry pointing at the public
- * `https://chat.qwen.ai/api/v2/models` endpoint, parsing the
+ * `https://chat.qwen.ai/api/v2/models/` endpoint, parsing the
  * `{ data: { data: [{ id, name, owned_by }] } }` shape.
  */
 import test from "node:test";
@@ -45,7 +45,7 @@ interface ModelsBody {
   source?: string;
 }
 
-const QWEN_WEB_MODELS_URL = "https://chat.qwen.ai/api/v2/models";
+const QWEN_WEB_MODELS_URL = "https://chat.qwen.ai/api/v2/models/";
 
 test("#3931 qwen-web model discovery fetches the public /api/v2/models catalog", async () => {
   await resetStorage();
@@ -83,7 +83,11 @@ test("#3931 qwen-web model discovery fetches the public /api/v2/models catalog",
     assert.equal(response.status, 200);
     const body = (await response.json()) as ModelsBody;
     assert.equal(body.provider, "qwen-web");
-    assert.equal(body.source, "api", "should serve the live qwen-web catalog, not local_catalog/empty");
+    assert.equal(
+      body.source,
+      "api",
+      "should serve the live qwen-web catalog, not local_catalog/empty"
+    );
     assert.ok(fetchedUrl, `should have probed ${QWEN_WEB_MODELS_URL}`);
     const ids = body.models.map((m) => m.id);
     assert.ok(ids.includes("qwen3-max"), `live ids missing: ${ids.join(",")}`);
diff --git a/tests/unit/reasoning-token-buffer-6274.test.ts b/tests/unit/reasoning-token-buffer-6274.test.ts
index 95403ee45d..abc16227a5 100644
--- a/tests/unit/reasoning-token-buffer-6274.test.ts
+++ b/tests/unit/reasoning-token-buffer-6274.test.ts
@@ -5,7 +5,8 @@
  * capable model with a large output cap (e.g. glm-5.2) the #3587 headroom heuristic
  * (`max(current + 1000, ceil(current * 1.5))`) rewrote it to 1001 and forwarded that
  * upstream. A tiny explicit budget below REASONING_BUFFER_MIN_TRIGGER (256) is a
- * probe and must pass through verbatim; genuine budgets keep the #3587 headroom.
+ * probe and must pass through verbatim; genuine budgets keep the #3587 headroom
+ * only when the full headroom fits inside an explicit output cap.
  *
  * Kept standalone against the pure `resolveReasoningBufferedMaxTokens` rather than
  * extending the frozen `combo-routing-engine.test.ts` god-file.
@@ -20,12 +21,10 @@ const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-reasoning
 process.env.DATA_DIR = TEST_DATA_DIR;
 
 const core = await import("../../src/lib/db/core.ts");
-const { saveModelsDevCapabilities, clearModelsDevCapabilities } = await import(
-  "../../src/lib/modelsDevSync.ts"
-);
-const { resolveReasoningBufferedMaxTokens, REASONING_BUFFER_MIN_TRIGGER } = await import(
-  "../../open-sse/services/reasoningTokenBuffer.ts"
-);
+const { saveModelsDevCapabilities, clearModelsDevCapabilities } =
+  await import("../../src/lib/modelsDevSync.ts");
+const { resolveReasoningBufferedMaxTokens, REASONING_BUFFER_MIN_TRIGGER } =
+  await import("../../open-sse/services/reasoningTokenBuffer.ts");
 
 function capabilityEntry(limitContext: unknown, overrides: Record<string, unknown> = {}) {
   return {
@@ -55,6 +54,19 @@ test.before(() => {
   saveModelsDevCapabilities({
     zhipu: {
       "glm-5.2": capabilityEntry(200000, { reasoning: true, limit_output: 65536 }),
+      // Deliberately NOT prefixed with a real MODEL_SPECS key (e.g. "glm-5.2") —
+      // getStaticSpec()/getCanonicalModelSpecId() does prefix matching (#6714),
+      // so a fixture id like "glm-5.2-no-output-cap" would silently fall through
+      // to the real glm-5.2 static spec's 131072 cap and defeat this fixture's
+      // "no cap anywhere" premise.
+      "totally-fictitious-model-6714-no-output-cap": capabilityEntry(200000, {
+        reasoning: true,
+        limit_output: null,
+      }),
+      "glm-5.2-output-cap-40000": capabilityEntry(200000, {
+        reasoning: true,
+        limit_output: 40000,
+      }),
     },
   });
 });
@@ -91,3 +103,26 @@ test("#6274 reasoning buffer does not inflate probe-sized max_tokens", () => {
     "genuine reasoning budgets keep the #3587 headroom"
   );
 });
+
+test("reasoning buffer requires an explicit cap and preserves near-cap budgets", () => {
+  assert.equal(
+    resolveReasoningBufferedMaxTokens("zhipu/totally-fictitious-model-6714-no-output-cap", 32000),
+    null,
+    "missing model output cap should disable heuristic token inflation"
+  );
+
+  // Known cap below the heuristic result: preserve the caller's in-range budget
+  // rather than inflating to a value that may reduce response room unexpectedly.
+  assert.equal(
+    resolveReasoningBufferedMaxTokens("zhipu/glm-5.2-output-cap-40000", 32000),
+    32000,
+    "known model output cap should preserve in-range near-cap budgets"
+  );
+
+  // Known cap below the caller value still clamps the requested value itself.
+  assert.equal(
+    resolveReasoningBufferedMaxTokens("zhipu/glm-5.2-output-cap-40000", 41000),
+    40000,
+    "requested max_tokens above the model output cap should be capped"
+  );
+});
diff --git a/tests/unit/rejected-request-usage.test.ts b/tests/unit/rejected-request-usage.test.ts
new file mode 100644
index 0000000000..bec7fc223e
--- /dev/null
+++ b/tests/unit/rejected-request-usage.test.ts
@@ -0,0 +1,84 @@
+// Regression guard — support-mesh escalation (2026-07-08, whatsbrasil):
+// an OmniRoute API key ("opencode-mac") showed "zero requisições" even though
+// it received traffic. Root cause: requests rejected *before* handleChatCore
+// (pipeline-gate / provider circuit breaker OPEN, or a combo with every target
+// exhausted) short-circuit in src/sse/handlers/chat.ts and only wrote a
+// call_logs row via saveCallLog — they never reached persistFailureUsage, so
+// no usage_history row was created and the per-api-key usage counter
+// (getApiKeyUsageRows, which reads usage_history) never incremented.
+//
+// The fix routes those rejections through recordRejectedRequestUsage(), which
+// writes BOTH the call_logs row (dashboard/logs visibility, preserved) AND a
+// usage_history row attributed to the api key with success:false — so the
+// rejected traffic is counted per key.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-rejected-usage-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const usageHistory = await import("../../src/lib/usage/usageHistory.ts");
+const callLogs = await import("../../src/lib/usage/callLogs.ts");
+const { recordRejectedRequestUsage } = await import("../../src/sse/handlers/rejectedRequestUsage.ts");
+
+test.beforeEach(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+  usageHistory.clearPendingRequests();
+});
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("gate-rejected request is attributed to the api key in usage_history", async () => {
+  await recordRejectedRequestUsage({
+    status: 503,
+    model: "claude-sonnet-5",
+    requestedModel: "claude-sonnet-5",
+    provider: "anthropic",
+    endpoint: "/v1/chat/completions",
+    error: "[503] Pipeline gate rejected",
+    apiKeyId: "key-opencode-mac",
+    apiKeyName: "opencode-mac",
+    startTime: Date.now() - 5,
+  });
+
+  // usage_history row exists, attributed to the key, marked as a failure.
+  const rows = (await usageHistory.getUsageDb()).data.history;
+  const keyRows = rows.filter((r: { apiKeyId?: string | null }) => r.apiKeyId === "key-opencode-mac");
+  assert.equal(keyRows.length, 1, "expected one usage_history row for the rejected request");
+  assert.equal(keyRows[0].success, false, "rejected request must be recorded as success:false");
+
+  // call_logs visibility is preserved (dashboard/logs).
+  const logs = await callLogs.getCallLogs({});
+  const rejected = (logs.logs ?? logs).filter?.((l: { apiKeyName?: string | null }) => l.apiKeyName === "opencode-mac");
+  assert.ok(rejected && rejected.length >= 1, "expected a call_logs row for the rejected request");
+});
+
+test("combo-exhausted rejection is also counted per api key", async () => {
+  await recordRejectedRequestUsage({
+    status: 502,
+    model: "gpt-5",
+    requestedModel: "gpt-5",
+    provider: "-",
+    endpoint: "/v1/chat/completions",
+    error: '[502] Combo "prod" failed — all targets exhausted',
+    comboName: "prod",
+    apiKeyId: "key-opencode-mac",
+    apiKeyName: "opencode-mac",
+    startTime: Date.now() - 3,
+  });
+
+  const rows = (await usageHistory.getUsageDb()).data.history;
+  const keyRows = rows.filter((r: { apiKeyId?: string | null }) => r.apiKeyId === "key-opencode-mac");
+  assert.equal(keyRows.length, 1);
+  assert.equal(keyRows[0].success, false);
+});
diff --git a/tests/unit/relay-check-rate-limit-existing-token.test.ts b/tests/unit/relay-check-rate-limit-existing-token.test.ts
new file mode 100644
index 0000000000..2843c15a25
--- /dev/null
+++ b/tests/unit/relay-check-rate-limit-existing-token.test.ts
@@ -0,0 +1,129 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// Regression test for src/lib/db/relayProxies.ts::checkRateLimit.
+//
+// Covers the perf change that threads an already-fetched RelayToken into
+// checkRateLimit to avoid a redundant `SELECT * FROM relay_tokens WHERE id = ?`
+// re-query:
+//   - the `existingToken` fast-path must agree with the legacy re-query path
+//     (same allowed/remaining for identical DB state)
+//   - the legacy re-query path (no token passed) must still work unmodified
+//   - the per-minute cap must still be enforced correctly via the fast-path
+
+const TEST_DATA_DIR = fs.mkdtempSync(
+  path.join(os.tmpdir(), "omniroute-relay-check-rate-limit-")
+);
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const relayProxies = await import("../../src/lib/db/relayProxies.ts");
+
+async function resetStorage() {
+  core.resetDbInstance();
+
+  for (let attempt = 0; attempt < 10; attempt++) {
+    try {
+      if (fs.existsSync(TEST_DATA_DIR)) {
+        fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+      }
+      break;
+    } catch (error) {
+      const code = (error as NodeJS.ErrnoException)?.code;
+      if ((code === "EBUSY" || code === "EPERM") && attempt < 9) {
+        await new Promise((resolve) => setTimeout(resolve, 50 * (attempt + 1)));
+      } else {
+        throw error;
+      }
+    }
+  }
+
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(async () => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+// Inserts a relay_tokens row directly (bypassing createRelayToken, which uses
+// a CommonJS `require("node:crypto")` that is unavailable under this ESM test
+// runner — a pre-existing, unrelated issue) and returns the RelayToken as
+// checkRateLimit's existingToken param expects it (camelCase, via getRelayToken).
+function insertRelayToken(overrides: {
+  id: string;
+  name: string;
+  maxRequestsPerMinute: number;
+  maxRequestsPerDay: number;
+}) {
+  const db = core.getDbInstance();
+  const now = Math.floor(Date.now() / 1000);
+  db.prepare(
+    `
+    INSERT INTO relay_tokens (id, name, token_hash, token_prefix, description, combo_id, allowed_models,
+      max_tokens_per_request, max_requests_per_minute, max_requests_per_day, max_cost_per_day,
+      enabled, created_at, updated_at, expires_at, metadata)
+    VALUES (?, ?, ?, ?, '', NULL, '["*"]', 128000, ?, ?, 0, 1, ?, ?, NULL, '{}')
+  `
+  ).run(
+    overrides.id,
+    overrides.name,
+    `hash-${overrides.id}`,
+    `rl_${overrides.id}`,
+    overrides.maxRequestsPerMinute,
+    overrides.maxRequestsPerDay,
+    now,
+    now
+  );
+  const token = relayProxies.getRelayToken(overrides.id);
+  if (!token) throw new Error("failed to insert test relay token");
+  return token;
+}
+
+test("checkRateLimit: existingToken fast-path agrees with the legacy re-query path", () => {
+  const token = insertRelayToken({
+    id: "rl_fastpath1",
+    name: "fast-path-token",
+    maxRequestsPerMinute: 10,
+    maxRequestsPerDay: 1000,
+  });
+
+  const legacy = relayProxies.checkRateLimit(token.id);
+  const fastPath = relayProxies.checkRateLimit(token.id, token);
+
+  assert.deepEqual(fastPath.allowed, legacy.allowed);
+  assert.deepEqual(fastPath.remaining, legacy.remaining);
+});
+
+test("checkRateLimit: legacy re-query path (no token passed) still works when the token does not exist", () => {
+  const result = relayProxies.checkRateLimit("does-not-exist");
+  assert.equal(result.allowed, false);
+  assert.equal(result.remaining, 0);
+});
+
+test("checkRateLimit: existingToken fast-path still enforces the per-minute cap", () => {
+  const token = insertRelayToken({
+    id: "rl_captoken1",
+    name: "cap-token",
+    maxRequestsPerMinute: 2,
+    maxRequestsPerDay: 1000,
+  });
+
+  // Record 2 requests in the current minute window — matches the cap.
+  relayProxies.recordRelayUsage(token.id, { model: "test-model", cost: 0 });
+  relayProxies.recordRelayUsage(token.id, { model: "test-model", cost: 0 });
+
+  const fastPath = relayProxies.checkRateLimit(token.id, token);
+  const legacy = relayProxies.checkRateLimit(token.id);
+
+  assert.equal(fastPath.allowed, false);
+  assert.equal(fastPath.remaining, 0);
+  assert.deepEqual(fastPath, legacy);
+});
diff --git a/tests/unit/relay-deploy-5128.test.ts b/tests/unit/relay-deploy-5128.test.ts
index 7e9f149aee..31ac95240a 100644
--- a/tests/unit/relay-deploy-5128.test.ts
+++ b/tests/unit/relay-deploy-5128.test.ts
@@ -3,6 +3,7 @@ import assert from "node:assert/strict";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import vm from "node:vm";
 
 // Regression tests for #5128 — one-click relay deployments (Deno + Cloudflare +
 // Vercel) broken in v3.8.37. Four distinct, independently-reproducible bugs:
@@ -81,13 +82,22 @@ test("#5128B: extractRelayAuth decrypts the encrypted relayAuthEnc form (encrypt
 // --------------------------------------------------------------------------
 test("#5128C: Cloudflare worker upload sends an accepted script Content-Type", async () => {
   const realFetch = globalThis.fetch;
-  let putBodyType: string | undefined;
+  let requestContentType: string | undefined;
+  let scriptPartContentType: string | undefined;
   globalThis.fetch = (async (input: unknown, init: RequestInit = {}) => {
     const url = String(input);
     if (init.method === "PUT" && url.includes("/workers/scripts/")) {
-      const fd = init.body as FormData;
-      const scriptPart = fd.get("index.js") as Blob;
-      putBodyType = scriptPart.type;
+      // #6416: the upload body is a raw multipart Buffer (not a FormData
+      // instance — see cloudflareWorkerScript.ts::buildCloudflareWorkerUploadRequest),
+      // so assert directly on the request Content-Type header and the
+      // embedded part header instead of reading FormData.get().
+      const headers = new Headers(init.headers);
+      requestContentType = headers.get("content-type") ?? undefined;
+      const bodyText = Buffer.isBuffer(init.body)
+        ? (init.body as Buffer).toString("utf8")
+        : String(init.body);
+      const match = bodyText.match(/name="index\.js"[^]*?Content-Type: ([^\r\n]+)/);
+      scriptPartContentType = match?.[1];
       // Simulate the CF API rejecting the upload so the route short-circuits
       // without making the follow-up subdomain calls.
       return Response.json({ errors: [{ message: "stubbed" }] }, { status: 400 });
@@ -112,10 +122,100 @@ test("#5128C: Cloudflare worker upload sends an accepted script Content-Type", a
     globalThis.fetch = realFetch;
   }
 
+  // #6416: the overall request Content-Type must itself be one CF accepts —
+  // a FormData body auto-negotiated through undici's patched fetch degraded
+  // to "text/plain;charset=UTF-8", which CF flatly rejects.
+  assert.ok(
+    requestContentType?.startsWith("multipart/form-data; boundary="),
+    `expected an accepted request Content-Type, got "${requestContentType}"`
+  );
   // CF rejects "application/javascript+module"; only these are accepted.
   assert.ok(
-    putBodyType === "application/javascript" || putBodyType === "text/javascript",
-    `expected an accepted script MIME, got "${putBodyType}"`
+    scriptPartContentType === "application/javascript" ||
+      scriptPartContentType === "text/javascript",
+    `expected an accepted script MIME, got "${scriptPartContentType}"`
+  );
+});
+
+// --------------------------------------------------------------------------
+// E) Cloudflare worker script uses Service Worker syntax with body_part (#6416)
+// --------------------------------------------------------------------------
+test("#6416: Cloudflare worker script body is Service Worker syntax (no top-level export) + metadata uses body_part", async () => {
+  const realFetch = globalThis.fetch;
+  let capturedScriptBody = "";
+  let capturedMetadata: Record<string, unknown> | undefined;
+  globalThis.fetch = (async (input: unknown, init: RequestInit = {}) => {
+    const url = String(input);
+    if (init.method === "PUT" && url.includes("/workers/scripts/") && !url.includes("/subdomain")) {
+      const bodyText = Buffer.isBuffer(init.body)
+        ? (init.body as Buffer).toString("utf8")
+        : String(init.body);
+      const scriptMatch = bodyText.match(
+        /name="index\.js"[^]*?Content-Type: [^\r\n]+\r\n\r\n([^]*?)\r\n--/
+      );
+      const metadataMatch = bodyText.match(
+        /name="metadata"[^]*?Content-Type: application\/json\r\n\r\n([^]*?)\r\n--/
+      );
+      capturedScriptBody = scriptMatch?.[1] ?? "";
+      capturedMetadata = metadataMatch?.[1]
+        ? (JSON.parse(metadataMatch[1]) as Record<string, unknown>)
+        : undefined;
+      return Response.json({ errors: [{ message: "stubbed" }] }, { status: 400 });
+    }
+    return Response.json({ result: {} });
+  }) as unknown as typeof globalThis.fetch;
+
+  try {
+    const route = await import("../../src/app/api/settings/proxy/cloudflare-deploy/route.ts");
+    await route.POST(
+      new Request("http://localhost/api/settings/proxy/cloudflare-deploy", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          accountId: "abcdef0123456789",
+          apiToken: "cf-token-aaaaaaaaaaaaaaaaaaaaaa",
+          projectName: "omniroute-relay",
+        }),
+      })
+    );
+  } finally {
+    globalThis.fetch = realFetch;
+  }
+
+  // The Cloudflare multipart upload API parses `application/javascript` script
+  // parts as Service Workers, so the body must NOT use ES-module syntax
+  // (`export default {...}`). It must register a fetch event listener instead.
+  assert.ok(
+    !/^\s*export\s+default/m.test(capturedScriptBody),
+    "Cloudflare worker script must not use `export default` (#6416 — CF parses non-`+module` MIME types as Service Workers)"
+  );
+  assert.ok(
+    /addEventListener\(\s*["']fetch["']/.test(capturedScriptBody),
+    "Cloudflare worker script must register a fetch event listener"
+  );
+
+  const privateHostnameFnSource = capturedScriptBody.match(
+    /function isPrivateHostname\(h\) \{[\s\S]*?\n\}/
+  )?.[0];
+  assert.ok(privateHostnameFnSource, "emitted worker script should contain isPrivateHostname");
+  const isPrivateHostname = vm.runInNewContext(
+    `${privateHostnameFnSource}; isPrivateHostname;`,
+    {}
+  ) as (host: string) => boolean;
+  assert.equal(isPrivateHostname("[::1]"), true, "bracketed IPv6 loopback must stay blocked");
+  assert.equal(isPrivateHostname("[fd00::1]"), true, "bracketed IPv6 ULA must stay blocked");
+
+  // Metadata must use `body_part` (Service Worker entry) rather than
+  // `main_module` (which requires an actual ES module).
+  assert.equal(
+    capturedMetadata?.body_part,
+    "index.js",
+    "metadata.body_part must point at the script part"
+  );
+  assert.equal(
+    capturedMetadata?.main_module,
+    undefined,
+    "metadata must not use main_module — that requires an ES module script body (#6416)"
   );
 });
 
diff --git a/tests/unit/relay-probe-stats.test.ts b/tests/unit/relay-probe-stats.test.ts
new file mode 100644
index 0000000000..14693f5e66
--- /dev/null
+++ b/tests/unit/relay-probe-stats.test.ts
@@ -0,0 +1,36 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import {
+  recordRelayProbe,
+  getRelayProbeStats,
+  resetRelayProbeStats,
+} from "@/lib/db/relayProbeStats";
+
+test.beforeEach(() => {
+  resetRelayProbeStats();
+});
+
+test("starts at zero", () => {
+  assert.deepEqual(getRelayProbeStats(), { tested: 0, alive: 0 });
+});
+
+test("counts tested and alive probes", () => {
+  recordRelayProbe(true);
+  recordRelayProbe(false);
+  recordRelayProbe(true);
+  assert.deepEqual(getRelayProbeStats(), { tested: 3, alive: 2 });
+});
+
+test("returns a copy so callers cannot mutate internal state", () => {
+  recordRelayProbe(true);
+  const snapshot = getRelayProbeStats();
+  snapshot.tested = 999;
+  assert.deepEqual(getRelayProbeStats(), { tested: 1, alive: 1 });
+});
+
+test("reset returns counters to zero", () => {
+  recordRelayProbe(false);
+  recordRelayProbe(false);
+  resetRelayProbeStats();
+  assert.deepEqual(getRelayProbeStats(), { tested: 0, alive: 0 });
+});
diff --git a/tests/unit/relay-test-result-awareness.test.ts b/tests/unit/relay-test-result-awareness.test.ts
new file mode 100644
index 0000000000..17ce5c0b3d
--- /dev/null
+++ b/tests/unit/relay-test-result-awareness.test.ts
@@ -0,0 +1,68 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { buildRelayTestResult } from "@/app/api/settings/proxy/test/relayTestResult";
+
+const base = { publicIp: "1.2.3.4", latencyMs: 12, relayUrl: "https://relay.example" };
+
+// Minimal HeaderAccessor so we do not depend on a concrete Headers implementation.
+function headers(map: Record<string, string>): { get(name: string): string | null } {
+  return { get: (name: string) => (name in map ? map[name] : null) };
+}
+
+test("parses relay awareness from x-relay-* response headers on success", () => {
+  const r = buildRelayTestResult({
+    ...base,
+    statusCode: 200,
+    relayAuthPresent: true,
+    relayResponseHeaders: headers({
+      "x-relay-url": "https://relay-1.example",
+      "x-relay-mode": "primary",
+      "x-relay-attempts": "3",
+      "x-relay-fallback": "true",
+    }),
+  });
+  assert.equal(r.success, true);
+  assert.deepEqual(r.relay, {
+    url: "https://relay-1.example",
+    mode: "primary",
+    attempts: 3,
+    fallback: true,
+  });
+});
+
+test("omits relay block when no response headers provided", () => {
+  const r = buildRelayTestResult({ ...base, statusCode: 200, relayAuthPresent: true });
+  assert.equal(r.success, true);
+  assert.equal(r.relay, undefined);
+});
+
+test("coerces missing/invalid awareness header values to null", () => {
+  const r = buildRelayTestResult({
+    ...base,
+    statusCode: 200,
+    relayAuthPresent: true,
+    relayResponseHeaders: headers({
+      "x-relay-attempts": "not-a-number",
+      "x-relay-fallback": "maybe",
+    }),
+  });
+  assert.deepEqual(r.relay, {
+    url: null,
+    mode: null,
+    attempts: null,
+    fallback: false,
+  });
+});
+
+test("does not parse awareness on a failed relay response", () => {
+  const r = buildRelayTestResult({
+    ...base,
+    statusCode: 502,
+    publicIp: null,
+    relayAuthPresent: true,
+    relayResponseHeaders: headers({ "x-relay-url": "https://relay-1.example" }),
+  });
+  assert.equal(r.success, false);
+  assert.equal(r.relay, undefined);
+  assert.ok(typeof r.error === "string" && r.error.includes("502"));
+});
diff --git a/tests/unit/repro-6142-devin-cloud-agent-unwired.test.ts b/tests/unit/repro-6142-devin-cloud-agent-unwired.test.ts
new file mode 100644
index 0000000000..015e7e1300
--- /dev/null
+++ b/tests/unit/repro-6142-devin-cloud-agent-unwired.test.ts
@@ -0,0 +1,27 @@
+// tests/unit/repro-6142-devin-cloud-agent-unwired.test.ts
+import { test } from "node:test";
+import assert from "node:assert/strict";
+
+import { validateProviderApiKey } from "../../src/lib/providers/validation";
+import { getStaticModelsForProvider } from "../../src/lib/providers/staticModels";
+
+test("#6142 (fixed): saving a Devin cloud-agent API key should not be 'unsupported' by the generic provider flow (parity with jules)", async () => {
+  const result = await validateProviderApiKey({
+    provider: "devin",
+    apiKey: "cog_fake_service_user_token_for_repro",
+  });
+  assert.notEqual(
+    result.error,
+    "Provider validation not supported",
+    "devin should have a specialty validator wired (like jules), not fall through to 'not supported'"
+  );
+  assert.notEqual(result.unsupported, true);
+});
+
+test("#6142 (fixed): the 'Available Models' UI should have a usable static catalog for devin (parity with jules)", () => {
+  const devinStaticModels = getStaticModelsForProvider("devin");
+  assert.ok(
+    Array.isArray(devinStaticModels) && devinStaticModels.length > 0,
+    "devin should expose a static model catalog like jules does"
+  );
+});
diff --git a/tests/unit/repro-6377-agentrouter-validation.test.ts b/tests/unit/repro-6377-agentrouter-validation.test.ts
new file mode 100644
index 0000000000..cebc459990
--- /dev/null
+++ b/tests/unit/repro-6377-agentrouter-validation.test.ts
@@ -0,0 +1,81 @@
+// Repro for GitHub issue #6377: AgentRouter "Check" (validate API key) returns
+// "Invalid API key" for a genuinely valid token.
+//
+// Root cause: PR #6255 (#6056) routed the REAL chat-request path for the
+// built-in `agentrouter` provider through the dynamic Claude-Code wire image
+// (buildProviderHeaders/buildProviderUrl -> CC fingerprint headers + the
+// `?beta=true` chat path) specifically because AgentRouter's WAF rejects
+// requests that don't look like the official Claude Code client
+// ("unauthorized client detected" — see the comment in
+// open-sse/config/providers/registry/agentrouter/index.ts).
+//
+// validation.ts's generic `entry.format === "claude"` branch (used for the
+// dashboard "Check" button) was NOT updated by that PR: it still builds a
+// bare request (Content-Type + x-api-key + anthropic-version only, no
+// `?beta=true`, no CC fingerprint headers) straight to entry.baseUrl. A WAF
+// that gates on the CC wire image will legitimately 403 this validation
+// probe even though the same key works for real chat traffic — the exact
+// mismatch the reporter describes.
+//
+// This test simulates that WAF: accept only requests that carry the CC wire
+// image markers (User-Agent: claude-cli/... and the `?beta=true` chat path);
+// reject everything else with 403 "unauthorized client detected", mapped by
+// the validator to { valid: false, error: "Invalid API key" }.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { validateProviderApiKey } = await import("../../src/lib/providers/validation.ts");
+
+const originalFetch = globalThis.fetch;
+
+test.afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+test("agentrouter key validation must not false-negative behind the CC-wire-image WAF gate (#6377)", async () => {
+  const calls: { url: string; headers: Record<string, string> }[] = [];
+
+  globalThis.fetch = async (url: string | URL, init: RequestInit = {}) => {
+    const u = String(url);
+    const headers: Record<string, string> = {};
+    if (init?.headers) {
+      for (const [k, v] of Object.entries(init.headers)) {
+        headers[k.toLowerCase()] = String(v);
+      }
+    }
+    calls.push({ url: u, headers });
+
+    // Emulate AgentRouter's real-world WAF: only requests that look like the
+    // official Claude Code client (CC wire image: `?beta=true` chat path +
+    // a claude-cli User-Agent) are let through with a valid key. Anything
+    // else — even with the SAME valid key — is rejected as an
+    // "unauthorized client".
+    const looksLikeClaudeCode =
+      u.includes("beta=true") && /claude-cli/i.test(headers["user-agent"] || "");
+
+    if (!looksLikeClaudeCode) {
+      return new Response(JSON.stringify({ error: "unauthorized client detected" }), {
+        status: 403,
+      });
+    }
+
+    return new Response(JSON.stringify({ id: "msg_ok" }), { status: 200 });
+  };
+
+  const result = await validateProviderApiKey({
+    provider: "agentrouter",
+    apiKey: "sk-genuinely-valid-agentrouter-key",
+    providerSpecificData: {},
+  });
+
+  // BEFORE the fix: validation.ts's generic `entry.format === "claude"`
+  // branch sends a bare request (no `?beta=true`, no CC User-Agent) and gets
+  // 403'd by the WAF -> false "Invalid API key" for a key that actually works.
+  assert.equal(
+    result.valid,
+    true,
+    `expected the valid key to validate, got: ${JSON.stringify(result)} — ` +
+      `requests made: ${JSON.stringify(calls.map((c) => ({ url: c.url, ua: c.headers["user-agent"] })))}`
+  );
+});
diff --git a/tests/unit/repro-6524.test.ts b/tests/unit/repro-6524.test.ts
new file mode 100644
index 0000000000..b71a72c98a
--- /dev/null
+++ b/tests/unit/repro-6524.test.ts
@@ -0,0 +1,103 @@
+/**
+ * Regression test for issue #6524.
+ *
+ * Reporter observed: for `ollama-cloud/deepseek-v4-flash`, a synced capability row
+ * with `limit_output=1048576` (wrongly equal to `limit_context`, while the real
+ * upstream output cap is `65536`) caused the reasoning-token-buffer heuristic to
+ * expand `max_tokens` 64000 -> 96000, which upstream rejected with
+ * "exceeds model's maximum output tokens (65536)".
+ *
+ * Root cause (confirmed by reading `resolveReasoningBufferedMaxTokens` and its
+ * `getExplicitModelOutputCap` clamp source): the clamp math itself is correct, but
+ * `getExplicitModelOutputCap()` only ever read the unvalidated synced
+ * `limit_output` (or registry/static fallbacks) — it ignored the operator-settable
+ * `max_token` capability override (`src/lib/db/modelCapabilityOverrides.ts`,
+ * `/api/model-capability-overrides`) that `getResolvedModelCapabilities()` already
+ * consulted. That inconsistency meant an operator manually correcting a bad synced
+ * output cap (the existing, already-shipped remediation path for wrong catalog
+ * data) had no effect on the reasoning buffer, which kept inflating past the real
+ * cap regardless.
+ *
+ * Fix: `getExplicitModelOutputCap()` now checks the same `max_token` override
+ * before falling back to synced/registry/static data, via a helper shared with
+ * `getResolvedModelCapabilities()`.
+ */
+import assert from "node:assert/strict";
+import test from "node:test";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-repro-6524-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const { saveModelsDevCapabilities, clearModelsDevCapabilities } = await import(
+  "../../src/lib/modelsDevSync.ts"
+);
+const { setModelCapabilityOverride, removeModelCapabilityOverride } = await import(
+  "../../src/lib/db/modelCapabilityOverrides.ts"
+);
+const { resolveReasoningBufferedMaxTokens } = await import(
+  "../../open-sse/services/reasoningTokenBuffer.ts"
+);
+
+const PROVIDER = "ollama-cloud";
+const MODEL = "deepseek-v4-flash";
+const TARGET = `${PROVIDER}/${MODEL}`;
+const REAL_UPSTREAM_OUTPUT_CAP = 65536; // per reporter's boundary test table
+
+function capabilityEntry(limitContext: unknown, overrides: Record<string, unknown> = {}) {
+  return {
+    reasoning: false,
+    tool_call: true,
+    attachment: false,
+    temperature: true,
+    structured_output: true,
+    limit: { context: limitContext, output: limitContext },
+    ...overrides,
+  };
+}
+
+test.before(() => {
+  clearModelsDevCapabilities();
+  // Mirrors the exact production row from the issue: limit_context and limit_output
+  // both wrongly synced to 1048576 for ollama-cloud/deepseek-v4-flash, while the real
+  // upstream output cap (per the reporter's boundary test) is 65536.
+  saveModelsDevCapabilities({
+    [PROVIDER]: {
+      [MODEL]: capabilityEntry(1048576, { reasoning: true, limit_output: 1048576 }),
+    },
+  });
+});
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("#6524: with only the (wrong) synced catalog data, the buffer still inflates past the real cap", () => {
+  // Documents the known, out-of-scope limitation: nothing in our codebase can
+  // psychically know the real upstream cap before an operator (or a future
+  // self-healing mechanism) supplies a correction. This is the reported symptom's
+  // starting state, not something this fix promises to eliminate on first contact.
+  const result = resolveReasoningBufferedMaxTokens(TARGET, 64000);
+  assert.equal(result, 96000);
+});
+
+test("#6524: an operator-set max_token override now clamps the reasoning buffer to the real cap", () => {
+  assert.ok(
+    setModelCapabilityOverride(TARGET, "max_token", REAL_UPSTREAM_OUTPUT_CAP),
+    "expected the max_token override to be written"
+  );
+  try {
+    const result = resolveReasoningBufferedMaxTokens(TARGET, 64000);
+    assert.ok(
+      result === null || result <= REAL_UPSTREAM_OUTPUT_CAP,
+      `expected max_tokens to stay <= ${REAL_UPSTREAM_OUTPUT_CAP}, got ${result} ` +
+        `(reproduces reported 64000 -> 96000 inflation, upstream then 400s)`
+    );
+  } finally {
+    removeModelCapabilityOverride(TARGET, "max_token");
+  }
+});
diff --git a/tests/unit/repro-6557-noauth-connection-disable-ignored.test.ts b/tests/unit/repro-6557-noauth-connection-disable-ignored.test.ts
new file mode 100644
index 0000000000..e71da092cc
--- /dev/null
+++ b/tests/unit/repro-6557-noauth-connection-disable-ignored.test.ts
@@ -0,0 +1,95 @@
+/**
+ * Repro for #6557 — "disabled provider still used by router (opencode/big-pickle)"
+ *
+ * Root-cause hypothesis: OmniRoute exposes TWO different "disable this no-auth
+ * provider" affordances that write to two DISCONNECTED places:
+ *
+ *  1. Main Providers grid page toggle (ProviderCard inside NoAuthProvidersSection)
+ *     -> handleToggleProvider() -> PUT /api/providers/:id { isActive: false }
+ *     This only works once a real `provider_connections` row exists for the
+ *     no-auth provider (created e.g. via "Add Account" in NoAuthAccountCard for
+ *     fingerprint-account providers like opencode/mimocode).
+ *
+ *  2. Provider detail page toggle (NoAuthProviderControls/NoAuthProviderToggle)
+ *     -> handleEnabledChange() -> PATCH /api/settings { blockedProviders: [...] }
+ *
+ * getNoAuthCandidates() in open-sse/services/autoCombo/virtualFactory.ts (used to
+ * build the "auto"/virtual-combo candidate pool) ONLY checks mechanism #2
+ * (blockedProviders). It never looks at the no-auth provider's own
+ * provider_connections row / isActive flag at all — so disabling via mechanism
+ * #1 (the toggle switch shown on the main Providers grid card, which IS what
+ * renders once an account/connection row exists) has ZERO effect on routing.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-repro-6557-"));
+const ORIGINAL_DATA_DIR = process.env.DATA_DIR;
+
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const virtualFactory = await import("../../open-sse/services/autoCombo/virtualFactory.ts");
+
+async function resetStorage() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(async () => {
+  await resetStorage();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+
+  if (ORIGINAL_DATA_DIR === undefined) {
+    delete process.env.DATA_DIR;
+  } else {
+    process.env.DATA_DIR = ORIGINAL_DATA_DIR;
+  }
+});
+
+test("#6557: disabling the opencode no-auth provider's own connection (isActive=false, the toggle on the main Providers grid card) does NOT remove it from the auto-combo candidate pool", async () => {
+  const conn = await providersDb.createProviderConnection({
+    provider: "opencode",
+    authType: "no-auth",
+    name: "OpenCode Free Account 1",
+    providerSpecificData: { fingerprints: ["11111111111111111111111111111111"] },
+  });
+
+  const beforeCombo = await virtualFactory.createVirtualAutoCombo(undefined);
+  assert.ok(
+    beforeCombo.autoConfig.candidatePool.includes("opencode"),
+    "baseline: opencode should be a candidate before any disable action"
+  );
+
+  // Simulates exactly what the main Providers grid toggle does:
+  // PUT /api/providers/:id { isActive: false } -> updateProviderConnection(id, { isActive: false })
+  await providersDb.updateProviderConnection(conn.id, { isActive: false });
+
+  const updated = await providersDb.getProviderConnectionById(conn.id);
+  assert.equal(updated?.isActive, false, "the connection must actually be persisted as inactive");
+
+  const afterCombo = await virtualFactory.createVirtualAutoCombo(undefined);
+  assert.ok(
+    !afterCombo.autoConfig.candidatePool.includes("opencode"),
+    "BUG #6557: opencode must NOT be routed to after its connection was disabled via the " +
+      "main Providers-grid toggle (isActive=false), but it still is — the no-auth candidate " +
+      "builder ignores provider_connections.isActive entirely."
+  );
+});
+
+test("#6557 regression guard: a no-auth provider with ZERO connection rows (default auto-generated account path) is still included in the auto-combo candidate pool", async () => {
+  const combo = await virtualFactory.createVirtualAutoCombo(undefined);
+  assert.ok(
+    combo.autoConfig.candidatePool.includes("opencode"),
+    "a no-auth provider with no connection row at all must still be included by default"
+  );
+});
diff --git a/tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts b/tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts
new file mode 100644
index 0000000000..8c56090b33
--- /dev/null
+++ b/tests/unit/repro-6576-kiro-thinking-unsupported-model.test.ts
@@ -0,0 +1,64 @@
+// Repro probe for GitHub issue #6576.
+//
+// Kiro/CodeWhisperer rejects `additionalModelRequestFields` for
+// claude-sonnet-4.5 / claude-haiku-4.5 with a raw upstream 400:
+//   "[400]: additionalModelRequestFields is not supported for this model"
+//
+// buildKiroPayload() gates thinking injection on supportsReasoning(model),
+// which resolves from the GENERIC Anthropic-API capability data
+// (MODEL_SPECS["claude-sonnet-4-5-..."].supportsThinking === true,
+// MODEL_SPECS["claude-haiku-4-5-20251001"].supportsThinking === true).
+// That flag says nothing about whether the *Kiro/AWS CodeWhisperer*
+// backend accepts the adaptive-thinking additionalModelRequestFields
+// envelope for these specific models — only the newer adaptive-only
+// models (Opus 4.7/4.8, Sonnet 5, Fable 5) are proven to accept it there
+// (see the existing "drops temperature when thinking is enabled" tests).
+//
+// This test asserts the payload for claude-sonnet-4.5 (the reporter's own
+// model) must NOT carry additionalModelRequestFields when reasoning is
+// requested, matching what Kiro's upstream actually accepts. It currently
+// FAILS because buildKiroPayload has no Kiro-specific allowlist/exclusion
+// and blindly forwards the field whenever the generic capability flag says
+// supportsThinking:true.
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { buildKiroPayload } = await import(
+  "../../open-sse/translator/request/openai-to-kiro.ts"
+);
+
+test("[repro #6576] buildKiroPayload must not attach additionalModelRequestFields for claude-sonnet-4.5 (Kiro rejects it)", () => {
+  const body = {
+    messages: [{ role: "user", content: "Calculate 51818+62218, and reply with result only." }],
+    reasoning_effort: "medium",
+    max_tokens: 2048,
+    stream: false,
+  };
+
+  const result = buildKiroPayload("claude-sonnet-4.5", body, false, null);
+
+  assert.equal(
+    result.additionalModelRequestFields,
+    undefined,
+    "additionalModelRequestFields must not be sent for claude-sonnet-4.5 — " +
+      "Kiro/CodeWhisperer rejects it upstream with " +
+      "'[400]: additionalModelRequestFields is not supported for this model' (issue #6576)"
+  );
+});
+
+test("[repro #6576] buildKiroPayload must not attach additionalModelRequestFields for claude-haiku-4.5 (Kiro rejects it)", () => {
+  const body = {
+    messages: [{ role: "user", content: "hi" }],
+    thinking: { type: "adaptive" },
+  };
+
+  const result = buildKiroPayload("claude-haiku-4.5", body, false, null);
+
+  assert.equal(
+    result.additionalModelRequestFields,
+    undefined,
+    "additionalModelRequestFields must not be sent for claude-haiku-4.5 — " +
+      "Kiro/CodeWhisperer rejects it upstream (issue #6576 comment by fenix007: " +
+      "9/9 production requests with reasoning params 400'd for this exact model)"
+  );
+});
diff --git a/tests/unit/repro-6637-kimi-token-limit.test.ts b/tests/unit/repro-6637-kimi-token-limit.test.ts
new file mode 100644
index 0000000000..b27bc35595
--- /dev/null
+++ b/tests/unit/repro-6637-kimi-token-limit.test.ts
@@ -0,0 +1,41 @@
+// Repro probe for issue #6637: combo stops fallback after Kimi total token-limit 400.
+//
+// Observed provider response (Kimi, verbatim from the issue report):
+//   "Invalid request: Your request exceeded model token limit: 262144 (requested: 308458)"
+//
+// combo.ts's #2101 guard (handleComboChat) treats a 400 as a combo-halting
+// "body-specific" error UNLESS isContextOverflow400() or isParamValidation400()
+// recognizes it as a context/param overflow that should fall through to the next
+// combo target. Kimi's exact wording ("... exceeded model token limit ...") does
+// NOT contain the literal word "context", so isContextOverflow400() misses it even
+// though accountFallback.ts's OWN CONTEXT_OVERFLOW_PATTERNS (used one layer below,
+// to decide fallbackResult.shouldFallback) explicitly matches `/\btoken limit\b/i`
+// and `/\bmax.*token/i`. The two classifiers disagree, and the stricter one wins,
+// so the combo halts instead of trying the next (larger-context) target.
+import assert from "node:assert/strict";
+import test from "node:test";
+import { isContextOverflow400, isParamValidation400 } from "../../open-sse/services/combo.ts";
+
+const KIMI_ERROR_TEXT =
+  "Invalid request: Your request exceeded model token limit: 262144 (requested: 308458)";
+
+test("#6637: Kimi's 'exceeded model token limit' 400 must be classified as context/token overflow (not body-specific)", () => {
+  // This is the exact predicate combo.ts checks before deciding to abort the
+  // whole combo instead of falling through to the next target (combo.ts ~L2038-2049):
+  //   if (status === 400 && fallbackResult.shouldFallback &&
+  //       !isContextOverflow400(errorText) && !isParamValidation400(errorText) && ...)
+  //     -> "stopping combo"
+  //
+  // For the fallback to proceed to the next target, at least one of these must be true.
+  const isRecognizedAsOverflow = isContextOverflow400(KIMI_ERROR_TEXT) || isParamValidation400(KIMI_ERROR_TEXT);
+
+  assert.equal(
+    isRecognizedAsOverflow,
+    true,
+    `Expected Kimi's "exceeded model token limit" 400 to be classified as context/token ` +
+      `overflow so combo fallback continues to the next target, but neither ` +
+      `isContextOverflow400() nor isParamValidation400() matched it. This causes ` +
+      `handleComboChat's #2101 guard to treat it as a body-specific error and halt the ` +
+      `whole combo (bug #6637).`
+  );
+});
diff --git a/tests/unit/repro-6692-sticky-terminal.test.ts b/tests/unit/repro-6692-sticky-terminal.test.ts
new file mode 100644
index 0000000000..3d816e6df7
--- /dev/null
+++ b/tests/unit/repro-6692-sticky-terminal.test.ts
@@ -0,0 +1,164 @@
+/**
+ * TDD repro probe for issue #6692 — "Combo session stickiness never releases a
+ * credits-exhausted account (failover stops working)".
+ *
+ * Root cause (verified by code read): applySessionStickiness's ONLY eligibility
+ * gate for keeping a sticky pin was a 5h/weekly usage-PERCENTAGE headroom check
+ * (open-sse/services/combo/sessionStickiness.ts). It never inspected connection
+ * testStatus / rateLimitedUntil / terminal state. clearStickyBinding()
+ * (sessionStickiness.ts) had zero call sites anywhere in combo.ts's failure/
+ * retry path (confirmed via repo-wide grep) — only the two internal branches
+ * inside applySessionStickiness itself (connection missing from pool, or low
+ * headroom) ever cleared a binding.
+ *
+ * This test reproduces the reported symptom using ONLY the real, exported
+ * sessionStickiness.ts API, driven exactly the way combo.ts drives it in
+ * production:
+ *   - recordStickyBinding() is called after a SUCCESSFUL turn (mirrors
+ *     combo.ts:1879 / combo.ts:2830).
+ *   - The bound connection's 5h/weekly utilization is healthy (fresh windows),
+ *     exactly as it would be for an account that is durably dead for a reason
+ *     ORTHOGONAL to 5h/weekly utilization (credits_exhausted / banned / a
+ *     per-day soft cap — reporter #2's exact scenario).
+ *   - The connection-health fetcher (the fix's new injectable seam, mirroring
+ *     __setStickinessHeadroomFetcherForTests) reports the bound connection as
+ *     credits_exhausted — exactly what a real provider_connections row would
+ *     report once markAccountUnavailable() has classified the terminal error.
+ *
+ * Expected (correct) behavior: once a sticky-bound connection is known
+ * terminally unhealthy, the pin must release and failover must move to the
+ * next healthy target.
+ *
+ * Actual (BEFORE the fix): applySessionStickiness re-promoted the dead
+ * connection anyway, because headroom was the only gate it consulted — this
+ * test failed RED on the pre-fix code (result.stuck === true, dead connection
+ * stayed at position 0).
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import type { HeadroomSaturation } from "../../open-sse/services/combo/headroomRanking.ts";
+import type { StickyConnectionHealth } from "../../open-sse/services/combo/sessionStickiness.ts";
+
+const mod = await import("../../open-sse/services/combo/sessionStickiness.ts");
+const {
+  deriveMessageHash,
+  applySessionStickiness,
+  recordStickyBinding,
+  clearAllStickyBindings,
+  __setStickinessHeadroomFetcherForTests,
+  __setStickinessConnectionFetcherForTests,
+} = mod;
+
+function makeTarget(
+  connectionId: string
+): import("../../open-sse/services/combo/types.ts").ResolvedComboTarget {
+  return {
+    kind: "model",
+    stepId: `step-${connectionId}`,
+    executionKey: `key-${connectionId}`,
+    modelStr: `gpt-4/${connectionId}`,
+    provider: "openai",
+    providerId: null,
+    connectionId,
+    weight: 1,
+    label: null,
+  };
+}
+
+function injectSat(sat: HeadroomSaturation | undefined): void {
+  __setStickinessHeadroomFetcherForTests(async (_id: string) => sat);
+}
+
+function injectConnectionHealth(byId: Record<string, StickyConnectionHealth | undefined>): void {
+  __setStickinessConnectionFetcherForTests(async (connectionId: string) => byId[connectionId]);
+}
+
+test.beforeEach(() => {
+  clearAllStickyBindings();
+});
+
+test.after(() => {
+  __setStickinessHeadroomFetcherForTests(null);
+  __setStickinessConnectionFetcherForTests(null);
+});
+
+test("BUG #6692: sticky pin survives a terminal (credits_exhausted) account — headroom-only gate keeps re-promoting the dead connection instead of failing over", async () => {
+  // Healthy 5h/weekly utilization (fresh windows) — exactly what a
+  // credits_exhausted / banned / daily-soft-capped account reports on THESE
+  // axes, since the terminal state is orthogonal to 5h/weekly percentage
+  // utilization (issue #6692, both reporters).
+  injectSat({ util5h: 0.05, util7d: 0.05 }); // headroom = 0.95, well above threshold
+
+  // The bound connection is durably dead (credits_exhausted); the fallback
+  // connection is unknown to the health fetcher (fail-open → healthy).
+  injectConnectionHealth({ "conn-exhausted": { testStatus: "credits_exhausted" } });
+
+  // Upstream strategy ordering already ranks conn-healthy first (a terminally
+  // dead account naturally scores worse on the normal ordering signals too) —
+  // conn-exhausted is only ever tried first because the sticky pin FORCE-
+  // PROMOTES it. That force-promotion, not the base ordering, is the bug.
+  const targets = [makeTarget("conn-healthy"), makeTarget("conn-exhausted")];
+  const messages = [{ role: "user", content: "Multi-turn conversation, turn 1" }];
+  const hash = deriveMessageHash(messages)!;
+  assert.ok(hash, "hash must be derivable");
+
+  // Turn 1 (production: combo.ts success branch, e.g. combo.ts:1879):
+  // conn-exhausted served the first turn successfully → sticky-bound.
+  recordStickyBinding(hash, "conn-exhausted");
+
+  // Turn 2 (production): conn-exhausted now returns credits_exhausted /
+  // banned / a masked daily-cap refusal — the provider_connections row is
+  // updated by markAccountUnavailable() with testStatus=credits_exhausted,
+  // which the injected connection-health fetcher above simulates.
+
+  // Turn 3 (production): the next request in the same conversation calls
+  // applySessionStickiness() again. Desired behavior: the terminally dead
+  // connection must NOT be re-promoted over the naturally-better ordering.
+  const result = await applySessionStickiness(targets, messages);
+
+  assert.equal(
+    result.stuck,
+    false,
+    "sticky pin must release once the bound connection is terminally exhausted, " +
+      "not only when 5h/weekly headroom is low (issue #6692)"
+  );
+  assert.equal(
+    result.targets[0].connectionId,
+    "conn-healthy",
+    "the terminally dead sticky pin must NOT be force-promoted over the naturally-ordered healthy target"
+  );
+});
+
+test("BUG #6692 (rate-limited variant): sticky pin releases while the bound connection is still inside its rateLimitedUntil window", async () => {
+  injectSat({ util5h: 0.05, util7d: 0.05 });
+  const future = new Date(Date.now() + 60_000).toISOString();
+  injectConnectionHealth({ "conn-cooling": { rateLimitedUntil: future } });
+
+  const targets = [makeTarget("conn-healthy"), makeTarget("conn-cooling")];
+  const messages = [{ role: "user", content: "Another conversation" }];
+  const hash = deriveMessageHash(messages)!;
+
+  recordStickyBinding(hash, "conn-cooling");
+
+  const result = await applySessionStickiness(targets, messages);
+
+  assert.equal(result.stuck, false, "pin must release while the connection is still cooling down");
+  assert.equal(result.targets[0].connectionId, "conn-healthy");
+});
+
+test("healthy sticky connection (unknown to the connection-health fetcher) still stays pinned — fail-open preserved", async () => {
+  injectSat({ util5h: 0.05, util7d: 0.05 });
+  injectConnectionHealth({}); // unknown connection → fail-open → not terminal
+
+  const targets = [makeTarget("conn-a"), makeTarget("conn-b")];
+  const messages = [{ role: "user", content: "Healthy conversation" }];
+  const hash = deriveMessageHash(messages)!;
+
+  recordStickyBinding(hash, "conn-a");
+
+  const result = await applySessionStickiness(targets, messages);
+
+  assert.equal(result.stuck, true, "a healthy/unknown connection must remain pinned");
+  assert.equal(result.targets[0].connectionId, "conn-a");
+});
diff --git a/tests/unit/repro-6701-claude-detect-fallback.test.ts b/tests/unit/repro-6701-claude-detect-fallback.test.ts
new file mode 100644
index 0000000000..c17b6e1705
--- /dev/null
+++ b/tests/unit/repro-6701-claude-detect-fallback.test.ts
@@ -0,0 +1,74 @@
+/**
+ * Repro for #6701 — Claude Code CLI reported "not found" in OmniRoute's
+ * dashboard even though the user has used it before (settings.json present)
+ * and upstream 9router (same machine, same settings.json) reports it as
+ * "Connected".
+ *
+ * Root cause: `getCliRuntimeStatus()` in src/shared/services/cliRuntime.ts
+ * only ever answers `installed` from binary resolution (known install paths
+ * + PATH lookup via `where.exe`/`command -v`). If the CLI binary is not
+ * currently resolvable (stale PATH inherited by a long-running/background
+ * OmniRoute process, binary moved, etc.) it unconditionally reports
+ * installed:false — even when `~/.claude/settings.json` proves the tool was
+ * installed and used before.
+ *
+ * Upstream 9router's equivalent route (src/app/api/cli-tools/claude-settings/route.js)
+ * has a second-chance fallback: if `where`/`which` fails, it still reports
+ * installed:true when the settings file exists on disk. OmniRoute's rewrite
+ * into cliRuntime.ts dropped that fallback, which is the concrete regression
+ * relative to 9router this issue's screenshots capture.
+ *
+ * This test forces the binary lookup to fail deterministically (CLI_CLAUDE_BIN
+ * pointed at a path that does not exist) while a real settings.json sits under
+ * an isolated CLI_CONFIG_HOME. Expected (post-fix, 9router-parity) behavior:
+ * installed should stay true because the settings file is present. Current
+ * code returns installed:false / reason:"not_found" — this is the RED proof.
+ */
+
+import { describe, it, before, after } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const { getCliRuntimeStatus } = await import("../../src/shared/services/cliRuntime.ts");
+
+describe("#6701 — claude detection should fall back to settings.json when binary is unresolvable", () => {
+  let configHome: string;
+  const prevBin = process.env.CLI_CLAUDE_BIN;
+  const prevConfigHome = process.env.CLI_CONFIG_HOME;
+
+  before(() => {
+    // Isolated config home *within* os.homedir() (CLI_CONFIG_HOME validation
+    // requires this) so we never touch the real ~/.claude directory.
+    configHome = fs.mkdtempSync(path.join(os.homedir(), ".omniroute-test-6701-"));
+    const claudeDir = path.join(configHome, ".claude");
+    fs.mkdirSync(claudeDir, { recursive: true });
+    fs.writeFileSync(
+      path.join(claudeDir, "settings.json"),
+      JSON.stringify({ env: { ANTHROPIC_BASE_URL: "http://localhost:20128" } }, null, 2)
+    );
+
+    // Force the binary lookup to fail deterministically regardless of host state.
+    process.env.CLI_CLAUDE_BIN = path.join(os.tmpdir(), "definitely-not-a-real-claude-binary-6701");
+    process.env.CLI_CONFIG_HOME = configHome;
+  });
+
+  after(() => {
+    fs.rmSync(configHome, { recursive: true, force: true });
+    if (prevBin === undefined) delete process.env.CLI_CLAUDE_BIN;
+    else process.env.CLI_CLAUDE_BIN = prevBin;
+    if (prevConfigHome === undefined) delete process.env.CLI_CONFIG_HOME;
+    else process.env.CLI_CONFIG_HOME = prevConfigHome;
+  });
+
+  it("reports installed:true when settings.json exists, even if the binary can't be resolved", async () => {
+    const result = await getCliRuntimeStatus("claude");
+
+    assert.equal(
+      result.installed,
+      true,
+      `Expected installed:true (9router-parity settings.json fallback), got installed:${result.installed} reason:${result.reason}`
+    );
+  });
+});
diff --git a/tests/unit/repro-6912-volcengine-max-completion-tokens.test.ts b/tests/unit/repro-6912-volcengine-max-completion-tokens.test.ts
new file mode 100644
index 0000000000..601ea92d58
--- /dev/null
+++ b/tests/unit/repro-6912-volcengine-max-completion-tokens.test.ts
@@ -0,0 +1,182 @@
+// @ts-nocheck
+// Regression test for #6912: OmniRoute never renamed a client-sent
+// `max_completion_tokens` back to `max_tokens` for providers/models whose
+// registry entry only documents the legacy field (Volcengine Ark / DeepSeek).
+// chatCore.ts already renamed the OTHER direction (max_tokens ->
+// max_completion_tokens for o1/o3/o4/gpt-5.4/5.5, #1961) but had no symmetric
+// case, so `max_completion_tokens` was forwarded byte-for-byte to Volcengine,
+// which silently ignores the unrecognized field and returns an unbounded
+// completion.
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-repro-6912-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const { clearCache } = await import("../../src/lib/semanticCache.ts");
+const { clearIdempotency } = await import("../../src/lib/idempotencyLayer.ts");
+const { clearInflight } = await import("../../open-sse/services/requestDedup.ts");
+const { resetAll: resetAccountSemaphores } = await import(
+  "../../open-sse/services/accountSemaphore.ts"
+);
+const { handleChatCore, clearUpstreamProxyConfigCache } = await import(
+  "../../open-sse/handlers/chatCore.ts"
+);
+const { resetPayloadRulesConfigForTests } = await import("../../open-sse/services/payloadRules.ts");
+
+const originalFetch = globalThis.fetch;
+
+function noopLog() {
+  return {
+    debug() {},
+    info() {},
+    warn() {},
+    error() {},
+  };
+}
+
+function toPlainHeaders(headers) {
+  if (!headers) return {};
+  if (headers instanceof Headers) return Object.fromEntries(headers.entries());
+  return Object.fromEntries(
+    Object.entries(headers).map(([key, value]) => [key, value == null ? "" : String(value)])
+  );
+}
+
+function buildOpenAIResponse(text = "ok") {
+  return new Response(
+    JSON.stringify({
+      id: "chatcmpl-json",
+      object: "chat.completion",
+      model: "DeepSeek-V4-Flash",
+      choices: [
+        {
+          index: 0,
+          message: { role: "assistant", content: text },
+          finish_reason: "stop",
+        },
+      ],
+      usage: { prompt_tokens: 4, completion_tokens: 2, total_tokens: 6 },
+    }),
+    { status: 200, headers: { "Content-Type": "application/json" } }
+  );
+}
+
+async function invokeChatCore({ body, provider, model, endpoint = "/v1/chat/completions" }) {
+  const calls: Array<{ url: string; headers: Record<string, string>; parsedBody: unknown }> = [];
+
+  globalThis.fetch = async (url, init = {}) => {
+    const headers = toPlainHeaders(init.headers);
+    const captured = {
+      url: String(url),
+      method: init.method || "GET",
+      headers,
+      body: init.body ? JSON.parse(String(init.body)) : null,
+    };
+    calls.push(captured);
+    return buildOpenAIResponse();
+  };
+
+  try {
+    const requestBody = structuredClone(body);
+    const result = await handleChatCore({
+      body: requestBody,
+      modelInfo: { provider, model, extendedContext: false },
+      credentials: { apiKey: "sk-test", providerSpecificData: {} },
+      log: noopLog(),
+      clientRawRequest: {
+        endpoint,
+        body: structuredClone(body),
+        headers: new Headers({ accept: "application/json" }),
+      },
+      connectionId: null,
+      apiKeyInfo: null,
+      userAgent: "unit-test",
+      isCombo: false,
+      comboStrategy: null,
+      onCredentialsRefreshed: null,
+      onRequestSuccess: null,
+    } as unknown as Parameters<typeof handleChatCore>[0]);
+
+    return { result, calls, call: calls.at(-1) };
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+}
+
+async function resetStorage() {
+  clearUpstreamProxyConfigCache();
+  resetPayloadRulesConfigForTests();
+  clearCache();
+  clearIdempotency();
+  clearInflight();
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.afterEach(async () => {
+  globalThis.fetch = originalFetch;
+  resetAccountSemaphores();
+  await resetStorage();
+});
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("#6912: chatCore renames max_completion_tokens to max_tokens for volcengine/DeepSeek-V4-Flash", async () => {
+  const { call } = await invokeChatCore({
+    provider: "volcengine",
+    model: "DeepSeek-V4-Flash",
+    body: {
+      model: "DeepSeek-V4-Flash",
+      messages: [{ role: "user", content: "hi" }],
+      max_completion_tokens: 30,
+      stream: false,
+    },
+  });
+
+  assert.equal(call.body.max_tokens, 30, "expected max_completion_tokens to be normalized to max_tokens for volcengine");
+  assert.equal(call.body.max_completion_tokens, undefined);
+});
+
+test("#6912: chatCore does not clobber an already-present max_tokens", async () => {
+  const { call } = await invokeChatCore({
+    provider: "volcengine",
+    model: "DeepSeek-V4-Flash",
+    body: {
+      model: "DeepSeek-V4-Flash",
+      messages: [{ role: "user", content: "hi" }],
+      max_tokens: 500,
+      max_completion_tokens: 30,
+      stream: false,
+    },
+  });
+
+  assert.equal(call.body.max_tokens, 500, "existing max_tokens must win over max_completion_tokens");
+  assert.equal(call.body.max_completion_tokens, undefined);
+});
+
+test("#6912: chatCore keeps the pre-existing max_tokens->max_completion_tokens direction for o3 (#1961)", async () => {
+  const { call } = await invokeChatCore({
+    provider: "openai",
+    model: "o3",
+    body: {
+      model: "o3",
+      messages: [{ role: "user", content: "hi" }],
+      max_tokens: 99999,
+      stream: false,
+    },
+  });
+
+  // Existing provider-side token-limit clamping (unrelated to #6912) caps the
+  // renamed value; this test only asserts the rename direction is preserved.
+  assert.equal(call.body.max_tokens, undefined);
+  assert.equal(call.body.max_completion_tokens, 16384);
+});
diff --git a/tests/unit/repro-6951.test.ts b/tests/unit/repro-6951.test.ts
new file mode 100644
index 0000000000..9de9bf3912
--- /dev/null
+++ b/tests/unit/repro-6951.test.ts
@@ -0,0 +1,137 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+// #6951 — Codex Responses API strict mode forces every tool property into
+// `required`, so the model always emits *some* value for "optional" params.
+// `stripEmptyOptionalToolArgs` (open-sse/translator/response/openai-responses/pureHelpers.ts)
+// used to be an allowlist of 2 tool names that only stripped empty-string/empty-array
+// values, so a forced non-empty value on a non-allowlisted tool (or a schema-declared
+// default value) was always forwarded verbatim to the client. This test proves the
+// schema-aware normalization (drop-if-default, generalized drop-if-empty) added for #6951,
+// and the end-to-end schema threading from the request's `tools[]` into the streaming
+// call sites in `openai-responses.ts` (response.output_item.done handling).
+
+const { stripEmptyOptionalToolArgs } = await import(
+  "../../open-sse/translator/response/openai-responses/pureHelpers.ts"
+);
+const { extractToolSchemaMap } = await import(
+  "../../open-sse/translator/response/openai-responses/toolSchemas.ts"
+);
+const { openaiResponsesToOpenAIResponse } = await import(
+  "../../open-sse/translator/response/openai-responses.ts"
+);
+
+const AGENT_SCHEMA = {
+  type: "object",
+  properties: {
+    description: { type: "string" },
+    prompt: { type: "string" },
+    subagent_type: { type: "string" },
+    model: { type: "string" },
+    run_in_background: { type: "boolean" },
+    isolation: { type: "string", enum: ["local", "remote"], default: "local" },
+    cloud_base_branch: { type: "string" },
+  },
+  // Responses API strict mode: every property is required, even "optional" ones.
+  required: [
+    "description",
+    "prompt",
+    "subagent_type",
+    "model",
+    "run_in_background",
+    "isolation",
+    "cloud_base_branch",
+  ],
+};
+
+test("6951: drop-if-default — forced value equal to the schema default is stripped", () => {
+  const raw = JSON.stringify({
+    description: "x",
+    prompt: "y",
+    subagent_type: "claude",
+    model: "sonnet",
+    run_in_background: false,
+    isolation: "local", // matches schema default -> indistinguishable from omission
+    cloud_base_branch: "",
+  });
+  const cleaned = JSON.parse(stripEmptyOptionalToolArgs(raw, "Agent", AGENT_SCHEMA));
+  assert.equal(Object.prototype.hasOwnProperty.call(cleaned, "isolation"), false);
+  // cloud_base_branch is required by this schema -> must NOT be stripped just for being empty.
+  assert.equal(Object.prototype.hasOwnProperty.call(cleaned, "cloud_base_branch"), true);
+});
+
+test("6951: generalized drop-if-empty — empty optional prop stripped for ANY tool when not in schema.required", () => {
+  const schema = {
+    type: "object",
+    properties: { note: { type: "string" }, tags: { type: "array" } },
+    required: [], // both optional
+  };
+  const raw = JSON.stringify({ note: "", tags: [] });
+  const cleaned = JSON.parse(stripEmptyOptionalToolArgs(raw, "SomeOtherTool", schema));
+  assert.equal(Object.prototype.hasOwnProperty.call(cleaned, "note"), false);
+  assert.equal(Object.prototype.hasOwnProperty.call(cleaned, "tags"), false);
+});
+
+test("6951: required-by-schema empty prop is preserved (safety — not indistinguishable from omission)", () => {
+  const schema = {
+    type: "object",
+    properties: { note: { type: "string" } },
+    required: ["note"],
+  };
+  const raw = JSON.stringify({ note: "" });
+  const cleaned = JSON.parse(stripEmptyOptionalToolArgs(raw, "SomeOtherTool", schema));
+  assert.equal(Object.prototype.hasOwnProperty.call(cleaned, "note"), true);
+});
+
+test("6951: no schema supplied — behavior unchanged (allowlist + empty-only, backward compatible)", () => {
+  const raw = JSON.stringify({ query: "", tags: [] });
+  assert.equal(stripEmptyOptionalToolArgs(raw, "SomeOtherTool"), raw);
+});
+
+test("6951: extractToolSchemaMap builds a name->schema map from Chat Completions tools[]", () => {
+  const body = {
+    tools: [
+      { type: "function", function: { name: "Agent", parameters: AGENT_SCHEMA } },
+      { type: "function", function: { name: "no_schema" } },
+    ],
+  };
+  const map = extractToolSchemaMap(body);
+  assert.equal(map?.get("Agent"), AGENT_SCHEMA);
+  assert.equal(map?.has("no_schema"), false);
+  assert.equal(extractToolSchemaMap({}), null);
+});
+
+test("6951: RED->GREEN — schema threaded end-to-end strips the default-valued isolation arg", () => {
+  // Simulates createSSEStream's TranslateState carrying `toolSchemas` extracted from the
+  // request body, as wired in open-sse/utils/stream.ts.
+  const state = { toolSchemas: new Map([["Agent", AGENT_SCHEMA]]) };
+
+  openaiResponsesToOpenAIResponse(
+    { type: "response.output_item.added", item: { type: "function_call", call_id: "call_1", name: "Agent" } },
+    state
+  );
+  const done = openaiResponsesToOpenAIResponse(
+    {
+      type: "response.output_item.done",
+      item: {
+        type: "function_call",
+        call_id: "call_1",
+        name: "Agent",
+        arguments: JSON.stringify({
+          description: "d",
+          prompt: "p",
+          subagent_type: "claude",
+          model: "sonnet",
+          run_in_background: false,
+          isolation: "local",
+          cloud_base_branch: "",
+        }),
+      },
+    },
+    state
+  );
+
+  const args = JSON.parse(done.choices[0].delta.tool_calls[0].function.arguments);
+  assert.equal(Object.prototype.hasOwnProperty.call(args, "isolation"), false);
+  assert.equal(args.description, "d");
+});
diff --git a/tests/unit/repro-6952-commentary.test.ts b/tests/unit/repro-6952-commentary.test.ts
new file mode 100644
index 0000000000..4e622a1065
--- /dev/null
+++ b/tests/unit/repro-6952-commentary.test.ts
@@ -0,0 +1,257 @@
+/**
+ * TDD repro for #6952: commentary-phase output leaks in TRANSLATE mode.
+ *
+ * Background: #6199/#6561 added a stateful commentary-phase filter
+ * (`shouldDropResponsesCommentaryEvent`) but wired it only into
+ * `createSSEStream`'s PASSTHROUGH branch. The TRANSLATE-mode branch (an
+ * openai-responses upstream translated into another client format, e.g.
+ * codex routes streaming into Claude Code) called `translateResponse()` on
+ * every raw chunk without checking `phase`, so `phase: "commentary"`
+ * scratchpad text — duplicate prose and narrated tool-call arguments — leaked
+ * into the client-visible text block, right alongside the real final answer
+ * and the real function_call.
+ *
+ * This test drives `createSSEStream({ mode: "translate", targetFormat:
+ * "openai-responses", sourceFormat: "claude" })` with a realistic upstream
+ * sequence: a commentary item (duplicate prose + narrated tool-call JSON),
+ * a real final-answer item, and a real function_call — then asserts the
+ * translated Claude-shaped SSE stream contains the final prose exactly once,
+ * never the commentary text, and still carries the real tool call.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-commentary-6952-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+const core = await import("../../src/lib/db/core.ts");
+
+const { createSSEStream } = await import("../../open-sse/utils/stream.ts");
+
+const textEncoder = new TextEncoder();
+
+async function readTransformed(chunks: string[], options: object): Promise<string> {
+  const source = new ReadableStream({
+    start(controller) {
+      for (const chunk of chunks) {
+        controller.enqueue(textEncoder.encode(chunk));
+      }
+      controller.close();
+    },
+  });
+  return new Response(source.pipeThrough(createSSEStream(options))).text();
+}
+
+test.after(() => {
+  core.resetDbInstance();
+  if (fs.existsSync(TEST_DATA_DIR)) {
+    fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  }
+});
+
+const COMMENTARY_TEXT = "narrating the tool call before actually making it";
+const COMMENTARY_ARGS_JSON = '{"path":"/etc/passwd","reason":"scratchpad narration"}';
+const FINAL_TEXT = "Here is the final answer for the user.";
+const TOOL_NAME = "read_file";
+const TOOL_ARGS_JSON = '{"path":"/tmp/real.txt"}';
+
+function sse(event: object): string {
+  return `data: ${JSON.stringify(event)}\n\n`;
+}
+
+// Upstream openai-responses sequence: commentary item (prose + narrated tool
+// args) -> real final-answer item -> real function_call.
+function buildResponsesStream(): string[] {
+  return [
+    sse({ type: "response.created", response: { id: "resp_6952", output: [] } }),
+    // --- commentary item (internal scratchpad, must never reach the client) ---
+    sse({
+      type: "response.output_item.added",
+      output_index: 0,
+      item: {
+        id: "msg_commentary",
+        type: "message",
+        role: "assistant",
+        phase: "commentary",
+        content: [],
+      },
+    }),
+    sse({
+      type: "response.output_text.delta",
+      output_index: 0,
+      item_id: "msg_commentary",
+      content_index: 0,
+      delta: COMMENTARY_TEXT,
+    }),
+    sse({
+      type: "response.output_text.delta",
+      output_index: 0,
+      item_id: "msg_commentary",
+      content_index: 0,
+      delta: COMMENTARY_ARGS_JSON,
+    }),
+    sse({
+      type: "response.output_text.done",
+      output_index: 0,
+      item_id: "msg_commentary",
+      content_index: 0,
+      text: COMMENTARY_TEXT + COMMENTARY_ARGS_JSON,
+    }),
+    sse({
+      type: "response.output_item.done",
+      output_index: 0,
+      item: {
+        id: "msg_commentary",
+        type: "message",
+        role: "assistant",
+        phase: "commentary",
+        content: [{ type: "output_text", text: COMMENTARY_TEXT + COMMENTARY_ARGS_JSON }],
+      },
+    }),
+    // --- real final-answer item (must always be forwarded, exactly once) ---
+    sse({
+      type: "response.output_item.added",
+      output_index: 1,
+      item: {
+        id: "msg_final",
+        type: "message",
+        role: "assistant",
+        phase: "final",
+        content: [],
+      },
+    }),
+    sse({
+      type: "response.output_text.delta",
+      output_index: 1,
+      item_id: "msg_final",
+      content_index: 0,
+      delta: FINAL_TEXT,
+    }),
+    sse({
+      type: "response.output_text.done",
+      output_index: 1,
+      item_id: "msg_final",
+      content_index: 0,
+      text: FINAL_TEXT,
+    }),
+    sse({
+      type: "response.output_item.done",
+      output_index: 1,
+      item: {
+        id: "msg_final",
+        type: "message",
+        role: "assistant",
+        phase: "final",
+        content: [{ type: "output_text", text: FINAL_TEXT }],
+      },
+    }),
+    // --- real function_call (must always be forwarded) ---
+    sse({
+      type: "response.output_item.added",
+      output_index: 2,
+      item: {
+        id: "fc_real",
+        type: "function_call",
+        call_id: "call_real_1",
+        name: TOOL_NAME,
+        arguments: "",
+      },
+    }),
+    sse({
+      type: "response.function_call_arguments.delta",
+      output_index: 2,
+      item_id: "fc_real",
+      delta: TOOL_ARGS_JSON,
+    }),
+    sse({
+      type: "response.output_item.done",
+      output_index: 2,
+      item: {
+        id: "fc_real",
+        type: "function_call",
+        call_id: "call_real_1",
+        name: TOOL_NAME,
+        arguments: TOOL_ARGS_JSON,
+      },
+    }),
+    sse({
+      type: "response.completed",
+      response: {
+        id: "resp_6952",
+        output: [
+          {
+            id: "msg_final",
+            type: "message",
+            role: "assistant",
+            phase: "final",
+            content: [{ type: "output_text", text: FINAL_TEXT }],
+          },
+          {
+            id: "fc_real",
+            type: "function_call",
+            call_id: "call_real_1",
+            name: TOOL_NAME,
+            arguments: TOOL_ARGS_JSON,
+          },
+        ],
+        usage: { input_tokens: 10, output_tokens: 20 },
+      },
+    }),
+  ];
+}
+
+const TRANSLATE_RESPONSES_TO_CLAUDE_OPTIONS = {
+  mode: "translate",
+  targetFormat: "openai-responses",
+  sourceFormat: "claude",
+  provider: "openai",
+};
+
+test("TRANSLATE mode drops commentary-phase text before translateResponse (#6952)", async () => {
+  const output = await readTransformed(buildResponsesStream(), {
+    ...TRANSLATE_RESPONSES_TO_CLAUDE_OPTIONS,
+    dropResponsesCommentary: true,
+  });
+
+  assert.ok(
+    !output.includes(COMMENTARY_TEXT),
+    "commentary-phase prose must not reach the translated client stream"
+  );
+  assert.ok(
+    !output.includes(COMMENTARY_ARGS_JSON),
+    "commentary-phase narrated tool-call JSON must not reach the translated client stream"
+  );
+
+  // The final prose must appear exactly once — not once from commentary
+  // duplication and once from the real final item.
+  const finalTextOccurrences = output.split(FINAL_TEXT).length - 1;
+  assert.equal(
+    finalTextOccurrences,
+    1,
+    `expected prose exactly once in the translated stream, got ${finalTextOccurrences}`
+  );
+
+  // The real tool call must still be forwarded (arguments are JSON-escaped inside
+  // an `input_json_delta` SSE frame, so match on the unescaped path fragment).
+  assert.ok(
+    output.includes("/tmp/real.txt"),
+    "the real function_call arguments must be forwarded"
+  );
+  assert.ok(output.includes(TOOL_NAME), "the real function_call name must be forwarded");
+});
+
+test("TRANSLATE mode passes commentary through when dropping is disabled (gate/regression) (#6952)", async () => {
+  const output = await readTransformed(buildResponsesStream(), {
+    ...TRANSLATE_RESPONSES_TO_CLAUDE_OPTIONS,
+    dropResponsesCommentary: false,
+  });
+
+  assert.ok(
+    output.includes(COMMENTARY_TEXT),
+    "with the flag disabled, commentary text must still pass through untouched"
+  );
+  assert.ok(output.includes(FINAL_TEXT), "the final answer text must still be forwarded");
+});
diff --git a/tests/unit/repro-6957.test.ts b/tests/unit/repro-6957.test.ts
new file mode 100644
index 0000000000..696dfada3d
--- /dev/null
+++ b/tests/unit/repro-6957.test.ts
@@ -0,0 +1,130 @@
+/**
+ * Repro for #6957 — combo builder "2. Model" dropdown shows visually duplicated
+ * "imported" rows and appears to be missing the "-latest" aliases for a native
+ * Mistral provider with 2 API-key connections.
+ *
+ * Root cause (confirmed against the reporter's actual `GET /api/combos/builder/options`
+ * payload, issue #6957): there is NO literal `model.id` collision — every synced
+ * model id is already unique after `buildModelOptions()`/`getAllSyncedAvailableModels()`
+ * dedup. The bug is that `ComboBuilderModelOption.name` (the text rendered in the
+ * `<option>` in `src/app/(dashboard)/dashboard/combos/page.tsx:3217-3220`) is
+ * populated straight from the upstream-synced `model.name`, which Mistral's own
+ * /v1/models catalog resolves to a shared "canonical" display name for every alias
+ * in a model family. So `codestral-2508`, `codestral-latest`,
+ * `mistral-code-fim-latest` and `mistral-code-latest` are 4 DISTINCT ids that all
+ * render as the literal text "codestral-2508 · imported" — indistinguishable in the
+ * picker — and the `-latest` alias (e.g. `mistral-large-latest`) is present in the
+ * payload but invisible/unfindable because it displays under its base model's name
+ * instead of its own.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-combo-6957-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const modelsDb = await import("../../src/lib/db/models.ts");
+const { getComboBuilderOptions } = await import("../../src/lib/combos/builderOptions.ts");
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+// A trimmed slice of the reporter's actual payload (issue #6957 comment attachment
+// Untitled-1.json): 4 distinct ids in the "codestral" family that all resolve to
+// the same upstream display name, plus the "mistral-large" base/-latest pair.
+const MISTRAL_FAMILY_SLICE = [
+  { id: "codestral-2508", name: "codestral-2508" },
+  { id: "codestral-latest", name: "codestral-2508" },
+  { id: "mistral-code-fim-latest", name: "codestral-2508" },
+  { id: "mistral-code-latest", name: "codestral-2508" },
+  { id: "mistral-large-2512", name: "mistral-large-2512" },
+  { id: "mistral-large-latest", name: "mistral-large-2512" },
+];
+
+test("#6957 native Mistral provider with 2 connections: synced models produce a unique id per model but ambiguous/colliding display names", async () => {
+  // Native Mistral provider, 2 API-key connections — mirrors the reporter's setup
+  // (providerId "mistral", connectionCount 2, both accounts auto-syncing the same
+  // upstream catalog).
+  const conn1 = await providersDb.createProviderConnection({
+    provider: "mistral",
+    authType: "apikey",
+    name: "ac1",
+    apiKey: "sk-mistral-ac1",
+  });
+  const conn2 = await providersDb.createProviderConnection({
+    provider: "mistral",
+    authType: "apikey",
+    name: "ac2",
+    apiKey: "sk-mistral-ac2",
+  });
+
+  // Both connections sync the identical upstream catalog slice (same account
+  // family just imported twice, matching "connectionCount: 2" in the reporter's
+  // JSON — this is what produces the appearance of duplicates in the builder).
+  for (const conn of [conn1, conn2]) {
+    await modelsDb.replaceSyncedAvailableModelsForConnection(
+      "mistral",
+      conn.id,
+      MISTRAL_FAMILY_SLICE.map((m) => ({ id: m.id, name: m.name, source: "imported" }))
+    );
+  }
+
+  const payload = await getComboBuilderOptions();
+  const mistral = payload.providers.find((p) => p.providerId === "mistral");
+  assert.ok(mistral, "mistral provider must appear in the combo builder output");
+  assert.equal(mistral!.connectionCount, 2, "sanity: 2 connections, matching the reporter's setup");
+
+  const models = mistral!.models.filter((m) => MISTRAL_FAMILY_SLICE.some((f) => f.id === m.id));
+
+  // No literal id duplicates — confirms the earlier needs-info hypothesis (a
+  // per-connection modelMap dedup gap) was WRONG; every id is already unique.
+  const ids = models.map((m) => m.id);
+  assert.equal(new Set(ids).size, ids.length, "sanity: model ids are already unique");
+  assert.equal(models.length, MISTRAL_FAMILY_SLICE.length, "all 6 distinct models must be present");
+
+  // THE BUG: the picker renders `model.name` as the visible label
+  // (page.tsx:3217-3220 `{model.name}{model.source ? ... : ""}`). Today,
+  // `buildModelOptions()`/`addModelOption()` (builderOptions.ts) passes the
+  // upstream-synced name straight through with no disambiguation, so 4 distinct
+  // models render identical text and the "-latest" alias is indistinguishable
+  // from its base model — reproducing both reported symptoms at once.
+  const codestralLatest = models.find((m) => m.id === "codestral-latest")!;
+  const codestralBase = models.find((m) => m.id === "codestral-2508")!;
+  assert.notEqual(
+    codestralLatest.name,
+    codestralBase.name,
+    "RED: 'codestral-latest' must render a distinguishable label from its base 'codestral-2508' " +
+      "model — today both literally render 'codestral-2508 · imported', which is exactly the " +
+      "visually-duplicated rows + invisible '-latest' alias reported in #6957"
+  );
+
+  const mistralLargeLatest = models.find((m) => m.id === "mistral-large-latest")!;
+  const mistralLargeBase = models.find((m) => m.id === "mistral-large-2512")!;
+  assert.notEqual(
+    mistralLargeLatest.name,
+    mistralLargeBase.name,
+    "RED: 'mistral-large-latest' must render a distinguishable label from its base " +
+      "'mistral-large-2512' model"
+  );
+
+  // Provider-wide: no two distinct model ids should ever render the same option text.
+  const nameCollisions = new Map<string, string[]>();
+  for (const model of models) {
+    const bucket = nameCollisions.get(model.name) || [];
+    bucket.push(model.id);
+    nameCollisions.set(model.name, bucket);
+  }
+  const collidingNames = Array.from(nameCollisions.entries()).filter(([, ids]) => ids.length > 1);
+  assert.equal(
+    collidingNames.length,
+    0,
+    `RED: distinct model ids must not share an identical display name (collisions: ${JSON.stringify(collidingNames)})`
+  );
+});
diff --git a/tests/unit/repro-6975.test.ts b/tests/unit/repro-6975.test.ts
new file mode 100644
index 0000000000..ffe17dfe66
--- /dev/null
+++ b/tests/unit/repro-6975.test.ts
@@ -0,0 +1,35 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-combo-embed-6975-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const modelsDb = await import("../../src/lib/db/models.ts");
+const { getComboBuilderOptions } = await import("../../src/lib/combos/builderOptions.ts");
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("#6975 embeddings-only custom model must appear in the combo builder output", async () => {
+  await modelsDb.addCustomModel("opencode", "zzz-embed-6975", "Embed Model 6975", "manual", "embeddings", [
+    "embeddings",
+  ]);
+  const payload = await getComboBuilderOptions();
+  const m = payload.providers.flatMap((p) => p.models).find((m) => m.id === "zzz-embed-6975");
+  assert.ok(m, "embeddings-only custom model must appear in the combo builder output");
+});
+
+test("#6975 rerank-only custom model must appear in the combo builder output", async () => {
+  await modelsDb.addCustomModel("opencode", "zzz-rerank-6975", "Rerank Model 6975", "manual", "rerank", [
+    "rerank",
+  ]);
+  const payload = await getComboBuilderOptions();
+  const m = payload.providers.flatMap((p) => p.models).find((m) => m.id === "zzz-rerank-6975");
+  assert.ok(m, "rerank-only custom model must appear in the combo builder output");
+});
diff --git a/tests/unit/request-defaults-store-session.test.ts b/tests/unit/request-defaults-store-session.test.ts
index 602178cf56..45122e0465 100644
--- a/tests/unit/request-defaults-store-session.test.ts
+++ b/tests/unit/request-defaults-store-session.test.ts
@@ -5,10 +5,16 @@ const {
   buildOpenAIStoreSessionId,
   ensureOpenAIStoreSessionFallback,
   getClaudeCodeCompatibleRequestDefaults,
+  normalizeCodexReasoningEffort,
   normalizeProviderSpecificData,
   sanitizeProviderSpecificDataForResponse,
 } = await import("../../src/lib/providers/requestDefaults.ts");
 
+test("Codex request defaults accept max but leave ultra to the Codex client", () => {
+  assert.equal(normalizeCodexReasoningEffort("max"), "max");
+  assert.equal(normalizeCodexReasoningEffort("ultra"), undefined);
+});
+
 test("buildOpenAIStoreSessionId normalizes external and generated session ids", () => {
   assert.equal(
     buildOpenAIStoreSessionId("ext:client session/abc"),
diff --git a/tests/unit/request-log-migration.test.ts b/tests/unit/request-log-migration.test.ts
index c35be628a1..00178b9fc1 100644
--- a/tests/unit/request-log-migration.test.ts
+++ b/tests/unit/request-log-migration.test.ts
@@ -61,7 +61,11 @@ test("archives legacy request log layout into a zip and removes old files", asyn
   const archiveFilename = await migrations.archiveLegacyRequestLogs();
 
   assert.match(archiveFilename || "", /_legacy-request-logs\.zip$/);
-  assert.equal(fs.existsSync(LEGACY_LOGS_DIR), false);
+  // DATA_DIR/logs itself is preserved (not recursively removed) because it is shared
+  // with the live app logger's own logs/application subdirectory since #6234 — only the
+  // individual legacy entries inside it are archived-then-deleted (#6799).
+  assert.equal(fs.existsSync(LEGACY_LOGS_DIR), true);
+  assert.equal(fs.existsSync(path.join(LEGACY_LOGS_DIR, "session-a")), false);
   assert.equal(fs.existsSync(LEGACY_CALL_LOGS_DIR), false);
   assert.equal(fs.existsSync(LEGACY_SUMMARY_FILE), false);
   assert.equal(fs.existsSync(MARKER_PATH), true);
diff --git a/tests/unit/rerank-openrouter-6574.test.ts b/tests/unit/rerank-openrouter-6574.test.ts
new file mode 100644
index 0000000000..55128b1ad6
--- /dev/null
+++ b/tests/unit/rerank-openrouter-6574.test.ts
@@ -0,0 +1,32 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { parseRerankModel, getRerankProvider, getAllRerankModels } = await import(
+  "../../open-sse/config/rerankRegistry.ts"
+);
+
+// #6574 — OpenRouter now exposes a Cohere-compatible /api/v1/rerank endpoint
+// (confirmed live: openrouter.ai/cohere/rerank-4-pro, model ids stay
+// fully-qualified "cohere/rerank-4-pro"), but RERANK_PROVIDERS has no
+// "openrouter" entry at all. Same failure class as #5332 (siliconflow/deepinfra):
+// parseRerankModel() can't resolve a provider for a 3-segment id when the
+// provider itself isn't registered, so /v1/rerank falls through straight to
+// the generic "Invalid rerank model" 400 without ever calling upstream.
+test("#6574 parseRerankModel resolves openrouter multi-slash rerank model id", () => {
+  assert.deepEqual(parseRerankModel("openrouter/cohere/rerank-4-pro"), {
+    provider: "openrouter",
+    model: "cohere/rerank-4-pro",
+  });
+});
+
+test("#6574 getRerankProvider('openrouter') returns a provider config", () => {
+  assert.ok(getRerankProvider("openrouter"), "openrouter should be a registered rerank provider");
+});
+
+test("#6574 getAllRerankModels lists openrouter reranker models", () => {
+  const ids = getAllRerankModels().map((m) => m.id);
+  assert.ok(
+    ids.includes("openrouter/cohere/rerank-4-pro"),
+    `expected openrouter/cohere/rerank-4-pro in ${JSON.stringify(ids)}`
+  );
+});
diff --git a/tests/unit/responses-commentary-event-frame-6561.test.ts b/tests/unit/responses-commentary-event-frame-6561.test.ts
new file mode 100644
index 0000000000..99fcfeee7b
--- /dev/null
+++ b/tests/unit/responses-commentary-event-frame-6561.test.ts
@@ -0,0 +1,170 @@
+/**
+ * Regression test for #6561 (follow-up to #6199 / #6232).
+ *
+ * The upstream Responses-compatible SSE stream is a real `event: <type>\ndata:
+ * <json>\n\n` frame, not a bare `data:` line. The passthrough loop in
+ * open-sse/utils/stream.ts buffers the `event:` line into
+ * `passthroughEventPrefix` (via `.remember()`) and only clears/prefixes it when
+ * a `data:` line is actually forwarded (`prefixData()`/`clearPendingPassthroughEvent()`).
+ *
+ * The #6199 commentary-drop `continue;` branches (stream.ts ~1337 / ~1351) never
+ * called `clearPendingPassthroughEvent()` before skipping the `data:` line. So the
+ * buffered `event:` line survived and got flushed alone on the next blank line
+ * (stream.ts ~1200-1207), producing an event-only SSE frame with NO `data:` line
+ * — which is exactly what the OpenAI Python SDK chokes on (`json.loads("")`).
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-commentary-6561-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+const core = await import("../../src/lib/db/core.ts");
+
+const { createSSEStream } = await import("../../open-sse/utils/stream.ts");
+
+const textEncoder = new TextEncoder();
+
+async function readTransformed(chunks: string[], options: object): Promise<string> {
+  const source = new ReadableStream({
+    start(controller) {
+      for (const chunk of chunks) {
+        controller.enqueue(textEncoder.encode(chunk));
+      }
+      controller.close();
+    },
+  });
+  return new Response(source.pipeThrough(createSSEStream(options))).text();
+}
+
+test.after(() => {
+  core.resetDbInstance();
+  if (fs.existsSync(TEST_DATA_DIR)) {
+    fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  }
+});
+
+const COMMENTARY_TEXT = "internal chain-of-thought commentary that must stay hidden";
+const FINAL_TEXT = "The final answer visible to the user.";
+
+// Real upstream frames carry BOTH an `event:` line and a `data:` line, unlike
+// the #6199 regression test's bare `data:`-only helper.
+function sseFrame(eventType: string, payload: object): string {
+  return `event: ${eventType}\ndata: ${JSON.stringify(payload)}\n\n`;
+}
+
+function buildResponsesStreamWithEventLines(): string[] {
+  return [
+    sseFrame("response.created", {
+      type: "response.created",
+      response: { id: "resp_6561", output: [] },
+    }),
+    // --- commentary item (internal, must be dropped when filtering) ---
+    sseFrame("response.output_item.added", {
+      type: "response.output_item.added",
+      output_index: 0,
+      item: {
+        id: "msg_commentary",
+        type: "message",
+        role: "assistant",
+        phase: "commentary",
+        content: [],
+      },
+    }),
+    sseFrame("response.content_part.added", {
+      type: "response.content_part.added",
+      output_index: 0,
+      item_id: "msg_commentary",
+      content_index: 0,
+      part: { type: "output_text", text: "" },
+    }),
+    sseFrame("response.output_text.delta", {
+      type: "response.output_text.delta",
+      output_index: 0,
+      item_id: "msg_commentary",
+      content_index: 0,
+      delta: COMMENTARY_TEXT,
+    }),
+    sseFrame("response.output_text.done", {
+      type: "response.output_text.done",
+      output_index: 0,
+      item_id: "msg_commentary",
+      content_index: 0,
+      text: COMMENTARY_TEXT,
+    }),
+    sseFrame("response.output_item.done", {
+      type: "response.output_item.done",
+      output_index: 0,
+      item: {
+        id: "msg_commentary",
+        type: "message",
+        role: "assistant",
+        phase: "commentary",
+        content: [{ type: "output_text", text: COMMENTARY_TEXT }],
+      },
+    }),
+    // --- final answer item (must always be forwarded) ---
+    sseFrame("response.output_item.added", {
+      type: "response.output_item.added",
+      output_index: 1,
+      item: {
+        id: "msg_final",
+        type: "message",
+        role: "assistant",
+        phase: "final",
+        content: [],
+      },
+    }),
+    sseFrame("response.output_text.delta", {
+      type: "response.output_text.delta",
+      output_index: 1,
+      item_id: "msg_final",
+      content_index: 0,
+      delta: FINAL_TEXT,
+    }),
+    sseFrame("response.output_item.done", {
+      type: "response.output_item.done",
+      output_index: 1,
+      item: {
+        id: "msg_final",
+        type: "message",
+        role: "assistant",
+        phase: "final",
+        content: [{ type: "output_text", text: FINAL_TEXT }],
+      },
+    }),
+  ];
+}
+
+const PASSTHROUGH_RESPONSES_OPTIONS = {
+  mode: "passthrough",
+  provider: "openai",
+  clientResponseFormat: "openai-responses",
+};
+
+test("#6561: dropping commentary via event+data frames must not leave event-only frames", async () => {
+  const output = await readTransformed(buildResponsesStreamWithEventLines(), {
+    ...PASSTHROUGH_RESPONSES_OPTIONS,
+    dropResponsesCommentary: true,
+  });
+
+  // Sanity: the original #6199 leak is indeed fixed — no commentary text leaks.
+  assert.ok(!output.includes(COMMENTARY_TEXT), "commentary text must not leak");
+
+  // Split the raw SSE text into frames (separated by a blank line) and find any
+  // frame that has an `event:` line but NO `data:` line — that is the bug.
+  const frames = output.split("\n\n").filter((f) => f.trim().length > 0);
+  const eventOnlyFrames = frames.filter((f) => /^event:/m.test(f) && !/^data:/m.test(f));
+
+  assert.deepEqual(
+    eventOnlyFrames,
+    [],
+    `expected no event-only (data-less) SSE frames, got:\n${JSON.stringify(eventOnlyFrames, null, 2)}`
+  );
+
+  // The final answer must still be forwarded correctly with its data line intact.
+  assert.ok(output.includes(FINAL_TEXT), "final answer text must be forwarded");
+});
diff --git a/tests/unit/responses-translation-fixes.test.ts b/tests/unit/responses-translation-fixes.test.ts
index 61cf4b23f1..2cffb53ff2 100644
--- a/tests/unit/responses-translation-fixes.test.ts
+++ b/tests/unit/responses-translation-fixes.test.ts
@@ -126,6 +126,60 @@ test("Codex Responses input: null input normalizes to an empty list (not [null])
   assert.deepEqual(body.input, []);
 });
 
+test("Codex Responses input: assistant history normalized to output_text (OpenAI/Codex rejects input_text on assistant turns)", () => {
+  const body: Record<string, unknown> = {
+    input: [
+      {
+        type: "message",
+        role: "assistant",
+        content: [
+          {
+            type: "input_text",
+            text: "Previous assistant answer",
+            annotations: [{ type: "url_citation", url: "https://example.com" }],
+            logprobs: [{ token: "Previous" }],
+            obfuscation: "opaque",
+          },
+          { type: "scoped_content", scope: "internal", content: "Preserve me" },
+        ],
+      },
+      {
+        type: "message",
+        role: "user",
+        content: [
+          { type: "input_image", image_url: "https://example.com/image.png", detail: "high" },
+          { type: "input_file", file_id: "file_123" },
+        ],
+      },
+      { type: "function_call", call_id: "call_123", name: "lookup", arguments: "{}" },
+      { type: "function_call_output", call_id: "call_123", output: "done" },
+    ],
+  };
+
+  normalizeCodexResponsesInput(body);
+
+  assert.deepEqual(body.input, [
+    {
+      type: "message",
+      role: "assistant",
+      content: [
+        { type: "output_text", text: "Previous assistant answer" },
+        { type: "scoped_content", scope: "internal", content: "Preserve me" },
+      ],
+    },
+    {
+      type: "message",
+      role: "user",
+      content: [
+        { type: "input_image", image_url: "https://example.com/image.png", detail: "high" },
+        { type: "input_file", file_id: "file_123" },
+      ],
+    },
+    { type: "function_call", call_id: "call_123", name: "lookup", arguments: "{}" },
+    { type: "function_call_output", call_id: "call_123", output: "done" },
+  ]);
+});
+
 test("Responses→Chat: null input normalizes to an empty list (not [null])", () => {
   assert.deepEqual(normalizeResponsesInputForChat(null), []);
 });
@@ -458,7 +512,10 @@ test("Chat→Responses streaming: completed event includes accumulated output",
 
   // Finish
   const finishChunk = { choices: [{ index: 0, delta: {}, finish_reason: "stop" }] };
-  const events = openaiToOpenAIResponsesResponse(finishChunk, state);
+  openaiToOpenAIResponsesResponse(finishChunk, state);
+  // #6906: no usage was ever sent for this stream, so response.completed is deferred
+  // until the stream-end flush (no trailing usage-only chunk will ever arrive).
+  const events = openaiToOpenAIResponsesResponse(null, state);
   const completedEvent = events.find((e) => e.event === "response.completed");
   assert.ok(completedEvent.data.response.output, "completed should have output");
   assert.ok(completedEvent.data.response.output.length > 0, "output should not be empty");
diff --git a/tests/unit/responses-usage-trailing-6906.test.ts b/tests/unit/responses-usage-trailing-6906.test.ts
new file mode 100644
index 0000000000..5bf66b0cb4
--- /dev/null
+++ b/tests/unit/responses-usage-trailing-6906.test.ts
@@ -0,0 +1,133 @@
+// Regression guard for #6906: response.completed must carry usage even when
+// the upstream sends a trailing usage-only chunk AFTER the finish_reason chunk
+// (the real-world OpenAI-compatible `stream_options.include_usage: true` order).
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { openaiToOpenAIResponsesResponse } from "../../open-sse/translator/response/openai-responses.ts";
+import { initState } from "../../open-sse/translator/index.ts";
+import { FORMATS } from "../../open-sse/translator/formats.ts";
+import { createResponsesApiTransformStream } from "../../open-sse/transformer/responsesTransformer.ts";
+
+function collectLiveTranslatorEvents(chunks) {
+  const state = initState(FORMATS.OPENAI_RESPONSES);
+  const events = [];
+  for (const chunk of chunks) {
+    const result = openaiToOpenAIResponsesResponse(chunk, state);
+    if (result) events.push(...result);
+  }
+  return events;
+}
+
+test("BUG #6906: live translator — response.completed carries usage when the usage-only chunk arrives AFTER finish_reason", () => {
+  const events = collectLiveTranslatorEvents([
+    {
+      id: "chatcmpl-1",
+      model: "gpt-4.1",
+      choices: [{ index: 0, delta: { content: "Hello" }, finish_reason: null }],
+    },
+    // finish_reason chunk arrives BEFORE the usage-only chunk (real-world order)
+    {
+      id: "chatcmpl-1",
+      model: "gpt-4.1",
+      choices: [{ index: 0, delta: {}, finish_reason: "stop" }],
+      usage: null,
+    },
+    // trailing usage-only chunk per stream_options.include_usage=true semantics
+    {
+      id: "chatcmpl-1",
+      model: "gpt-4.1",
+      choices: [],
+      usage: { prompt_tokens: 2249, completion_tokens: 123, total_tokens: 2372 },
+    },
+  ]);
+
+  const completedEvent = events.find((event) => event.event === "response.completed");
+  assert.ok(completedEvent, "response.completed event should be emitted");
+  assert.deepEqual(
+    completedEvent.data.response.usage,
+    { input_tokens: 2249, output_tokens: 123, total_tokens: 2372 },
+    "response.completed must carry usage even when the usage-only chunk trails finish_reason"
+  );
+});
+
+test("BUG #6906 (flush fallback): live translator still emits response.completed on stream end when no trailing usage chunk ever arrives", () => {
+  const state = initState(FORMATS.OPENAI_RESPONSES);
+  const events = [];
+  const chunks = [
+    {
+      id: "chatcmpl-2",
+      model: "gpt-4.1",
+      choices: [{ index: 0, delta: { content: "Hi" }, finish_reason: null }],
+    },
+    {
+      id: "chatcmpl-2",
+      model: "gpt-4.1",
+      choices: [{ index: 0, delta: {}, finish_reason: "stop" }],
+    },
+  ];
+  for (const chunk of chunks) {
+    const result = openaiToOpenAIResponsesResponse(chunk, state);
+    if (result) events.push(...result);
+  }
+  // stream end (flush)
+  const flushed = openaiToOpenAIResponsesResponse(null, state);
+  if (flushed) events.push(...flushed);
+
+  const completedEvent = events.find((event) => event.event === "response.completed");
+  assert.ok(completedEvent, "response.completed event should be emitted on flush");
+});
+
+test("BUG #6906: legacy transformer — response.completed carries usage when the usage-only chunk arrives AFTER finish_reason", async () => {
+  const chunks = [
+    {
+      id: "chatcmpl-3",
+      model: "gpt-4.1",
+      choices: [{ index: 0, delta: { content: "Hello" }, finish_reason: null }],
+    },
+    {
+      id: "chatcmpl-3",
+      model: "gpt-4.1",
+      choices: [{ index: 0, delta: {}, finish_reason: "stop" }],
+      usage: null,
+    },
+    {
+      id: "chatcmpl-3",
+      model: "gpt-4.1",
+      choices: [],
+      usage: { prompt_tokens: 55, completion_tokens: 11, total_tokens: 66 },
+    },
+  ];
+
+  const encoder = new TextEncoder();
+  const decoder = new TextDecoder();
+  const readable = new ReadableStream({
+    start(controller) {
+      for (const chunk of chunks) {
+        controller.enqueue(encoder.encode(`data: ${JSON.stringify(chunk)}\n\n`));
+      }
+      controller.enqueue(encoder.encode("data: [DONE]\n\n"));
+      controller.close();
+    },
+  });
+
+  const transformed = readable.pipeThrough(createResponsesApiTransformStream(null, 60000));
+  const reader = transformed.getReader();
+  let full = "";
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    full += decoder.decode(value, { stream: true });
+  }
+
+  // Events are emitted as `event: <type>\ndata: <json>\n\n` blocks.
+  const blocks = full.split("\n\n").filter((block) => block.includes("event: response.completed"));
+  assert.ok(blocks.length > 0, "response.completed event should be emitted");
+  const dataLine = blocks[0].split("\n").find((line) => line.startsWith("data:"));
+  const payload = JSON.parse(dataLine.replace(/^data:\s*/, ""));
+  assert.deepEqual(
+    payload.response.usage,
+    { prompt_tokens: 55, completion_tokens: 11, total_tokens: 66 },
+    "legacy transformer response.completed must carry usage even when the usage-only chunk trails finish_reason"
+  );
+});
diff --git a/tests/unit/rotation-config-omniroute.test.ts b/tests/unit/rotation-config-omniroute.test.ts
new file mode 100644
index 0000000000..0c172b758d
--- /dev/null
+++ b/tests/unit/rotation-config-omniroute.test.ts
@@ -0,0 +1,196 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+// Runtime rotation config (operator-managed, e.g. VibeProxy): env-driven per-status fallback
+// enable, rate-limit cooldown override, per-connection overrides, and a sliding-window
+// threshold counter — with defaults that preserve the engine's historical behavior.
+
+const rc = await import("../../open-sse/services/rotationConfig.ts");
+const { checkFallbackError } = await import("../../open-sse/services/accountFallback.ts");
+
+const ROTATION_ENV_KEYS = [
+  "OMNIROUTE_ROTATION_ENABLED",
+  "OMNIROUTE_ROTATION_RATE_LIMIT_RESET_SECONDS",
+  "OMNIROUTE_ROTATION_DISABLE_TAG_WITHOUT_RESET",
+  "OMNIROUTE_ROTATE_ON_429",
+  "OMNIROUTE_ROTATE_429_THRESHOLD",
+  "OMNIROUTE_ROTATE_429_WINDOW_SECONDS",
+  "OMNIROUTE_ROTATE_ON_500",
+  "OMNIROUTE_ROTATE_500_THRESHOLD",
+  "OMNIROUTE_ROTATE_500_WINDOW_SECONDS",
+  "OMNIROUTE_ROTATE_ON_502",
+  "OMNIROUTE_ROTATE_502_THRESHOLD",
+  "OMNIROUTE_ROTATE_502_WINDOW_SECONDS",
+  "OMNIROUTE_ROTATE_ON_400",
+  "OMNIROUTE_ROTATE_400_THRESHOLD",
+  "OMNIROUTE_ROTATE_400_WINDOW_SECONDS",
+];
+
+function clearEnv() {
+  for (const k of ROTATION_ENV_KEYS) delete process.env[k];
+  rc.resetGlobalRotationConfigForTest();
+}
+
+test("defaults preserve historical behavior (no env set)", () => {
+  clearEnv();
+  const cfg = rc.getGlobalRotationConfig();
+  assert.equal(cfg.enabled, true);
+  assert.equal(cfg.rateLimit429.enabled, true);
+  assert.equal(cfg.serverError500.enabled, true);
+  assert.equal(cfg.badGateway502.enabled, true);
+  assert.equal(cfg.badRequest400.enabled, false); // 400 is opt-in
+  assert.equal(cfg.rateLimit429.threshold, 1); // immediate
+  assert.equal(rc.rateLimitCooldownOverrideMs(cfg), null); // no override => engine default
+  clearEnv();
+});
+
+test("env parse: disable 502, enable 400, set reset seconds + thresholds", () => {
+  clearEnv();
+  process.env.OMNIROUTE_ROTATE_ON_502 = "false";
+  process.env.OMNIROUTE_ROTATE_ON_400 = "true";
+  process.env.OMNIROUTE_ROTATION_RATE_LIMIT_RESET_SECONDS = "10";
+  process.env.OMNIROUTE_ROTATE_429_THRESHOLD = "6";
+  process.env.OMNIROUTE_ROTATE_429_WINDOW_SECONDS = "120";
+  rc.resetGlobalRotationConfigForTest();
+
+  const cfg = rc.getGlobalRotationConfig();
+  assert.equal(cfg.badGateway502.enabled, false);
+  assert.equal(cfg.badRequest400.enabled, true);
+  assert.equal(rc.rateLimitCooldownOverrideMs(cfg), 10_000);
+  assert.equal(cfg.rateLimit429.threshold, 6);
+  assert.equal(cfg.rateLimit429.windowMs, 120_000);
+  clearEnv();
+});
+
+test("isFallbackBlockedForStatus: restrictive for 429/500/502, never for 400/ungated", () => {
+  clearEnv();
+  process.env.OMNIROUTE_ROTATE_ON_502 = "false";
+  rc.resetGlobalRotationConfigForTest();
+  const cfg = rc.getGlobalRotationConfig();
+
+  assert.equal(rc.isFallbackBlockedForStatus(502, cfg), true); // disabled => blocked
+  assert.equal(rc.isFallbackBlockedForStatus(429, cfg), false); // enabled default
+  assert.equal(rc.isFallbackBlockedForStatus(500, cfg), false);
+  assert.equal(rc.isFallbackBlockedForStatus(400, cfg), false); // additive, never blocked
+  assert.equal(rc.isFallbackBlockedForStatus(401, cfg), false); // ungated
+  clearEnv();
+});
+
+test("shouldForceFallbackFor400 only when opted in", () => {
+  clearEnv();
+  let cfg = rc.getGlobalRotationConfig();
+  assert.equal(rc.shouldForceFallbackFor400(400, cfg), false); // default off
+
+  process.env.OMNIROUTE_ROTATE_ON_400 = "true";
+  rc.resetGlobalRotationConfigForTest();
+  cfg = rc.getGlobalRotationConfig();
+  assert.equal(rc.shouldForceFallbackFor400(400, cfg), true);
+  assert.equal(rc.shouldForceFallbackFor400(429, cfg), false); // not a 400
+  clearEnv();
+});
+
+test("resolveRotationConfig merges per-connection overrides over global", () => {
+  clearEnv();
+  process.env.OMNIROUTE_ROTATE_429_THRESHOLD = "6";
+  rc.resetGlobalRotationConfigForTest();
+
+  const merged = rc.resolveRotationConfig({
+    rotateOn429: false,
+    error429Threshold: 3,
+    rateLimitResetSeconds: 20,
+  });
+  assert.equal(merged.rateLimit429.enabled, false); // overridden
+  assert.equal(merged.rateLimit429.threshold, 3); // overridden (not the global 6)
+  assert.equal(merged.rateLimitResetMs, 20_000); // overridden
+  assert.equal(merged.serverError500.enabled, true); // inherited
+  clearEnv();
+});
+
+test("recordErrorAndCheckThreshold: sliding window reaches threshold then resets", () => {
+  clearEnv();
+  process.env.OMNIROUTE_ROTATE_429_THRESHOLD = "3";
+  process.env.OMNIROUTE_ROTATE_429_WINDOW_SECONDS = "60";
+  rc.resetGlobalRotationConfigForTest();
+  const cfg = rc.getGlobalRotationConfig();
+
+  const t0 = 1_000_000;
+  assert.equal(rc.recordErrorAndCheckThreshold("conn-a", 429, cfg, t0), false); // 1
+  assert.equal(rc.recordErrorAndCheckThreshold("conn-a", 429, cfg, t0 + 1000), false); // 2
+  assert.equal(rc.recordErrorAndCheckThreshold("conn-a", 429, cfg, t0 + 2000), true); // 3 => rotate
+  // Counter reset after threshold — next error starts a fresh window.
+  assert.equal(rc.recordErrorAndCheckThreshold("conn-a", 429, cfg, t0 + 3000), false);
+  clearEnv();
+});
+
+test("recordErrorAndCheckThreshold: errors outside the window do not accumulate", () => {
+  clearEnv();
+  process.env.OMNIROUTE_ROTATE_500_THRESHOLD = "3";
+  process.env.OMNIROUTE_ROTATE_500_WINDOW_SECONDS = "60";
+  rc.resetGlobalRotationConfigForTest();
+  const cfg = rc.getGlobalRotationConfig();
+
+  const t0 = 2_000_000;
+  assert.equal(rc.recordErrorAndCheckThreshold("conn-b", 500, cfg, t0), false); // 1
+  // 2 minutes later — the first error has fallen out of the 60s window.
+  assert.equal(rc.recordErrorAndCheckThreshold("conn-b", 500, cfg, t0 + 120_000), false); // still 1
+  clearEnv();
+});
+
+test("recordErrorAndCheckThreshold: threshold 1 (default) => immediate rotate", () => {
+  clearEnv();
+  const cfg = rc.getGlobalRotationConfig();
+  assert.equal(rc.recordErrorAndCheckThreshold("conn-c", 429, cfg, 1), true);
+  clearEnv();
+});
+
+test("integration: OMNIROUTE_ROTATE_ON_502=false blocks 502 fallback in checkFallbackError", () => {
+  clearEnv();
+  process.env.OMNIROUTE_ROTATE_ON_502 = "false";
+  rc.resetGlobalRotationConfigForTest();
+
+  const blocked = checkFallbackError(502, "bad gateway", 0, null, "openai");
+  assert.equal(blocked.shouldFallback, false);
+  clearEnv();
+
+  // With default config, a 502 still falls over (historical behavior).
+  const dflt = checkFallbackError(502, "bad gateway", 0, null, "openai");
+  assert.equal(dflt.shouldFallback, true);
+  clearEnv();
+});
+
+test("integration: 400 with rate-limit text still falls over under default config (#4976 preserved)", () => {
+  clearEnv();
+  const res = checkFallbackError(
+    400,
+    "Detected high-frequency non-compliant requests from you.",
+    0,
+    null,
+    "mimocode"
+  );
+  assert.equal(res.shouldFallback, true);
+  clearEnv();
+});
+
+test("integration: plain 400 does not fall over by default, but does when opted in", () => {
+  clearEnv();
+  const dflt = checkFallbackError(400, "Invalid JSON: unexpected token", 0, null, "openai");
+  assert.equal(dflt.shouldFallback, false);
+  clearEnv();
+
+  process.env.OMNIROUTE_ROTATE_ON_400 = "true";
+  rc.resetGlobalRotationConfigForTest();
+  const opted = checkFallbackError(400, "Invalid JSON: unexpected token", 0, null, "openai");
+  assert.equal(opted.shouldFallback, true);
+  clearEnv();
+});
+
+test("integration: rate-limit cooldown override applies to a 429 with no upstream hint", () => {
+  clearEnv();
+  process.env.OMNIROUTE_ROTATION_RATE_LIMIT_RESET_SECONDS = "10";
+  rc.resetGlobalRotationConfigForTest();
+
+  const res = checkFallbackError(429, "rate limit", 0, null, "openai");
+  assert.equal(res.shouldFallback, true);
+  assert.equal(res.cooldownMs, 10_000);
+  clearEnv();
+});
diff --git a/tests/unit/route-guard-middleware-local-only.test.ts b/tests/unit/route-guard-middleware-local-only.test.ts
new file mode 100644
index 0000000000..3a4b394a7f
--- /dev/null
+++ b/tests/unit/route-guard-middleware-local-only.test.ts
@@ -0,0 +1,31 @@
+/**
+ * Security regression: /api/middleware/* routes must be classified as LOCAL_ONLY
+ * so loopback enforcement runs unconditionally before any auth check.
+ *
+ * Middleware hooks compile + run arbitrary JS via `new vm.Script` on the request
+ * hot path (src/lib/middleware/registry.ts) — the same remote-code-execution class
+ * as /api/plugins/* (which is already LOCAL_ONLY). A leaked JWT over a
+ * Cloudflared/Ngrok tunnel must not be able to install or trigger a middleware
+ * hook. Hard Rules #15 + #17. See docs/security/ROUTE_GUARD_TIERS.md.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { isLocalOnlyPath } from "../../src/server/authz/routeGuard.ts";
+
+test("/api/middleware/ prefix (trailing slash) is LOCAL_ONLY", () => {
+  assert.equal(isLocalOnlyPath("/api/middleware/"), true);
+});
+
+test("/api/middleware/hooks is LOCAL_ONLY (list + install compile arbitrary JS)", () => {
+  assert.equal(isLocalOnlyPath("/api/middleware/hooks"), true);
+});
+
+test("/api/middleware/hooks/[name] is LOCAL_ONLY (compile + run via vm.Script)", () => {
+  assert.equal(isLocalOnlyPath("/api/middleware/hooks/my-hook"), true);
+});
+
+test("non-middleware paths are NOT LOCAL_ONLY (no over-match)", () => {
+  assert.equal(isLocalOnlyPath("/api/combos"), false);
+  assert.equal(isLocalOnlyPath("/api/providers"), false);
+  assert.equal(isLocalOnlyPath("/api/keys"), false);
+});
diff --git a/tests/unit/rtk-enable-renderers-6703.test.ts b/tests/unit/rtk-enable-renderers-6703.test.ts
new file mode 100644
index 0000000000..9674369a13
--- /dev/null
+++ b/tests/unit/rtk-enable-renderers-6703.test.ts
@@ -0,0 +1,41 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  rtkConfigSchema,
+  compressionSettingsUpdateSchema,
+} from "../../src/shared/validation/compressionConfigSchemas.ts";
+import { DEFAULT_RTK_CONFIG } from "../../open-sse/services/compression/types.ts";
+
+// Regression for #6703: rtkConfigSchema uses Zod .strict() but was missing the
+// `enableRenderers` field that DEFAULT_RTK_CONFIG (and the RTK engine's own
+// configSchema) already define. The frontend reads DEFAULT_RTK_CONFIG (which
+// carries enableRenderers), sends the full object back on save, and .strict()
+// rejects the unknown key → HTTP 400 "Unrecognized key: enableRenderers".
+// This broke PUT /api/settings/compression, POST /api/context/rtk/test, and
+// PUT /api/context/rtk/config.
+
+describe("RTK config schema — enableRenderers (#6703)", () => {
+  it("accepts enableRenderers on the strict rtkConfigSchema", () => {
+    assert.equal(rtkConfigSchema.safeParse({ enableRenderers: false }).success, true);
+    assert.equal(rtkConfigSchema.safeParse({ enableRenderers: true }).success, true);
+  });
+
+  it("accepts the full DEFAULT_RTK_CONFIG without stripping fields", () => {
+    const result = rtkConfigSchema.safeParse(DEFAULT_RTK_CONFIG);
+    assert.equal(result.success, true, JSON.stringify(result.error?.issues));
+    assert.equal(result.data.enableRenderers, false);
+  });
+
+  it("rejects a genuinely unknown key (strict mode still enforced)", () => {
+    assert.equal(rtkConfigSchema.safeParse({ totallyBogusKey: true }).success, false);
+  });
+
+  it("accepts rtkConfig with enableRenderers through the settings-update schema", () => {
+    // Mirrors the PUT /api/settings/compression payload from the bug report.
+    const result = compressionSettingsUpdateSchema.safeParse({
+      rtkConfig: { ...DEFAULT_RTK_CONFIG, enableRenderers: false },
+    });
+    assert.equal(result.success, true, JSON.stringify(result.error?.issues));
+  });
+});
diff --git a/tests/unit/rule12-error-sanitization-sweep.test.ts b/tests/unit/rule12-error-sanitization-sweep.test.ts
new file mode 100644
index 0000000000..400bb68b9b
--- /dev/null
+++ b/tests/unit/rule12-error-sanitization-sweep.test.ts
@@ -0,0 +1,149 @@
+/**
+ * Rule #12 regression sweep — HTTP error bodies must route through
+ * sanitizeErrorMessage() so raw stack traces / absolute source paths never leak.
+ *
+ * This covers routes fixed in the fix/rule12-error-sanitization-sweep PR. It drives
+ * the real route handlers (fresh temp DATA_DIR, localhost request → auth disabled by
+ * default, matching the tests/unit/obsidian-webdav-route.test.ts pattern) and forces
+ * the DB layer to throw an Error whose message embeds an absolute source path + a
+ * stack tail. The assertion is behavioral: the emitted body must NOT contain the raw
+ * path and must NOT match /at \/|[A-Za-z]:\\/ — i.e. it is the sanitized form.
+ *
+ * mock.module() is unavailable in this tsx/ESM + Node setup (see
+ * tests/unit/proxyfetch-undici-retry.test.ts), so we monkeypatch the shared DB
+ * singleton returned by getDbInstance() and restore it after each test.
+ */
+
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import type { NextRequest } from "next/server";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omni-rule12-sweep-"));
+const ORIGINAL_DATA_DIR = process.env.DATA_DIR;
+
+// Set DATA_DIR before importing anything that touches the DB.
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const compressionRoute = await import("../../src/app/api/settings/compression/route.ts");
+const cacheEntriesRoute = await import("../../src/app/api/cache/entries/route.ts");
+const dbHealthRoute = await import("../../src/app/api/db/health/route.ts");
+const { sanitizeErrorMessage } = await import("../../open-sse/utils/error.ts");
+
+// An error message carrying BOTH a first-line absolute source path (must be
+// replaced with <path>) and a multi-line stack tail (must be truncated away).
+const LEAK_PATH_POSIX = "/home/omni/secret/config.ts";
+const LEAK_PATH_WIN = "C:\\Users\\secret\\app.ts";
+function makeLeakyError(): Error {
+  const err = new Error(
+    `SqliteError: disk I/O error while opening ${LEAK_PATH_POSIX}:42\n` +
+      `    at Database.prepare (${LEAK_PATH_WIN}:10:5)\n` +
+      `    at listEntries (/opt/omniroute/src/lib/db/x.ts:88:12)`
+  );
+  return err;
+}
+
+function makeRequest(url: string, options?: RequestInit): NextRequest {
+  return new Request(url, options) as unknown as NextRequest;
+}
+
+// Sanity: the sanitizer really does strip these leaks (guards the test itself —
+// if sanitizeErrorMessage regressed, this fails first).
+test("sanitizeErrorMessage strips absolute paths + stack tail (self-check)", () => {
+  const out = sanitizeErrorMessage(String(makeLeakyError()));
+  assert.ok(!out.includes("/home/omni/secret"), "posix path leaked");
+  assert.ok(!out.includes("C:\\Users\\secret"), "windows path leaked");
+  assert.ok(!/\bat\s+\//.test(out), "stack frame leaked");
+  assert.ok(out.includes("<path>"), "path token should be replaced");
+});
+
+// Wrap the shared DB singleton's `prepare` so any statement whose SQL matches
+// `sqlMatch` throws our leaky error; everything else (auth's getSettings, etc.)
+// keeps working. Returns a restore fn.
+function patchPrepareToThrow(sqlMatch: string): () => void {
+  const db = core.getDbInstance();
+  const orig = db.prepare.bind(db);
+  (db as unknown as { prepare: unknown }).prepare = (sql: string, ...rest: unknown[]) => {
+    if (typeof sql === "string" && sql.includes(sqlMatch)) {
+      throw makeLeakyError();
+    }
+    return orig(sql, ...(rest as []));
+  };
+  return () => {
+    (db as unknown as { prepare: unknown }).prepare = orig;
+  };
+}
+
+function patchPragmaToThrow(): () => void {
+  const db = core.getDbInstance();
+  const orig = db.pragma.bind(db);
+  (db as unknown as { pragma: unknown }).pragma = () => {
+    throw makeLeakyError();
+  };
+  return () => {
+    (db as unknown as { pragma: unknown }).pragma = orig;
+  };
+}
+
+// A leak assertion applied to any string field of an error body.
+function assertSanitized(raw: string, context: string): void {
+  assert.ok(!raw.includes("/home/omni/secret"), `${context}: posix path leaked → ${raw}`);
+  assert.ok(!raw.includes("C:\\Users\\secret"), `${context}: windows path leaked → ${raw}`);
+  assert.ok(!raw.includes("/opt/omniroute"), `${context}: stack path leaked → ${raw}`);
+  // The task's contract: body must not contain a leading absolute-path frame.
+  assert.ok(!/at \/|[A-Za-z]:\\/.test(raw), `${context}: matched /at \\/|[A-Za-z]:\\\\/ → ${raw}`);
+}
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  if (ORIGINAL_DATA_DIR === undefined) {
+    delete process.env.DATA_DIR;
+  } else {
+    process.env.DATA_DIR = ORIGINAL_DATA_DIR;
+  }
+});
+
+test("GET /api/settings/compression → 500 body is sanitized (shape { error })", async () => {
+  const restore = patchPrepareToThrow("FROM key_value WHERE namespace = ?");
+  try {
+    const res = await compressionRoute.GET(
+      makeRequest("http://localhost/api/settings/compression")
+    );
+    assert.equal(res.status, 500);
+    const body = (await res.json()) as { error: string };
+    assert.equal(typeof body.error, "string");
+    assertSanitized(body.error, "compression GET");
+  } finally {
+    restore();
+  }
+});
+
+test("GET /api/cache/entries → 500 body is sanitized (shape { error })", async () => {
+  const restore = patchPrepareToThrow("semantic_cache");
+  try {
+    const res = await cacheEntriesRoute.GET(makeRequest("http://localhost/api/cache/entries"));
+    assert.equal(res.status, 500);
+    const body = (await res.json()) as { error: string };
+    assert.equal(typeof body.error, "string");
+    assertSanitized(body.error, "cache/entries GET");
+  } finally {
+    restore();
+  }
+});
+
+test("GET /api/db/health → 500 body is sanitized (shape { error: { message } })", async () => {
+  const restore = patchPragmaToThrow();
+  try {
+    const res = await dbHealthRoute.GET(makeRequest("http://localhost/api/db/health"));
+    assert.equal(res.status, 500);
+    const body = (await res.json()) as { error: { message: string } };
+    assert.equal(typeof body.error.message, "string");
+    assertSanitized(body.error.message, "db/health GET");
+  } finally {
+    restore();
+  }
+});
diff --git a/tests/unit/select-impacted-tests.test.ts b/tests/unit/select-impacted-tests.test.ts
index 88692f0e9f..dd64c55f77 100644
--- a/tests/unit/select-impacted-tests.test.ts
+++ b/tests/unit/select-impacted-tests.test.ts
@@ -60,3 +60,65 @@ test("changed unit test in a curated subdir → run itself", () => {
   const sel = selectImpacted({ changed: ["tests/unit/db/migration.test.ts"], map: MAP });
   assert.deepEqual(sel, ["tests/unit/db/migration.test.ts"]);
 });
+
+// Parity with package.json test:unit braces — memory/usage/combo/serial were missing
+// from UNIT_SUBDIRS and silently failed to self-select.
+test("changed unit test under memory/ → run itself", () => {
+  const sel = selectImpacted({
+    changed: ["tests/unit/memory/store.test.ts"],
+    map: MAP,
+  });
+  assert.deepEqual(sel, ["tests/unit/memory/store.test.ts"]);
+});
+
+test("changed unit test under usage/ → run itself", () => {
+  const sel = selectImpacted({
+    changed: ["tests/unit/usage/quota.test.ts"],
+    map: MAP,
+  });
+  assert.deepEqual(sel, ["tests/unit/usage/quota.test.ts"]);
+});
+
+test("changed unit test under combo/ → run itself", () => {
+  const sel = selectImpacted({
+    changed: ["tests/unit/combo/routing.test.ts"],
+    map: MAP,
+  });
+  assert.deepEqual(sel, ["tests/unit/combo/routing.test.ts"]);
+});
+
+test("changed unit test under serial/ → run itself", () => {
+  const sel = selectImpacted({
+    changed: ["tests/unit/serial/flaky-once.test.ts"],
+    map: MAP,
+  });
+  assert.deepEqual(sel, ["tests/unit/serial/flaky-once.test.ts"]);
+});
+
+test("changed unit .test.mjs → run itself", () => {
+  const sel = selectImpacted({
+    changed: ["tests/unit/example.test.mjs"],
+    map: MAP,
+  });
+  assert.deepEqual(sel, ["tests/unit/example.test.mjs"]);
+});
+
+// package.json: tests/unit/**/*.test.mjs (any depth, not only UNIT_SUBDIRS).
+test("nested .test.mjs outside UNIT_SUBDIRS → run itself", () => {
+  const sel = selectImpacted({
+    changed: ["tests/unit/misc/nested/deep.test.mjs"],
+    map: MAP,
+  });
+  assert.deepEqual(sel, ["tests/unit/misc/nested/deep.test.mjs"]);
+});
+
+// electron/bin are outside the import-graph map roots — must NOT force __RUN_ALL__.
+test("changed electron/ file alone → empty (not unit fail-safe)", () => {
+  const sel = selectImpacted({ changed: ["electron/main.js"], map: MAP });
+  assert.deepEqual(sel, []);
+});
+
+test("changed bin/ file alone → empty (not unit fail-safe)", () => {
+  const sel = selectImpacted({ changed: ["bin/omniroute.js"], map: MAP });
+  assert.deepEqual(sel, []);
+});
diff --git a/tests/unit/sensenova-provider.test.ts b/tests/unit/sensenova-provider.test.ts
new file mode 100644
index 0000000000..b376ec7394
--- /dev/null
+++ b/tests/unit/sensenova-provider.test.ts
@@ -0,0 +1,25 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { PROVIDER_MAX_TOKENS } from "../../open-sse/config/constants.ts";
+import { getModelsByProviderId } from "../../open-sse/config/providerModels.ts";
+
+test("SenseNova Token Plan catalog exposes only supported chat models with 64K output", () => {
+  const models = getModelsByProviderId("sensenova");
+  const ids = new Set(models.map((model) => model.id));
+
+  assert.ok(ids.has("sensenova-6.7-flash-lite"));
+  assert.ok(ids.has("deepseek-v4-flash"));
+  assert.ok(ids.has("glm-5.2"));
+  assert.equal(ids.has("sensenova-u1-fast"), false, "U1 Fast is not a chat-completions model");
+
+  for (const model of models) {
+    assert.equal(
+      model.maxOutputTokens,
+      65536,
+      `${model.id} should use Token Plan's 64K output cap`
+    );
+  }
+
+  assert.equal(PROVIDER_MAX_TOKENS.sensenova, 65536);
+});
diff --git a/tests/unit/serial/combo-quota-share-cooldown-wait-timing.test.ts b/tests/unit/serial/combo-quota-share-cooldown-wait-timing.test.ts
new file mode 100644
index 0000000000..536bf8c038
--- /dev/null
+++ b/tests/unit/serial/combo-quota-share-cooldown-wait-timing.test.ts
@@ -0,0 +1,153 @@
+/**
+ * tests/unit/serial/combo-quota-share-cooldown-wait-timing.test.ts
+ *
+ * Extracted from tests/unit/combo-quota-share-cooldown-wait.test.ts (#6803).
+ *
+ * These two scenarios assert a wall-clock ceiling (`elapsed < 1500`) around a
+ * handleComboChat() call that also performs real SQLite I/O (test.beforeEach
+ * does fs.rmSync+fs.mkdirSync + core.resetDbInstance()). Under CI-runner
+ * CPU/IO contention (multiple concurrent sibling shard jobs) this ceiling can
+ * be exceeded even though the functional behavior (no wait, single dispatch)
+ * is correct — this is a "did NOT wait out a cooldown" ceiling, not a
+ * behavior-under-test assertion, so it is timing-sensitive by nature.
+ *
+ * Running these in tests/unit/serial/ (--test-concurrency=1, see
+ * package.json's test:unit:serial) removes the intra-suite parallelism that
+ * was the dominant source of contention, matching the repo's established
+ * remedy pattern for this class of test.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omr-combo-cooldown-wait-timing-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = "test-combo-cooldown-wait-timing-secret";
+
+const core = await import("../../../src/lib/db/core.ts");
+const { handleComboChat } = await import("../../../open-sse/services/combo.ts");
+const { clearAllModelLockouts } = await import("../../../open-sse/services/accountFallback.ts");
+
+function createLog() {
+  return { info: () => {}, warn: () => {}, error: () => {}, debug: () => {} };
+}
+
+const BASE_COOLDOWN_MS = 150;
+const RETRY_AFTER_MS = 250;
+
+function shortModelLockoutSettings() {
+  return {
+    modelLockout: {
+      enabled: true,
+      errorCodes: [403, 429],
+      baseCooldownMs: BASE_COOLDOWN_MS,
+      maxCooldownMs: 5000,
+      maxBackoffSteps: 0,
+      useExponentialBackoff: false,
+    },
+  };
+}
+
+function jsonResponse(status: number, body: Record<string, unknown>) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+function rateLimitResponse(status: number) {
+  return jsonResponse(status, {
+    error: { message: `rate limited (${status})` },
+    retryAfter: new Date(Date.now() + RETRY_AFTER_MS).toISOString(),
+  });
+}
+
+function comboOf(strategy: string) {
+  return {
+    name: `qtSd/${strategy}-${Math.random().toString(16).slice(2, 8)}`,
+    strategy,
+    models: ["openai/gpt-4"],
+    config: { maxRetries: 0, retryDelayMs: 0, fallbackDelayMs: 0, maxSetRetries: 0 },
+  };
+}
+
+async function resetStorage() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(async () => {
+  clearAllModelLockouts();
+  await resetStorage();
+});
+
+test.after(async () => {
+  clearAllModelLockouts();
+  try {
+    core.resetDbInstance();
+    fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  } catch {
+    /* best effort */
+  }
+});
+
+test("quota-share: 403 quota_exhausted → NO wait, error propagated immediately", async () => {
+  let calls = 0;
+  const handleSingleModel = async () => {
+    calls += 1;
+    return rateLimitResponse(403);
+  };
+
+  const startedAt = Date.now();
+  const res = await handleComboChat({
+    body: { model: "openai/gpt-4" },
+    combo: comboOf("quota-share"),
+    handleSingleModel,
+    isModelAvailable: async () => true,
+    log: createLog() as never,
+    settings: shortModelLockoutSettings(),
+    allCombos: null,
+  });
+  const elapsed = Date.now() - startedAt;
+
+  assert.notEqual(res.status, 200, "quota_exhausted must not be retried into a success");
+  // The real signal that the cooldown wait did NOT fire: a single upstream
+  // dispatch (no redispatch). The 403 lock cooldown is multi-second, so the
+  // wait — had it fired — would dominate the elapsed time; assert we stayed far
+  // below that (loose bound; the first combo dispatch pays DB/import overhead).
+  assert.equal(calls, 1, "quota_exhausted must NOT trigger a wait+redispatch");
+  // Widened from 1500ms (#6803): the primary signal is calls===1 above (no
+  // redispatch happened at all); this ceiling is a secondary sanity check
+  // that we didn't accidentally wait out a real (multi-second-to-hours)
+  // quota_exhausted lock, so a generous bound still catches a real
+  // regression while tolerating CI-runner DB/import contention.
+  assert.ok(elapsed < 10000, `quota_exhausted must not wait out a cooldown, but ${elapsed}ms elapsed`);
+});
+
+test("non quota-share (priority): 429 propagated immediately, NO wait", async () => {
+  let calls = 0;
+  const handleSingleModel = async () => {
+    calls += 1;
+    return rateLimitResponse(429);
+  };
+
+  const startedAt = Date.now();
+  const res = await handleComboChat({
+    body: { model: "openai/gpt-4" },
+    combo: { ...comboOf("priority"), name: "priority-combo" },
+    handleSingleModel,
+    isModelAvailable: async () => true,
+    log: createLog() as never,
+    settings: shortModelLockoutSettings(),
+    allCombos: null,
+  });
+  const elapsed = Date.now() - startedAt;
+
+  assert.equal(res.status, 429, "priority combo must propagate the 429 unchanged");
+  assert.equal(calls, 1, "priority combo must NOT wait+redispatch");
+  // Widened from 1500ms (#6803) — see the sibling test above for rationale.
+  assert.ok(elapsed < 10000, `priority combo must not wait out a cooldown, but ${elapsed}ms elapsed`);
+});
diff --git a/tests/unit/serial/combo-strategy-fallbacks-half-open-timing.test.ts b/tests/unit/serial/combo-strategy-fallbacks-half-open-timing.test.ts
new file mode 100644
index 0000000000..f813779c78
--- /dev/null
+++ b/tests/unit/serial/combo-strategy-fallbacks-half-open-timing.test.ts
@@ -0,0 +1,164 @@
+/**
+ * tests/unit/serial/combo-strategy-fallbacks-half-open-timing.test.ts
+ *
+ * Extracted from tests/unit/combo-strategy-fallbacks.test.ts (#6803).
+ *
+ * This scenario races a real 80ms setTimeout against a 40ms circuit-breaker
+ * resetTimeout before asserting breaker.getStatus().state === 'HALF_OPEN'.
+ * Under a starved event loop (CI-runner CPU contention from concurrent
+ * sibling shard jobs) this timing margin can be missed even though the
+ * lazy-recovery contract (OPEN → HALF_OPEN once the reset timeout elapses) is
+ * implemented correctly.
+ *
+ * Running this in tests/unit/serial/ (--test-concurrency=1, see package.json's
+ * test:unit:serial) removes the intra-suite parallelism that was the dominant
+ * source of contention, matching the repo's established remedy pattern for
+ * this class of test.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-combo-fallbacks-half-open-"));
+const ORIGINAL_DATA_DIR = process.env.DATA_DIR;
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const { handleComboChat } = await import("../../../open-sse/services/combo.ts");
+const core = await import("../../../src/lib/db/core.ts");
+const settingsDb = await import("../../../src/lib/db/settings.ts");
+const { resetAllComboMetrics } = await import("../../../open-sse/services/comboMetrics.ts");
+const { resetAllCircuitBreakers, getCircuitBreaker } =
+  await import("../../../src/shared/utils/circuitBreaker.ts");
+const { resetAll: resetAllSemaphores } =
+  await import("../../../open-sse/services/rateLimitSemaphore.ts");
+const { _resetAllDecks } = await import("../../../src/shared/utils/shuffleDeck.ts");
+const { clearSessions } = await import("../../../open-sse/services/sessionManager.ts");
+
+type LogEntry = { level: string; tag: unknown; msg: unknown };
+
+function createLog() {
+  const entries: LogEntry[] = [];
+  return {
+    info: (tag: unknown, msg: unknown) => entries.push({ level: "info", tag, msg }),
+    warn: (tag: unknown, msg: unknown) => entries.push({ level: "warn", tag, msg }),
+    error: (tag: unknown, msg: unknown) => entries.push({ level: "error", tag, msg }),
+    debug: (tag: unknown, msg: unknown) => entries.push({ level: "debug", tag, msg }),
+    entries,
+  };
+}
+
+function okResponse(body: unknown = { choices: [{ message: { content: "ok" } }] }) {
+  return new Response(JSON.stringify(body), {
+    status: 200,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+async function cleanupTestDataDir() {
+  let lastError: unknown;
+  for (let attempt = 0; attempt < 5; attempt += 1) {
+    try {
+      core.resetDbInstance();
+      fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+      return;
+    } catch (error: unknown) {
+      lastError = error;
+      await new Promise((resolve) => setTimeout(resolve, 25));
+    }
+  }
+  if (lastError) throw lastError;
+}
+
+test.beforeEach(async () => {
+  resetAllComboMetrics();
+  resetAllCircuitBreakers();
+  resetAllSemaphores();
+  _resetAllDecks();
+  clearSessions();
+  await cleanupTestDataDir();
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+  await settingsDb.resetAllPricing();
+  settingsDb.clearAllLKGP();
+});
+
+test.after(async () => {
+  resetAllComboMetrics();
+  resetAllCircuitBreakers();
+  resetAllSemaphores();
+  _resetAllDecks();
+  settingsDb.clearAllLKGP();
+  if (ORIGINAL_DATA_DIR === undefined) {
+    delete process.env.DATA_DIR;
+  } else {
+    process.env.DATA_DIR = ORIGINAL_DATA_DIR;
+  }
+  await cleanupTestDataDir();
+});
+
+test("combo skips a provider while its breaker is OPEN and attempts it again after the reset timeout (HALF_OPEN)", async () => {
+  // Widened from the original 40ms/80ms margin (#6803): under contended
+  // CI-runner load even --test-concurrency=1 doesn't guarantee the "while
+  // OPEN" dispatch completes before a 40ms window elapses. A larger absolute
+  // margin (same ~2x wait:resetTimeout ratio) tolerates real scheduling
+  // jitter while still proving the lazy-recovery contract.
+  const breaker = getCircuitBreaker("openai", { failureThreshold: 1, resetTimeout: 300 });
+  try {
+    await breaker.execute(async () => {
+      throw new Error("simulated provider failure");
+    });
+  } catch {
+    // expected — trips the breaker OPEN
+  }
+  assert.equal(breaker.getStatus().state, "OPEN");
+
+  const comboDef = {
+    name: "half-open-recovery",
+    strategy: "priority",
+    models: ["openai/gpt-4o-mini", "claude/sonnet"],
+    config: { maxRetries: 0, retryDelayMs: 0, fallbackDelayMs: 0 },
+  };
+
+  // While OPEN: the openai target must be skipped, claude serves.
+  const callsWhileOpen: string[] = [];
+  const blocked = await handleComboChat({
+    body: {},
+    combo: comboDef,
+    handleSingleModel: async (_body: unknown, modelStr: string) => {
+      callsWhileOpen.push(modelStr);
+      return okResponse();
+    },
+    isModelAvailable: async () => true,
+    log: createLog(),
+    settings: null,
+    allCombos: null,
+  });
+  assert.equal(blocked.ok, true);
+  assert.deepEqual(callsWhileOpen, ["claude/sonnet"], "OPEN breaker target must be skipped");
+
+  // After the reset timeout the breaker reads HALF_OPEN — the combo must probe
+  // the provider again instead of excluding it forever (lazy recovery contract).
+  await new Promise((resolve) => setTimeout(resolve, 600));
+  assert.equal(breaker.getStatus().state, "HALF_OPEN");
+
+  const callsAfterExpiry: string[] = [];
+  const probed = await handleComboChat({
+    body: {},
+    combo: comboDef,
+    handleSingleModel: async (_body: unknown, modelStr: string) => {
+      callsAfterExpiry.push(modelStr);
+      return okResponse();
+    },
+    isModelAvailable: async () => true,
+    log: createLog(),
+    settings: null,
+    allCombos: null,
+  });
+  assert.equal(probed.ok, true);
+  assert.deepEqual(
+    callsAfterExpiry,
+    ["openai/gpt-4o-mini"],
+    "HALF_OPEN provider must be probed again"
+  );
+});
diff --git a/tests/unit/serial/provider-health-autopilot.test.ts b/tests/unit/serial/provider-health-autopilot.test.ts
index b0dafa2914..c7ea6c4fc5 100644
--- a/tests/unit/serial/provider-health-autopilot.test.ts
+++ b/tests/unit/serial/provider-health-autopilot.test.ts
@@ -217,6 +217,48 @@ test("provider health autopilot action rejects cross-site mutations", async () =
   assert.ok(unchanged.rateLimitedUntil);
 });
 
+test("provider health autopilot action accepts LAN dashboard requests (#6277)", async () => {
+  // #6277: Docker/LAN deployments (accessed via LAN IP, not localhost) got a
+  // spurious 403 "Invalid request origin" clicking "remove cooldown". Root
+  // cause: this route carried a DUPLICATE per-route validateBrowserMutationOrigin
+  // check re-added by the v3.8.42 release squash after PR #5278 centralized
+  // origin enforcement in the authz pipeline. The pipeline's centralized check
+  // (src/server/authz/pipeline.ts) strips PEER_IP_HEADER before forwarding the
+  // request to the route handler, so by the time this handler runs the peer
+  // stamp is gone — exactly what a real post-middleware request looks like.
+  // The route must trust the pipeline's verdict and NOT re-validate origin
+  // itself; without PEER_IP_HEADER, the per-route check cannot resolve the LAN
+  // "direct-local-host" candidate and rejects a same-origin-but-LAN mutation.
+  await enableManagementAuth();
+  const connection = await createCooldownConnection();
+  const report = await autopilot.buildProviderHealthAutopilotReport({
+    provider: PROVIDER,
+    includeHealthy: true,
+  });
+  const action = findAction(report, "clear_connection_cooldown");
+  assert.ok(action);
+
+  const request = await makeManagementSessionRequest(
+    "http://localhost/api/providers/health-autopilot/actions",
+    {
+      method: "POST",
+      headers: { origin: "http://192.168.1.50:20128", "sec-fetch-site": "same-origin" },
+      body: {
+        type: action.type,
+        target: action.target,
+        preconditionsHash: action.preconditionsHash,
+        confirm: true,
+      },
+    }
+  );
+  assert.equal(request.headers.get("x-omniroute-peer-ip"), null);
+
+  const response = await actionsRoute.POST(request);
+  assert.equal(response.status, 200);
+  const body = await response.json();
+  assert.equal(body.success, true);
+});
+
 test("provider health autopilot action rejects malformed JSON", async () => {
   await enableManagementAuth();
 
diff --git a/tests/unit/services/fusion-min-panel-and-failure-detail.test.ts b/tests/unit/services/fusion-min-panel-and-failure-detail.test.ts
new file mode 100644
index 0000000000..0b1196edd7
--- /dev/null
+++ b/tests/unit/services/fusion-min-panel-and-failure-detail.test.ts
@@ -0,0 +1,86 @@
+/**
+ * Regression tests for issue #6454.
+ *
+ * (1) fusionTuning.minPanel=1 must be honored — one fast success + slow stragglers
+ *     should trigger the straggler-grace timer immediately (quorum reached at 1),
+ *     capping wall time near the grace window instead of waiting for the whole
+ *     panel or forcing all N stragglers to arrive.
+ * (2) When every panel member fails, the 503 body must carry per-member
+ *     reasons (model=status_XXX) so operators can distinguish rate-limit
+ *     fan-fail from a broader outage.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { handleFusionChat } from "../../../open-sse/services/fusion.ts";
+
+const noop = () => {};
+const log = { info: noop, warn: noop, debug: noop, error: noop };
+
+type Body = Record<string, unknown>;
+
+function okResponse(content: string, delayMs = 0): Promise<Response> {
+  const body = JSON.stringify({ choices: [{ message: { role: "assistant", content } }] });
+  const make = () =>
+    new Response(body, { status: 200, headers: { "Content-Type": "application/json" } });
+  return delayMs > 0 ? new Promise((r) => setTimeout(() => r(make()), delayMs)) : Promise.resolve(make());
+}
+function errResponse(status: number, delayMs = 0): Promise<Response> {
+  const body = JSON.stringify({ error: { message: "boom" } });
+  const make = () =>
+    new Response(body, { status, headers: { "Content-Type": "application/json" } });
+  return delayMs > 0 ? new Promise((r) => setTimeout(() => r(make()), delayMs)) : Promise.resolve(make());
+}
+
+test("fusion #6454: minPanel=1 lets the grace-timer fire on the FIRST success (no unbounded wait for a 2nd)", async () => {
+  // p/fast returns in 5ms. p/slow-fail delays 3s then errors, p/slow-fail-2 delays 3s then errors.
+  // With minPanel=1 (honored), grace timer (50ms) starts at t≈5ms, resolves at t≈55ms.
+  // With minPanel clamped to 2 (bug), grace never starts (never reaches 2 oks) so we wait
+  // for all stragglers → ~3s wall time or hardTimeout.
+  const handleSingleModel = (_b: Body, m: string) => {
+    if (m === "p/fast") return okResponse("fast", 5);
+    return errResponse(500, 3000); // slow-fail
+  };
+  const t0 = Date.now();
+  const res = await handleFusionChat({
+    body: { messages: [{ role: "user", content: "Q" }] },
+    models: ["p/fast", "p/slow-fail", "p/slow-fail-2"],
+    handleSingleModel,
+    log,
+    tuning: { minPanel: 1, stragglerGraceMs: 50, panelHardTimeoutMs: 10000 },
+  });
+  const elapsed = Date.now() - t0;
+  // Grace must have fired near the fast success — well under the 3s straggler delay.
+  assert.ok(
+    elapsed < 1500,
+    `minPanel=1 must let grace fire at 1st success — took ${elapsed}ms (expected <1500ms)`
+  );
+  // With 1 survivor, degrade path returns the survivor directly (not 503).
+  assert.notEqual(res.status, 503);
+});
+
+test("fusion #6454: total panel failure 503 surfaces per-member reason (status codes visible)", async () => {
+  const handleSingleModel = async (_b: Body, m: string) => {
+    if (m === "p/a") return (await errResponse(429));
+    if (m === "p/b") return (await errResponse(503));
+    return (await errResponse(500));
+  };
+  const res = await handleFusionChat({
+    body: { messages: [{ role: "user", content: "Q" }] },
+    models: ["p/a", "p/b", "p/c"],
+    handleSingleModel,
+    log,
+    tuning: { minPanel: 2, stragglerGraceMs: 50, panelHardTimeoutMs: 5000 },
+  });
+  assert.equal(res.status, 503);
+  const body = (await res.clone().json()) as { error: { message: string } };
+  const msg = body.error?.message ?? "";
+  // Body must name each model AND its status so operator can tell rate-limit
+  // (429) from outage (500/503). Before the fix this was an opaque generic string.
+  assert.match(msg, /p\/a/, "message should name p/a");
+  assert.match(msg, /p\/b/, "message should name p/b");
+  assert.match(msg, /p\/c/, "message should name p/c");
+  assert.match(msg, /429/, "message should carry status 429");
+  assert.match(msg, /503/, "message should carry status 503");
+  assert.match(msg, /500/, "message should carry status 500");
+});
diff --git a/tests/unit/settings-schema-routing-strategies.test.ts b/tests/unit/settings-schema-routing-strategies.test.ts
index 964fe19e6b..4ba3152d05 100644
--- a/tests/unit/settings-schema-routing-strategies.test.ts
+++ b/tests/unit/settings-schema-routing-strategies.test.ts
@@ -91,7 +91,7 @@ test("settings schemas accept global Codex fast tier setting", () => {
     codexServiceTier: {
       enabled: true,
       tier: "flex",
-      supportedModels: ["gpt-5.5", "gpt-5.4"],
+      supportedModels: ["gpt-5.6-sol", "gpt-5.6-terra"],
     },
   };
   const routeParsed = settingsRouteSchema.parse(payload);
diff --git a/tests/unit/settings-ui-layout-static.test.ts b/tests/unit/settings-ui-layout-static.test.ts
index 278b938d12..a05e298c1f 100644
--- a/tests/unit/settings-ui-layout-static.test.ts
+++ b/tests/unit/settings-ui-layout-static.test.ts
@@ -99,6 +99,7 @@ test("Global Routing page renders top-level modules in the requested order", ()
   const routingTab = readSrc("src/app/(dashboard)/dashboard/settings/components/RoutingTab.tsx");
 
   assertInOrder(page, [
+    "<RoutingStrategyCard",
     "<ComboDefaultsTab",
     "<ModelAliasesUnified",
     "<FallbackChainsEditor",
diff --git a/tests/unit/shared/components/KiroAuthModal.test.tsx b/tests/unit/shared/components/KiroAuthModal.test.tsx
index 728657400c..948072d217 100644
--- a/tests/unit/shared/components/KiroAuthModal.test.tsx
+++ b/tests/unit/shared/components/KiroAuthModal.test.tsx
@@ -15,6 +15,12 @@ function makeContainer(): HTMLElement {
   return container;
 }
 
+function setInputValue(input: HTMLInputElement, value: string): void {
+  const setter = Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, "value")?.set;
+  setter?.call(input, value);
+  input.dispatchEvent(new Event("input", { bubbles: true }));
+}
+
 describe("KiroAuthModal", () => {
   beforeEach(() => {
     (
@@ -53,4 +59,54 @@ describe("KiroAuthModal", () => {
 
     expect(onMethodSelect).toHaveBeenCalledWith("social", { provider: "google" });
   });
+
+  it("notifies API key import success before closing the modal", async () => {
+    const { default: KiroAuthModal } = await import("@/shared/components/KiroAuthModal");
+    const container = makeContainer();
+    const root = createRoot(container);
+    const calls: string[] = [];
+    const onMethodSelect = vi.fn(() => calls.push("select"));
+    const onClose = vi.fn(() => calls.push("close"));
+    const originalFetch = globalThis.fetch;
+
+    globalThis.fetch = vi.fn(async () => {
+      return new Response(JSON.stringify({ success: true, connection: { id: "conn-1" } }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+    }) as typeof fetch;
+
+    try {
+      await act(async () => {
+        root.render(<KiroAuthModal isOpen onClose={onClose} onMethodSelect={onMethodSelect} />);
+      });
+
+      const apiKeyButton = Array.from(container.querySelectorAll("button")).find(
+        (button) => button.querySelector("h3")?.textContent === "API Key"
+      );
+
+      await act(async () => {
+        apiKeyButton?.click();
+      });
+
+      const apiKeyInput = container.querySelector("input") as HTMLInputElement;
+      const saveButton = Array.from(container.querySelectorAll("button")).find((button) =>
+        button.textContent?.includes("Validate and Save API Key")
+      );
+
+      await act(async () => {
+        setInputValue(apiKeyInput, "ksk_test_key");
+      });
+
+      await act(async () => {
+        saveButton?.click();
+      });
+
+      expect(onMethodSelect).toHaveBeenCalledWith("api-key");
+      expect(onClose).toHaveBeenCalled();
+      expect(calls).toEqual(["select", "close"]);
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
 });
diff --git a/tests/unit/sidebar-search-filter.test.ts b/tests/unit/sidebar-search-filter.test.ts
new file mode 100644
index 0000000000..7193194978
--- /dev/null
+++ b/tests/unit/sidebar-search-filter.test.ts
@@ -0,0 +1,92 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { filterSidebarSectionsByQuery } from "../../src/shared/utils/sidebarSearch.ts";
+
+type Item = { id: string; label: string };
+type Group = { type: "group"; id: string; items: Item[] };
+type Section = { id: string; children: (Item | Group)[] };
+
+function makeSections(): Section[] {
+  return [
+    {
+      id: "omni-proxy",
+      children: [
+        { id: "combos", label: "Combos" },
+        { id: "providers", label: "Providers" },
+        {
+          type: "group",
+          id: "tools",
+          items: [
+            { id: "playground", label: "Playground" },
+            { id: "logs", label: "Request Logs" },
+          ],
+        },
+      ],
+    },
+    {
+      id: "configuration",
+      children: [
+        { id: "settings", label: "Settings" },
+        { id: "webhooks", label: "Webhooks" },
+      ],
+    },
+  ];
+}
+
+test("empty/whitespace query returns all sections unchanged (identity-ish)", () => {
+  const sections = makeSections();
+  assert.deepEqual(filterSidebarSectionsByQuery(sections, ""), sections);
+  assert.deepEqual(filterSidebarSectionsByQuery(sections, "   "), sections);
+});
+
+test("filters flat items by case-insensitive substring match on label", () => {
+  const result = filterSidebarSectionsByQuery(makeSections(), "combo");
+  assert.equal(result.length, 1);
+  assert.equal(result[0].id, "omni-proxy");
+  assert.deepEqual(
+    result[0].children.map((c) => ("label" in c ? c.id : c.id)),
+    ["combos"]
+  );
+});
+
+test("matches are case-insensitive", () => {
+  const result = filterSidebarSectionsByQuery(makeSections(), "SETTINGS");
+  assert.equal(result.length, 1);
+  assert.equal(result[0].id, "configuration");
+});
+
+test("filters items inside a group, dropping non-matching group members", () => {
+  const result = filterSidebarSectionsByQuery(makeSections(), "logs");
+  assert.equal(result.length, 1);
+  const group = result[0].children.find((c) => "type" in c && c.type === "group") as
+    | Group
+    | undefined;
+  assert.ok(group, "expected the tools group to survive filtering");
+  assert.deepEqual(
+    group!.items.map((i) => i.id),
+    ["logs"]
+  );
+});
+
+test("drops a group entirely when none of its items match", () => {
+  const result = filterSidebarSectionsByQuery(makeSections(), "playground-xyz-no-match");
+  assert.deepEqual(result, []);
+});
+
+test("drops sections that have no matching children at all", () => {
+  const result = filterSidebarSectionsByQuery(makeSections(), "webhooks");
+  assert.equal(result.length, 1);
+  assert.equal(result[0].id, "configuration");
+});
+
+test("query matching nothing returns an empty array", () => {
+  const result = filterSidebarSectionsByQuery(makeSections(), "zzz-nonexistent-zzz");
+  assert.deepEqual(result, []);
+});
+
+test("does not mutate the input sections", () => {
+  const sections = makeSections();
+  const snapshot = JSON.parse(JSON.stringify(sections));
+  filterSidebarSectionsByQuery(sections, "combo");
+  assert.deepEqual(sections, snapshot);
+});
diff --git a/tests/unit/sidebar-visibility.test.ts b/tests/unit/sidebar-visibility.test.ts
index 1a5b62c62a..721e00e29b 100644
--- a/tests/unit/sidebar-visibility.test.ts
+++ b/tests/unit/sidebar-visibility.test.ts
@@ -56,6 +56,7 @@ test("primary sidebar items place limits after cache", () => {
       "context-lite",
       "context-aggressive",
       "context-ultra",
+      "context-omniglyph",
       "compression-studio",
       "cli-code",
       "cli-agents",
@@ -92,6 +93,7 @@ test("context sidebar section sits between primary and cli", () => {
       { id: "context-lite", href: "/dashboard/context/lite" },
       { id: "context-aggressive", href: "/dashboard/context/aggressive" },
       { id: "context-ultra", href: "/dashboard/context/ultra" },
+      { id: "context-omniglyph", href: "/dashboard/context/omniglyph" },
     ]
   );
 });
diff --git a/tests/unit/skills-builtins-sandbox.test.ts b/tests/unit/skills-builtins-sandbox.test.ts
index 9f70ea219e..a696d3bf7a 100644
--- a/tests/unit/skills-builtins-sandbox.test.ts
+++ b/tests/unit/skills-builtins-sandbox.test.ts
@@ -1,4 +1,4 @@
-import test from "node:test";
+import test from "node:test";
 import assert from "node:assert/strict";
 import { EventEmitter } from "node:events";
 import { createRequire } from "node:module";
@@ -56,6 +56,11 @@ function createFakeProcess({ onKill } = {}) {
 
 async function withSandboxModule(fakeSpawn, fn) {
   const originalSpawn = childProcess.spawn;
+  const originalRuntime = process.env["SKILLS_SANDBOX_RUNTIME"];
+  // Pin to docker for existing tests so the hardcoded args[0] === "run" /
+  // args[0] === "kill" assertions remain deterministic regardless of the
+  // host's installed container runtimes.
+  process.env["SKILLS_SANDBOX_RUNTIME"] = "docker";
   childProcess.spawn = fakeSpawn;
 
   try {
@@ -65,6 +70,11 @@ async function withSandboxModule(fakeSpawn, fn) {
     return await fn(module);
   } finally {
     childProcess.spawn = originalSpawn;
+    if (originalRuntime === undefined) {
+      delete process.env["SKILLS_SANDBOX_RUNTIME"];
+    } else {
+      process.env["SKILLS_SANDBOX_RUNTIME"] = originalRuntime;
+    }
   }
 }
 
@@ -350,3 +360,205 @@ test("sandboxRunner handles success, spawn errors, timeouts, and killAll cleanup
     }
   );
 });
+
+test("sandboxRunner kill/killAll fallback naming matches containerProvider's SANDBOX_NAME convention", async () => {
+  const calls = [];
+
+  await withSandboxModule(
+    (_command, args) => {
+      calls.push({ args });
+      return createFakeProcess();
+    },
+    async ({ sandboxRunner }) => {
+      // A freshly-imported sandboxRunner has never called run(), so
+      // cachedProvider is still null and kill()/killAll() must fall back to
+      // the docker CLI directly — that fallback name must still match
+      // containerProvider.ts's SANDBOX_NAME (`omniroute-${id}`), not the
+      // pre-PR `omniroute-sandbox-${id}` convention.
+      const proc = createFakeProcess();
+      sandboxRunner.runningContainers.set("fallback-id", proc);
+      sandboxRunner.kill("fallback-id");
+
+      const killCall = calls.find((entry) => entry.args[0] === "kill");
+      assert.ok(killCall, "kill command should have been issued");
+      assert.equal(killCall.args[1], "omniroute-fallback-id");
+
+      const procA = createFakeProcess();
+      const procB = createFakeProcess();
+      sandboxRunner.runningContainers.set("fallback-a", procA);
+      sandboxRunner.runningContainers.set("fallback-b", procB);
+      sandboxRunner.killAll();
+
+      const killAllNames = calls
+        .filter((entry) => entry.args[0] === "kill")
+        .map((entry) => entry.args[1]);
+      assert.ok(killAllNames.includes("omniroute-fallback-a"));
+      assert.ok(killAllNames.includes("omniroute-fallback-b"));
+    }
+  );
+});
+
+// -------------------------------------------------------------
+//  Container Provider Unit Tests
+// -------------------------------------------------------------
+
+test("containerProvider: all five providers registered", () => {
+  // Dynamic import to avoid polluting the sandbox module's state
+  return importFresh("src/lib/skills/containerProvider.ts").then((mod) => {
+    assert.ok(mod.ALL_PROVIDERS.length === 5);
+    assert.deepStrictEqual(
+      mod.ALL_PROVIDERS.map((p) => p.id),
+      ["docker", "apple", "wsl", "orbstack", "podman"],
+    );
+    assert.ok(mod.PROVIDER_BY_ID.has("docker"));
+    assert.ok(mod.PROVIDER_BY_ID.has("apple"));
+    assert.ok(mod.PROVIDER_BY_ID.has("wsl"));
+    assert.ok(mod.PROVIDER_BY_ID.has("orbstack"));
+    assert.ok(mod.PROVIDER_BY_ID.has("podman"));
+  });
+});
+
+test("containerProvider: platformPriority returns correct order per OS", () => {
+  return importFresh("src/lib/skills/containerProvider.ts").then((mod) => {
+    const originalPlatform = Object.getOwnPropertyDescriptor(
+      process,
+      "platform",
+    );
+
+    // darwin
+    Object.defineProperty(process, "platform", { value: "darwin" });
+    assert.deepStrictEqual(mod.platformPriority(), [
+      "apple",
+      "orbstack",
+      "podman",
+      "docker",
+    ]);
+
+    // win32
+    Object.defineProperty(process, "platform", { value: "win32" });
+    assert.deepStrictEqual(mod.platformPriority(), [
+      "wsl",
+      "docker",
+      "podman",
+    ]);
+
+    // linux
+    Object.defineProperty(process, "platform", { value: "linux" });
+    assert.deepStrictEqual(mod.platformPriority(), ["podman", "docker"]);
+
+    // Restore
+    if (originalPlatform) {
+      Object.defineProperty(
+        process,
+        "platform",
+        originalPlatform,
+      );
+    }
+  });
+});
+
+test("containerProvider: buildRun produces run as args[0] for all providers", () => {
+  return importFresh("src/lib/skills/containerProvider.ts").then((mod) => {
+    const config = {
+      cpuLimit: 100,
+      memoryLimit: 256,
+      timeout: 30000,
+      networkEnabled: false,
+      readOnly: true,
+    };
+    for (const provider of mod.ALL_PROVIDERS) {
+      const resolved = provider.buildRun(
+        "alpine",
+        ["echo", "hi"],
+        "test-id",
+        config,
+      );
+      assert.equal(
+        resolved.args[0],
+        "run",
+        `${provider.id}: args[0] must be "run"`,
+      );
+      assert.ok(
+        resolved.args.includes("--rm"),
+        `${provider.id}: should include --rm`,
+      );
+      assert.ok(
+        resolved.args.includes("alpine"),
+        `${provider.id}: should include image`,
+      );
+      // killArgs must return something callable
+      const kill = resolved.killArgs("test-cont");
+      assert.ok(Array.isArray(kill), `${provider.id}: killArgs returns array`);
+      assert.ok(kill.length > 0, `${provider.id}: killArgs non-empty`);
+    }
+  });
+});
+
+test("containerProvider: buildKillArgs returns kill|stop for cleanup", () => {
+  return importFresh("src/lib/skills/containerProvider.ts").then((mod) => {
+    // Every provider should return an array whose first element is
+    // its known cleanup verb.
+    const verbs = new Map([
+      ["docker", "kill"],
+      ["apple", "kill"],
+      ["wsl", "kill"],
+      ["orbstack", "kill"],
+      ["podman", "kill"],
+    ]);
+    for (const provider of mod.ALL_PROVIDERS) {
+      const expectedVerb = verbs.get(provider.id);
+      const args = provider.buildKillArgs("test-cont");
+      assert.equal(args[0], expectedVerb, `${provider.id} kill verb`);
+    }
+  });
+});
+
+test("containerProvider: buildKillCommand utility", () => {
+  return importFresh("src/lib/skills/containerProvider.ts").then((mod) => {
+    const dockerProvider = mod.PROVIDER_BY_ID.get("docker")!;
+    const result = mod.buildKillCommand(dockerProvider, "test-id");
+    assert.equal(result.command, "docker");
+    assert.equal(result.args[0], "kill");
+    assert.equal(result.args[1], "omniroute-test-id");
+  });
+});
+
+test("containerProvider: resolveProvider respects SKILLS_SANDBOX_RUNTIME override", async () => {
+  // Unpin the global env for this test
+  delete process.env.SKILLS_SANDBOX_RUNTIME;
+  const mod = await importFresh("src/lib/skills/containerProvider.ts");
+  mod._resetProviderCacheForTests();
+
+  process.env.SKILLS_SANDBOX_RUNTIME = "docker";
+  const provider = await mod.resolveProvider();
+  assert.equal(provider.id, "docker");
+
+  process.env.SKILLS_SANDBOX_RUNTIME = "apple";
+  mod._resetProviderCacheForTests();
+  const provider2 = await mod.resolveProvider();
+  assert.equal(provider2.id, "apple");
+
+  process.env.SKILLS_SANDBOX_RUNTIME = "wsl";
+  mod._resetProviderCacheForTests();
+  const provider3 = await mod.resolveProvider();
+  assert.equal(provider3.id, "wsl");
+
+  delete process.env.SKILLS_SANDBOX_RUNTIME;
+  mod._resetProviderCacheForTests();
+});
+
+test("containerProvider: resolveProvider falls back to docker when no runtime installed", async () => {
+  delete process.env.SKILLS_SANDBOX_RUNTIME;
+  const mod = await importFresh("src/lib/skills/containerProvider.ts");
+  mod._resetProviderCacheForTests();
+
+  // Auto-detect walks platform priority — if nothing is installed we
+  // always land on docker as the fallback.
+  const provider = await mod.resolveProvider();
+  assert.ok(
+    ["docker", "apple", "wsl", "podman", "orbstack"].includes(provider.id),
+  );
+  // Ensure the fallback is always docker when probes fail
+  // (this test is best-effort — on a host with docker installed,
+  //  the auto-detect will legitimately pick docker)
+});
diff --git a/tests/unit/skills-collect-routes.test.ts b/tests/unit/skills-collect-routes.test.ts
new file mode 100644
index 0000000000..9657937a84
--- /dev/null
+++ b/tests/unit/skills-collect-routes.test.ts
@@ -0,0 +1,268 @@
+/**
+ * Unit tests for the skill-collector CLI-detection REST surface (PR #6294 review):
+ *
+ * - GET/POST /api/github-skills
+ * - GET      /api/skills/collect/detect
+ * - POST     /api/skills/collect/install
+ *
+ * Coverage goals (mandatory per PR #6294 plan-file):
+ * - Auth-required assertion: every route returns 401/403 when management auth is
+ *   required and no credential is provided (requireManagementAuth wiring).
+ * - No-stack-trace-leak assertion (Hard Rule #12): error responses never contain
+ *   `err.stack`/absolute-path fragments.
+ * - Happy-path smoke test for each route.
+ *
+ * global.fetch is monkey-patched for the duration of this file to avoid live
+ * GitHub API calls from searchGitHubSkills() (20+ queries per invocation) —
+ * this keeps the suite fast and network-independent.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import type { NextRequest } from "next/server";
+
+// ── DB / auth setup ───────────────────────────────────────────────────────────
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-skills-collect-routes-"));
+const ORIGINAL_DATA_DIR = process.env.DATA_DIR;
+
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = process.env.API_KEY_SECRET ?? "skills-collect-routes-test-secret";
+
+// Import DB first (order matters — sets DATA_DIR before localDb loads)
+const core = await import("../../src/lib/db/core.ts");
+const apiKeysDb = await import("../../src/lib/db/apiKeys.ts");
+
+// Import routes AFTER env vars are set
+const githubSkillsRoute = await import("../../src/app/api/github-skills/route.ts");
+const detectRoute = await import("../../src/app/api/skills/collect/detect/route.ts");
+const installRoute = await import("../../src/app/api/skills/collect/install/route.ts");
+
+// ── fetch mock — avoid live GitHub API calls ────────────────────────────────
+
+const originalFetch = globalThis.fetch;
+
+test.before(() => {
+  globalThis.fetch = (async () =>
+    new Response(JSON.stringify({ items: [] }), {
+      status: 200,
+      headers: { "content-type": "application/json" },
+    })) as typeof fetch;
+});
+
+test.after(() => {
+  globalThis.fetch = originalFetch;
+  core.resetDbInstance();
+  apiKeysDb.resetApiKeyState();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+
+async function resetStorage() {
+  core.resetDbInstance();
+  apiKeysDb.resetApiKeyState();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+  delete process.env.INITIAL_PASSWORD;
+}
+
+function makeRequest(
+  method: string,
+  url: string,
+  body?: unknown,
+  headers: Record<string, string> = {}
+): Request {
+  return new Request(url, {
+    method,
+    headers: {
+      ...(body !== undefined ? { "content-type": "application/json" } : {}),
+      ...headers,
+    },
+    body: body !== undefined ? JSON.stringify(body) : undefined,
+  });
+}
+
+// GET/POST /api/github-skills and GET /api/skills/collect/detect are typed as
+// NextRequest; POST /api/skills/collect/install is typed as plain Request. A
+// standard Request satisfies every property NextRequest handlers actually read
+// (method/url/headers/json()) — the same cast pattern as tests/unit/a2a-enabled-route.test.ts.
+function asNextRequest(req: Request): NextRequest {
+  return req as unknown as NextRequest;
+}
+
+function assertNoStackTrace(message: string) {
+  assert.ok(
+    !message.match(/\bat \/|\bat file:\/\//),
+    `Error message must not contain a stack trace: "${message}"`
+  );
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+// ═════════════════════════════════════════════════════════════════════════════
+// GET/POST /api/github-skills — auth guard
+// ═════════════════════════════════════════════════════════════════════════════
+
+test("GET /api/github-skills — 401/403 when auth is required and no token provided", async () => {
+  process.env.INITIAL_PASSWORD = "test-password-requires-login";
+
+  const req = makeRequest("GET", "http://localhost/api/github-skills");
+  const res = await githubSkillsRoute.GET(asNextRequest(req));
+
+  assert.ok(
+    res.status === 401 || res.status === 403,
+    `Expected 401 or 403 without auth, got ${res.status}`
+  );
+  const body = (await res.json()) as { error: { message: string } | string };
+  const errorMsg =
+    typeof body.error === "string" ? body.error : (body.error as { message: string }).message;
+  assertNoStackTrace(errorMsg);
+});
+
+test("POST /api/github-skills — 401/403 when auth is required and no token provided", async () => {
+  process.env.INITIAL_PASSWORD = "test-password-requires-login";
+
+  const req = makeRequest("POST", "http://localhost/api/github-skills", {
+    repoName: "user/repo",
+  });
+  const res = await githubSkillsRoute.POST(asNextRequest(req));
+
+  assert.ok(
+    res.status === 401 || res.status === 403,
+    `Expected 401 or 403 without auth, got ${res.status}`
+  );
+});
+
+test("GET /api/github-skills — 200 happy path when auth is not required", async () => {
+  const req = makeRequest("GET", "http://localhost/api/github-skills?minStars=1&maxResults=5");
+  const res = await githubSkillsRoute.GET(asNextRequest(req));
+
+  assert.equal(res.status, 200);
+  const body = (await res.json()) as { skills: unknown[]; total: number };
+  assert.ok(Array.isArray(body.skills));
+  assert.equal(typeof body.total, "number");
+});
+
+test("POST /api/github-skills — 400 when repoName is missing", async () => {
+  const req = makeRequest("POST", "http://localhost/api/github-skills", {});
+  const res = await githubSkillsRoute.POST(asNextRequest(req));
+  assert.equal(res.status, 400);
+});
+
+test("POST /api/github-skills — 200 plans install for a valid repoName", async () => {
+  const req = makeRequest("POST", "http://localhost/api/github-skills", {
+    repoName: "user/skill-example",
+    targets: ["claude"],
+  });
+  const res = await githubSkillsRoute.POST(asNextRequest(req));
+  assert.equal(res.status, 200);
+  const body = (await res.json()) as { results: { target: string; action: string }[] };
+  assert.equal(body.results[0].action, "planned");
+});
+
+// ═════════════════════════════════════════════════════════════════════════════
+// GET /api/skills/collect/detect — auth guard + happy path
+// ═════════════════════════════════════════════════════════════════════════════
+
+test("GET /api/skills/collect/detect — 401/403 when auth is required and no token provided", async () => {
+  process.env.INITIAL_PASSWORD = "test-password-requires-login";
+
+  const req = makeRequest("GET", "http://localhost/api/skills/collect/detect");
+  const res = await detectRoute.GET(asNextRequest(req));
+
+  assert.ok(
+    res.status === 401 || res.status === 403,
+    `Expected 401 or 403 without auth, got ${res.status}`
+  );
+  const body = (await res.json()) as { error: { message: string } | string };
+  const errorMsg =
+    typeof body.error === "string" ? body.error : (body.error as { message: string }).message;
+  assertNoStackTrace(errorMsg);
+});
+
+test("GET /api/skills/collect/detect — 200 happy path when auth is not required", async () => {
+  const req = makeRequest("GET", "http://localhost/api/skills/collect/detect");
+  const res = await detectRoute.GET(asNextRequest(req));
+
+  assert.equal(res.status, 200);
+  const body = (await res.json()) as {
+    tools: Record<string, unknown>;
+    installedToolIds: string[];
+    matchedSkills: unknown[];
+    totalSkills: number;
+  };
+  assert.ok(typeof body.tools === "object" && body.tools !== null);
+  assert.ok(Array.isArray(body.installedToolIds));
+  assert.ok(Array.isArray(body.matchedSkills));
+  assert.equal(typeof body.totalSkills, "number");
+});
+
+// ═════════════════════════════════════════════════════════════════════════════
+// POST /api/skills/collect/install — auth guard + happy path
+// ═════════════════════════════════════════════════════════════════════════════
+
+test("POST /api/skills/collect/install — 401/403 when auth is required and no token provided", async () => {
+  process.env.INITIAL_PASSWORD = "test-password-requires-login";
+
+  const req = makeRequest("POST", "http://localhost/api/skills/collect/install", {
+    repoName: "user/skill-example",
+    targets: ["claude"],
+  });
+  const res = await installRoute.POST(req);
+
+  assert.ok(
+    res.status === 401 || res.status === 403,
+    `Expected 401 or 403 without auth, got ${res.status}`
+  );
+  const body = (await res.json()) as { error: { message: string } | string };
+  const errorMsg =
+    typeof body.error === "string" ? body.error : (body.error as { message: string }).message;
+  assertNoStackTrace(errorMsg);
+});
+
+test("POST /api/skills/collect/install — 400 on invalid body (missing repoName)", async () => {
+  const req = makeRequest("POST", "http://localhost/api/skills/collect/install", {
+    targets: ["claude"],
+  });
+  const res = await installRoute.POST(req);
+  assert.equal(res.status, 400);
+});
+
+test("POST /api/skills/collect/install — 200 plans install for a valid body", async () => {
+  const req = makeRequest("POST", "http://localhost/api/skills/collect/install", {
+    repoName: "user/skill-example",
+    targets: ["claude", "codex"],
+    description: "an example agent skill",
+  });
+  const res = await installRoute.POST(req);
+
+  assert.equal(res.status, 200);
+  const body = (await res.json()) as {
+    ok: boolean;
+    results: { target: string; action: string; destDir?: string }[];
+  };
+  assert.equal(body.ok, true);
+  assert.equal(body.results.length, 2);
+  for (const r of body.results) {
+    assert.equal(r.action, "planned");
+    assert.ok(r.destDir);
+  }
+});
+
+test("POST /api/skills/collect/install — 200 with a per-target error for an unknown tool", async () => {
+  const req = makeRequest("POST", "http://localhost/api/skills/collect/install", {
+    repoName: "user/skill-example",
+    targets: ["totally-unknown-tool"],
+  });
+  const res = await installRoute.POST(req);
+
+  assert.equal(res.status, 200);
+  const body = (await res.json()) as { ok: boolean; results: { ok: boolean; action: string }[] };
+  assert.equal(body.ok, false);
+  assert.equal(body.results[0].action, "error");
+});
diff --git a/tests/unit/specialty-model-catalog-routes.test.ts b/tests/unit/specialty-model-catalog-routes.test.ts
index 790592ab20..01ab26691c 100644
--- a/tests/unit/specialty-model-catalog-routes.test.ts
+++ b/tests/unit/specialty-model-catalog-routes.test.ts
@@ -65,7 +65,10 @@ test("image catalog GET uses the unified active-credential model list", async ()
 
   const ids = await listedIds(imageRoute, "/v1/images/generations");
 
-  assert.ok(ids.includes("codex/gpt-5.5"));
+  assert.deepEqual(
+    ids.filter((id) => id.startsWith("codex/")),
+    ["codex/gpt-5.6-sol", "codex/gpt-5.6-terra", "codex/gpt-5.6-luna"]
+  );
   assert.ok(!ids.includes("openai/gpt-image-2"));
 });
 
diff --git a/tests/unit/stream-payload-collector.test.ts b/tests/unit/stream-payload-collector.test.ts
index 1cb9e58b85..669edcdd1e 100644
--- a/tests/unit/stream-payload-collector.test.ts
+++ b/tests/unit/stream-payload-collector.test.ts
@@ -75,3 +75,143 @@ test("createStructuredSSECollector collector has expected methods", () => {
   const keys = Object.keys(c);
   assert.ok(keys.length > 0);
 });
+
+// #6276 — tool_call arguments lost in request/response logs when a continuation
+// delta omits `index` (some OpenAI-compatible proxies only send `index` on the
+// FIRST tool_call delta chunk, then only `id` on subsequent chunks).
+
+type ToolCallSummary = {
+  choices: Array<{
+    message: {
+      tool_calls: Array<{ function: { name: string; arguments: string } }>;
+    };
+  }>;
+};
+
+function toolCallEvent(delta: Record<string, unknown>, finishReason?: string) {
+  return {
+    index: 0,
+    data: {
+      id: "chatcmpl-1",
+      object: "chat.completion.chunk",
+      created: 1,
+      model: "deepseek-v4-flash-free",
+      choices: [{ index: 0, delta, ...(finishReason ? { finish_reason: finishReason } : {}) }],
+    },
+  };
+}
+
+test("buildStreamSummaryFromEvents merges tool_call deltas when every chunk carries `index` (happy path)", () => {
+  const events = [
+    toolCallEvent({
+      role: "assistant",
+      tool_calls: [
+        { index: 0, id: "call_a", type: "function", function: { name: "Bash", arguments: "" } },
+      ],
+    }),
+    toolCallEvent({
+      tool_calls: [{ index: 0, id: "call_a", type: "function", function: { arguments: '{"x":1}' } }],
+    }),
+    toolCallEvent({}, "tool_calls"),
+  ];
+
+  const summary = collector.buildStreamSummaryFromEvents(
+    events,
+    "openai",
+    "deepseek-v4-flash-free"
+  ) as ToolCallSummary;
+  const toolCalls = summary.choices[0].message.tool_calls;
+
+  assert.equal(toolCalls.length, 1);
+  assert.equal(toolCalls[0].function.name, "Bash");
+  assert.equal(toolCalls[0].function.arguments, '{"x":1}');
+});
+
+test("buildStreamSummaryFromEvents merges a continuation delta that carries only `id` (no `index`) into the initiating tool_call (#6276)", () => {
+  const events = [
+    toolCallEvent({
+      role: "assistant",
+      tool_calls: [
+        {
+          index: 0,
+          id: "call_00_xasdOvEWoeldzXAqFPQP2849",
+          type: "function",
+          function: { name: "Bash", arguments: "" },
+        },
+      ],
+    }),
+    // Continuation chunk omits `index`, carries only `id` + arguments fragment.
+    toolCallEvent({
+      tool_calls: [
+        {
+          id: "call_00_xasdOvEWoeldzXAqFPQP2849",
+          type: "function",
+          function: { arguments: '{"command": "date' },
+        },
+      ],
+    }),
+    toolCallEvent({
+      tool_calls: [
+        {
+          id: "call_00_xasdOvEWoeldzXAqFPQP2849",
+          type: "function",
+          function: { arguments: '"}' },
+        },
+      ],
+    }),
+    toolCallEvent({}, "tool_calls"),
+  ];
+
+  const summary = collector.buildStreamSummaryFromEvents(
+    events,
+    "openai",
+    "deepseek-v4-flash-free"
+  ) as ToolCallSummary;
+  const toolCalls = summary.choices[0].message.tool_calls;
+
+  assert.equal(
+    toolCalls.length,
+    1,
+    `expected 1 tool_call, got ${toolCalls.length}: ${JSON.stringify(toolCalls)}`
+  );
+  assert.equal(toolCalls[0].function.name, "Bash");
+  assert.equal(toolCalls[0].function.arguments, '{"command": "date"}');
+});
+
+test("buildStreamSummaryFromEvents keeps two genuinely different interleaved tool_calls separate", () => {
+  const events = [
+    toolCallEvent({
+      role: "assistant",
+      tool_calls: [
+        { index: 0, id: "call_a", type: "function", function: { name: "Bash", arguments: "" } },
+        { index: 1, id: "call_b", type: "function", function: { name: "Read", arguments: "" } },
+      ],
+    }),
+    toolCallEvent({
+      tool_calls: [
+        { index: 0, id: "call_a", type: "function", function: { arguments: '{"cmd":"a"' } },
+        { index: 1, id: "call_b", type: "function", function: { arguments: '{"path":"b"' } },
+      ],
+    }),
+    toolCallEvent({
+      tool_calls: [
+        { index: 0, id: "call_a", type: "function", function: { arguments: "}" } },
+        { index: 1, id: "call_b", type: "function", function: { arguments: "}" } },
+      ],
+    }),
+    toolCallEvent({}, "tool_calls"),
+  ];
+
+  const summary = collector.buildStreamSummaryFromEvents(
+    events,
+    "openai",
+    "deepseek-v4-flash-free"
+  ) as ToolCallSummary;
+  const toolCalls = summary.choices[0].message.tool_calls;
+
+  assert.equal(toolCalls.length, 2);
+  assert.equal(toolCalls[0].function.name, "Bash");
+  assert.equal(toolCalls[0].function.arguments, '{"cmd":"a"}');
+  assert.equal(toolCalls[1].function.name, "Read");
+  assert.equal(toolCalls[1].function.arguments, '{"path":"b"}');
+});
diff --git a/tests/unit/sync-models-degraded-local-catalog-5460-5465.test.ts b/tests/unit/sync-models-degraded-local-catalog-5460-5465.test.ts
index 876384b191..fdec9bb538 100644
--- a/tests/unit/sync-models-degraded-local-catalog-5460-5465.test.ts
+++ b/tests/unit/sync-models-degraded-local-catalog-5460-5465.test.ts
@@ -19,6 +19,15 @@ test("isDegradedLocalCatalog: intentional local-only catalog is NOT a degraded f
   );
   // Case-insensitive on source.
   assert.equal(isDegradedLocalCatalog({ source: "LOCAL_CATALOG", intentional: true }), false);
+  assert.equal(
+    isDegradedLocalCatalog({
+      source: "local_catalog",
+      intentional: true,
+      warning: "Codex live and GitHub catalogs unavailable — using local catalog",
+    }),
+    false,
+    "Codex's intentional local fallback must import normally"
+  );
 });
 
 test("isDegradedLocalCatalog: a degraded remote-fetch fallback IS a failure (502)", () => {
diff --git a/tests/unit/synthetic-provider.test.ts b/tests/unit/synthetic-provider.test.ts
new file mode 100644
index 0000000000..2a50b0c92f
--- /dev/null
+++ b/tests/unit/synthetic-provider.test.ts
@@ -0,0 +1,94 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { getRegistryEntry } = await import("../../open-sse/config/providerRegistry.ts");
+const { getModelInfoCore } = await import("../../open-sse/services/model.ts");
+const { DEFAULT_PRICING_INFERENCE } =
+  await import("../../src/shared/constants/pricing/inference-hosts.ts");
+
+const INCLUDED_DIRECT_MODELS = [
+  "hf:openai/gpt-oss-120b",
+  "hf:zai-org/GLM-5.2",
+  "hf:moonshotai/Kimi-K2.7-Code",
+  "hf:Qwen/Qwen3.6-27B",
+  "hf:MiniMaxAI/MiniMax-M3",
+  "hf:zai-org/GLM-4.7-Flash",
+  "hf:nvidia/NVIDIA-Nemotron-3-Super-120B-A12B-NVFP4",
+] as const;
+
+const SYNTHETIC_MODEL_ALIASES = {
+  "syn:gpt-oss-120b": "hf:openai/gpt-oss-120b",
+  "syn:large:text": "hf:zai-org/GLM-5.2",
+  "syn:large:vision": "hf:moonshotai/Kimi-K2.7-Code",
+  "syn:small:vision": "hf:Qwen/Qwen3.6-27B",
+  "syn:minimax-m3": "hf:MiniMaxAI/MiniMax-M3",
+  "syn:small:text": "hf:zai-org/GLM-4.7-Flash",
+  "syn:nemotron-3-super": "hf:nvidia/NVIDIA-Nemotron-3-Super-120B-A12B-NVFP4",
+} as const;
+
+function syntheticEntry() {
+  const entry = getRegistryEntry("synthetic");
+  assert.ok(entry, "synthetic provider should be registered");
+  return entry;
+}
+
+test("synthetic provider targets api.synthetic.new", () => {
+  const entry = syntheticEntry();
+  assert.equal(entry.baseUrl, "https://api.synthetic.new/openai/v1/chat/completions");
+  assert.equal(entry.modelsUrl, "https://api.synthetic.new/openai/v1/models");
+  assert.equal(entry.passthroughModels, true);
+});
+
+test("synthetic static catalog tracks the included direct models", () => {
+  const ids = syntheticEntry().models.map((model) => model.id);
+  assert.deepEqual(ids, INCLUDED_DIRECT_MODELS);
+});
+
+test("synthetic catalog carries current context and capability metadata", () => {
+  const models = new Map(syntheticEntry().models.map((model) => [model.id, model]));
+
+  assert.equal(models.get("hf:zai-org/GLM-5.2")?.contextLength, 524288);
+  assert.equal(models.get("hf:zai-org/GLM-4.7-Flash")?.contextLength, 196608);
+  assert.equal(models.get("hf:openai/gpt-oss-120b")?.contextLength, 131072);
+
+  for (const id of INCLUDED_DIRECT_MODELS) {
+    assert.equal(models.get(id)?.toolCalling, true, `${id} should advertise tool calling`);
+    assert.equal(models.get(id)?.supportsReasoning, true, `${id} should advertise reasoning`);
+    assert.equal(models.get(id)?.maxOutputTokens, 65536, `${id} should advertise max output`);
+  }
+
+  for (const id of [
+    "hf:moonshotai/Kimi-K2.7-Code",
+    "hf:Qwen/Qwen3.6-27B",
+    "hf:MiniMaxAI/MiniMax-M3",
+  ]) {
+    assert.equal(models.get(id)?.supportsVision, true, `${id} should advertise vision`);
+  }
+});
+
+test("synthetic catalog exposes short aliases for the provider-native ids", async () => {
+  const models = new Map(syntheticEntry().models.map((model) => [model.id, model]));
+
+  for (const [alias, canonicalId] of Object.entries(SYNTHETIC_MODEL_ALIASES)) {
+    assert.deepEqual(models.get(canonicalId)?.aliases, [alias]);
+
+    const resolved = await getModelInfoCore(`synthetic/${alias}`, null);
+    assert.equal(resolved.provider, "synthetic");
+    assert.equal(resolved.model, canonicalId);
+  }
+});
+
+test("synthetic pricing covers every curated static model", () => {
+  const pricing = DEFAULT_PRICING_INFERENCE.synthetic;
+  for (const id of INCLUDED_DIRECT_MODELS) {
+    assert.ok(pricing[id], `missing synthetic pricing for ${id}`);
+  }
+
+  assert.deepEqual(pricing["hf:zai-org/GLM-5.2"], {
+    input: 1.4,
+    output: 4.4,
+    cached: 1.4,
+    reasoning: 0,
+    cache_creation: 0,
+  });
+});
diff --git a/tests/unit/t12-pricing-updates.test.ts b/tests/unit/t12-pricing-updates.test.ts
index d8d5aca520..799f7cec76 100644
--- a/tests/unit/t12-pricing-updates.test.ts
+++ b/tests/unit/t12-pricing-updates.test.ts
@@ -4,11 +4,20 @@ import assert from "node:assert/strict";
 import { getDefaultPricing } from "../../src/shared/constants/pricing.ts";
 import { REGISTRY } from "../../open-sse/config/providerRegistry.ts";
 
-test("T12: pricing table includes MiniMax, GLM, Kimi and gpt-5.4 mini entries", () => {
+test("T12: pricing table includes current Codex, MiniMax, GLM and Kimi entries", () => {
   const pricing = getDefaultPricing();
 
-  assert.ok(pricing.cx["gpt-5.4"], "missing cx/gpt-5.4");
-  assert.ok(pricing.cx["gpt-5.4-mini"], "missing cx/gpt-5.4-mini");
+  assert.ok(pricing.cx["gpt-5.6-sol-ultra"], "missing cx/gpt-5.6-sol-ultra");
+  assert.ok(pricing.cx["gpt-5.6-terra-max"], "missing cx/gpt-5.6-terra-max");
+  assert.ok(pricing.cx["gpt-5.6-luna-max"], "missing cx/gpt-5.6-luna-max");
+  assert.equal(pricing.cx["gpt-5.6-sol"].input, 5);
+  assert.equal(pricing.cx["gpt-5.6-sol"].output, 30);
+  assert.equal(pricing.cx["gpt-5.6-terra"].input, 2.5);
+  assert.equal(pricing.cx["gpt-5.6-terra"].output, 15);
+  assert.equal(pricing.cx["gpt-5.6-luna"].input, 1);
+  assert.equal(pricing.cx["gpt-5.6-luna"].output, 6);
+  assert.equal(pricing.cx["gpt-5.4"], undefined);
+  assert.equal(pricing.cx["gpt-5.4-mini"], undefined);
 
   assert.ok(pricing.minimax["minimax-m2.5"], "missing minimax/minimax-m2.5");
   assert.ok(pricing.minimax["minimax-m2.7"], "missing minimax/minimax-m2.7");
diff --git a/tests/unit/t28-model-catalog-updates.test.ts b/tests/unit/t28-model-catalog-updates.test.ts
index 355c00d799..3455bafcca 100644
--- a/tests/unit/t28-model-catalog-updates.test.ts
+++ b/tests/unit/t28-model-catalog-updates.test.ts
@@ -58,6 +58,31 @@ test("T28: qwen registry uses native chat.qwen.ai base URL", () => {
   );
 });
 
+test("T28: lmarena registry seeds Direct-chat Text/search; image models in IMAGE_PROVIDERS", async () => {
+  const { IMAGE_PROVIDERS } = await import("../../open-sse/config/imageRegistry.ts");
+  const lmarenaIds = REGISTRY.lmarena.models.map((m) => m.id);
+  const imageIds = (IMAGE_PROVIDERS.lmarena?.models || []).map((m: { id: string }) => m.id);
+
+  // Chat registry: Text + Search only (not Image thrash)
+  assert.ok(lmarenaIds.length >= 40 && lmarenaIds.length < 60);
+  assert.ok(lmarenaIds.includes("gemini-3.1-pro-preview"));
+  assert.ok(lmarenaIds.includes("gemini-3.5-flash-high"));
+  assert.ok(lmarenaIds.includes("claude-sonnet-5"));
+  assert.ok(!lmarenaIds.includes("flux-2-pro"), "image models must not live in chat registry");
+
+  // Image registry: Direct-chat Image category
+  assert.ok(imageIds.length >= 20);
+  assert.ok(imageIds.includes("flux-2-pro") || imageIds.includes("flux-2-dev"));
+  assert.ok(IMAGE_PROVIDERS.lmarena, "lmarena must be an IMAGE_PROVIDERS key");
+
+  // publicName collision → category-suffixed catalog id (chat side)
+  assert.ok(lmarenaIds.includes("grok-4.3/text") || lmarenaIds.includes("grok-4.3/search"));
+
+  const resolved = await getModelInfoCore("lma/gemini-3.1-pro-preview", {});
+  assert.equal(resolved.provider, "lmarena");
+  assert.equal(resolved.model, "gemini-3.1-pro-preview");
+});
+
 test("T28: vertex catalog includes partner models when vertex executor is available", () => {
   const vertexIds = REGISTRY.vertex.models.map((m) => m.id);
 
diff --git a/tests/unit/t3chat-web-cookie-hint-5465.test.ts b/tests/unit/t3chat-web-cookie-hint-5465.test.ts
index e938b87947..0cac7c6e92 100644
--- a/tests/unit/t3chat-web-cookie-hint-5465.test.ts
+++ b/tests/unit/t3chat-web-cookie-hint-5465.test.ts
@@ -57,6 +57,27 @@ test("t3-web requirement now carries the hintKey override (#5465)", () => {
   assert.equal(req.hintKey, "t3ChatWebCookieHint");
 });
 
+test("lmarena add-credential hint uses dedicated copy (not generic single-cookie), full header intent", () => {
+  // Intent-only: product copy may mention CF/reCAPTCHA/chunk shorthand; do not freeze wording.
+  const t = makeTranslator({
+    webCookieCredentialHint:
+      "Required cookie: {credential}. Paste the Cookie header value from your own signed-in {provider} web session. Do not include the Cookie: prefix.",
+  });
+
+  const requirement = WEB_SESSION_CREDENTIAL_REQUIREMENTS["lmarena"];
+  const hint = getWebSessionCredentialHint(t, requirement, "Arena", false);
+
+  assert.equal(requirement.hintKey, "lmarenaWebCookieHint");
+  assert.ok(requirement.credentialName && /arena-auth-prod-v1/i.test(requirement.credentialName));
+  assert.ok(hint && hint.length > 0, "dedicated hintFallback/i18n must resolve");
+  assert.ok(/full cookie header/i.test(hint), "must ask for the full Cookie header");
+  assert.ok(/arena-auth-prod-v1/i.test(hint), "must reference Arena auth cookies");
+  assert.ok(
+    !hint.startsWith("Required cookie:"),
+    "must not fall back to the generic cookie template"
+  );
+});
+
 test("cookie providers without a hintKey still use the generic hint (#5465 regression guard)", () => {
   const t = makeTranslator({
     webCookieCredentialHint:
diff --git a/tests/unit/t40-opencode-cli-tools-integration.test.ts b/tests/unit/t40-opencode-cli-tools-integration.test.ts
index 580b08f5ee..feaacf8256 100644
--- a/tests/unit/t40-opencode-cli-tools-integration.test.ts
+++ b/tests/unit/t40-opencode-cli-tools-integration.test.ts
@@ -46,10 +46,7 @@ test("T40: OpenCode config path resolves per-platform", () => {
     { APPDATA: "C:\\Users\\dev\\AppData\\Roaming" },
     "C:\\Users\\dev"
   );
-  assert.equal(
-    windowsPath,
-    path.join("C:\\Users\\dev", ".config", "opencode", "opencode.json")
-  );
+  assert.equal(windowsPath, path.join("C:\\Users\\dev", ".config", "opencode", "opencode.json"));
 
   // Windows still honors XDG_CONFIG_HOME when set.
   const windowsXdg = resolveOpencodeConfigPath(
@@ -149,8 +146,8 @@ test("T40: OpenCode merge preserves unrelated config and updates only provider.o
     {
       baseUrl: "http://localhost:20128/v1",
       apiKey: "sk_test_opencode",
-      models: ["cx/gpt-5.4"],
-      modelLabels: { "cx/gpt-5.4": "GPT-5.4" },
+      models: ["cx/gpt-5.6-sol"],
+      modelLabels: { "cx/gpt-5.6-sol": "GPT-5.6 Sol" },
     }
   );
 
@@ -159,7 +156,7 @@ test("T40: OpenCode merge preserves unrelated config and updates only provider.o
     github: { command: "npx", args: ["-y", "@modelcontextprotocol/server-github"] },
   });
   assert.deepEqual(mergedConfig.provider.omniroute.models, {
-    "cx/gpt-5.4": { name: "GPT-5.4" },
+    "cx/gpt-5.6-sol": { name: "GPT-5.6 Sol" },
   });
 });
 
diff --git a/tests/unit/trae-publiccred.test.ts b/tests/unit/trae-publiccred.test.ts
new file mode 100644
index 0000000000..b3372e2cf4
--- /dev/null
+++ b/tests/unit/trae-publiccred.test.ts
@@ -0,0 +1,38 @@
+import { test } from "node:test";
+import assert from "node:assert";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { resolvePublicCred } from "../../open-sse/utils/publicCreds.ts";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+
+test("trae_id embedded default decodes to the public Trae OAuth client_id", () => {
+  assert.equal(resolvePublicCred("trae_id"), "en1oxy7wnw8j9n");
+});
+
+test("TRAE_OAUTH_CLIENT_ID env override wins over the embedded default", () => {
+  const prev = process.env.TRAE_OAUTH_CLIENT_ID;
+  process.env.TRAE_OAUTH_CLIENT_ID = "test-trae-client-id";
+  try {
+    assert.equal(resolvePublicCred("trae_id", "TRAE_OAUTH_CLIENT_ID"), "test-trae-client-id");
+  } finally {
+    if (prev === undefined) delete process.env.TRAE_OAUTH_CLIENT_ID;
+    else process.env.TRAE_OAUTH_CLIENT_ID = prev;
+  }
+});
+
+test("trae.ts no longer embeds the raw client_id literal (Hard Rule #11)", () => {
+  const src = fs.readFileSync(
+    path.join(repoRoot, "open-sse/executors/trae.ts"),
+    "utf8"
+  ) as string;
+  assert.ok(
+    !src.includes("en1oxy7wnw8j9n"),
+    "trae.ts must resolve the client_id via resolvePublicCred(), not a string literal"
+  );
+  assert.ok(
+    src.includes('resolvePublicCred("trae_id", "TRAE_OAUTH_CLIENT_ID")'),
+    "trae.ts must call resolvePublicCred for the Trae client_id"
+  );
+});
diff --git a/tests/unit/translator-gemini-thinking-budget-6943.test.ts b/tests/unit/translator-gemini-thinking-budget-6943.test.ts
new file mode 100644
index 0000000000..eca7107a43
--- /dev/null
+++ b/tests/unit/translator-gemini-thinking-budget-6943.test.ts
@@ -0,0 +1,83 @@
+// Relocated from open-sse/translator/request/__tests__/openai-to-gemini.test.ts (#6943):
+// that path is collected by NO runner (vitest excludes open-sse/translator; node:test globs
+// only cover tests/**), so the suite never ran — flagged by check:test-discovery in the
+// v3.8.47 release pre-flight. Converted from vitest to node:test in place.
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { openaiToGeminiRequest } = await import(
+  "../../open-sse/translator/request/openai-to-gemini.ts"
+);
+
+type GeminiReq = {
+  generationConfig?: { thinkingConfig?: { thinkingBudget?: number; includeThoughts?: boolean } };
+};
+
+const base = (extra: Record<string, unknown>) => ({
+  model: "gemini/gemini-2.5-flash",
+  messages: [{ role: "user", content: "hi" }],
+  safetySettings: [],
+  ...extra,
+});
+
+test("#6813: budget_tokens 0 passes through without dropping to default", () => {
+  const r = openaiToGeminiRequest(
+    "gemini/gemini-2.5-flash",
+    base({ thinking: { type: "enabled", budget_tokens: 0 } }),
+    false
+  ) as GeminiReq;
+  assert.equal(r.generationConfig?.thinkingConfig?.thinkingBudget, 0);
+  assert.equal(r.generationConfig?.thinkingConfig?.includeThoughts, false);
+});
+
+test("#6813: budget_tokens 1 passes through", () => {
+  const r = openaiToGeminiRequest(
+    "gemini/gemini-2.5-flash",
+    base({ thinking: { type: "enabled", budget_tokens: 1 } }),
+    false
+  ) as GeminiReq;
+  assert.equal(r.generationConfig?.thinkingConfig?.thinkingBudget, 1);
+});
+
+test("#4170: no-knob case still injects default thinkingConfig with includeThoughts", () => {
+  const r = openaiToGeminiRequest("gemini/gemini-2.5-flash", base({}), false) as GeminiReq;
+  assert.equal(r.generationConfig?.thinkingConfig?.includeThoughts, true);
+  assert.ok((r.generationConfig?.thinkingConfig?.thinkingBudget ?? 0) > 0);
+});
+
+test("#6813: reasoning_effort none is the explicit off-switch (budget 0, no thoughts)", () => {
+  const r = openaiToGeminiRequest(
+    "gemini/gemini-2.5-flash",
+    base({ reasoning_effort: "none" }),
+    false
+  ) as GeminiReq;
+  assert.equal(r.generationConfig?.thinkingConfig?.thinkingBudget, 0);
+  assert.equal(r.generationConfig?.thinkingConfig?.includeThoughts, false);
+});
+
+test("reasoning_effort low maps to thinkingBudget 1024", () => {
+  const r = openaiToGeminiRequest(
+    "gemini/gemini-2.5-flash",
+    base({ reasoning_effort: "low" }),
+    false
+  ) as GeminiReq;
+  assert.equal(r.generationConfig?.thinkingConfig?.thinkingBudget, 1024);
+});
+
+test("reasoning_effort medium falls back to the model default budget (>=1024)", () => {
+  const r = openaiToGeminiRequest(
+    "custom-model",
+    { ...base({ reasoning_effort: "medium" }), model: "custom-model" },
+    false
+  ) as GeminiReq;
+  assert.ok((r.generationConfig?.thinkingConfig?.thinkingBudget ?? 0) >= 1024);
+});
+
+test("reasoning_effort high maps to the flash cap 24576", () => {
+  const r = openaiToGeminiRequest(
+    "gemini/gemini-2.5-flash",
+    base({ reasoning_effort: "high" }),
+    false
+  ) as GeminiReq;
+  assert.equal(r.generationConfig?.thinkingConfig?.thinkingBudget, 24576);
+});
diff --git a/tests/unit/translator-openai-responses-custom-tool-1007.test.ts b/tests/unit/translator-openai-responses-custom-tool-1007.test.ts
index dc21c8c934..cfd47fe597 100644
--- a/tests/unit/translator-openai-responses-custom-tool-1007.test.ts
+++ b/tests/unit/translator-openai-responses-custom-tool-1007.test.ts
@@ -130,6 +130,9 @@ test("OpenAI -> Responses: apply_patch streams as custom_tool_call with raw inpu
         },
       ],
     },
+    // #6906: real providers may send no separate usage chunk at all — the stream-end
+    // flush is what finalizes response.completed in that case.
+    null,
   ]);
 
   const added = events.find((e) => e.event === "response.output_item.added");
diff --git a/tests/unit/translator-openai-responses-req.test.ts b/tests/unit/translator-openai-responses-req.test.ts
index 87e5c97f43..3fdda8c31a 100644
--- a/tests/unit/translator-openai-responses-req.test.ts
+++ b/tests/unit/translator-openai-responses-req.test.ts
@@ -599,11 +599,34 @@ test("Chat -> Responses maps reasoning_effort into Responses reasoning", () => {
     null
   );
 
-  assert.deepEqual((result as any).reasoning, { effort: "low" });
+  // Effort-only chat requests now default `summary: "auto"` + the encrypted
+  // reasoning include so Responses-API upstreams stream thinking back to the
+  // chat client (previously the summary was empty and no think was visible).
+  assert.deepEqual((result as any).reasoning, { effort: "low", summary: "auto" });
+  assert.deepEqual((result as Record<string, unknown>).include, ["reasoning.encrypted_content"]);
   assert.equal((result as any).reasoning_effort, undefined);
   assert.equal((result as any).store, false);
 });
 
+test("Chat -> Responses does not default a reasoning summary for reasoning_effort none", () => {
+  const result = openaiToOpenAIResponsesRequest(
+    "gpt-5.3-codex-spark",
+    {
+      messages: [{ role: "user", content: "Hello" }],
+      reasoning_effort: "none",
+    },
+    false,
+    null
+  );
+
+  const record = result as Record<string, unknown>;
+  const reasoning = record.reasoning as Record<string, unknown> | undefined;
+  if (reasoning !== undefined) {
+    assert.equal(reasoning.summary, undefined);
+  }
+  assert.equal(record.include, undefined);
+});
+
 test("Chat -> Responses normalizes reasoning_effort max to xhigh", () => {
   const result = openaiToOpenAIResponsesRequest(
     "gpt-5.5",
@@ -615,7 +638,7 @@ test("Chat -> Responses normalizes reasoning_effort max to xhigh", () => {
     null
   );
 
-  assert.deepEqual((result as any).reasoning, { effort: "xhigh" });
+  assert.deepEqual((result as any).reasoning, { effort: "xhigh", summary: "auto" });
   assert.equal((result as any).reasoning_effort, undefined);
 });
 
diff --git a/tests/unit/translator-openai-to-gemini.test.ts b/tests/unit/translator-openai-to-gemini.test.ts
index 4156a58461..9be3c9e9b0 100644
--- a/tests/unit/translator-openai-to-gemini.test.ts
+++ b/tests/unit/translator-openai-to-gemini.test.ts
@@ -518,8 +518,12 @@ test("OpenAI -> Gemini helper IDs and JSON parsing stay in the expected format",
 });
 
 test("OpenAI -> Cloud Code Gemini applies native request defaults", () => {
+  // gemini-3.1-pro is thinking-capable; the previous fixture (gemini-3-flash-preview,
+  // supportsThinking: false / cap 0) encoded the pre-#6943 bug of requesting thoughts
+  // from a non-thinking model — reasoning_effort on a capped-at-0 model now correctly
+  // yields thinkingBudget 0 / includeThoughts false (see the flash assertion below).
   const request = openaiToCloudCodeGeminiRequest(
-    "gemini-3-flash-preview",
+    "gemini-3.1-pro",
     {
       messages: [{ role: "user", content: "Hello" }],
       reasoning_effort: "high",
@@ -527,8 +531,16 @@ test("OpenAI -> Cloud Code Gemini applies native request defaults", () => {
     true
   ) as any;
 
-  assert.equal(request.model, "gemini-3-flash-preview");
+  assert.equal(request.model, "gemini-3.1-pro");
   assert.equal(request.generationConfig.thinkingConfig.includeThoughts, true);
+
+  const flash = openaiToCloudCodeGeminiRequest(
+    "gemini-3-flash-preview",
+    { messages: [{ role: "user", content: "Hello" }], reasoning_effort: "high" },
+    true
+  ) as { generationConfig: { thinkingConfig: { thinkingBudget: number; includeThoughts: boolean } } };
+  assert.equal(flash.generationConfig.thinkingConfig.thinkingBudget, 0);
+  assert.equal(flash.generationConfig.thinkingConfig.includeThoughts, false);
   assert.equal(request.generationConfig.topK, undefined);
   assert.equal(request.contents.at(-1).parts[0].text, "Hello");
 });
diff --git a/tests/unit/translator-openai-to-kiro.test.ts b/tests/unit/translator-openai-to-kiro.test.ts
index 3421b2563b..4cf19efebb 100644
--- a/tests/unit/translator-openai-to-kiro.test.ts
+++ b/tests/unit/translator-openai-to-kiro.test.ts
@@ -1046,6 +1046,29 @@ test("buildKiroPayload accepts kr/* model ids without the [1m] suffix", () => {
   );
 });
 
+test("buildKiroPayload strips local Kiro selector suffixes before upstream", () => {
+  const body = { messages: [{ role: "user", content: "Hello" }] };
+
+  const result = buildKiroPayload("claude-sonnet-5-thinking-agentic", body, true, {});
+  assert.equal(
+    result.conversationState.currentMessage.userInputMessage.modelId,
+    "claude-sonnet-5",
+    "local -thinking/-agentic aliases must not be forwarded to Kiro"
+  );
+  assert.equal(
+    result.additionalModelRequestFields?.output_config?.effort,
+    "high",
+    "the -thinking selector should still request Kiro adaptive thinking"
+  );
+});
+
+test("buildKiroPayload maps auto-kiro selector to Kiro auto upstream id", () => {
+  const body = { messages: [{ role: "user", content: "Hello" }] };
+
+  const result = buildKiroPayload("auto-kiro", body, true, {});
+  assert.equal(result.conversationState.currentMessage.userInputMessage.modelId, "auto");
+});
+
 // Regression for upstream decolua/9router PR #2270: the dash->dot normalization's
 // trailing minor-version group must be bounded (1-2 digits), otherwise a
 // date-suffixed Claude model id (e.g. claude-opus-4-20250514) gets corrupted into
@@ -1098,7 +1121,7 @@ test("buildKiroPayload enables thinking mode for Claude models via reasoning_eff
     max_tokens: 64000,
   };
 
-  const result = buildKiroPayload("claude-opus-4.8", body, false, null);
+  const result = buildKiroPayload("claude-sonnet-5", body, false, null); // only Kiro model accepting adaptive thinking (#6576)
 
   assert.ok(result.additionalModelRequestFields, "additionalModelRequestFields must be set");
   assert.deepEqual(result.additionalModelRequestFields.thinking, {
@@ -1126,7 +1149,7 @@ test("buildKiroPayload drops temperature when thinking is enabled", () => {
     temperature: 0.5,
   };
 
-  const result = buildKiroPayload("claude-opus-4.8", body, false, null);
+  const result = buildKiroPayload("claude-sonnet-5", body, false, null);
 
   assert.ok(result.additionalModelRequestFields, "thinking must be enabled");
   assert.equal(
@@ -1157,7 +1180,7 @@ test("buildKiroPayload maps body.thinking budget_tokens to effort level", () =>
     thinking: { type: "enabled", budget_tokens: 50000 },
   };
 
-  const result = buildKiroPayload("claude-opus-4.7", body, false, null);
+  const result = buildKiroPayload("claude-sonnet-5", body, false, null);
 
   assert.ok(result.additionalModelRequestFields, "thinking must be enabled from budget_tokens");
   assert.equal(result.additionalModelRequestFields.output_config.effort, "high");
@@ -1189,7 +1212,7 @@ test("buildKiroPayload maps reasoning_effort to the same Kiro effort level (no +
 
 test("buildKiroPayload reads effort from Anthropic output_config.effort", () => {
   const result = buildKiroPayload(
-    "claude-opus-4.8",
+    "claude-sonnet-5",
     { messages: [{ role: "user", content: "hard" }], output_config: { effort: "xhigh" } },
     false,
     null
@@ -1201,7 +1224,7 @@ test("buildKiroPayload reads effort from Anthropic output_config.effort", () =>
 
 test("buildKiroPayload defaults adaptive thinking (no effort) to high", () => {
   const result = buildKiroPayload(
-    "claude-opus-4.8",
+    "claude-sonnet-5",
     { messages: [{ role: "user", content: "hard" }], thinking: { type: "adaptive" } },
     false,
     null
@@ -1216,7 +1239,7 @@ test("buildKiroPayload defaults adaptive thinking (no effort) to high", () => {
 
 test("buildKiroPayload drops both temperature and top_p when thinking is enabled", () => {
   const result = buildKiroPayload(
-    "claude-opus-4.8",
+    "claude-sonnet-5",
     {
       messages: [{ role: "user", content: "hard" }],
       reasoning_effort: "high",
diff --git a/tests/unit/translator-resp-openai-responses-roundtrip.test.ts b/tests/unit/translator-resp-openai-responses-roundtrip.test.ts
new file mode 100644
index 0000000000..72816793a2
--- /dev/null
+++ b/tests/unit/translator-resp-openai-responses-roundtrip.test.ts
@@ -0,0 +1,463 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { openaiToOpenAIResponsesResponse, openaiResponsesToOpenAIResponse } =
+  await import("../../open-sse/translator/response/openai-responses.ts");
+const { initState } = await import("../../open-sse/translator/index.ts");
+const { FORMATS } = await import("../../open-sse/translator/formats.ts");
+
+function collectEvents(chunks) {
+  const state = initState(FORMATS.OPENAI_RESPONSES);
+  const events = [];
+
+  for (const chunk of chunks) {
+    const result = openaiToOpenAIResponsesResponse(chunk, state);
+    if (result) events.push(...result);
+  }
+
+  return events;
+}
+
+test("Responses -> OpenAI -> Responses: round-trip preserves newlines in tool call content", () => {
+  // Step 1: Responses API format → Chat Completions format
+  const state1 = {};
+  const originalContent = "line1\nline2\nline3\n";
+
+  openaiResponsesToOpenAIResponse(
+    {
+      type: "response.output_item.added",
+      item: {
+        type: "function_call",
+        call_id: "call_rt_1",
+        name: "write",
+        arguments: JSON.stringify({ path: "/tmp/f.txt", content: originalContent }),
+      },
+    },
+    state1
+  );
+  openaiResponsesToOpenAIResponse(
+    {
+      type: "response.function_call_arguments.delta",
+      delta: "",
+    },
+    state1
+  );
+
+  const doneChunk = openaiResponsesToOpenAIResponse(
+    {
+      type: "response.output_item.done",
+      item: {
+        type: "function_call",
+        call_id: "call_rt_1",
+        name: "write",
+        arguments: JSON.stringify({ path: "/tmp/f.txt", content: originalContent }),
+      },
+    },
+    state1
+  );
+  assert.ok(doneChunk, "should produce Chat Completions chunk");
+  const toolCall = doneChunk.choices[0].delta.tool_calls[0];
+  assert.ok(toolCall, "should have tool_calls");
+
+  // Step 2: That Chat Completions chunk → Responses API events
+  const state2 = {};
+  const roundtripChunks = [];
+
+  // The arguments in Chat Completions format should be a JSON string
+  const ccArgs = toolCall.function.arguments;
+  const parsedArgs = JSON.parse(ccArgs);
+  assert.equal(parsedArgs.content, originalContent, "Chat Completions preserves newlines");
+
+  // Now feed back through chat → responses translator
+  const respEvents = collectEvents([
+    {
+      id: "chatcmpl-rt",
+      model: "gemma-4-26b-a4b-it",
+      choices: [
+        {
+          index: 0,
+          delta: {
+            tool_calls: [
+              {
+                index: 0,
+                id: "call_rt_1",
+                type: "function",
+                function: {
+                  name: "write",
+                  arguments: ccArgs,
+                },
+              },
+            ],
+          },
+          finish_reason: "tool_calls",
+        },
+      ],
+    },
+  ]);
+
+  const doneRt = respEvents.find(
+    (e) => e.event === "response.output_item.done" && e.data.item?.type === "function_call"
+  );
+  assert.ok(doneRt, "round-trip should produce output_item.done");
+  const finalArgs = JSON.parse(doneRt.data.item.arguments);
+  assert.equal(finalArgs.content, originalContent, "round-trip preserves newlines");
+  assert.equal(finalArgs.path, "/tmp/f.txt");
+});
+
+test("Responses -> OpenAI -> Responses: Python code with colon-newline-indent pattern survives round-trip", () => {
+  // This specifically tests the pattern that Gemma4 gets wrong:
+  // `f:\n    json.dump(...)` - the colon-newline-indent pattern
+  const pythonCode = `with open('/tmp/data.json', 'w') as f:
+    json.dump(data, f, indent=2)
+
+print("Done")
+`;
+
+  // Step 1: Responses → OpenAI (Chat Completions)
+  const state1 = {};
+  const chunk1 = openaiResponsesToOpenAIResponse(
+    {
+      type: "response.output_item.added",
+      item: {
+        type: "function_call",
+        call_id: "call_py_2",
+        name: "write",
+        arguments: JSON.stringify({
+          path: "/tmp/script.py",
+          content: pythonCode,
+        }),
+      },
+    },
+    state1
+  );
+
+  const done1 = openaiResponsesToOpenAIResponse(
+    {
+      type: "response.output_item.done",
+      item: {
+        type: "function_call",
+        call_id: "call_py_2",
+        name: "write",
+        arguments: JSON.stringify({
+          path: "/tmp/script.py",
+          content: pythonCode,
+        }),
+      },
+    },
+    state1
+  );
+
+  // The Chat Completions format tool call arguments must be valid parseable JSON
+  const ccArgsStr = done1.choices[0].delta.tool_calls[0].function.arguments;
+  const ccParsed = JSON.parse(ccArgsStr);
+  assert.equal(ccParsed.content, pythonCode, "Python code preserves newlines in Chat Completions");
+
+  // Step 2: OpenAI → Responses
+  const state2 = {};
+  const respEvents2 = collectEvents([
+    {
+      id: "chatcmpl-py2",
+      model: "gemma-4-26b-a4b-it",
+      choices: [
+        {
+          index: 0,
+          delta: {
+            tool_calls: [
+              {
+                index: 0,
+                id: "call_py_2",
+                type: "function",
+                function: {
+                  name: "write",
+                  arguments: ccArgsStr,
+                },
+              },
+            ],
+          },
+          finish_reason: "tool_calls",
+        },
+      ],
+    },
+  ]);
+
+  const done2 = respEvents2.find(
+    (e) => e.event === "response.output_item.done" && e.data.item?.type === "function_call"
+  );
+  assert.ok(done2, "round-trip should produce output_item.done");
+
+  const finalContent = JSON.parse(done2.data.item.arguments).content;
+  assert.equal(finalContent, pythonCode, "Python code survives full round-trip");
+
+  // Critical check: no literal backslash-n contamination
+  const literalBSN = finalContent.match(/\\n/g);
+  assert.equal(literalBSN, null, "no literal backslash-n after round-trip");
+});
+
+test("OpenAI -> Responses: escapeJsonStringValues fixes literal newlines in tool call args", () => {
+  // Simulate upstream provider (e.g. Gemini/Gemma) sending tool call arguments
+  // with ACTUAL 0x0A newlines instead of JSON \\n escapes - a known model bug.
+  // Build arguments string with real bytes to avoid JavaScript string escaping.
+  const LF = String.fromCharCode(0x0a);
+  const malformedArgs = '{"content":"def foo():' + LF + "  return 42" + LF + '"}';
+
+  // Verify the malformed input is NOT valid JSON (sanity check)
+  assert.throws(() => JSON.parse(malformedArgs), /Bad control character/);
+
+  const events = collectEvents([
+    {
+      id: "chatcmpl-1",
+      model: "gemini/gemma-4-26b-a4b-it",
+      choices: [
+        {
+          index: 0,
+          delta: {
+            tool_calls: [
+              {
+                index: 0,
+                id: "call_abc",
+                type: "function",
+                function: {
+                  name: "write",
+                  arguments: malformedArgs,
+                },
+              },
+            ],
+          },
+          finish_reason: null,
+        },
+      ],
+    },
+    {
+      id: "chatcmpl-1",
+      model: "gemini/gemma-4-26b-a4b-it",
+      choices: [
+        {
+          index: 0,
+          delta: {},
+          finish_reason: "tool_calls",
+        },
+      ],
+    },
+  ]);
+
+  // 1. Delta events must carry valid JSON (control chars escaped)
+  const deltaEvent = events.find((e) => e.event === "response.function_call_arguments.delta");
+  assert.ok(deltaEvent, "should have delta event");
+  assert.ok(typeof deltaEvent.data.delta === "string");
+  const deltaParsed = JSON.parse(deltaEvent.data.delta);
+  assert.equal(deltaParsed.content, "def foo():\n  return 42\n");
+  // Content must have real newlines after JSON.parse
+  assert.equal(deltaParsed.content.charCodeAt(10), 0x0a);
+
+  // 2. output_item.done must carry valid JSON
+  const doneEvent = events.find(
+    (e) =>
+      e.event === "response.output_item.done" &&
+      e.data?.item?.type === "function_call" &&
+      e.data.item.name === "write"
+  );
+  assert.ok(doneEvent);
+  const doneArgs = doneEvent.data.item.arguments;
+  assert.doesNotThrow(() => JSON.parse(doneArgs));
+
+  // 3. Completed event carries valid JSON
+  const completedEvent = events.find((e) => e.event === "response.completed");
+  if (completedEvent) {
+    const completedFc = (completedEvent.data.response?.output || []).find(
+      (item: { type?: string }) => item.type === "function_call"
+    );
+    if (completedFc) {
+      assert.doesNotThrow(() => JSON.parse(completedFc.arguments));
+    }
+  }
+
+  // 4. function_call_arguments.done carries valid JSON
+  const doneArgsEvent = events.find((e) => e.event === "response.function_call_arguments.done");
+  if (doneArgsEvent) {
+    assert.doesNotThrow(() => JSON.parse(doneArgsEvent.data.arguments));
+  }
+});
+
+test("Responses -> OpenAI: response.failed records upstream error", () => {
+  const state = {};
+  const result = openaiResponsesToOpenAIResponse(
+    {
+      type: "response.failed",
+      response: {
+        error: {
+          message: "Rate limit reached for gpt-5.4",
+          code: "rate_limit_exceeded",
+        },
+      },
+    },
+    state
+  );
+
+  assert.equal(result, null);
+  assert.ok(state.upstreamError);
+  assert.equal(state.upstreamError.status, 429);
+  assert.equal(state.upstreamError.type, "rate_limit_error");
+  assert.equal(state.upstreamError.code, "rate_limit_exceeded");
+  assert.match(state.upstreamError.message, /Rate limit reached/);
+});
+
+test("OpenAI -> Responses: deduplicates repeated tool argument snapshots", () => {
+  const args = JSON.stringify({ command: "grep -r pattern /var" });
+  const events = collectEvents([
+    {
+      id: "chatcmpl-tool-snapshot",
+      model: "gpt-4.1",
+      choices: [
+        {
+          index: 0,
+          delta: {
+            tool_calls: [
+              {
+                index: 0,
+                id: "call_1",
+                type: "function",
+                function: { name: "shell", arguments: args },
+              },
+            ],
+          },
+          finish_reason: null,
+        },
+      ],
+    },
+    {
+      id: "chatcmpl-tool-snapshot",
+      model: "gpt-4.1",
+      choices: [
+        {
+          index: 0,
+          delta: { tool_calls: [{ index: 0, function: { arguments: args } }] },
+          finish_reason: "tool_calls",
+        },
+      ],
+    },
+  ]);
+
+  const done = events.find((event) => event.event === "response.function_call_arguments.done");
+
+  assert.equal(done.data.arguments, args);
+  assert.equal(JSON.parse(done.data.arguments).command, "grep -r pattern /var");
+});
+
+test("OpenAI -> Responses: no double-escaping of already-escaped JSON arguments", () => {
+  // This test verifies that properly-escaped arguments (as produced by JSON.stringify)
+  // are NOT double-escaped by escapeJsonStringValues. The content contains characters
+  // that could trigger false-positive escaping: real newlines (0x0A) embedded in the
+  // content value, which JSON.stringify converts to \n, and double-quotes inside the
+  // content, which JSON.stringify converts to \".
+  const content = 'def foo():\n    print("hello")\n    print("world")\n';
+  const expected = JSON.stringify({ path: "/tmp/test.py", content });
+  // expected is: {"path":"/tmp/test.py","content":"def foo():\n    print(\"hello\")\n    print(\"world\")\n"}
+
+  const events = collectEvents([
+    {
+      id: "chatcmpl-no-double",
+      model: "gemini/gemma-4-26b-a4b-it",
+      choices: [
+        {
+          index: 0,
+          delta: {
+            tool_calls: [
+              {
+                index: 0,
+                id: "call_no_double",
+                type: "function",
+                function: { name: "write", arguments: expected },
+              },
+            ],
+          },
+          finish_reason: null,
+        },
+      ],
+    },
+    {
+      id: "chatcmpl-no-double",
+      model: "gemini/gemma-4-26b-a4b-it",
+      choices: [
+        {
+          index: 0,
+          delta: {},
+          finish_reason: "tool_calls",
+        },
+      ],
+      usage: { prompt_tokens: 5, completion_tokens: 10, total_tokens: 15 },
+    },
+  ]);
+
+  // 1. function_call_arguments.delta must NOT have double-escaped sequences
+  const deltaEvent = events.find((e) => e.event === "response.function_call_arguments.delta");
+  assert.ok(deltaEvent, "should emit function_call_arguments.delta");
+  const deltaParsed = JSON.parse(deltaEvent.data.delta);
+  // content should have real newlines, not literal backslash-n
+  assert.equal(deltaParsed.content, content, "delta parsed content should match original");
+  // Verify no literal \\n (double backslash + n) in the delta string
+  assert.ok(
+    !deltaEvent.data.delta.includes("\\\\n"),
+    "delta should NOT contain literal \\\\n (double backslash + n)"
+  );
+
+  // 2. function_call_arguments.done must carry valid JSON with correct content
+  const doneArgsEvent = events.find((e) => e.event === "response.function_call_arguments.done");
+  assert.ok(doneArgsEvent, "should emit function_call_arguments.done");
+  assert.doesNotThrow(() => JSON.parse(doneArgsEvent.data.arguments));
+  assert.equal(JSON.parse(doneArgsEvent.data.arguments).path, "/tmp/test.py");
+
+  // 3. output_item.done must carry valid JSON
+  const doneItem = events.find(
+    (e) => e.event === "response.output_item.done" && e.data.item?.type === "function_call"
+  );
+  assert.ok(doneItem, "should emit output_item.done for function_call");
+  const doneItemParsed = JSON.parse(doneItem.data.item.arguments);
+  assert.equal(doneItemParsed.path, "/tmp/test.py");
+  assert.equal(doneItemParsed.content, content);
+
+  // 4. response.completed output must carry valid JSON
+  const completed = events.find((e) => e.event === "response.completed");
+  assert.ok(completed, "should emit response.completed");
+  const completedFc = completed.data.response.output.find((i) => i.type === "function_call");
+  assert.ok(completedFc, "response.completed output should contain function_call");
+  const completedParsed = JSON.parse(completedFc.arguments);
+  assert.equal(completedParsed.path, "/tmp/test.py");
+  assert.equal(completedParsed.content, content);
+
+  // 5. Verify ALL three argument sources are byte-identical
+  assert.equal(
+    doneItem.data.item.arguments,
+    doneArgsEvent.data.arguments,
+    "output_item.done arguments must match function_call_arguments.done arguments"
+  );
+  assert.equal(
+    doneItem.data.item.arguments,
+    completedFc.arguments,
+    "output_item.done arguments must match response.completed output arguments"
+  );
+
+  // 6. Verify no evidence of double-escaping in any argument payload
+  for (const source of ["delta", "done", "completed"]) {
+    const argsStr =
+      source === "delta"
+        ? deltaEvent.data.delta
+        : source === "done"
+          ? doneArgsEvent.data.arguments
+          : completedFc.arguments;
+    assert.ok(
+      !argsStr.includes("\\\\n"),
+      `${source} arguments should NOT contain \\\\n (double backslash + n)`
+    );
+    // All three must be parseable JSON
+    const parsed = JSON.parse(argsStr);
+    assert.equal(typeof parsed.content, "string");
+    assert.ok(parsed.content.includes("\n"), `${source} content should have real newlines`);
+    // The backslash-n count after JSON.parse should be 0 (all are real newlines)
+    const literalBackslashN = (parsed.content.match(/\\n/g) || []).length;
+    assert.equal(
+      literalBackslashN,
+      0,
+      `${source} parsed content should have ZERO literal backslash-n sequences`
+    );
+  }
+});
diff --git a/tests/unit/translator-resp-openai-responses.test.ts b/tests/unit/translator-resp-openai-responses.test.ts
index 40dd6a0598..3659a82fb5 100644
--- a/tests/unit/translator-resp-openai-responses.test.ts
+++ b/tests/unit/translator-resp-openai-responses.test.ts
@@ -412,10 +412,18 @@ test("Responses -> OpenAI: tool-call delta, reasoning delta and completed usage
   assert.equal(args.choices[0].delta.tool_calls[0].function.arguments, '{"city":"SP"}');
   assert.equal(reasoning.choices[0].delta.reasoning_content, "Need weather info.");
   assert.equal(completed.choices[0].finish_reason, "tool_calls");
-  assert.equal((completed as any).usage.prompt_tokens, 8);
-  assert.equal((completed as any).usage.completion_tokens, 2);
-  (assert as any).equal((completed as any).usage.prompt_tokens_details.cached_tokens, 1);
-  assert.equal((completed as any).usage.prompt_tokens_details.cache_creation_tokens, 2);
+  const comp = completed as {
+    choices: Array<{ finish_reason: string }>;
+    usage: {
+      prompt_tokens: number;
+      completion_tokens: number;
+      prompt_tokens_details: { cached_tokens: number; cache_creation_tokens: number };
+    };
+  };
+  assert.equal(comp.usage.prompt_tokens, 8);
+  assert.equal(comp.usage.completion_tokens, 2);
+  assert.equal(comp.usage.prompt_tokens_details.cached_tokens, 1);
+  assert.equal(comp.usage.prompt_tokens_details.cache_creation_tokens, 2);
 });
 
 test("Responses -> OpenAI: preserves upstream model instead of defaulting to gpt-4", () => {
@@ -452,35 +460,11 @@ test("Responses -> OpenAI: preserves upstream model instead of defaulting to gpt
   assert.equal(created, null);
 });
 
-test("Responses -> OpenAI: response.failed records upstream error", () => {
-  const state = {};
-  const result = openaiResponsesToOpenAIResponse(
-    {
-      type: "response.failed",
-      response: {
-        error: {
-          message: "Rate limit reached for gpt-5.4",
-          code: "rate_limit_exceeded",
-        },
-      },
-    },
-    state
-  );
-
-  assert.equal(result, null);
-  assert.ok(state.upstreamError);
-  assert.equal(state.upstreamError.status, 429);
-  assert.equal(state.upstreamError.type, "rate_limit_error");
-  assert.equal(state.upstreamError.code, "rate_limit_exceeded");
-  assert.match(state.upstreamError.message, /Rate limit reached/);
-});
-
-test("OpenAI -> Responses: deduplicates repeated tool argument snapshots", () => {
-  const args = JSON.stringify({ command: "grep -r pattern /var" });
+test("OpenAI -> Responses: tool call arguments with newlines are preserved in function_call events", () => {
   const events = collectEvents([
     {
-      id: "chatcmpl-tool-snapshot",
-      model: "gpt-4.1",
+      id: "chatcmpl-nl",
+      model: "gemma-4-26b-a4b-it",
       choices: [
         {
           index: 0,
@@ -488,9 +472,12 @@ test("OpenAI -> Responses: deduplicates repeated tool argument snapshots", () =>
             tool_calls: [
               {
                 index: 0,
-                id: "call_1",
+                id: "call_nl_1",
                 type: "function",
-                function: { name: "shell", arguments: args },
+                function: {
+                  name: "write",
+                  arguments: '{"path":"/tmp/test.txt","content":"line1\\nline2\\n',
+                },
               },
             ],
           },
@@ -499,20 +486,152 @@ test("OpenAI -> Responses: deduplicates repeated tool argument snapshots", () =>
       ],
     },
     {
-      id: "chatcmpl-tool-snapshot",
-      model: "gpt-4.1",
+      id: "chatcmpl-nl",
+      model: "gemma-4-26b-a4b-it",
       choices: [
         {
           index: 0,
-          delta: { tool_calls: [{ index: 0, function: { arguments: args } }] },
+          delta: {
+            tool_calls: [{ index: 0, function: { arguments: 'line3\\nmore\\nlines\\n"}' } }],
+          },
+          finish_reason: "tool_calls",
+        },
+      ],
+      usage: { prompt_tokens: 10, completion_tokens: 20, total_tokens: 30 },
+    },
+  ]);
+
+  const done = events.find(
+    (e) => e.event === "response.output_item.done" && e.data.item?.type === "function_call"
+  );
+  assert.ok(done, "should emit output_item.done for function_call");
+
+  const argsStr = done.data.item.arguments;
+  const parsed = JSON.parse(argsStr);
+  assert.equal(typeof parsed.content, "string", "content should be a string");
+  assert.ok(parsed.content.includes("\n"), "content should contain actual newlines (0x0A)");
+  assert.equal(parsed.content, "line1\nline2\nline3\nmore\nlines\n");
+  assert.equal(parsed.path, "/tmp/test.txt");
+
+  // Verify the function_call is also present in response.completed output
+  const completed = events.find((e) => e.event === "response.completed");
+  assert.ok(completed, "should emit response.completed");
+  const outputFc = completed.data.response.output.find((item) => item.type === "function_call");
+  assert.ok(outputFc, "response.completed output should contain function_call");
+  assert.equal(outputFc.name, "write");
+  const parsedOutputArgs = JSON.parse(outputFc.arguments);
+  assert.equal(parsedOutputArgs.content, "line1\nline2\nline3\nmore\nlines\n");
+});
+
+test("OpenAI -> Responses: Python multi-line content with indentation survives translation", () => {
+  const pythonCode =
+    'import json\nimport random\nfrom datetime import datetime\n\ndata = {\n    "timestamp": datetime.now().isoformat(),\n    "numbers": [random.randint(1, 100) for _ in range(5)],\n    "greeting": "Hello from the agent test script!"\n}\n\nwith open(\'/tmp/data.json\', \'w\') as f:\n    json.dump(data, f, indent=2)\n\nprint("Done")\n';
+
+  const events = collectEvents([
+    {
+      id: "chatcmpl-py",
+      model: "gemma-4-26b-a4b-it",
+      choices: [
+        {
+          index: 0,
+          delta: {
+            tool_calls: [
+              {
+                index: 0,
+                id: "call_py_1",
+                type: "function",
+                function: {
+                  name: "write",
+                  arguments: JSON.stringify({
+                    path: "/tmp/script.py",
+                    content: pythonCode,
+                  }),
+                },
+              },
+            ],
+          },
+          finish_reason: "tool_calls",
+        },
+      ],
+      usage: { prompt_tokens: 15, completion_tokens: 50, total_tokens: 65 },
+    },
+  ]);
+
+  const done = events.find(
+    (e) => e.event === "response.output_item.done" && e.data.item?.type === "function_call"
+  );
+  assert.ok(done, "should emit output_item.done for function_call");
+
+  const argsStr = done.data.item.arguments;
+  const parsed = JSON.parse(argsStr);
+
+  // Verify content has proper newlines (0x0A, not literal backslash-n)
+  assert.ok(parsed.content.includes("\n"), "content should contain actual newlines");
+  assert.equal(parsed.content, pythonCode, "Python code should survive translation byte-identical");
+  assert.equal(parsed.path, "/tmp/script.py");
+
+  // Verify no literal backslash-n sneaks in
+  const backslashNCount = (parsed.content.match(/\\n/g) || []).length;
+  const newlineCount = (parsed.content.match(/\n/g) || []).length;
+  assert.equal(backslashNCount, 0, "should have ZERO literal backslash-n in content");
+  assert.ok(newlineCount > 5, "should have many actual newlines in Python code");
+});
+
+test("OpenAI -> Responses: parallel tool calls with mixed content survive translation", () => {
+  const events = collectEvents([
+    {
+      id: "chatcmpl-par",
+      model: "gemma-4-26b-a4b-it",
+      choices: [
+        {
+          index: 0,
+          delta: {
+            tool_calls: [
+              {
+                index: 0,
+                id: "call_a",
+                type: "function",
+                function: {
+                  name: "write",
+                  arguments: '{"path":"/tmp/a.txt","content":"hello\\nworld\\n"}',
+                },
+              },
+              {
+                index: 1,
+                id: "call_b",
+                type: "function",
+                function: {
+                  name: "exec",
+                  arguments: '{"command":"echo test"}',
+                },
+              },
+            ],
+          },
           finish_reason: "tool_calls",
         },
       ],
     },
+    // #6906: real providers may send no separate usage chunk at all — the stream-end
+    // flush is what finalizes response.completed in that case.
+    null,
   ]);
 
-  const done = events.find((event) => event.event === "response.function_call_arguments.done");
+  const doneEvents = events.filter(
+    (e) => e.event === "response.output_item.done" && e.data.item?.type === "function_call"
+  );
+  assert.equal(doneEvents.length, 2, "should emit output_item.done for both tool calls");
 
-  assert.equal(done.data.arguments, args);
-  assert.equal(JSON.parse(done.data.arguments).command, "grep -r pattern /var");
+  const writeCall = doneEvents.find((e) => e.data.item.name === "write");
+  const execCall = doneEvents.find((e) => e.data.item.name === "exec");
+  assert.ok(writeCall, "write function_call should be present");
+  assert.ok(execCall, "exec function_call should be present");
+
+  const writeArgs = JSON.parse(writeCall.data.item.arguments);
+  assert.equal(writeArgs.content, "hello\nworld\n");
+
+  // Verify completed output has both
+  const completed = events.find((e) => e.event === "response.completed");
+  assert.ok(completed, "should emit response.completed");
+  const outputFcs = completed.data.response.output.filter((item) => item.type === "function_call");
+  assert.equal(outputFcs.length, 2, "completed output should have both function_calls");
 });
diff --git a/tests/unit/types-barrel-model-cooldown.test.ts b/tests/unit/types-barrel-model-cooldown.test.ts
index d96dda9ac0..d1f156925b 100644
--- a/tests/unit/types-barrel-model-cooldown.test.ts
+++ b/tests/unit/types-barrel-model-cooldown.test.ts
@@ -14,3 +14,71 @@ test("types barrel supports the model cooldown error payload consumer", async ()
     },
   });
 });
+
+test("model cooldown body includes optional retry_after ISO + credentials_cooling count", async () => {
+  const { buildModelCooldownBody } = await import("../../open-sse/utils/error.ts");
+
+  const iso = "2026-07-07T12:34:56.000Z";
+  assert.deepEqual(
+    buildModelCooldownBody({
+      model: "openrouter/fusion",
+      retryAfterSec: 30,
+      retryAfterAt: iso,
+      credentialsCoolingCount: 3,
+    }),
+    {
+      error: {
+        message: "All credentials for model openrouter/fusion are cooling down",
+        type: "rate_limit_error",
+        code: "model_cooldown",
+        model: "openrouter/fusion",
+        reset_seconds: 30,
+        retry_after: iso,
+        credentials_cooling: 3,
+      },
+    }
+  );
+});
+
+test("model cooldown body omits retry_after / credentials_cooling when absent or invalid", async () => {
+  const { buildModelCooldownBody } = await import("../../open-sse/utils/error.ts");
+
+  assert.deepEqual(
+    buildModelCooldownBody({
+      model: "x",
+      retryAfterSec: 5,
+      retryAfterAt: null,
+      credentialsCoolingCount: 0,
+    }),
+    {
+      error: {
+        message: "All credentials for model x are cooling down",
+        type: "rate_limit_error",
+        code: "model_cooldown",
+        model: "x",
+        reset_seconds: 5,
+      },
+    }
+  );
+});
+
+test("modelCooldownResponse emits HTTP 429 with Retry-After header and retry_after ISO in body (#6460)", async () => {
+  const { modelCooldownResponse } = await import("../../open-sse/utils/error.ts");
+
+  const iso = "2026-07-07T12:34:56.000Z";
+  const res = modelCooldownResponse({
+    model: "openrouter/fusion",
+    retryAfter: iso,
+    credentialsCoolingCount: 4,
+  });
+
+  assert.equal(res.status, 429);
+  assert.ok(res.headers.get("Retry-After"), "Retry-After header must be set");
+  const body = await res.json();
+  assert.equal(body.error.code, "model_cooldown");
+  assert.equal(body.error.type, "rate_limit_error");
+  assert.equal(body.error.model, "openrouter/fusion");
+  assert.equal(body.error.retry_after, iso);
+  assert.equal(body.error.credentials_cooling, 4);
+  assert.equal(typeof body.error.reset_seconds, "number");
+});
diff --git a/tests/unit/ui/ProviderIcon-icon-url.test.tsx b/tests/unit/ui/ProviderIcon-icon-url.test.tsx
index 19977c1455..f34ace21a5 100644
--- a/tests/unit/ui/ProviderIcon-icon-url.test.tsx
+++ b/tests/unit/ui/ProviderIcon-icon-url.test.tsx
@@ -23,8 +23,8 @@ const { default: ProviderIcon } = await import("@/shared/components/ProviderIcon
 // ── Helpers ───────────────────────────────────────────────────────────────────
 
 // Deliberately not registered in @lobehub/icons aliases or the KNOWN_PNGS/KNOWN_SVGS
-// static-asset sets, so tests exercise only the `src` override + generic-icon fallback
-// paths, never the @lobehub/static resolution chain.
+// static-asset sets, so tests exercise only the `src` override + fallback chain
+// (thesvg.org → generic icon). Never reaches the local SVG or @lobehub tiers.
 const UNKNOWN_PROVIDER_ID = "openai-compatible-test-node-xyz";
 
 const containers: HTMLElement[] = [];
@@ -50,8 +50,9 @@ function fireImgError(container: HTMLElement) {
 }
 
 beforeEach(() => {
-  (globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT =
-    true;
+  (
+    globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }
+  ).IS_REACT_ACT_ENVIRONMENT = true;
 });
 
 afterEach(() => {
@@ -71,18 +72,31 @@ describe("ProviderIcon — custom remote icon URL (#2166)", () => {
     expect(img?.getAttribute("src")).toBe("https://example.com/logo.png");
   });
 
-  it("falls back to the generic icon when `src` is unset", () => {
+  it("falls back to thesvg.org CDN when `src` is unset (Tier 3 for unknown providers)", () => {
     const container = renderIcon({});
-    expect(container.querySelector("img")).toBeNull();
-    expect(container.querySelector("svg")).not.toBeNull();
+    const img = container.querySelector("img");
+    expect(img).not.toBeNull();
+    expect(img?.getAttribute("src")).toBe(
+      "https://thesvg.org/icons/openai-compatible-test-node-xyz/default.svg"
+    );
   });
 
-  it("falls back to the generic (lobehub/static) icon chain when `src` load fails and no fallbackText is given", () => {
+  it("falls back through thesvg.org CDN then generic icon when `src` load fails and no fallbackText is given", () => {
     const container = renderIcon({ src: "https://example.com/broken.png" });
     expect(container.querySelector("img")).not.toBeNull();
 
     fireImgError(container);
 
+    // Falls back to thesvg.org
+    const img = container.querySelector("img");
+    expect(img).not.toBeNull();
+    expect(img?.getAttribute("src")).toBe(
+      "https://thesvg.org/icons/openai-compatible-test-node-xyz/default.svg"
+    );
+
+    fireImgError(container);
+
+    // thesvg.org fails → generic SVG icon
     expect(container.querySelector("img")).toBeNull();
     expect(container.querySelector("svg")).not.toBeNull();
   });
@@ -102,9 +116,12 @@ describe("ProviderIcon — custom remote icon URL (#2166)", () => {
     expect(container.textContent).toBe("OC");
   });
 
-  it("ignores a whitespace-only src and falls back to the generic icon", () => {
+  it("ignores a whitespace-only src and falls back to thesvg.org CDN", () => {
     const container = renderIcon({ src: "   " });
-    expect(container.querySelector("img")).toBeNull();
-    expect(container.querySelector("svg")).not.toBeNull();
+    const img = container.querySelector("img");
+    expect(img).not.toBeNull();
+    expect(img?.getAttribute("src")).toBe(
+      "https://thesvg.org/icons/openai-compatible-test-node-xyz/default.svg"
+    );
   });
 });
diff --git a/tests/unit/ui/add-api-key-modal-unsupported-save-5565.test.tsx b/tests/unit/ui/add-api-key-modal-unsupported-save-5565.test.tsx
index e2afb05ca5..5d123321ef 100644
--- a/tests/unit/ui/add-api-key-modal-unsupported-save-5565.test.tsx
+++ b/tests/unit/ui/add-api-key-modal-unsupported-save-5565.test.tsx
@@ -25,7 +25,12 @@ function render(props: Record<string, unknown>) {
   const root = createRoot(el);
   act(() => {
     root.render(
-      <AddApiKeyModal isOpen onSave={async () => undefined} onClose={() => {}} {...(props as any)} />
+      <AddApiKeyModal
+        isOpen
+        onSave={async () => undefined}
+        onClose={() => {}}
+        {...(props as any)}
+      />
     );
   });
   containers.push({ root, el });
@@ -62,7 +67,10 @@ beforeEach(() => {
             Promise.resolve({ error: "Provider validation not supported", unsupported: true }),
         } as Response);
       }
-      return Promise.resolve({ ok: true, json: () => Promise.resolve({ valid: true }) } as Response);
+      return Promise.resolve({
+        ok: true,
+        json: () => Promise.resolve({ valid: true }),
+      } as Response);
     })
   );
 });
@@ -76,6 +84,25 @@ afterEach(() => {
 });
 
 describe("AddApiKeyModal — 'validation not supported' is a non-blocking warning (#5565/#5567)", () => {
+  it("does not show unsupported validator responses as red save errors after Check cookie", async () => {
+    const el = render({ provider: "lmarena", providerName: "LMArena" });
+
+    const apiKeyInput = el.querySelector<HTMLInputElement>('input[type="password"]')!;
+    expect(apiKeyInput).toBeTruthy();
+    setInputValue(apiKeyInput, "arena-auth-prod-v1.0=abc; arena-auth-prod-v1.1=def");
+
+    const checkBtn = Array.from(el.querySelectorAll("button")).find(
+      (b) => b.textContent?.trim() === "Check cookie"
+    )!;
+    expect(checkBtn).toBeTruthy();
+    act(() => {
+      checkBtn.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+
+    await waitFor(() => el.textContent?.includes("N/A") ?? false);
+    expect(el.textContent).not.toContain("Provider validation not supported");
+  });
+
   it("still calls onSave when /validate returns unsupported=true", async () => {
     const onSave = vi.fn().mockResolvedValue(undefined);
     const el = render({ provider: "piapi", providerName: "PiAPI", onSave });
diff --git a/tests/unit/ui/logs-page-detail-modal-reopen-on-close.test.tsx b/tests/unit/ui/logs-page-detail-modal-reopen-on-close.test.tsx
new file mode 100644
index 0000000000..27d418ee46
--- /dev/null
+++ b/tests/unit/ui/logs-page-detail-modal-reopen-on-close.test.tsx
@@ -0,0 +1,206 @@
+// @vitest-environment jsdom
+/**
+ * TDD regression: dashboard/logs — closing the request-detail modal after the
+ * FIRST row click immediately reopens it; only the second close works.
+ *
+ * Root cause: LogsPage computes `initialId` from `window.location` on EVERY
+ * render, but Next.js App Router syncs `window.location` only after the
+ * navigation commits — i.e. after the re-render triggered by
+ * `router.replace()`. So:
+ *
+ *  1. Row click → openDetail → router.replace("?id=X"): page re-renders while
+ *     location is still the old URL → initialId stays null, the child's
+ *     one-shot `initialOpenedRef` guard is never consumed.
+ *  2. First close → closeDetail → router.replace(no id): page re-renders while
+ *     location STILL carries "?id=X" → initialId flips null → "X" → the child's
+ *     deep-link effect fires (guard still unarmed) → openDetail reopens the
+ *     modal.
+ *  3. Second close works because the guard is now armed.
+ *
+ * The router mock below reproduces that ordering: replace() re-renders the
+ * page synchronously (like the App Router segment re-render) and the URL is
+ * committed to window.location separately, after the render — via
+ * commitPendingUrl().
+ */
+import React, { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const routerControl = vi.hoisted(() => ({
+  pendingUrl: null as string | null,
+  bumpPageRender: () => {},
+}));
+
+vi.mock("next-intl", () => ({
+  useTranslations: () => (key: string) => key,
+}));
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({
+    replace: (url: string) => {
+      // Mirror App Router ordering: the segment re-renders first, the URL is
+      // synced to window.location only after the commit (commitPendingUrl()).
+      routerControl.pendingUrl = url;
+      routerControl.bumpPageRender();
+    },
+    push: vi.fn(),
+    prefetch: vi.fn(),
+    refresh: vi.fn(),
+  }),
+  usePathname: () => "/dashboard/logs",
+  useSearchParams: () => new URLSearchParams(globalThis.location.search),
+}));
+
+vi.mock("@/store/emailPrivacyStore", () => ({
+  default: () => ({ emailsVisible: true }),
+}));
+
+// LogsPage imports { ConfirmModal, RequestLoggerV2 } from the barrel; keep the
+// real logger (the component under test) and stub the unrelated ConfirmModal
+// so the test doesn't drag the whole barrel into jsdom.
+vi.mock("@/shared/components", async () => {
+  const { default: RequestLoggerV2 } = await import(
+    "../../../src/shared/components/RequestLoggerV2.tsx"
+  );
+  const ConfirmModal = ({ isOpen }: { isOpen: boolean }) =>
+    isOpen ? <div data-testid="confirm-modal" /> : null;
+  return { RequestLoggerV2, ConfirmModal };
+});
+
+const { default: LogsPage } = await import(
+  "../../../src/app/(dashboard)/dashboard/logs/page.tsx"
+);
+
+// Stands in for the App Router segment root: router.replace() re-renders the
+// whole page tree, which is exactly what re-evaluates LogsPage's initialId.
+function Harness() {
+  const [, setVersion] = React.useState(0);
+  React.useEffect(() => {
+    routerControl.bumpPageRender = () => setVersion((v) => v + 1);
+    return () => {
+      routerControl.bumpPageRender = () => {};
+    };
+  }, []);
+  return <LogsPage />;
+}
+
+function commitPendingUrl() {
+  if (routerControl.pendingUrl != null) {
+    window.history.replaceState(null, "", routerControl.pendingUrl);
+    routerControl.pendingUrl = null;
+  }
+}
+
+class FakeIntersectionObserver {
+  observe() {}
+  unobserve() {}
+  disconnect() {}
+  takeRecords() {
+    return [];
+  }
+}
+
+const LOG_ROW = {
+  id: "log-1",
+  status: 200,
+  timestamp: new Date().toISOString(),
+  model: "gpt-4o",
+  provider: "openai",
+  account: "user@example.com",
+  tokens: { in: 10, out: 20 },
+  duration: 1234,
+};
+
+let container: HTMLElement;
+let root: Root;
+
+async function settle() {
+  await act(async () => {
+    await vi.advanceTimersByTimeAsync(0);
+  });
+}
+
+beforeEach(() => {
+  localStorage.clear();
+  routerControl.pendingUrl = null;
+  routerControl.bumpPageRender = () => {};
+  vi.stubGlobal("IntersectionObserver", FakeIntersectionObserver);
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url.startsWith("/api/usage/call-logs")) {
+        return Response.json([LOG_ROW]);
+      }
+      if (url.startsWith("/api/logs/detail")) {
+        return Response.json({ enabled: false });
+      }
+      if (url.startsWith(`/api/logs/${LOG_ROW.id}`)) {
+        return Response.json({ ...LOG_ROW, active: false });
+      }
+      if (url.startsWith("/api/provider-nodes")) {
+        return Response.json({ nodes: [] });
+      }
+      return Response.json({});
+    })
+  );
+  vi.useFakeTimers();
+  container = document.createElement("div");
+  document.body.appendChild(container);
+  root = createRoot(container);
+});
+
+afterEach(async () => {
+  await act(async () => {
+    root.unmount();
+  });
+  container.remove();
+  vi.useRealTimers();
+  vi.unstubAllGlobals();
+  window.history.replaceState(null, "", "/dashboard/logs");
+});
+
+describe("LogsPage detail modal — first-close reopen regression", () => {
+  it("closing the modal after the first row click keeps it closed", async () => {
+    window.history.replaceState(null, "", "/dashboard/logs");
+
+    await act(async () => {
+      root.render(<Harness />);
+    });
+    await settle();
+
+    // First click on the log row opens the detail modal.
+    const row = container.querySelector("tbody tr") as HTMLTableRowElement;
+    expect(row).not.toBeNull();
+    await act(async () => {
+      row.click();
+    });
+    await settle();
+    // Navigation commits after the render: URL now carries ?id=log-1.
+    commitPendingUrl();
+    expect(window.location.search).toContain("id=log-1");
+    expect(container.querySelector('[role="dialog"]')).not.toBeNull();
+
+    // First close: closeDetail() re-renders the page while window.location
+    // still has ?id=log-1 (the close navigation has not committed yet).
+    const dialog = container.querySelector('[role="dialog"]') as HTMLElement;
+    await act(async () => {
+      dialog.click(); // backdrop click → onClose
+    });
+    await settle();
+
+    // The modal must stay closed — the stale ?id in location must not reopen it.
+    expect(container.querySelector('[role="dialog"]')).toBeNull();
+  });
+
+  it("deep link ?id= still opens the modal on mount", async () => {
+    window.history.replaceState(null, "", `/dashboard/logs?id=${LOG_ROW.id}`);
+
+    await act(async () => {
+      root.render(<Harness />);
+    });
+    await settle();
+
+    expect(container.querySelector('[role="dialog"]')).not.toBeNull();
+  });
+});
diff --git a/tests/unit/ui/omniglyphContextPage.test.tsx b/tests/unit/ui/omniglyphContextPage.test.tsx
new file mode 100644
index 0000000000..816d1a25ee
--- /dev/null
+++ b/tests/unit/ui/omniglyphContextPage.test.tsx
@@ -0,0 +1,141 @@
+// @vitest-environment jsdom
+import React, { act } from "react";
+import { createRoot } from "react-dom/client";
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import { SAMPLE_METRICS } from "../../../src/app/(dashboard)/dashboard/context/omniglyph/sampleData.ts";
+
+// i18n is not resolved in vitest/jsdom; the page hardcodes its engine copy in English
+// anyway (catalog convention), so no next-intl mock is needed. Asserts are on
+// i18n-independent content: headings, measured numbers, gate labels, data-testid hooks.
+
+// ── Harness (mirrors tests/unit/ui/compressionPanel.test.tsx) ──────────────────
+const containers: HTMLElement[] = [];
+const roots: Array<{ unmount: () => void }> = [];
+
+function mount(ui: React.ReactElement): HTMLElement {
+  const container = document.createElement("div");
+  document.body.appendChild(container);
+  containers.push(container);
+  const root = createRoot(container);
+  roots.push(root);
+  act(() => {
+    root.render(ui);
+  });
+  return container;
+}
+
+beforeEach(() => {
+  (
+    globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }
+  ).IS_REACT_ACT_ENVIRONMENT = true;
+});
+
+afterEach(async () => {
+  vi.restoreAllMocks();
+  await act(async () => {
+    while (roots.length > 0) roots.pop()?.unmount();
+  });
+  for (let i = 0; i < 10; i++) await Promise.resolve();
+  while (containers.length > 0) containers.pop()?.remove();
+  document.body.innerHTML = "";
+});
+
+async function flush() {
+  await act(async () => {
+    for (let i = 0; i < 10; i++) await Promise.resolve();
+  });
+}
+
+interface CapturedPut {
+  url: string;
+  body: Record<string, unknown>;
+}
+
+function setupFetchMock(): { puts: CapturedPut[] } {
+  const puts: CapturedPut[] = [];
+  const json = (body: unknown, status = 200) =>
+    new Response(JSON.stringify(body), { status, headers: { "Content-Type": "application/json" } });
+
+  // omniglyph absent from `engines` initially → disabled; rtk/caveman present so we can
+  // assert they SURVIVE the PUT (the store persists the whole map as one row).
+  const initialConfig = {
+    enabled: true,
+    engines: { rtk: { enabled: true, level: "standard" }, caveman: { enabled: false } },
+  };
+
+  vi.spyOn(globalThis, "fetch").mockImplementation(
+    async (input: RequestInfo | URL, init?: RequestInit) => {
+      const url = input.toString();
+      const method = (init?.method ?? "GET").toUpperCase();
+      if (url.includes("/api/settings/compression")) {
+        if (method === "PUT") {
+          const body = JSON.parse(String(init?.body ?? "{}"));
+          puts.push({ url, body });
+          return json({ ...initialConfig, ...body });
+        }
+        return json(initialConfig);
+      }
+      return json({}, 404);
+    }
+  );
+  return { puts };
+}
+
+// ── Tests ──────────────────────────────────────────────────────────────────────
+describe("OmniglyphContextPage", () => {
+  it("renders the four sections with the measured numbers and the real render", async () => {
+    setupFetchMock();
+    const { default: Page } = await import(
+      "../../../src/app/(dashboard)/dashboard/context/omniglyph/OmniglyphContextPageClient"
+    );
+    let container!: HTMLElement;
+    await act(async () => {
+      container = mount(<Page />);
+    });
+    await flush();
+
+    const text = container.textContent ?? "";
+    // Header + preview status
+    expect(text).toContain("OmniGlyph");
+    expect(text).toContain("Preview");
+    // Economics
+    expect(text).toContain("~10×");
+    expect(text).toContain("59–70%");
+    // Before → after: measured savings + the real rendered image
+    expect(text).toContain(`−${SAMPLE_METRICS.savingsPct}% tokens on this block`);
+    const img = container.querySelector("img");
+    expect(img, "the rendered sample page <img> must be present").toBeTruthy();
+    expect(img!.getAttribute("src")).toMatch(/^data:image\/png;base64,/);
+    // Gates
+    expect(text).toContain("claude-fable-5");
+    expect(text).toContain("direct Anthropic");
+    // Config control
+    expect(container.querySelector('[data-testid="omniglyph-enable-toggle"]')).toBeTruthy();
+  });
+
+  it("enabling the engine PUTs the full engines map with omniglyph on, preserving the others", async () => {
+    const { puts } = setupFetchMock();
+    const { default: Page } = await import(
+      "../../../src/app/(dashboard)/dashboard/context/omniglyph/OmniglyphContextPageClient"
+    );
+    let container!: HTMLElement;
+    await act(async () => {
+      container = mount(<Page />);
+    });
+    await flush();
+
+    const toggle = container.querySelector('[data-testid="omniglyph-enable-toggle"] button') as HTMLButtonElement | null;
+    expect(toggle, "enable toggle button must exist").toBeTruthy();
+    await act(async () => {
+      toggle!.click();
+    });
+    await flush();
+
+    expect(puts.length).toBe(1);
+    const engines = puts[0]!.body.engines as Record<string, { enabled: boolean }>;
+    expect(engines.omniglyph).toEqual({ enabled: true });
+    // The other engines must survive the whole-map PUT.
+    expect(engines.rtk?.enabled).toBe(true);
+    expect(engines.caveman?.enabled).toBe(false);
+  });
+});
diff --git a/tests/unit/ui/playground-api-tab.test.tsx b/tests/unit/ui/playground-api-tab.test.tsx
index 7b8e83a6f2..30b73d3d13 100644
--- a/tests/unit/ui/playground-api-tab.test.tsx
+++ b/tests/unit/ui/playground-api-tab.test.tsx
@@ -232,7 +232,10 @@ describe("ApiTab", () => {
 
     mockFetch.mockImplementation(async (url: string) => {
       if (typeof url === "string" && url.includes("/v1/models")) {
-        return new Response(JSON.stringify({ data: [] }), {
+        // A non-empty model list is required so the Send button becomes
+        // enabled (ApiTab disables it while `!selectedModel`) — an empty
+        // list here would silently short-circuit the whole SSE path.
+        return new Response(JSON.stringify({ data: [{ id: "openai/gpt-4" }] }), {
           headers: { "content-type": "application/json" },
         });
       }
@@ -249,25 +252,40 @@ describe("ApiTab", () => {
     });
 
     const el = renderApiTab();
-    await waitFor(() => el.querySelector("select") !== null);
+    // Selects render in order: [0] endpoint, [1] provider, [2] model, [3] account key.
+    await waitFor(() => el.querySelectorAll("select").length >= 3);
+    const modelSelect = el.querySelectorAll("select")[2] as HTMLSelectElement;
+    await waitFor(() => modelSelect.options.length > 0);
+
+    act(() => {
+      modelSelect.value = "openai/gpt-4";
+      modelSelect.dispatchEvent(new Event("change", { bubbles: true }));
+    });
 
     // Find Send button
     const sendBtn = Array.from(el.querySelectorAll("button")).find(
       (b) => b.textContent?.includes("send")
     ) as HTMLButtonElement | undefined;
 
-    if (sendBtn && !sendBtn.disabled) {
-      await act(async () => {
-        sendBtn.click();
-      });
+    // Selecting a model + the auto-populated request body must enable Send —
+    // otherwise the SSE path below never runs and this test would be vacuous.
+    expect(sendBtn).toBeDefined();
+    expect(sendBtn?.disabled).toBe(false);
 
-      await waitFor(() => {
-        const editors = el.querySelectorAll("[data-testid='monaco-editor']");
-        return editors.length >= 2 && (editors[1] as HTMLTextAreaElement).value !== "";
-      }, 2000);
-    }
-    // If button is disabled (no model selected), test still passes — SSE infra is verified
-    expect(true).toBe(true);
+    await act(async () => {
+      sendBtn?.click();
+    });
+
+    await waitFor(() => {
+      const editors = el.querySelectorAll("[data-testid='monaco-editor']");
+      return editors.length >= 2 && (editors[1] as HTMLTextAreaElement).value !== "";
+    }, 2000);
+
+    // Assert the actual observable outcome: the streamed SSE delta content
+    // reached the response editor, proving the SSE infra genuinely ran.
+    const editors = el.querySelectorAll("[data-testid='monaco-editor']");
+    const responseEditor = editors[1] as HTMLTextAreaElement;
+    expect(responseEditor.value).toContain("Hello!");
   });
 
   it("shows info banner", async () => {
diff --git a/tests/unit/ui/playground-model-search-4086.test.tsx b/tests/unit/ui/playground-model-search-4086.test.tsx
new file mode 100644
index 0000000000..6b80cd94c4
--- /dev/null
+++ b/tests/unit/ui/playground-model-search-4086.test.tsx
@@ -0,0 +1,162 @@
+// @vitest-environment jsdom
+import React from "react";
+import { act } from "react";
+import { createRoot } from "react-dom/client";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+// #4086: the raw Playground model <select> had no search/filter, forcing users to scroll
+// a flat list (e.g. 50+ OpenRouter models). Regression guard for the search box added to
+// StudioConfigPane's model picker.
+
+vi.mock("next-intl", () => ({
+  useTranslations: () => (key: string) => key,
+}));
+
+vi.mock("@/lib/playground/codeExport", () => ({
+  endpointToPath: (ep: string) => `/v1/${ep}`,
+}));
+
+const AVAILABLE_MODELS = ["openai/gpt-4o", "anthropic/claude-3", "openrouter/mistral-large"];
+
+vi.mock("@/app/(dashboard)/dashboard/translator/hooks/useAvailableModels", () => ({
+  useAvailableModels: () => ({
+    availableModels: AVAILABLE_MODELS,
+    modelCapabilities: {},
+    loading: false,
+  }),
+}));
+
+vi.mock("@/app/(dashboard)/dashboard/translator/hooks/useProviderOptions", () => ({
+  useProviderOptions: () => ({
+    provider: "",
+    setProvider: vi.fn(),
+    providerOptions: [],
+    loading: false,
+  }),
+}));
+
+const { default: StudioConfigPane } = await import(
+  "../../../src/app/(dashboard)/dashboard/playground/components/StudioConfigPane"
+);
+const { DEFAULT_PARAMS } = await import(
+  "../../../src/app/(dashboard)/dashboard/playground/components/ParamSliders"
+);
+
+const containers: Array<{ root: ReturnType<typeof createRoot>; el: HTMLDivElement }> = [];
+
+function makeConfig() {
+  return {
+    endpoint: "chat.completions" as const,
+    baseUrl: "http://localhost:20128",
+    model: "openai/gpt-4o",
+    systemPrompt: "You are a helpful assistant.",
+    params: { ...DEFAULT_PARAMS },
+  };
+}
+
+function renderPane(
+  configState: ReturnType<typeof makeConfig>,
+  setConfigState: (s: ReturnType<typeof makeConfig>) => void
+): HTMLDivElement {
+  const el = document.createElement("div");
+  document.body.appendChild(el);
+  const root = createRoot(el);
+  act(() => {
+    root.render(
+      <StudioConfigPane
+        configState={configState}
+        setConfigState={setConfigState as (s: typeof configState) => void}
+      />
+    );
+  });
+  containers.push({ root, el });
+  return el;
+}
+
+function setInputValue(input: HTMLInputElement, value: string) {
+  const nativeInputValueSetter = Object.getOwnPropertyDescriptor(
+    window.HTMLInputElement.prototype,
+    "value"
+  )?.set;
+  nativeInputValueSetter?.call(input, value);
+  input.dispatchEvent(new Event("input", { bubbles: true }));
+}
+
+describe("StudioConfigPane model search (#4086)", () => {
+  beforeEach(() => {
+    (globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean })
+      .IS_REACT_ACT_ENVIRONMENT = true;
+  });
+
+  afterEach(() => {
+    for (const { root, el } of containers.splice(0)) {
+      act(() => root.unmount());
+      el.remove();
+    }
+    document.body.innerHTML = "";
+    vi.clearAllMocks();
+  });
+
+  it("renders a search input above the model select", () => {
+    const config = makeConfig();
+    const el = renderPane(config, vi.fn());
+    const searchInput = el.querySelector(
+      "input[type='text'][placeholder='search']"
+    ) as HTMLInputElement | null;
+    expect(searchInput).toBeTruthy();
+  });
+
+  it("shows all models in the select when the search box is empty", () => {
+    const config = makeConfig();
+    const el = renderPane(config, vi.fn());
+    const modelSelect = Array.from(el.querySelectorAll<HTMLSelectElement>("select")).find((s) =>
+      Array.from(s.options).some((o) => o.value === "openai/gpt-4o")
+    );
+    expect(modelSelect).toBeTruthy();
+    expect(modelSelect?.options.length).toBe(AVAILABLE_MODELS.length);
+  });
+
+  it("filters the model select options as the user types", () => {
+    const config = makeConfig();
+    const el = renderPane(config, vi.fn());
+
+    const searchInput = el.querySelector(
+      "input[type='text'][placeholder='search']"
+    ) as HTMLInputElement;
+    expect(searchInput).toBeTruthy();
+
+    act(() => {
+      setInputValue(searchInput, "claude");
+    });
+
+    const modelSelect = Array.from(el.querySelectorAll<HTMLSelectElement>("select")).find((s) =>
+      Array.from(s.options).some((o) => o.value === "anthropic/claude-3")
+    );
+    expect(modelSelect).toBeTruthy();
+    // The non-matching "openrouter/mistral-large" model is filtered out. The currently
+    // selected "openai/gpt-4o" stays pinned (see the dedicated test below) even though it
+    // doesn't match "claude" — so the matched model plus the pinned selection remain.
+    const values = Array.from(modelSelect?.options ?? []).map((o) => o.value);
+    expect(values).toContain("anthropic/claude-3");
+    expect(values).not.toContain("openrouter/mistral-large");
+  });
+
+  it("keeps a currently selected model visible even when it doesn't match the query", () => {
+    const config = makeConfig(); // model = "openai/gpt-4o"
+    const el = renderPane(config, vi.fn());
+
+    const searchInput = el.querySelector(
+      "input[type='text'][placeholder='search']"
+    ) as HTMLInputElement;
+
+    act(() => {
+      setInputValue(searchInput, "claude");
+    });
+
+    const modelSelect = Array.from(el.querySelectorAll<HTMLSelectElement>("select")).find((s) =>
+      Array.from(s.options).some((o) => o.value === "anthropic/claude-3")
+    );
+    const values = Array.from(modelSelect?.options ?? []).map((o) => o.value);
+    expect(values).toContain("openai/gpt-4o");
+  });
+});
diff --git a/tests/unit/ui/request-logger-autorefresh-visibility-3972.test.tsx b/tests/unit/ui/request-logger-autorefresh-visibility-3972.test.tsx
index 44f9284fbb..c0027b1a00 100644
--- a/tests/unit/ui/request-logger-autorefresh-visibility-3972.test.tsx
+++ b/tests/unit/ui/request-logger-autorefresh-visibility-3972.test.tsx
@@ -36,10 +36,10 @@ vi.mock("@/store/emailPrivacyStore", () => ({
   default: () => ({ emailsVisible: true }),
 }));
 
-const RequestLoggerV2 = (await import("../../../src/shared/components/RequestLoggerV2.tsx")).default;
-const { DEFAULT_REFRESH_INTERVAL_SEC } = await import(
-  "../../../src/shared/components/requestLoggerPreferences.ts"
-);
+const RequestLoggerV2 = (await import("../../../src/shared/components/RequestLoggerV2.tsx"))
+  .default;
+const { DEFAULT_REFRESH_INTERVAL_SEC } =
+  await import("../../../src/shared/components/requestLoggerPreferences.ts");
 
 function setVisibility(state: "visible" | "hidden") {
   Object.defineProperty(document, "visibilityState", { configurable: true, get: () => state });
@@ -58,8 +58,25 @@ let callLogsRequests = 0;
 let container: HTMLElement;
 let root: Root;
 
+function deferredResponse() {
+  let resolve!: (response: Response) => void;
+  const promise = new Promise<Response>((res) => {
+    resolve = res;
+  });
+  return { promise, resolve };
+}
+
 beforeEach(() => {
   callLogsRequests = 0;
+  if (!globalThis.localStorage) {
+    const store = new Map<string, string>();
+    vi.stubGlobal("localStorage", {
+      getItem: (key: string) => store.get(key) ?? null,
+      setItem: (key: string, value: string) => store.set(key, String(value)),
+      removeItem: (key: string) => store.delete(key),
+      clear: () => store.clear(),
+    });
+  }
   localStorage.clear();
   vi.stubGlobal("IntersectionObserver", FakeIntersectionObserver);
   vi.stubGlobal(
@@ -86,15 +103,96 @@ beforeEach(() => {
 });
 
 afterEach(async () => {
-  await act(async () => {
-    root.unmount();
-  });
-  container.remove();
+  if (root) {
+    await act(async () => {
+      root.unmount();
+    });
+  }
+  container?.remove();
   vi.useRealTimers();
   vi.unstubAllGlobals();
   setVisibility("visible");
 });
 
+describe("RequestLoggerV2 detail modal lifecycle", () => {
+  it("does not reopen a manually closed detail modal when a stale detail fetch resolves", async () => {
+    setVisibility("visible");
+    const detail = deferredResponse();
+    const fetchMock = vi.fn(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url.startsWith("/api/usage/call-logs")) {
+        return Response.json([
+          {
+            id: "log-1",
+            status: 200,
+            method: "POST",
+            path: "/v1/chat/completions",
+            model: "gpt-test",
+            provider: "openai",
+            timestamp: new Date().toISOString(),
+            duration: 42,
+            tokens: { in: 1, out: 2 },
+          },
+        ]);
+      }
+      if (url.startsWith("/api/logs/log-1")) {
+        return detail.promise;
+      }
+      if (url.startsWith("/api/provider-nodes")) {
+        return Response.json({ nodes: [] });
+      }
+      if (url.startsWith("/api/logs/detail")) {
+        return Response.json({ enabled: false });
+      }
+      return Response.json({});
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    await act(async () => {
+      root.render(<RequestLoggerV2 />);
+    });
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(0);
+    });
+
+    const row = Array.from(container.querySelectorAll("tr")).find((tr) =>
+      tr.textContent?.includes("gpt-test")
+    );
+    expect(row).toBeTruthy();
+
+    await act(async () => {
+      row?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+    expect(container.querySelector('[aria-label="Request log detail"]')).not.toBeNull();
+
+    await act(async () => {
+      container
+        .querySelector<HTMLButtonElement>('[aria-label="Close detail modal"]')
+        ?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+    expect(container.querySelector('[aria-label="Request log detail"]')).toBeNull();
+
+    await act(async () => {
+      detail.resolve(
+        Response.json({
+          id: "log-1",
+          status: 200,
+          method: "POST",
+          path: "/v1/chat/completions",
+          model: "gpt-test",
+          provider: "openai",
+          timestamp: new Date().toISOString(),
+          duration: 43,
+          tokens: { in: 1, out: 3 },
+        })
+      );
+      await detail.promise;
+    });
+
+    expect(container.querySelector('[aria-label="Request log detail"]')).toBeNull();
+  });
+});
+
 describe("RequestLoggerV2 auto-refresh (#3972 + #4054)", () => {
   it("keeps polling on the interval when the tab becomes visible without a visibilitychange event", async () => {
     // Mounts while the document reports "hidden", no visibilitychange ever fires.
diff --git a/tests/unit/ui/web-session-cookie-modal-size-6265.test.tsx b/tests/unit/ui/web-session-cookie-modal-size-6265.test.tsx
new file mode 100644
index 0000000000..6d569f9047
--- /dev/null
+++ b/tests/unit/ui/web-session-cookie-modal-size-6265.test.tsx
@@ -0,0 +1,81 @@
+// @vitest-environment jsdom
+// Issue #6265 — the "Add session cookie" modal (AddApiKeyModal, shared by every
+// `-web` cookie provider) was undersized on a 1920x1080 viewport: users had to
+// scroll *inside* the modal to reach Save, and the top of the cookie helper text
+// was clipped. Root cause: the height cap (`max-h-*` + `overflow-y-auto`) lived on
+// the INNER body div only, while the OUTERMOST dialog wrapper had no height bound
+// at all — so the whole box (header + body) could grow taller than the viewport
+// and get clipped by the centering flexbox, independent of the inner scrollbar.
+//
+// Fix: move the single height cap to the outermost dialog wrapper (`role="dialog"`)
+// and stop giving the inner body container its own independent `max-h-`/`overflow`
+// cap, so there is exactly one scroll owner for the whole modal.
+import React, { act } from "react";
+import { createRoot } from "react-dom/client";
+import { describe, it, expect, vi, afterEach } from "vitest";
+
+vi.mock("next-intl", () => ({
+  useTranslations: () => (key: string) => key,
+}));
+
+const { default: AddApiKeyModal } =
+  await import("../../../src/app/(dashboard)/dashboard/providers/[id]/components/modals/AddApiKeyModal");
+
+const containers: Array<{ root: ReturnType<typeof createRoot>; el: HTMLDivElement }> = [];
+
+function render(props: Record<string, unknown>) {
+  const el = document.createElement("div");
+  document.body.appendChild(el);
+  const root = createRoot(el);
+  act(() => {
+    root.render(
+      <AddApiKeyModal
+        isOpen
+        onSave={async () => undefined}
+        onClose={() => {}}
+        {...(props as any)}
+      />
+    );
+  });
+  containers.push({ root, el });
+  return el;
+}
+
+afterEach(() => {
+  for (const { root, el } of containers.splice(0)) {
+    act(() => root.unmount());
+    el.remove();
+  }
+});
+
+describe("AddApiKeyModal — cookie modal sizing (#6265)", () => {
+  it("caps height on the OUTERMOST dialog wrapper, not on an inner body div", () => {
+    // chatgpt-web is a `kind: "cookie"` web-session provider — same shared modal
+    // path lmarena/claude-web/gemini-web/kimi-web/z-ai all go through.
+    const el = render({ provider: "chatgpt-web", providerName: "ChatGPT (Web)" });
+
+    const dialog = el.querySelector<HTMLElement>('[role="dialog"]');
+    expect(dialog).toBeTruthy();
+
+    // The outermost wrapper must be the single owner of the height cap + scroll.
+    expect(dialog!.className).toMatch(/max-h-\[90vh\]/);
+    expect(dialog!.className).toMatch(/overflow-y-auto/);
+
+    // The body container (last child of the dialog — header is first, no footer
+    // prop is used by AddApiKeyModal) must NOT carry its own independent max-h/
+    // overflow cap — otherwise the outer cap and the inner cap fight (double cap),
+    // clipping content before the outer 90vh bound ever kicks in.
+    const bodyDiv = dialog!.children[dialog!.children.length - 1] as HTMLElement;
+    expect(bodyDiv).toBeTruthy();
+    expect(bodyDiv.className).not.toMatch(/max-h-/);
+    expect(bodyDiv.className).not.toMatch(/overflow-y-auto/);
+
+    // Sanity: the cookie helper text and Save button are both present in the DOM
+    // (this modal renders the full guide + form Save/Cancel inline in the body).
+    expect(el.textContent).toContain("How to get the session credential");
+    const saveBtn = Array.from(el.querySelectorAll("button")).find(
+      (b) => b.textContent?.trim() === "save"
+    );
+    expect(saveBtn).toBeTruthy();
+  });
+});
diff --git a/tests/unit/usage-analytics-route.test.ts b/tests/unit/usage-analytics-route.test.ts
index 89ea451f6a..a74e4e34f7 100644
--- a/tests/unit/usage-analytics-route.test.ts
+++ b/tests/unit/usage-analytics-route.test.ts
@@ -220,22 +220,32 @@ test("GET /api/usage/analytics does not report flex savings for non-Codex provid
   assert.equal(flexTier.usageSavingsTokens, 0);
 });
 
-test("GET /api/usage/analytics applies Codex GPT-5.4 Fast multiplier", async () => {
+test("GET /api/usage/analytics applies Codex GPT-5.6 Sol Fast multiplier", async () => {
   await localDb.updatePricing({
-    codex: { "gpt-5.4": { input: 5, output: 30 } },
+    codex: { "gpt-5.6-sol": { input: 5, output: 30 } },
   });
   const db = core.getDbInstance();
   db.prepare(
     `INSERT INTO usage_history (provider, model, connection_id, tokens_input, tokens_output, success, latency_ms, service_tier, timestamp)
      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
-  ).run("codex", "gpt-5.4", "codex-fast", 1000, 500, 1, 250, "priority", new Date().toISOString());
+  ).run(
+    "codex",
+    "gpt-5.6-sol",
+    "codex-fast",
+    1000,
+    500,
+    1,
+    250,
+    "priority",
+    new Date().toISOString()
+  );
 
   const response = await analyticsRoute.GET(makeRequest("http://localhost/api/usage/analytics"));
   const body = await response.json();
 
   assert.equal(response.status, 200);
-  assertClose(body.summary.totalCost, 0.04);
-  assertClose(body.summary.fastCost, 0.04);
+  assertClose(body.summary.totalCost, 0.03);
+  assertClose(body.summary.fastCost, 0.03);
 });
 
 test("GET /api/usage/analytics maps Codex auto-review usage to GPT-5.5 pricing", async () => {
diff --git a/tests/unit/usage-analytics.test.ts b/tests/unit/usage-analytics.test.ts
index ea4aec0eae..ff7e486ccc 100644
--- a/tests/unit/usage-analytics.test.ts
+++ b/tests/unit/usage-analytics.test.ts
@@ -15,7 +15,8 @@ const usageHistory = await import("../../src/lib/usage/usageHistory.ts");
 const usageStats = await import("../../src/lib/usage/usageStats.ts");
 const legacyUsageAnalytics = await import("../../src/lib/usageAnalytics.ts");
 const callLogs = await import("../../src/lib/usage/callLogs.ts");
-const { calculateCost } = await import("../../src/lib/usage/costCalculator.ts");
+const { calculateCost, getCodexFastCostMultiplier } =
+  await import("../../src/lib/usage/costCalculator.ts");
 
 // Use the official clearPendingRequests export instead of manual cleanup
 const clearPendingRequests = usageHistory.clearPendingRequests;
@@ -398,11 +399,11 @@ test("computeAnalytics groups renamed API key usage by stable ID", async () => {
   assert.equal(analytics.byApiKey[0].completionTokens, 15);
 });
 
-test("Codex Fast service tier applies documented GPT-5.5 and GPT-5.4 cost multipliers", async () => {
+test("Codex Fast service tier applies GPT-5.5 and GPT-5.6 credit multipliers", async () => {
   await localDb.updatePricing({
     codex: {
       "gpt-5.5": { input: 5, output: 30 },
-      "gpt-5.4": { input: 5, output: 30 },
+      "gpt-5.6-sol": { input: 5, output: 30 },
     },
   });
 
@@ -411,7 +412,12 @@ test("Codex Fast service tier applies documented GPT-5.5 and GPT-5.4 cost multip
   assert.equal(await calculateCost("codex", "gpt-5.5", tokens), 0.02);
   assert.equal(await calculateCost("codex", "gpt-5.5", tokens, { serviceTier: "priority" }), 0.05);
   assert.equal(await calculateCost("codex", "gpt-5.5", tokens, { serviceTier: "flex" }), 0.01);
-  assert.equal(await calculateCost("codex", "gpt-5.4-high", tokens, { serviceTier: "fast" }), 0.04);
+  assert.equal(
+    await calculateCost("codex", "gpt-5.6-sol-high", tokens, { serviceTier: "fast" }),
+    0.03
+  );
+  assert.equal(getCodexFastCostMultiplier("cx", "gpt-5.6-terra-ultra", "fast"), 1.5);
+  assert.equal(getCodexFastCostMultiplier("codex", "gpt-5.6-luna-max", "priority"), 1.5);
   assert.equal(await calculateCost("openai", "gpt-5.5", tokens, { serviceTier: "priority" }), 0.02);
   assert.equal(await calculateCost("openai", "gpt-5.5", tokens, { serviceTier: "flex" }), 0.02);
 });
diff --git a/tests/unit/usage-migrations-legacy-archive-safety.test.ts b/tests/unit/usage-migrations-legacy-archive-safety.test.ts
new file mode 100644
index 0000000000..8e5eeb7465
--- /dev/null
+++ b/tests/unit/usage-migrations-legacy-archive-safety.test.ts
@@ -0,0 +1,141 @@
+// Regression tests for #6401 / #6799.
+//
+// #6799: archiveLegacyRequestLogs() treated the ENTIRE DATA_DIR/logs directory as a
+// single "legacy request log" archive target and recursively deleted it after zipping —
+// including DATA_DIR/logs/application/, which is the live file-logger's own directory
+// since PR #6234 moved the default APP_LOG_FILE_PATH to DATA_DIR/logs/application/app.log.
+//
+// #6401: yazl's addFile() does an internal stat()-then-stream-read (TOCTOU). Because the
+// live logger keeps appending to files under the swept directory while the migration is
+// zipping them, the file can grow between yazl's stat and its later read, and yazl throws
+// "file data stream has unexpected number of bytes" as an error event on a stream that
+// was never wired into archiveLegacyRequestLogs()'s own try/catch — surfacing as an
+// uncaught exception that crashes the process at boot.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const ORIGINAL_HOME = process.env.HOME;
+const ORIGINAL_USERPROFILE = process.env.USERPROFILE;
+const ORIGINAL_DATA_DIR = process.env.DATA_DIR;
+const ORIGINAL_NEXT_PHASE = process.env.NEXT_PHASE;
+
+const TEST_HOME_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-6401-6799-home-"));
+const TEST_DATA_DIR = path.join(TEST_HOME_DIR, "data");
+
+process.env.HOME = TEST_HOME_DIR;
+process.env.USERPROFILE = TEST_HOME_DIR;
+process.env.DATA_DIR = TEST_DATA_DIR;
+delete process.env.NEXT_PHASE;
+
+const migrations = await import("../../src/lib/usage/migrations.ts");
+const { getDbInstance, resetDbInstance } = await import("../../src/lib/db/core.ts");
+
+const APP_LOG_DIR = path.join(TEST_DATA_DIR, "logs", "application");
+const APP_LOG_FILE = path.join(APP_LOG_DIR, "app.log");
+const CURRENT_REQUEST_LOGS_DIR = path.join(TEST_DATA_DIR, "logs");
+
+test.before(() => {
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+});
+
+test.after(() => {
+  try {
+    const db = getDbInstance();
+    if (db?.open) db.close();
+  } catch {
+    // Database may already be closed.
+  }
+  resetDbInstance?.();
+
+  if (ORIGINAL_HOME === undefined) delete process.env.HOME;
+  else process.env.HOME = ORIGINAL_HOME;
+  if (ORIGINAL_USERPROFILE === undefined) delete process.env.USERPROFILE;
+  else process.env.USERPROFILE = ORIGINAL_USERPROFILE;
+  if (ORIGINAL_DATA_DIR === undefined) delete process.env.DATA_DIR;
+  else process.env.DATA_DIR = ORIGINAL_DATA_DIR;
+  if (ORIGINAL_NEXT_PHASE === undefined) delete process.env.NEXT_PHASE;
+  else process.env.NEXT_PHASE = ORIGINAL_NEXT_PHASE;
+
+  fs.rmSync(TEST_HOME_DIR, { recursive: true, force: true });
+});
+
+test("#6799: archiveLegacyRequestLogs() must not delete the live app-logger directory (DATA_DIR/logs/application)", async () => {
+  fs.mkdirSync(APP_LOG_DIR, { recursive: true });
+  fs.writeFileSync(APP_LOG_FILE, '{"level":30,"msg":"server starting"}\n');
+
+  assert.equal(
+    fs.existsSync(APP_LOG_FILE),
+    true,
+    "precondition: live app.log exists before migration runs"
+  );
+
+  await migrations.archiveLegacyRequestLogs();
+
+  assert.equal(
+    fs.existsSync(APP_LOG_FILE),
+    true,
+    "archiveLegacyRequestLogs() deleted the live app.log file — DATA_DIR/logs/application must be excluded from the legacy archive sweep"
+  );
+  assert.equal(
+    fs.existsSync(CURRENT_REQUEST_LOGS_DIR),
+    true,
+    "archiveLegacyRequestLogs() deleted the entire DATA_DIR/logs directory, including the live application log subtree"
+  );
+});
+
+test("#6401: archiveLegacyRequestLogs does not crash the process when a legacy target is being actively appended to (yazl TOCTOU)", async (t) => {
+  const legacyLogFile = path.join(CURRENT_REQUEST_LOGS_DIR, "legacy-request.log");
+  fs.mkdirSync(CURRENT_REQUEST_LOGS_DIR, { recursive: true });
+  fs.writeFileSync(legacyLogFile, "x".repeat(64 * 1024));
+
+  // Clear the marker written by the previous test so this run re-enters the archive path.
+  const markerPath = path.join(TEST_DATA_DIR, "log_archives", "legacy-request-logs.json");
+  fs.rmSync(markerPath, { force: true });
+
+  let writing = true;
+  const writer = setInterval(() => {
+    if (!writing) return;
+    try {
+      fs.appendFileSync(legacyLogFile, "y".repeat(4096));
+    } catch {
+      /* ignore */
+    }
+  }, 2);
+  writer.unref();
+
+  let uncaught: unknown = null;
+  const onUncaught = (err: unknown) => {
+    uncaught = err;
+  };
+  process.on("uncaughtException", onUncaught);
+
+  t.after(() => {
+    writing = false;
+    clearInterval(writer);
+    process.off("uncaughtException", onUncaught);
+  });
+
+  let rejected: unknown = null;
+  try {
+    await migrations.archiveLegacyRequestLogs();
+  } catch (err) {
+    rejected = err;
+  }
+
+  await new Promise((r) => setTimeout(r, 800));
+
+  writing = false;
+  clearInterval(writer);
+
+  assert.equal(
+    uncaught,
+    null,
+    `archiveLegacyRequestLogs() let an uncaughtException escape instead of handling/rejecting it: ${String(uncaught)}`
+  );
+  // The function itself already has an outer try/catch at call sites; here we assert it
+  // resolves or rejects cleanly rather than crashing the process via uncaughtException.
+  void rejected;
+});
diff --git a/tests/unit/validate-release-green.test.ts b/tests/unit/validate-release-green.test.ts
index 371a92c420..bf62fd8096 100644
--- a/tests/unit/validate-release-green.test.ts
+++ b/tests/unit/validate-release-green.test.ts
@@ -12,8 +12,15 @@ const {
   isDrift,
   computeVerdict,
   classifyRunError,
+  extractCiGates,
+  FULL_CI_SKIP,
 } = mod;
 
+const extract = extractCiGates as (
+  yamlText: string,
+  opts?: { jobs?: string[]; skip?: Set<string>; envMap?: Record<string, Record<string, string>> }
+) => { id: string; job: string; args: string[]; env?: Record<string, string> }[];
+
 test("eslintCounts sums errors + warnings across files", () => {
   const parsed = [
     { errorCount: 2, warningCount: 5 },
@@ -177,3 +184,104 @@ test("pre-flight runs the slow suites CONCURRENTLY (v3.8.45 perf — was ~1h ser
   // Each still saves its per-gate log for red diagnosis without a re-run.
   assert.match(src, /slow\.forEach\([\s\S]*?saveGateLog\(g\.id/, "each slow gate persists its log");
 });
+
+// ─── --full-ci gate extraction (P0, v3.8.46 post-mortem) ─────────────────────
+
+const CI_FIXTURE = `
+name: CI
+jobs:
+  lint:
+    steps:
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run check:route-validation:t06
+  quality-extended:
+    steps:
+      - name: Bundle size
+        run: npm run check:bundle-size -- --ratchet
+      - name: Build
+        run: npm run build
+  docs-sync-strict:
+    steps:
+      - run: |
+          npm run check:docs-all
+          npm run check:docs-symbols
+  pr-test-policy:
+    steps:
+      - run: npm run check:test-masking
+      - run: npm run check:pr-evidence
+  quality-gate:
+    steps:
+      - run: npm run check:codeql-ratchet
+  test-unit:
+    steps:
+      - run: npm run test:unit
+`;
+
+test("extractCiGates: pulls npm-run gate steps from the ci.yml gate jobs only", () => {
+  const gates = extract(CI_FIXTURE);
+  const ids = gates.map((g) => g.id);
+  // gate scripts from the target jobs are present…
+  assert.ok(ids.includes("lint"), "lint gate");
+  assert.ok(ids.includes("check:route-validation:t06"), "colon-suffixed gate id survives");
+  assert.ok(ids.includes("check:bundle-size"), "quality-extended gate");
+  assert.ok(ids.includes("check:test-masking"), "pr-test-policy gate");
+  // …a `run: |` multi-line block is scanned line-by-line…
+  assert.ok(ids.includes("check:docs-all") && ids.includes("check:docs-symbols"), "multi-line run");
+  // …and NON-gate steps + jobs outside the gate set are ignored.
+  assert.ok(!ids.includes("build") && !ids.some((i) => i.startsWith("test:")), "no build/test-run");
+  assert.equal(gates.find((g) => g.job === "test-unit"), undefined, "test-unit job is not scanned");
+});
+
+test("extractCiGates: preserves `-- <args>` so ratchet flags reach the script", () => {
+  const g = extract(CI_FIXTURE).find((x) => x.id === "check:bundle-size");
+  assert.deepEqual(g?.args, ["run", "check:bundle-size", "--", "--ratchet"]);
+  const plain = extract(CI_FIXTURE).find((x) => x.id === "lint");
+  assert.deepEqual(plain?.args, ["run", "lint"], "no `--` when the step has no extra args");
+});
+
+test("extractCiGates: skips the non-local gates (pr-evidence, codeql-ratchet)", () => {
+  const ids = extract(CI_FIXTURE).map((g) => g.id);
+  assert.ok(!ids.includes("check:pr-evidence"), "pr-evidence needs a PR body — skipped");
+  assert.ok(!ids.includes("check:codeql-ratchet"), "codeql-ratchet is a remote-main check — skipped");
+  assert.ok(FULL_CI_SKIP.has("check:pr-evidence") && FULL_CI_SKIP.has("check:codeql-ratchet"));
+});
+
+test("extractCiGates: attaches GITHUB_BASE_REF=main env to test-masking + de-dups", () => {
+  const gates = extract(CI_FIXTURE + "\n  lint2:\n    steps:\n      - run: npm run lint\n", {
+    jobs: [
+      "lint",
+      "lint2",
+      "quality-extended",
+      "docs-sync-strict",
+      "pr-test-policy",
+      "quality-gate",
+    ],
+  });
+  const tm = gates.find((g) => g.id === "check:test-masking");
+  assert.deepEqual(tm?.env, { GITHUB_BASE_REF: "main" }, "test-masking compares against main");
+  // `lint` declared in two jobs appears once (dedup by script id).
+  assert.equal(gates.filter((g) => g.id === "lint").length, 1, "de-duplicated across jobs");
+});
+
+test("extractCiGates: the REAL ci.yml yields the base-reds that leaked in v3.8.46", async () => {
+  const fs = await import("node:fs");
+  const yaml = fs.readFileSync(
+    new URL("../../.github/workflows/ci.yml", import.meta.url),
+    "utf8"
+  );
+  const ids = new Set(extract(yaml).map((g) => g.id));
+  // The exact gates that leaked to the v3.8.46 release PR because the pre-flight
+  // never ran them — --full-ci now reproduces every one.
+  for (const g of [
+    "check:route-validation:t06",
+    // openapi-routes + docs-symbols collapsed into one FS walk (#6716).
+    "check:api-docs-refs",
+    "check:bundle-size",
+    "check:test-masking",
+    "check:file-size",
+  ]) {
+    assert.ok(ids.has(g), `real ci.yml must expose ${g} to --full-ci`);
+  }
+  assert.ok(ids.size >= 20, "the real gate set is substantial (>= 20 static gates)");
+});
diff --git a/tests/unit/validation-badge-unsupported-5442.test.ts b/tests/unit/validation-badge-unsupported-5442.test.ts
index d10f024b86..74385b32cc 100644
--- a/tests/unit/validation-badge-unsupported-5442.test.ts
+++ b/tests/unit/validation-badge-unsupported-5442.test.ts
@@ -6,20 +6,32 @@ import assert from "node:assert/strict";
 // The Add-API-Key modal only had success/failed states, so it rendered a red
 // "Invalid" badge for those providers even though the key was saved fine. The
 // "unsupported" result now maps to a neutral info "N/A" badge, not "Invalid".
-const { validationBadgeProps } = await import(
-  "../../src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts"
-);
+const { validationBadgeProps } =
+  await import("../../src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts");
 
 test("#5442 unsupported validation → neutral N/A badge, not red Invalid", () => {
   assert.deepEqual(validationBadgeProps("unsupported"), {
     variant: "info",
     labelKey: "notApplicable",
+    fallback: "N/A",
   });
 });
 
 test("#5442 success and failed badges are unchanged", () => {
-  assert.deepEqual(validationBadgeProps("success"), { variant: "success", labelKey: "valid" });
-  assert.deepEqual(validationBadgeProps("failed"), { variant: "error", labelKey: "invalid" });
+  assert.deepEqual(validationBadgeProps("success"), {
+    variant: "success",
+    labelKey: "valid",
+    fallback: "Valid",
+  });
+  assert.deepEqual(validationBadgeProps("failed"), {
+    variant: "error",
+    labelKey: "invalid",
+    fallback: "Invalid",
+  });
   // Any other/unknown result defaults to the error badge (fail-safe).
-  assert.deepEqual(validationBadgeProps("whatever"), { variant: "error", labelKey: "invalid" });
+  assert.deepEqual(validationBadgeProps("whatever"), {
+    variant: "error",
+    labelKey: "invalid",
+    fallback: "Invalid",
+  });
 });
diff --git a/tests/unit/validation-web-providers-split.test.ts b/tests/unit/validation-web-providers-split.test.ts
index 8b947604e7..0b321c69ed 100644
--- a/tests/unit/validation-web-providers-split.test.ts
+++ b/tests/unit/validation-web-providers-split.test.ts
@@ -25,7 +25,7 @@ test("webProvidersA exposes its six validators (deepseek/qwen/grok/chatgpt/perpl
   }
 });
 
-test("webProvidersB exposes its eight validators (muse-spark/adapta/claude/gemini/copilot/t3/jules/inner-ai)", () => {
+test("webProvidersB exposes its nine validators (muse-spark/adapta/claude/gemini/copilot/t3/jules/devin/inner-ai)", () => {
   for (const name of [
     "validateMuseSparkWebProvider",
     "validateAdaptaWebProvider",
@@ -34,6 +34,7 @@ test("webProvidersB exposes its eight validators (muse-spark/adapta/claude/gemin
     "validateCopilotWebProvider",
     "validateT3WebProvider",
     "validateJulesProvider",
+    "validateDevinCloudAgentProvider",
     "validateInnerAiProvider",
   ]) {
     assert.equal(typeof (B as Record<string, unknown>)[name], "function", `B missing ${name}`);
diff --git a/tests/unit/vision-bridge-policy-reroute-6640.test.ts b/tests/unit/vision-bridge-policy-reroute-6640.test.ts
new file mode 100644
index 0000000000..62a5ae0d4f
--- /dev/null
+++ b/tests/unit/vision-bridge-policy-reroute-6640.test.ts
@@ -0,0 +1,149 @@
+// Regression tests for PR #6640 review findings — Vision Bridge's individual-model
+// auto-reroute (route an image-bearing request straight to a vision-capable model
+// instead of describe-then-forward) swaps `body.model` INSIDE the guardrail
+// pipeline, which runs AFTER `chat.ts` already called `enforceApiKeyPolicy()`
+// against the original model. Without a re-check, a key restricted via
+// `allowedModels` could silently execute against an unvetted reroute target.
+//
+// These tests exercise the real `handleChat()` pipeline end-to-end (real DB,
+// real guardrail registry, mocked upstream fetch) to prove:
+//   1. A guardrail-driven reroute to a model NOT in the key's `allowedModels`
+//      is rejected — the request falls back to the original, already-approved
+//      model instead of silently escaping the policy.
+//   2. A guardrail-driven reroute to a model that DOES pass the allowlist is
+//      still honored (the fix must not break the legitimate reroute).
+//   3. The reroute honors an explicit `settings.visionBridgeModel` operator
+//      override, consistent with the combo/describe path.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { createChatPipelineHarness } from "../integration/_chatPipelineHarness.ts";
+
+const harness = await createChatPipelineHarness("vision-bridge-policy-reroute-6640");
+const { handleChat, buildRequest, buildOpenAIResponse, resetStorage, seedConnection, seedApiKey, settingsDb } =
+  harness;
+
+function imageBearingBody(model: string) {
+  return {
+    model,
+    stream: false,
+    messages: [
+      {
+        role: "user",
+        content: [
+          { type: "text", text: "What is in this image?" },
+          { type: "image_url", image_url: { url: "https://example.com/image.png" } },
+        ],
+      },
+    ],
+  };
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(async () => {
+  await harness.cleanup();
+});
+
+test("#6640: guardrail reroute to a model outside allowedModels is rejected — falls back to the original allowed model", async () => {
+  await seedConnection("openai", { apiKey: "sk-openai-primary" });
+  // Vision Bridge auto-reroutes non-vision models with images to the best
+  // available vision-capable model; pin it to a DIFFERENT model than the one
+  // the key is allowed to use, so a real reroute is guaranteed to happen and
+  // to conflict with the allowlist.
+  await settingsDb.updateSettings({ visionBridgeModel: "openai/gpt-4o-mini" });
+
+  const apiKey = await seedApiKey({ allowedModels: ["openai/gpt-3.5-turbo"] });
+
+  const fetchCalls: Array<{ body: Record<string, unknown> | null }> = [];
+  globalThis.fetch = async (_url: string | URL | Request, init: RequestInit = {}) => {
+    fetchCalls.push({ body: init.body ? JSON.parse(String(init.body)) : null });
+    return buildOpenAIResponse("described");
+  };
+
+  const response = await handleChat(
+    buildRequest({
+      authKey: apiKey.key,
+      body: imageBearingBody("openai/gpt-3.5-turbo"),
+    })
+  );
+
+  // The reroute target (gpt-4o-mini) is not in allowedModels — the request
+  // must NOT be silently executed against it. It must either fall back to the
+  // original, already-approved model (gpt-3.5-turbo) or be rejected outright,
+  // but it must never reach the upstream with the disallowed model.
+  if (response.status === 200) {
+    assert.equal(fetchCalls.length, 1, "exactly one upstream call expected");
+    assert.equal(
+      fetchCalls[0].body?.model,
+      "gpt-3.5-turbo",
+      "must fall back to the original allowed model, not silently execute the disallowed reroute target"
+    );
+  } else {
+    assert.equal(fetchCalls.length, 0, "a rejected request must never reach the upstream");
+  }
+});
+
+test("#6640: guardrail reroute to a model inside allowedModels is honored (no regression)", async () => {
+  await seedConnection("openai", { apiKey: "sk-openai-primary" });
+  await settingsDb.updateSettings({ visionBridgeModel: "openai/gpt-4o-mini" });
+
+  // This key allows BOTH the original model and the reroute target.
+  const apiKey = await seedApiKey({
+    allowedModels: ["openai/gpt-3.5-turbo", "openai/gpt-4o-mini"],
+  });
+
+  const fetchCalls: Array<{ body: Record<string, unknown> | null }> = [];
+  globalThis.fetch = async (_url: string | URL | Request, init: RequestInit = {}) => {
+    fetchCalls.push({ body: init.body ? JSON.parse(String(init.body)) : null });
+    return buildOpenAIResponse("described");
+  };
+
+  const response = await handleChat(
+    buildRequest({
+      authKey: apiKey.key,
+      body: imageBearingBody("openai/gpt-3.5-turbo"),
+    })
+  );
+
+  assert.equal(response.status, 200);
+  assert.equal(fetchCalls.length, 1);
+  assert.equal(
+    fetchCalls[0].body?.model,
+    "gpt-4o-mini",
+    "reroute to an allowed vision model must still be honored"
+  );
+});
+
+test("#6640: reroute honors an explicit settings.visionBridgeModel override (consistency with the describe path)", async () => {
+  await seedConnection("openai", { apiKey: "sk-openai-primary" });
+  await settingsDb.updateSettings({ visionBridgeModel: "openai/gpt-4o-mini" });
+
+  // No allowlist restriction — nothing to enforce here, this proves the
+  // settings threading itself (independent of the policy re-check above).
+  const apiKey = await seedApiKey();
+
+  const fetchCalls: Array<{ body: Record<string, unknown> | null }> = [];
+  globalThis.fetch = async (_url: string | URL | Request, init: RequestInit = {}) => {
+    fetchCalls.push({ body: init.body ? JSON.parse(String(init.body)) : null });
+    return buildOpenAIResponse("described");
+  };
+
+  const response = await handleChat(
+    buildRequest({
+      authKey: apiKey.key,
+      body: imageBearingBody("openai/gpt-3.5-turbo"),
+    })
+  );
+
+  assert.equal(response.status, 200);
+  assert.equal(fetchCalls.length, 1);
+  assert.equal(
+    fetchCalls[0].body?.model,
+    "gpt-4o-mini",
+    "the configured settings.visionBridgeModel must be honored as the reroute target"
+  );
+});
diff --git a/tests/unit/vscode-shared-metadata.test.ts b/tests/unit/vscode-shared-metadata.test.ts
index 9d8e1d0047..4ad453793d 100644
--- a/tests/unit/vscode-shared-metadata.test.ts
+++ b/tests/unit/vscode-shared-metadata.test.ts
@@ -15,30 +15,35 @@ const rawReasoningMetadata =
 
 test("vscode raw and tokenized family-first helpers share behavior", () => {
   assert.equal(
-    familyFirstModelIds.resolveFamilyFirstPublishedModelId("gpt-5.4__provider_cx__tier_priority"),
-    "cx/gpt-5.4__tier_priority"
+    familyFirstModelIds.resolveFamilyFirstPublishedModelId(
+      "gpt-5.6-sol__provider_cx__tier_priority"
+    ),
+    "cx/gpt-5.6-sol__tier_priority"
   );
   assert.deepEqual(
-    rawFamilyFirstModelIds.getFamilyFirstModelCandidates("cx/gpt-5.4__tier_flex", "gpt-5.4"),
-    familyFirstModelIds.getFamilyFirstModelCandidates("cx/gpt-5.4__tier_flex", "gpt-5.4")
+    rawFamilyFirstModelIds.getFamilyFirstModelCandidates(
+      "cx/gpt-5.6-sol__tier_flex",
+      "gpt-5.6-sol"
+    ),
+    familyFirstModelIds.getFamilyFirstModelCandidates("cx/gpt-5.6-sol__tier_flex", "gpt-5.6-sol")
   );
 });
 
 test("vscode raw and tokenized service tier helpers share behavior", () => {
   const tokenizedPayload = serviceTierVariants.resolveVscodeServiceTierRequest({
-    model: "gpt-5.4__provider_cx__tier_flex",
+    model: "gpt-5.6-sol__provider_cx__tier_flex",
   });
   const rawPayload = rawServiceTierVariants.resolveVscodeServiceTierRequest({
-    model: "gpt-5.4__provider_cx__tier_flex",
+    model: "gpt-5.6-sol__provider_cx__tier_flex",
   });
 
   assert.deepEqual(rawPayload, tokenizedPayload);
   assert.deepEqual(
     serviceTierVariants.expandVscodeServiceTierModels([
-      { id: "cx/gpt-5.4", name: "cx/gpt-5.4", owned_by: "codex" },
+      { id: "cx/gpt-5.6-sol", name: "cx/gpt-5.6-sol", owned_by: "codex" },
     ]),
     rawServiceTierVariants.expandVscodeServiceTierModels([
-      { id: "cx/gpt-5.4", name: "cx/gpt-5.4", owned_by: "codex" },
+      { id: "cx/gpt-5.6-sol", name: "cx/gpt-5.6-sol", owned_by: "codex" },
     ])
   );
 });
@@ -61,3 +66,49 @@ test("vscode raw and tokenized reasoning helpers share behavior", () => {
     rawReasoningMetadata.buildReasoningConfigSchema(["none", "high"], "high")
   );
 });
+
+test("vscode reasoning metadata supports GPT-5.6 Max and Ultra without splitting legacy slugs", () => {
+  const sol = {
+    id: "cx/gpt-5.6-sol",
+    owned_by: "codex",
+    capabilities: { reasoning: true },
+  };
+  const luna = {
+    id: "cx/gpt-5.6-luna",
+    owned_by: "codex",
+    capabilities: { reasoning: true },
+  };
+
+  assert.deepEqual(reasoningMetadata.getReasoningEffortValues(sol), [
+    "none",
+    "low",
+    "medium",
+    "high",
+    "xhigh",
+    "max",
+    "ultra",
+  ]);
+  assert.deepEqual(reasoningMetadata.getReasoningEffortValues(luna), [
+    "none",
+    "low",
+    "medium",
+    "high",
+    "xhigh",
+    "max",
+  ]);
+  assert.equal(
+    reasoningMetadata.inferSelectedReasoningEffort(
+      { ...sol, id: "cx/gpt-5.6-sol-ultra" },
+      reasoningMetadata.getReasoningEffortValues(sol)
+    ),
+    "ultra"
+  );
+  assert.equal(
+    reasoningMetadata.getReasoningVariantBaseModelId("cx/gpt-5.6-sol-max"),
+    "cx/gpt-5.6-sol"
+  );
+  assert.equal(
+    reasoningMetadata.getReasoningVariantBaseModelId("cx/gpt-5.1-codex-max"),
+    "cx/gpt-5.1-codex-max"
+  );
+});
diff --git a/tests/unit/vscode-token-routes-gpt56.test.ts b/tests/unit/vscode-token-routes-gpt56.test.ts
new file mode 100644
index 0000000000..293e312a7c
--- /dev/null
+++ b/tests/unit/vscode-token-routes-gpt56.test.ts
@@ -0,0 +1,134 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(
+  path.join(os.tmpdir(), "omniroute-vscode-token-routes-gpt56-")
+);
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "vscode-token-routes-gpt56-secret";
+
+const core = await import("../../src/lib/db/core.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const settingsDb = await import("../../src/lib/db/settings.ts");
+const apiKeysDb = await import("../../src/lib/db/apiKeys.ts");
+const vscodeRawModelsRoute =
+  await import("../../src/app/api/v1/vscode/raw/[token]/models/route.ts");
+
+interface RawModel {
+  id: string;
+  [key: string]: unknown;
+}
+
+async function resetStorage() {
+  core.resetDbInstance();
+  apiKeysDb.resetApiKeyState();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(() => {
+  core.resetDbInstance();
+  apiKeysDb.resetApiKeyState();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test("vscode raw models route exposes native GPT-5.6 IDs and effort tiers", async () => {
+  await settingsDb.updateSettings({
+    requireLogin: true,
+    password: "hashed-password",
+    requireAuthForModels: true,
+  });
+  await providersDb.createProviderConnection({
+    provider: "codex",
+    authType: "oauth",
+    name: "codex-vscode-raw-models",
+    accessToken: "codex-test-token",
+    isActive: true,
+    testStatus: "active",
+    providerSpecificData: {},
+  });
+  const key = await apiKeysDb.createApiKey(
+    "vscode-raw-models-codex",
+    "machine-vscode-raw-models-codex"
+  );
+
+  const response = await vscodeRawModelsRoute.GET(
+    new Request(`http://localhost/api/v1/vscode/raw/${encodeURIComponent(key.key)}/models`)
+  );
+  const body = (await response.json()) as { data?: RawModel[] };
+  const models = body.data ?? [];
+  const importedIds = new Set(models.map((entry) => entry.id));
+  const findModel = (id: string) => models.find((entry) => entry.id === id);
+  const defaultModel = findModel("cx/gpt-5.6-sol");
+  const fastModel = findModel("cx/gpt-5.6-sol__tier_priority");
+  const flexModel = findModel("cx/gpt-5.6-sol__tier_flex");
+
+  assert.equal(response.status, 200);
+  assert.ok(defaultModel, "missing cx/gpt-5.6-sol in raw VS Code models route");
+  assert.ok(fastModel, "missing cx/gpt-5.6-sol__tier_priority in raw VS Code models route");
+  assert.ok(flexModel, "missing cx/gpt-5.6-sol__tier_flex in raw VS Code models route");
+  assert.equal(importedIds.size, models.length, "raw VS Code models route must not duplicate ids");
+  assert.ok(!importedIds.has("gpt-5.6-sol__provider_cx"));
+  assert.ok(!importedIds.has("gpt-5.6-sol__provider_cx__tier_priority"));
+  assert.ok(!importedIds.has("gpt-5.6-sol__provider_cx__tier_flex"));
+  assert.equal(defaultModel.object, "model");
+  assert.equal(typeof defaultModel.created, "number");
+  assert.equal(defaultModel.owned_by, "codex");
+  assert.equal(defaultModel.name, "Codex GPT 5.6 Sol");
+  assert.equal(typeof defaultModel.context_length, "number");
+  assert.equal(typeof defaultModel.max_output_tokens, "number");
+  assert.equal(typeof defaultModel.max_input_tokens, "number");
+  assert.deepEqual(defaultModel.capabilities, {
+    vision: true,
+    tool_calling: true,
+    reasoning: true,
+    thinking: true,
+    supportsThinking: true,
+    effort_tiers: ["none", "low", "medium", "high", "xhigh", "max", "ultra"],
+  });
+  for (const field of [
+    "url",
+    "toolCalling",
+    "vision",
+    "family",
+    "supportsReasoningEffort",
+    "supportedReasoningEfforts",
+    "defaultReasoningEffort",
+    "configurationSchema",
+    "configSchema",
+    "maxInputTokens",
+  ]) {
+    assert.equal(defaultModel[field], undefined);
+  }
+
+  const lowModel = findModel("cx/gpt-5.6-sol-low");
+  const mediumModel = findModel("cx/gpt-5.6-sol-medium");
+  const highModel = findModel("cx/gpt-5.6-sol-high");
+  const lowFastModel = findModel("cx/gpt-5.6-sol-low__tier_priority");
+  const mediumFastModel = findModel("cx/gpt-5.6-sol-medium__tier_priority");
+  const highFastModel = findModel("cx/gpt-5.6-sol-high__tier_priority");
+
+  assert.ok(lowModel, "missing cx/gpt-5.6-sol-low in raw VS Code models route");
+  assert.ok(mediumModel, "missing cx/gpt-5.6-sol-medium in raw VS Code models route");
+  assert.ok(highModel, "missing cx/gpt-5.6-sol-high in raw VS Code models route");
+  assert.ok(lowFastModel, "missing cx/gpt-5.6-sol-low__tier_priority in raw VS Code models route");
+  assert.ok(
+    mediumFastModel,
+    "missing cx/gpt-5.6-sol-medium__tier_priority in raw VS Code models route"
+  );
+  assert.ok(
+    highFastModel,
+    "missing cx/gpt-5.6-sol-high__tier_priority in raw VS Code models route"
+  );
+  assert.equal(lowModel.name, "Codex GPT 5.6 Sol (Low)");
+  assert.equal(lowFastModel.name, "Codex GPT 5.6 Sol (Low) (Fast)");
+  assert.equal(mediumFastModel.name, "Codex GPT 5.6 Sol (Medium) (Fast)");
+  assert.equal(highFastModel.name, "Codex GPT 5.6 Sol (High) (Fast)");
+});
diff --git a/tests/unit/vscode-token-routes.test.ts b/tests/unit/vscode-token-routes.test.ts
index 0a0cb4f8b3..24dfebb4fe 100644
--- a/tests/unit/vscode-token-routes.test.ts
+++ b/tests/unit/vscode-token-routes.test.ts
@@ -112,11 +112,11 @@ test("vscode tokenized root route exposes friendly model names alongside ids", a
     new Request(`http://localhost/api/v1/vscode/${encodeURIComponent(key.key)}/`)
   );
   const body = (await response.json()) as any;
-  const model = (body.data || []).find((entry: any) => entry.id === "gpt-5.4__provider_cx");
+  const model = (body.data || []).find((entry: any) => entry.id === "gpt-5.6-sol__provider_cx");
 
   assert.equal(response.status, 200);
-  assert.ok(model, "missing gpt-5.4__provider_cx in tokenized VS Code root route");
-  assert.equal(model.name, "Codex GPT 5.4 (Default)");
+  assert.ok(model, "missing gpt-5.6-sol__provider_cx in tokenized VS Code root route");
+  assert.equal(model.name, "Codex GPT 5.6 Sol (Default)");
 });
 
 test("vscode tokenized models route accepts path-scoped API keys", async () => {
@@ -151,7 +151,7 @@ test("vscode tokenized combos route exposes configured combos via token alias",
   await combosDb.createCombo({
     name: "test-combo",
     strategy: "priority",
-    models: [{ kind: "model", model: "codex/gpt-5.4-high", providerId: "codex" }],
+    models: [{ kind: "model", model: "codex/gpt-5.6-sol-high", providerId: "codex" }],
   });
 
   const combosRoute =
@@ -204,7 +204,7 @@ test("vscode combos route exposes combos through Ollama api/tags", async () => {
   await combosDb.createCombo({
     name: "tags-combo",
     strategy: "priority",
-    models: [{ kind: "model", model: "codex/gpt-5.4-high", providerId: "codex" }],
+    models: [{ kind: "model", model: "codex/gpt-5.6-sol-high", providerId: "codex" }],
   });
 
   const combosRoute =
@@ -236,7 +236,7 @@ test("vscode combos route resolves combo names through Ollama api/show", async (
   await combosDb.createCombo({
     name: "show-combo",
     strategy: "priority",
-    models: [{ kind: "model", model: "codex/gpt-5.4-high", providerId: "codex" }],
+    models: [{ kind: "model", model: "codex/gpt-5.6-sol-high", providerId: "codex" }],
   });
 
   const combosRoute =
@@ -255,7 +255,7 @@ test("vscode combos route resolves combo names through Ollama api/show", async (
   assert.equal(body.model, "show-combo");
   assert.equal(body.modelfile, "FROM show-combo");
   assert.equal(body.details.family, "show-combo");
-  assert.equal(body.model_info.context_length, 200000);
+  assert.equal(body.model_info.context_length, 500000);
   assert.deepEqual(body.supportsReasoningEffort, ["none", "low", "medium", "high", "xhigh"]);
   assert.equal(body.model_info.capabilities.reasoning, true);
 });
@@ -275,7 +275,7 @@ test("vscode tokenized combos root route exposes importable combo metadata", asy
   await combosDb.createCombo({
     name: "balanced-load",
     strategy: "reset-aware",
-    models: [{ kind: "model", model: "codex/gpt-5.4-high", providerId: "codex" }],
+    models: [{ kind: "model", model: "codex/gpt-5.6-sol-high", providerId: "codex" }],
   });
 
   const combosRoute =
@@ -290,8 +290,7 @@ test("vscode tokenized combos root route exposes importable combo metadata", asy
   assert.equal(response.status, 200);
   assert.ok(combo, "expected balanced-load in combo root response");
   assert.equal(combo.url.includes("/responses#models.ai.azure.com"), true);
-  assert.equal(combo.maxInputTokens, 200000);
-  assert.equal(combo.maxOutputTokens, 131072);
+  assert.equal(combo.maxInputTokens, 372000);
   assert.equal(combo.toolCalling, true);
   assert.deepEqual(combo.supportsReasoningEffort, ["none", "low", "medium", "high", "xhigh"]);
 });
@@ -354,28 +353,47 @@ test("vscode tokenized models route keeps xhigh for codex models that advertise
     new Request(`http://localhost/api/v1/vscode/${encodeURIComponent(key.key)}/models`)
   );
   const body = (await response.json()) as any;
-  const model = (body.data || []).find((entry: any) => entry.id === "gpt-5.4__provider_cx");
+  const model = (body.data || []).find((entry: any) => entry.id === "gpt-5.6-sol__provider_cx");
   const fastModel = (body.data || []).find(
-    (entry: any) => entry.id === "gpt-5.4__provider_cx__tier_priority"
+    (entry: any) => entry.id === "gpt-5.6-sol__provider_cx__tier_priority"
   );
   const flexModel = (body.data || []).find(
-    (entry: any) => entry.id === "gpt-5.4__provider_cx__tier_flex"
+    (entry: any) => entry.id === "gpt-5.6-sol__provider_cx__tier_flex"
   );
 
   assert.equal(response.status, 200);
-  assert.ok(model, "missing gpt-5.4__provider_cx in tokenized VS Code models route");
+  assert.ok(model, "missing gpt-5.6-sol__provider_cx in tokenized VS Code models route");
   assert.ok(
     fastModel,
-    "missing gpt-5.4__provider_cx__tier_priority in tokenized VS Code models route"
+    "missing gpt-5.6-sol__provider_cx__tier_priority in tokenized VS Code models route"
   );
-  assert.ok(flexModel, "missing gpt-5.4__provider_cx__tier_flex in tokenized VS Code models route");
-  assert.equal(model.name, "Codex GPT 5.4 (Default)");
-  assert.equal(fastModel.name, "Codex GPT 5.4 (Fast)");
-  assert.equal(flexModel.name, "Codex GPT 5.4 (Flex)");
+  assert.ok(
+    flexModel,
+    "missing gpt-5.6-sol__provider_cx__tier_flex in tokenized VS Code models route"
+  );
+  assert.equal(model.name, "Codex GPT 5.6 Sol (Default)");
+  assert.equal(fastModel.name, "Codex GPT 5.6 Sol (Fast)");
+  assert.equal(flexModel.name, "Codex GPT 5.6 Sol (Flex)");
   assert.equal(model.toolCalling, true);
   assert.equal(model.vision, true);
-  assert.deepEqual(model.supportsReasoningEffort, ["none", "low", "medium", "high", "xhigh"]);
-  assert.deepEqual(model.supportedReasoningEfforts, ["none", "low", "medium", "high", "xhigh"]);
+  assert.deepEqual(model.supportsReasoningEffort, [
+    "none",
+    "low",
+    "medium",
+    "high",
+    "xhigh",
+    "max",
+    "ultra",
+  ]);
+  assert.deepEqual(model.supportedReasoningEfforts, [
+    "none",
+    "low",
+    "medium",
+    "high",
+    "xhigh",
+    "max",
+    "ultra",
+  ]);
   assert.equal(model.defaultReasoningEffort, "none");
   assert.deepEqual(model.configSchema?.properties?.reasoningEffort?.enum, [
     "none",
@@ -383,135 +401,34 @@ test("vscode tokenized models route keeps xhigh for codex models that advertise
     "medium",
     "high",
     "xhigh",
+    "max",
+    "ultra",
   ]);
   assert.equal(model.configSchema?.properties?.reasoningEffort?.default, "none");
   const importedIds = new Set((body.data || []).map((entry: any) => entry.id));
-  assert.ok(!importedIds.has("cx/gpt-5.4"));
-  assert.ok(!importedIds.has("cx/gpt-5.4__tier_priority"));
-  assert.ok(!importedIds.has("cx/gpt-5.4__tier_flex"));
-  assert.ok(!importedIds.has("codex/gpt-5.4"));
-  assert.ok(!importedIds.has("cx/gpt-5.4-low"));
-  assert.ok(!importedIds.has("cx/gpt-5.4-medium"));
-  assert.ok(!importedIds.has("cx/gpt-5.4-high"));
-  assert.ok(!importedIds.has("cx/gpt-5.4-xhigh"));
-  assert.ok(!importedIds.has("cx/gpt-5.4-low__tier_priority"));
-  assert.ok(!importedIds.has("cx/gpt-5.4-medium__tier_priority"));
-  assert.ok(!importedIds.has("cx/gpt-5.4-xhigh__tier_flex"));
+  assert.ok(!importedIds.has("cx/gpt-5.6-sol"));
+  assert.ok(!importedIds.has("cx/gpt-5.6-sol__tier_priority"));
+  assert.ok(!importedIds.has("cx/gpt-5.6-sol__tier_flex"));
+  assert.ok(!importedIds.has("codex/gpt-5.6-sol"));
+  assert.ok(!importedIds.has("cx/gpt-5.6-sol-low"));
+  assert.ok(!importedIds.has("cx/gpt-5.6-sol-medium"));
+  assert.ok(!importedIds.has("cx/gpt-5.6-sol-high"));
+  assert.ok(!importedIds.has("cx/gpt-5.6-sol-xhigh"));
+  assert.ok(!importedIds.has("cx/gpt-5.6-sol-max"));
+  assert.ok(!importedIds.has("cx/gpt-5.6-sol-ultra"));
+  assert.ok(!importedIds.has("cx/gpt-5.6-sol-low__tier_priority"));
+  assert.ok(!importedIds.has("cx/gpt-5.6-sol-medium__tier_priority"));
+  assert.ok(!importedIds.has("cx/gpt-5.6-sol-ultra__tier_flex"));
+  assert.equal(
+    [...importedIds].some((id) => String(id).includes("gpt-5.4__provider_cx")),
+    false
+  );
   assert.equal(
     model.url,
     `http://localhost/api/v1/vscode/${encodeURIComponent(key.key)}/responses#models.ai.azure.com`
   );
 });
 
-test("vscode tokenized raw models route exposes provider-native ids without family-first grouping", async () => {
-  await settingsDb.updateSettings({
-    requireLogin: true,
-    password: "hashed-password",
-    requireAuthForModels: true,
-  });
-  await seedConnection("codex", { name: "codex-vscode-raw-models" });
-  const key = await apiKeysDb.createApiKey(
-    "vscode-raw-models-codex",
-    "machine-vscode-raw-models-codex"
-  );
-
-  const response = await vscodeRawModelsRoute.GET(
-    new Request(`http://localhost/api/v1/vscode/raw/${encodeURIComponent(key.key)}/models`)
-  );
-  const body = (await response.json()) as any;
-  const importedIds = new Set((body.data || []).map((entry: any) => entry.id));
-  const defaultModel = (body.data || []).find((entry: any) => entry.id === "cx/gpt-5.4");
-  const fastModel = (body.data || []).find(
-    (entry: any) => entry.id === "cx/gpt-5.4__tier_priority"
-  );
-  const flexModel = (body.data || []).find((entry: any) => entry.id === "cx/gpt-5.4__tier_flex");
-
-  assert.equal(response.status, 200);
-  assert.ok(defaultModel, "missing cx/gpt-5.4 in raw VS Code models route");
-  assert.ok(fastModel, "missing cx/gpt-5.4__tier_priority in raw VS Code models route");
-  assert.ok(flexModel, "missing cx/gpt-5.4__tier_flex in raw VS Code models route");
-  assert.equal(
-    importedIds.size,
-    (body.data || []).length,
-    "raw VS Code models route should not duplicate model ids"
-  );
-  assert.ok(!importedIds.has("gpt-5.4__provider_cx"));
-  assert.ok(!importedIds.has("gpt-5.4__provider_cx__tier_priority"));
-  assert.ok(!importedIds.has("gpt-5.4__provider_cx__tier_flex"));
-  assert.equal(defaultModel.object, "model");
-  assert.equal(typeof defaultModel.created, "number");
-  assert.equal(defaultModel.owned_by, "codex");
-  assert.equal(defaultModel.name, "Codex GPT 5.4");
-  assert.equal(typeof defaultModel.context_length, "number");
-  assert.equal(typeof defaultModel.max_output_tokens, "number");
-  assert.equal(typeof defaultModel.max_input_tokens, "number");
-  assert.deepEqual(defaultModel.capabilities, {
-    vision: true,
-    tool_calling: true,
-    reasoning: true,
-    thinking: true,
-    supportsThinking: true,
-    effort_tiers: ["none", "low", "medium", "high", "xhigh"],
-  });
-  assert.equal(defaultModel.url, undefined);
-  assert.equal(defaultModel.toolCalling, undefined);
-  assert.equal(defaultModel.vision, undefined);
-  assert.equal(defaultModel.family, undefined);
-  assert.equal(defaultModel.supportsReasoningEffort, undefined);
-  assert.equal(defaultModel.supportedReasoningEfforts, undefined);
-  assert.equal(defaultModel.defaultReasoningEffort, undefined);
-  assert.equal(defaultModel.configurationSchema, undefined);
-  assert.equal(defaultModel.configSchema, undefined);
-  assert.equal(defaultModel.maxInputTokens, undefined);
-
-  const lowModel = (body.data || []).find((entry: any) => entry.id === "cx/gpt-5.4-low");
-  const mediumModel = (body.data || []).find((entry: any) => entry.id === "cx/gpt-5.4-medium");
-  const highModel = (body.data || []).find((entry: any) => entry.id === "cx/gpt-5.4-high");
-  const lowFastModel = (body.data || []).find(
-    (entry: any) => entry.id === "cx/gpt-5.4-low__tier_priority"
-  );
-  const mediumFastModel = (body.data || []).find(
-    (entry: any) => entry.id === "cx/gpt-5.4-medium__tier_priority"
-  );
-  const highFastModel = (body.data || []).find(
-    (entry: any) => entry.id === "cx/gpt-5.4-high__tier_priority"
-  );
-
-  assert.ok(lowModel, "missing cx/gpt-5.4-low in raw VS Code models route");
-  assert.ok(mediumModel, "missing cx/gpt-5.4-medium in raw VS Code models route");
-  assert.ok(highModel, "missing cx/gpt-5.4-high in raw VS Code models route");
-  assert.ok(lowFastModel, "missing cx/gpt-5.4-low__tier_priority in raw VS Code models route");
-  assert.ok(
-    mediumFastModel,
-    "missing cx/gpt-5.4-medium__tier_priority in raw VS Code models route"
-  );
-  assert.ok(highFastModel, "missing cx/gpt-5.4-high__tier_priority in raw VS Code models route");
-  assert.equal(lowModel.name, "Codex GPT 5.4 (Low)");
-  assert.equal(lowFastModel.name, "Codex GPT 5.4 (Low) (Fast)");
-  assert.equal(mediumFastModel.name, "Codex GPT 5.4 (Medium) (Fast)");
-  assert.equal(highFastModel.name, "Codex GPT 5.4 (High) (Fast)");
-  assert.equal(defaultModel.url, undefined);
-  assert.equal(defaultModel.toolCalling, undefined);
-  assert.equal(defaultModel.vision, undefined);
-  assert.equal(defaultModel.family, undefined);
-  assert.equal(defaultModel.supportsReasoningEffort, undefined);
-  assert.equal(defaultModel.supportedReasoningEfforts, undefined);
-  assert.equal(defaultModel.defaultReasoningEffort, undefined);
-  assert.equal(defaultModel.configurationSchema, undefined);
-  assert.equal(defaultModel.configSchema, undefined);
-  assert.equal(defaultModel.maxInputTokens, undefined);
-  assert.equal(typeof defaultModel.max_output_tokens, "number");
-  assert.equal(typeof defaultModel.max_input_tokens, "number");
-  assert.deepEqual(defaultModel.capabilities, {
-    vision: true,
-    tool_calling: true,
-    reasoning: true,
-    thinking: true,
-    supportsThinking: true,
-    effort_tiers: ["none", "low", "medium", "high", "xhigh"],
-  });
-});
-
 test("vscode tokenized raw root route mirrors the raw models catalog", async () => {
   await settingsDb.updateSettings({
     requireLogin: true,
@@ -532,8 +449,8 @@ test("vscode tokenized raw root route mirrors the raw models catalog", async ()
 
   assert.equal(response.status, 200);
   assert.ok(Array.isArray(body.data));
-  assert.ok(body.data.some((entry: any) => entry.id === "cx/gpt-5.4"));
-  assert.ok(body.data.some((entry: any) => entry.id === "cx/gpt-5.4-low__tier_priority"));
+  assert.ok(body.data.some((entry: any) => entry.id === "cx/gpt-5.6-sol"));
+  assert.ok(body.data.some((entry: any) => entry.id === "cx/gpt-5.6-sol-low__tier_priority"));
 });
 
 test("vscode tokenized raw routes do not publish combo entries", async () => {
@@ -583,7 +500,7 @@ test("vscode tokenized raw tags route does not publish combo entries", async ()
   await combosDb.createCombo({
     name: "raw-tags-hidden-combo",
     strategy: "priority",
-    models: [{ kind: "model", model: "codex/gpt-5.4-high", providerId: "codex" }],
+    models: [{ kind: "model", model: "codex/gpt-5.6-sol-high", providerId: "codex" }],
   });
 
   const response = await vscodeRawTagsRoute.GET(
@@ -616,15 +533,15 @@ test("vscode tokenized raw show route resolves reasoning and service-tier varian
     new Request(`http://localhost/api/v1/vscode/raw/${encodeURIComponent(key.key)}/api/show`, {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: JSON.stringify({ name: "cx/gpt-5.4-low__tier_priority" }),
+      body: JSON.stringify({ name: "cx/gpt-5.6-sol-low__tier_priority" }),
     }),
     { params: { token: key.key } }
   );
   const body = (await response.json()) as any;
 
   assert.equal(response.status, 200);
-  assert.equal(body.model, "cx/gpt-5.4-low__tier_priority");
-  assert.equal(body.remote_model, "Codex GPT 5.4 (Low) (Fast)");
+  assert.equal(body.model, "cx/gpt-5.6-sol-low__tier_priority");
+  assert.equal(body.remote_model, "Codex GPT 5.6 Sol (Low) (Fast)");
   assert.equal(body.selectedReasoningEffort, "low");
   assert.equal(body.selected_reasoning_effort, "low");
   assert.equal(body.details.selectedReasoningEffort, "low");
@@ -645,7 +562,7 @@ test("vscode tokenized raw api/show does not resolve combo names", async () => {
   await combosDb.createCombo({
     name: "raw-show-hidden-combo",
     strategy: "priority",
-    models: [{ kind: "model", model: "codex/gpt-5.4-high", providerId: "codex" }],
+    models: [{ kind: "model", model: "codex/gpt-5.6-sol-high", providerId: "codex" }],
   });
 
   const response = await vscodeRawShowRoute.POST(
@@ -729,23 +646,49 @@ test("vscode tokenized tags route exposes reasoning metadata for codex models",
     new Request(`http://localhost/api/v1/vscode/${encodeURIComponent(key.key)}/api/tags`)
   );
   const body = (await response.json()) as any;
-  const model = (body.models || []).find((entry: any) => entry.name === "gpt-5.4__provider_cx");
+  const model = (body.models || []).find((entry: any) => entry.name === "gpt-5.6-sol__provider_cx");
 
   assert.equal(response.status, 200);
-  assert.ok(model, "missing gpt-5.4__provider_cx in tokenized VS Code tags route");
-  assert.deepEqual(model.supportsReasoningEffort, ["none", "low", "medium", "high", "xhigh"]);
-  assert.deepEqual(model.supports_reasoning_effort, ["none", "low", "medium", "high", "xhigh"]);
-  assert.deepEqual(model.supportedReasoningEfforts, ["none", "low", "medium", "high", "xhigh"]);
+  assert.ok(model, "missing gpt-5.6-sol__provider_cx in tokenized VS Code tags route");
+  assert.deepEqual(model.supportsReasoningEffort, [
+    "none",
+    "low",
+    "medium",
+    "high",
+    "xhigh",
+    "max",
+    "ultra",
+  ]);
+  assert.deepEqual(model.supports_reasoning_effort, [
+    "none",
+    "low",
+    "medium",
+    "high",
+    "xhigh",
+    "max",
+    "ultra",
+  ]);
+  assert.deepEqual(model.supportedReasoningEfforts, [
+    "none",
+    "low",
+    "medium",
+    "high",
+    "xhigh",
+    "max",
+    "ultra",
+  ]);
   assert.equal(model.defaultReasoningEffort, "none");
   assert.equal(model.selectedReasoningEffort, "none");
   assert.equal(model.selected_reasoning_effort, "none");
-  assert.equal(model.details.family, "gpt-5.4");
+  assert.equal(model.details.family, "gpt-5.6-sol");
   assert.deepEqual(model.configurationSchema?.properties?.reasoningEffort?.enum, [
     "none",
     "low",
     "medium",
     "high",
     "xhigh",
+    "max",
+    "ultra",
   ]);
   assert.equal(model.configurationSchema?.properties?.reasoningEffort?.default, "none");
   assert.deepEqual(model.details.configurationSchema?.properties?.reasoningEffort?.enum, [
@@ -754,6 +697,8 @@ test("vscode tokenized tags route exposes reasoning metadata for codex models",
     "medium",
     "high",
     "xhigh",
+    "max",
+    "ultra",
   ]);
   assert.deepEqual(model.details.supports_reasoning_effort, [
     "none",
@@ -761,21 +706,25 @@ test("vscode tokenized tags route exposes reasoning metadata for codex models",
     "medium",
     "high",
     "xhigh",
+    "max",
+    "ultra",
   ]);
   assert.equal(model.details.selected_reasoning_effort, "none");
   assert.ok(
-    !(body.models || []).some((entry: any) => entry.name === "cx/gpt-5.4-low"),
+    !(body.models || []).some((entry: any) => entry.name === "cx/gpt-5.6-sol-low"),
     "reasoning variant leaked into grouped VS Code tags route"
   );
   assert.ok(
-    !(body.models || []).some((entry: any) => entry.name === "cx/gpt-5.4-low__tier_priority"),
+    !(body.models || []).some((entry: any) => entry.name === "cx/gpt-5.6-sol-low__tier_priority"),
     "tier reasoning variant leaked into grouped VS Code tags route"
   );
   assert.ok(
-    (body.models || []).some((entry: any) => entry.name === "gpt-5.4__provider_cx__tier_priority")
+    (body.models || []).some(
+      (entry: any) => entry.name === "gpt-5.6-sol__provider_cx__tier_priority"
+    )
   );
   assert.ok(
-    (body.models || []).some((entry: any) => entry.name === "gpt-5.4__provider_cx__tier_flex")
+    (body.models || []).some((entry: any) => entry.name === "gpt-5.6-sol__provider_cx__tier_flex")
   );
 });
 
@@ -870,7 +819,7 @@ test("vscode tokenized grouped tags route does not publish combo entries", async
   await combosDb.createCombo({
     name: "grouped-hidden-combo",
     strategy: "priority",
-    models: [{ kind: "model", model: "codex/gpt-5.4-high", providerId: "codex" }],
+    models: [{ kind: "model", model: "codex/gpt-5.6-sol-high", providerId: "codex" }],
   });
 
   const response = await vscodeTagsRoute.GET(
@@ -1016,7 +965,7 @@ test("vscode tokenized grouped api/show does not resolve combo names", async ()
   await combosDb.createCombo({
     name: "grouped-show-hidden-combo",
     strategy: "priority",
-    models: [{ kind: "model", model: "codex/gpt-5.4-high", providerId: "codex" }],
+    models: [{ kind: "model", model: "codex/gpt-5.6-sol-high", providerId: "codex" }],
   });
 
   const response = await vscodeShowRoute.POST(
@@ -1081,18 +1030,42 @@ test("vscode tokenized api/show route exposes explicit reasoning effort metadata
     new Request(`http://localhost/api/v1/vscode/${encodeURIComponent(key.key)}/api/show`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ name: "gpt-5.4__provider_cx" }),
+      body: JSON.stringify({ name: "gpt-5.6-sol__provider_cx" }),
     })
   );
   const body = (await response.json()) as any;
 
   assert.equal(response.status, 200);
-  assert.equal(body.model, "gpt-5.4__provider_cx");
-  assert.equal(body.remote_model, "Codex GPT 5.4 (Default)");
-  assert.equal(body.details.family, "gpt-5.4");
-  assert.deepEqual(body.supportsReasoningEffort, ["none", "low", "medium", "high", "xhigh"]);
-  assert.deepEqual(body.supports_reasoning_effort, ["none", "low", "medium", "high", "xhigh"]);
-  assert.deepEqual(body.supportedReasoningEfforts, ["none", "low", "medium", "high", "xhigh"]);
+  assert.equal(body.model, "gpt-5.6-sol__provider_cx");
+  assert.equal(body.remote_model, "Codex GPT 5.6 Sol (Default)");
+  assert.equal(body.details.family, "gpt-5.6-sol");
+  assert.deepEqual(body.supportsReasoningEffort, [
+    "none",
+    "low",
+    "medium",
+    "high",
+    "xhigh",
+    "max",
+    "ultra",
+  ]);
+  assert.deepEqual(body.supports_reasoning_effort, [
+    "none",
+    "low",
+    "medium",
+    "high",
+    "xhigh",
+    "max",
+    "ultra",
+  ]);
+  assert.deepEqual(body.supportedReasoningEfforts, [
+    "none",
+    "low",
+    "medium",
+    "high",
+    "xhigh",
+    "max",
+    "ultra",
+  ]);
   assert.equal(body.defaultReasoningEffort, "none");
   assert.equal(body.selectedReasoningEffort, "none");
   assert.equal(body.selected_reasoning_effort, "none");
@@ -1102,17 +1075,21 @@ test("vscode tokenized api/show route exposes explicit reasoning effort metadata
     "medium",
     "high",
     "xhigh",
+    "max",
+    "ultra",
   ]);
   assert.equal(body.configurationSchema?.properties?.reasoningEffort?.default, "none");
-  assert.equal(body.model_info["general.basename"], "Codex GPT 5.4 (Default)");
+  assert.equal(body.model_info["general.basename"], "Codex GPT 5.6 Sol (Default)");
   assert.equal(body.model_info["general.architecture"], "codex");
-  assert.equal(body.model_info["codex.context_length"], 200000);
+  assert.equal(body.model_info["codex.context_length"], 500000);
   assert.deepEqual(body.model_info.supports_reasoning_effort, [
     "none",
     "low",
     "medium",
     "high",
     "xhigh",
+    "max",
+    "ultra",
   ]);
   assert.equal(body.model_info.selected_reasoning_effort, "none");
   assert.deepEqual(body.model_info.capabilities.supports_reasoning_effort, [
@@ -1121,6 +1098,8 @@ test("vscode tokenized api/show route exposes explicit reasoning effort metadata
     "medium",
     "high",
     "xhigh",
+    "max",
+    "ultra",
   ]);
 });
 
@@ -1140,23 +1119,23 @@ test("vscode tokenized api/show route exposes service tier variants with suffixe
     new Request(`http://localhost/api/v1/vscode/${encodeURIComponent(key.key)}/api/show`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ name: "gpt-5.4__provider_cx__tier_priority" }),
+      body: JSON.stringify({ name: "gpt-5.6-sol__provider_cx__tier_priority" }),
     })
   );
   const body = (await response.json()) as any;
 
   assert.equal(response.status, 200);
-  assert.equal(body.model, "gpt-5.4__provider_cx__tier_priority");
-  assert.equal(body.remote_model, "Codex GPT 5.4 (Fast)");
-  assert.equal(body.details.family, "gpt-5.4");
+  assert.equal(body.model, "gpt-5.6-sol__provider_cx__tier_priority");
+  assert.equal(body.remote_model, "Codex GPT 5.6 Sol (Fast)");
+  assert.equal(body.details.family, "gpt-5.6-sol");
 });
 
 test("vscode tokenized chat routes rewrite family-first ids back to the codex provider id", async () => {
   const payload = serviceTierVariants.resolveVscodeServiceTierRequest({
-    model: "gpt-5.4__provider_cx__tier_priority",
+    model: "gpt-5.6-sol__provider_cx__tier_priority",
   });
 
-  assert.equal(payload.model, "cx/gpt-5.4");
+  assert.equal(payload.model, "cx/gpt-5.6-sol");
   assert.equal(payload.service_tier, "priority");
 });
 
@@ -1176,7 +1155,7 @@ test("vscode tokenized /chat/completions route applies the path token and codex
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
-        model: "gpt-5.4__provider_cx__tier_priority",
+        model: "gpt-5.6-sol__provider_cx__tier_priority",
         messages: [{ role: "user", content: "hi" }],
         max_tokens: 1,
         stream: false,
@@ -1209,7 +1188,7 @@ test("vscode tokenized /responses route applies the path token and codex tier re
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
-        model: "gpt-5.4__provider_cx__tier_priority",
+        model: "gpt-5.6-sol__provider_cx__tier_priority",
         input: [{ role: "user", content: [{ type: "input_text", text: "hi" }] }],
         max_output_tokens: 1,
         stream: false,
@@ -1240,7 +1219,7 @@ test("vscode tokenized api/show route preserves the selected reasoning effort fo
     new Request(`http://localhost/api/v1/vscode/${encodeURIComponent(key.key)}/api/show`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ name: "cx/gpt-5.4-low" }),
+      body: JSON.stringify({ name: "cx/gpt-5.6-sol-low" }),
     })
   );
   const body = (await response.json()) as any;
@@ -1266,14 +1245,14 @@ test("vscode tokenized api/show route resolves canonical family aliases", async
     new Request(`http://localhost/api/v1/vscode/${encodeURIComponent(key.key)}/api/show`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ name: "gpt-5.4" }),
+      body: JSON.stringify({ name: "gpt-5.6-sol" }),
     })
   );
   const body = (await response.json()) as any;
 
   assert.equal(response.status, 200);
-  assert.equal(body.model, "gpt-5.4");
-  assert.equal(body.details.family, "gpt-5.4");
+  assert.equal(body.model, "gpt-5.6-sol");
+  assert.equal(body.details.family, "gpt-5.6-sol");
 });
 
 test("vscode tokenized v1 chat route is exposed under the tokenized base path", async () => {
diff --git a/tests/unit/waitForServer-tcp-fallback-6800.test.mjs b/tests/unit/waitForServer-tcp-fallback-6800.test.mjs
new file mode 100644
index 0000000000..71f3938b76
--- /dev/null
+++ b/tests/unit/waitForServer-tcp-fallback-6800.test.mjs
@@ -0,0 +1,78 @@
+// Regression test for issue #6800 item 1: waitForServer() must NOT declare the
+// server "ready" based on a raw-TCP-accept fallback when the HTTP layer never
+// answers a single request. This reproduces exactly the reported symptom: port
+// enters LISTEN / accepts TCP, but GET /api/monitoring/health (and any other
+// route) hangs indefinitely — yet the CLI still printed "OmniRoute is running!".
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import net from "node:net";
+import { waitForServer } from "../../bin/cli/utils/pid.mjs";
+
+test("#6800: waitForServer must NOT report ready when TCP accepts but HTTP never responds", async () => {
+  const server = net.createServer((socket) => {
+    // Accept the TCP connection (this is what makes the port show LISTEN and
+    // "accepts connections"), but never write an HTTP response and never
+    // close the socket — exactly the observed 30-60s hang before HTTP
+    // responds.
+  });
+
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  const port = server.address().port;
+
+  try {
+    const start = Date.now();
+    const ready = await waitForServer(port, 20000);
+    const elapsedMs = Date.now() - start;
+
+    assert.equal(
+      ready,
+      false,
+      `waitForServer() incorrectly reported ready=true after ${elapsedMs}ms even though ` +
+        `/api/monitoring/health never returned a response (only a TCP-accepting, ` +
+        `non-responding socket) — this is the readiness-lies-about-HTTP bug from #6800.`
+    );
+  } finally {
+    server.close();
+  }
+});
+
+test("#2460: waitForServer still recovers when health route briefly errors before mounting", async () => {
+  // Simulate the original Windows dev-cold-start scenario this fallback was
+  // built for: the port is open, but the very first few requests get an
+  // ECONNRESET / abrupt close (health route not mounted yet) before the
+  // server starts answering normally.
+  let attempts = 0;
+  const server = net.createServer((socket) => {
+    attempts += 1;
+    if (attempts <= 3) {
+      // Abruptly reset the connection — simulates a not-yet-mounted route.
+      socket.destroy();
+      return;
+    }
+    socket.on("data", () => {
+      socket.end("HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nok");
+    });
+  });
+
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  const port = server.address().port;
+
+  try {
+    const ready = await waitForServer(port, 20000);
+    assert.equal(
+      ready,
+      true,
+      "waitForServer() should still recover once the health route starts answering " +
+        "(regression guard for the original #2460 Windows cold-start fix)"
+    );
+  } finally {
+    server.close();
+  }
+});
diff --git a/tests/unit/web-cookie-validation-fallback.test.ts b/tests/unit/web-cookie-validation-fallback.test.ts
new file mode 100644
index 0000000000..c2d4373664
--- /dev/null
+++ b/tests/unit/web-cookie-validation-fallback.test.ts
@@ -0,0 +1,113 @@
+// Tests for validateWebCookieProvider fallback when no registry entry exists.
+// Covers providers like lmarena, gemini-business, poe-web, venice-web and v0-vercel-web
+// that are listed in WEB_COOKIE_PROVIDERS but have no entry in providerRegistry.ts.
+//
+// These providers only expose a marketing website URL (WEB_COOKIE_PROVIDERS[id].website),
+// not a real API host. Probing `${website}/models` does not reliably signal session
+// validity — live verification showed most of these hosts return redirects or SPA 200s
+// regardless of cookie validity, which would silently report an expired/garbage cookie as
+// "OK". Until each provider has a verified, side-effect-free auth probe against its real
+// API host, validateWebCookieProvider reports `unsupported: true` for this fallback case
+// instead of a false "valid" — and does so WITHOUT making any network probe.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { validateProviderApiKey } = await import("../../src/lib/providers/validation.ts");
+
+const originalFetch = globalThis.fetch;
+
+const fetchCalls: Array<{ url: string; headers: Record<string, string> }> = [];
+
+test.beforeEach(() => {
+  fetchCalls.length = 0;
+  globalThis.fetch = (async (url: string | URL, init?: RequestInit) => {
+    const headers: Record<string, string> = {};
+    if (init?.headers) {
+      if (init.headers instanceof Headers) {
+        init.headers.forEach((v, k) => {
+          headers[k] = v;
+        });
+      } else if (Array.isArray(init.headers)) {
+        for (const [k, v] of init.headers) headers[k] = v;
+      } else {
+        Object.assign(headers, init.headers);
+      }
+    }
+    fetchCalls.push({ url: String(url), headers });
+    // If this mock is ever hit for a no-registry-entry provider, the test will fail on
+    // the `fetchCalls.length` assertion below — this response is never meant to be read.
+    return new Response("", { status: 404 });
+  }) as typeof fetch;
+});
+
+test.afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+// ── lmarena (#6280: gained a REAL providerRegistry entry — left the fallback class) ──
+// Before #6280 lmarena had no registry entry, so this suite asserted the unsupported
+// fallback. The Arena modernization added a real registry entry (registry/lmarena/),
+// so validateWebCookieProvider now takes the probe path (directHttpsRequest against the
+// registry baseUrl — which deliberately bypasses this suite's fetch mock, so the probe
+// itself cannot be unit-asserted here). What this suite still guards for lmarena: its
+// classification out of the no-registry fallback.
+
+test("lmarena has a registry entry — no longer the no-registry unsupported fallback", async () => {
+  const { getRegistryEntry } = await import("@omniroute/open-sse/config/providerRegistry.ts");
+  const entry = getRegistryEntry("lmarena");
+  assert.ok(entry, "lmarena must have a providerRegistry entry (#6280 Arena modernization)");
+  assert.ok(entry.baseUrl, "the probe path requires a real baseUrl on the registry entry");
+});
+
+test("lmarena validation rejects empty cookie before checking support", async () => {
+  const result = await validateProviderApiKey({
+    provider: "lmarena",
+    apiKey: "",
+  });
+  assert.strictEqual(result.valid, false);
+  assert.match(result.error, /api key required|cookie/i);
+  assert.equal(fetchCalls.length, 0);
+});
+
+// ── gemini-business (no registry entry, falls back to WEB_COOKIE_PROVIDERS) ──
+
+test("gemini-business validation is unsupported and makes no network call", async () => {
+  const result = await validateProviderApiKey({
+    provider: "gemini-business",
+    apiKey: "test-gemini-cookie",
+  });
+  assert.strictEqual(result.valid, false);
+  assert.equal(result.unsupported, true);
+  assert.equal(fetchCalls.length, 0);
+});
+
+// ── remaining WEB_COOKIE_PROVIDERS-only providers (no registry entry) ──
+// NOTE: doubao-web and zenmux-free are intentionally NOT covered here — unlike when this
+// fix was proposed, both now carry a providerRegistry.ts entry (added independently of
+// this PR), so they no longer exercise the no-registry-entry fallback branch this test
+// file targets; they go through the pre-existing entry-based probe instead, which is out
+// of scope for this fix.
+
+for (const provider of ["poe-web", "venice-web", "v0-vercel-web"]) {
+  test(`${provider} validation is unsupported and makes no network call`, async () => {
+    const result = await validateProviderApiKey({
+      provider,
+      apiKey: "some-cookie-value",
+    });
+    assert.strictEqual(result.valid, false);
+    assert.equal(result.unsupported, true);
+    assert.equal(fetchCalls.length, 0);
+  });
+}
+
+// ── generic fallback guard ──
+
+test("unknown web-cookie provider without registry returns unsupported", async () => {
+  const result = await validateProviderApiKey({
+    provider: "fake-web",
+    apiKey: "some-key",
+  });
+  assert.strictEqual(result.valid, false);
+  assert.equal(result.unsupported, true);
+});
diff --git a/tests/unit/web-search-fallback-format.test.ts b/tests/unit/web-search-fallback-format.test.ts
index a7e038c855..39835e01dc 100644
--- a/tests/unit/web-search-fallback-format.test.ts
+++ b/tests/unit/web-search-fallback-format.test.ts
@@ -255,3 +255,61 @@ test("OpenAI -> Claude (non-passthrough): built-in web_search IS still converted
   const toolNames = tools.map((t) => (t.function ? t.function.name : t.name));
   assert.ok(toolNames.includes(OMNIROUTE_WEB_SEARCH_FALLBACK_TOOL_NAME));
 });
+
+// ── #3384: per-model interceptSearch override wins over every native-bypass default ──
+
+test("#3384 interceptSearchOverride=true forces interception even on the Claude->Claude bypass path", () => {
+  assert.equal(
+    supportsNativeWebSearchFallbackBypass({
+      provider: "claude",
+      sourceFormat: "claude",
+      targetFormat: "claude",
+      nativeCodexPassthrough: false,
+      interceptSearchOverride: true,
+    }),
+    false,
+    "explicit interceptSearch:true must NOT bypass, overriding the native Claude passthrough"
+  );
+});
+
+test("#3384 interceptSearchOverride=false forces native passthrough even for a standard provider", () => {
+  assert.equal(
+    supportsNativeWebSearchFallbackBypass({
+      provider: "openai",
+      sourceFormat: "openai",
+      targetFormat: "openai",
+      nativeCodexPassthrough: false,
+      interceptSearchOverride: false,
+    }),
+    true,
+    "explicit interceptSearch:false must bypass even though OpenAI->OpenAI has no native default bypass"
+  );
+});
+
+test("#3384 interceptSearchOverride=undefined falls through to the existing native-bypass defaults", () => {
+  assert.equal(
+    supportsNativeWebSearchFallbackBypass({
+      provider: "claude",
+      sourceFormat: "claude",
+      targetFormat: "claude",
+      nativeCodexPassthrough: false,
+      interceptSearchOverride: undefined,
+    }),
+    true,
+    "no override configured — default Claude->Claude bypass still applies"
+  );
+});
+
+test("#3384 end-to-end: interceptSearchOverride=true converts the tool on the Claude->Claude bypass path", () => {
+  const inputBody = { tools: [{ type: "web_search" }] };
+  const { fallback } = prepareWebSearchFallbackBody(inputBody, {
+    provider: "claude",
+    sourceFormat: "claude",
+    targetFormat: "claude",
+    nativeCodexPassthrough: false,
+    interceptSearchOverride: true,
+  });
+
+  assert.equal(fallback.enabled, true);
+  assert.equal(fallback.toolName, OMNIROUTE_WEB_SEARCH_FALLBACK_TOOL_NAME);
+});
diff --git a/tests/unit/web-session-credentials.test.ts b/tests/unit/web-session-credentials.test.ts
index 366b502960..250ac5ea39 100644
--- a/tests/unit/web-session-credentials.test.ts
+++ b/tests/unit/web-session-credentials.test.ts
@@ -37,22 +37,27 @@ test("web session credential metadata identifies cookie, token, and no-auth prov
     acceptsFullCookieHeader: false,
     storageKeys: ["token", "userToken"],
   });
-  // lmarena.ai's real auth cookie is `arena-auth-prod-v1`, not `session` (#3810).
-  // The session is now split across `arena-auth-prod-v1.0`, `.1`, … (#4271).
-  assert.deepEqual(webSessionCredentials.getWebSessionCredentialRequirement("lmarena"), {
-    kind: "cookie",
-    credentialName: "arena-auth-prod-v1",
-    placeholder:
-      "Paste the full Cookie header from lmarena.ai (the session is now split across arena-auth-prod-v1.0, .1, …)",
-    acceptsFullCookieHeader: true,
-    storageKeys: [
-      "cookie",
-      "arena-auth-prod-v1",
-      "arena-auth-prod-v1.0",
-      "arena-auth-prod-v1.1",
-      "session",
-    ],
-  });
+  // Arena (lmarena): assert contract/intent only — do not freeze UX copy.
+  // #3810 chunk name, #4271 split SSR cookies, full Cookie header paste.
+  {
+    const req = webSessionCredentials.getWebSessionCredentialRequirement("lmarena");
+    assert.ok(req && req.kind === "cookie");
+    assert.equal(req.acceptsFullCookieHeader, true);
+    assert.equal(req.hintKey, "lmarenaWebCookieHint");
+    assert.ok(req.storageKeys.includes("cookie"));
+    assert.ok(req.storageKeys.includes("arena-auth-prod-v1.0"));
+    assert.ok(req.storageKeys.includes("arena-auth-prod-v1.1"));
+    // legacy key retained for already-saved credentials
+    assert.ok(req.storageKeys.includes("session"));
+    assert.ok(/full cookie header/i.test(req.credentialName));
+    assert.ok(/arena-auth-prod-v1/i.test(req.placeholder));
+    // hintFallback is operator copy — may change with CF/reCAPTCHA notes; must still
+    // steer users to a full header and away from the empty single base cookie.
+    assert.ok(typeof req.hintFallback === "string" && req.hintFallback.length > 0);
+    assert.ok(/full cookie header/i.test(req.hintFallback));
+    assert.ok(/arena-auth-prod-v1/i.test(req.hintFallback));
+    assert.ok(/empty/i.test(req.hintFallback));
+  }
   assert.deepEqual(webSessionCredentials.getWebSessionCredentialRequirement("huggingchat"), {
     kind: "cookie",
     credentialName: "full Cookie header (hf-chat + token)",
diff --git a/tests/unit/xai-exact-cost-2453.test.ts b/tests/unit/xai-exact-cost-2453.test.ts
new file mode 100644
index 0000000000..085a5305de
--- /dev/null
+++ b/tests/unit/xai-exact-cost-2453.test.ts
@@ -0,0 +1,164 @@
+/**
+ * xAI exact provider-reported cost passthrough (port of decolua/9router#2453,
+ * capability A — @ryanngit).
+ *
+ * xAI's chat-completions `usage` object reports the exact billed cost of a
+ * request via `cost_in_usd_ticks`. Per the official docs
+ * (https://docs.x.ai/developers/cost-tracking and the API reference's usage
+ * schema): "TICKS_IN_USD_CENT: i64 = 100_000_000" ⇒ 10_000_000_000 (1e10)
+ * ticks per USD. Example given in the docs: 37756000 ticks ≈ $0.0038.
+ *
+ * NOTE: the upstream PR used a /1e12 divisor (100x under-report) — this port
+ * uses the doc-verified /1e10 divisor instead.
+ *
+ * OmniRoute previously always estimated cost from token counts × static
+ * pricing, discarding this exact figure. This test proves calculateCost()/
+ * computeCostFromPricing() now trust the exact figure when present, and
+ * still fall back to the token-based estimate when it is absent (control).
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { calculateCost, computeCostFromPricing } from "../../src/lib/usage/costCalculator.ts";
+import { extractUsageFromResponse } from "../../open-sse/handlers/usageExtractor.ts";
+import { extractUsage, normalizeUsage } from "../../open-sse/utils/usageTracking.ts";
+
+// $1/1M input, $2/1M output → 1M+1M tokens would estimate to $3 at the
+// metered rate. Chosen so the exact-cost value (~$0.0038) is unmistakably
+// NOT the token-based estimate — proves the early return actually fires.
+const PRICING = { input: 1, output: 2 };
+const TOKENS_1M_EACH = { input: 1_000_000, output: 1_000_000 };
+
+// Doc example: 37756000 ticks ≈ $0.0038 (docs.x.ai/developers/cost-tracking).
+const DOC_EXAMPLE_TICKS = 37_756_000;
+const DOC_EXAMPLE_USD = 0.0037756; // 37756000 / 1e10, exact
+
+test("computeCostFromPricing: xAI exact cost_in_usd_ticks overrides the token-based estimate", () => {
+  const cost = computeCostFromPricing(PRICING, {
+    ...TOKENS_1M_EACH,
+    cost_in_usd_ticks: DOC_EXAMPLE_TICKS,
+  });
+  assert.ok(
+    Math.abs(cost - DOC_EXAMPLE_USD) < 1e-9,
+    `expected ${DOC_EXAMPLE_USD}, got ${cost}`
+  );
+  assert.notEqual(cost, 3, "must not fall back to the $3 token-based estimate");
+});
+
+test("computeCostFromPricing: xAI exact cost works even with no pricing record at all", () => {
+  const cost = computeCostFromPricing(null, {
+    ...TOKENS_1M_EACH,
+    cost_in_usd_ticks: DOC_EXAMPLE_TICKS,
+  });
+  assert.ok(Math.abs(cost - DOC_EXAMPLE_USD) < 1e-9);
+});
+
+test("computeCostFromPricing CONTROL: no cost_in_usd_ticks still falls back to the token-based estimate", () => {
+  assert.equal(computeCostFromPricing(PRICING, TOKENS_1M_EACH), 3);
+});
+
+test("calculateCost: xAI exact cost_in_usd_ticks overrides whatever the token-based estimate would be", async () => {
+  // Baseline: the token-based estimate calculateCost would otherwise compute
+  // for this provider/model/token-count (whatever xai/grok-4.3's local
+  // pricing table says — not hardcoded here, so this test doesn't break if
+  // pricing data changes).
+  const baseline = await calculateCost("xai", "grok-4.3", { input: 500, output: 500 });
+
+  const cost = await calculateCost("xai", "grok-4.3", {
+    input: 500,
+    output: 500,
+    cost_in_usd_ticks: DOC_EXAMPLE_TICKS,
+  });
+
+  assert.ok(Math.abs(cost - DOC_EXAMPLE_USD) < 1e-9, `expected ${DOC_EXAMPLE_USD}, got ${cost}`);
+  assert.notEqual(cost, baseline, "exact cost must override the token-based estimate");
+});
+
+test("calculateCost CONTROL: no cost_in_usd_ticks still falls back to the token-based estimate (unchanged)", async () => {
+  const before = await calculateCost("xai", "grok-4.3", { input: 500, output: 500 });
+  const after = await calculateCost("xai", "grok-4.3", { input: 500, output: 500 });
+  assert.equal(after, before, "identical calls without the exact field must stay deterministic");
+  assert.notEqual(after, DOC_EXAMPLE_USD, "must not coincidentally match the exact-cost value");
+});
+
+test("normalizeUsage: passes through a finite cost_in_usd_ticks", () => {
+  const normalized = normalizeUsage({ prompt_tokens: 10, cost_in_usd_ticks: DOC_EXAMPLE_TICKS });
+  assert.equal(normalized.cost_in_usd_ticks, DOC_EXAMPLE_TICKS);
+});
+
+test("normalizeUsage: drops a non-finite cost_in_usd_ticks", () => {
+  const normalized = normalizeUsage({ prompt_tokens: 10, cost_in_usd_ticks: "not-a-number" });
+  assert.equal(normalized.cost_in_usd_ticks, undefined);
+});
+
+test("normalizeUsage: rejects null, empty, and negative exact costs", () => {
+  for (const value of [null, "", -1]) {
+    const normalized = normalizeUsage({ prompt_tokens: 10, cost_in_usd_ticks: value });
+    assert.equal(normalized.cost_in_usd_ticks, undefined, `unexpected exact cost for ${value}`);
+  }
+});
+
+test("extractUsageFromResponse: rejects malformed exact cost values", () => {
+  for (const value of [null, "", -1]) {
+    const usage = extractUsageFromResponse(
+      {
+        usage: {
+          prompt_tokens: 12,
+          completion_tokens: 8,
+          cost_in_usd_ticks: value,
+        },
+      },
+      "xai"
+    );
+    assert.ok(
+      !("cost_in_usd_ticks" in usage),
+      `must not add cost_in_usd_ticks for malformed value ${value}`
+    );
+  }
+});
+
+test("extractUsageFromResponse: xAI OpenAI-shaped usage carries cost_in_usd_ticks through", () => {
+  const usage = extractUsageFromResponse(
+    {
+      usage: {
+        prompt_tokens: 12,
+        completion_tokens: 8,
+        cost_in_usd_ticks: DOC_EXAMPLE_TICKS,
+      },
+    },
+    "xai"
+  );
+  assert.equal(usage.cost_in_usd_ticks, DOC_EXAMPLE_TICKS);
+});
+
+test("extractUsageFromResponse CONTROL: non-xAI OpenAI usage without the field stays unchanged (no stray key)", () => {
+  const usage = extractUsageFromResponse(
+    {
+      usage: {
+        prompt_tokens: 12,
+        completion_tokens: 8,
+        prompt_tokens_details: { cached_tokens: 3 },
+        completion_tokens_details: { reasoning_tokens: 2 },
+      },
+    },
+    "openai"
+  );
+  assert.deepEqual(usage, {
+    prompt_tokens: 12,
+    completion_tokens: 8,
+    cached_tokens: 3,
+    reasoning_tokens: 2,
+  });
+  assert.ok(!("cost_in_usd_ticks" in usage), "must not add a stray undefined key");
+});
+
+test("extractUsage (streaming): xAI OpenAI-format chunk carries cost_in_usd_ticks through", () => {
+  const usage = extractUsage({
+    usage: {
+      prompt_tokens: 12,
+      completion_tokens: 8,
+      cost_in_usd_ticks: DOC_EXAMPLE_TICKS,
+    },
+  });
+  assert.equal(usage.cost_in_usd_ticks, DOC_EXAMPLE_TICKS);
+});